joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102a3240
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov eax, dword [0x102b0eb4]
add eax, 0x1c78
mov dword [0x102b0eb4], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [0x102b0eb4], 0x19
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
add ecx, 0x3c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
jmp 0x102a32ae
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x1a], dx
mov ax, word [ebp - 0x1a]
cmp ax, 0x61
je 0x102a3328
jmp 0x102a3396
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x102a32db
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x102a32ae
mov eax, dword [ebp - 0x24]
mov dword [0x102b0eb4], 0x56e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x102a3396
mov dword [0x102b0eb0], 0x582
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x6f
je 0x102a3290
jmp 0x102a3396
mov dword [0x102b0eb0], 0x7df
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x102a3396
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x102a3396
mov dword [0x102b0eb0], 0x91c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x102a3396
mov dword [0x102b0eb4], 0x153e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x102a3396
mov eax, 1
mov dword [0x102b0eb4], 0x190e
mov dword [ebp - 0x2c], eax
jmp 0x102a33a7
mov dword [0x102b0eb0], 0x10e3
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x102a33a7
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
pop ebp
ret
Function at 0x102a3d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov dword [0x102b0eb0], 0x1594
call fcn.10001090
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x34], ecx
je 0x102a3d46
jmp 0x102a3ec6
mov eax, dword [esp + 0x30]
cmp word [eax], 0x5a4d
mov dword [esp + 0x2c], eax
je 0x102a3e0b
jmp 0x102a3e33
lea eax, [esp + 0x48]
mov dword [0x102b0eb4], 0x1aa1
mov dword [0x102b0eb0], 0x17ad
mov dword [esp + 0x28], eax
call fcn.102a3240
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x102a3ebe
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.102a3490
lea ecx, [esp + 0x48]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x4c], edx
mov dword [0x102b0eb4], 0x1364
mov dword [esp + 0x94], 0x12da00
mov edx, dword [0x102b0e9c]
mov dword [esp + 0x70], edx
mov edx, dword [0x102b0ea0]
add ecx, 0x34
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
lea eax, [0x102a2170]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov esi, dword [0x102b0ea4]
mov dword [esp + 0x90], esi
mov esi, dword [0x102b0ea8]
mov dword [esp + 0x5c], esi
mov esi, dword [0x102b0eac]
mov dword [esp + 0x54], esi
mov dword [0x102b0eb0], 0x423
mov dword [esp + 0x30], eax
jmp 0x102a3d2e
mov eax, dword [esp + 0x2c]
add eax, 0x3c
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
cmp dword [edx + ecx], 0x4550
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
je 0x102a3e4a
mov eax, dword [esp + 0x2c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x30], eax
jmp 0x102a3d2e
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x48]
mov dword [esp + 0x84], eax
mov dword [0x102b0eb4], 0x2099
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x88], eax
mov dword [0x102b0eb0], 0xa15
mov eax, dword [esp + 0x40]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.102a2de0
mov ecx, dword [0x102b0eb0]
add ecx, 0xbd7
mov dword [0x102b0eb0], ecx
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x102b0eb0], 0x1824
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call esi
cmp eax, 7
jne 0x44b624
push 1
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x660210], al
mov byte [0xa626f4], al
mov eax, 0xd7b0
mov dword [0x660228], ecx
mov word [0xa6274c], ax
mov word [0xa6274e], ax
mov word [0x660624], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x660258], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b678
call esi
cmp al, 4
ja 0x44b67e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x660254], eax
pop esi
ret
Function at 0x618a62
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
invalid
ficom word [eax]
out 0xc1, al
ljmp 0x826e
adc byte [ecx - 0x25], bh
sub al, 0x61
sbb byte [eax + 0x11b6b820], 0xf0
add byte [edx + 0x4a], 0xc9
jecxz 0x618aa0
xor al, bh
jbe 0x6189fa
test cl, 0x80
invalid
inc ebx
cmp bh, byte [ebx]
invalid
xchg ecx, eax
insd dword es:[edi], dx
mov ecx, 0x2050b1f9
sub al, 0x8b
fcom qword [esi + 6]
sal byte ss:[ecx + 0x2b7d08ce], 0xf2
jno 0x618a36
in al, dx
push eax
and esp, dword [eax]
loope 0x618aef
invalid
shl ecx, 1
sbb dh, byte [eax - 0x49059dd2]
jecxz 0x618a88
test eax, 0xd075c178
outsd dx, dword [esi]
loope 0x618ae8
inc ebx
pop esi
test al, 0x78
inc esp
and al, 0xed
and esi, ebp
mov eax, dword [0xe1406320]
jp 0x618b0d
cmpps xmm0, xmmword [ecx], 0x5c
add eax, edx
sub byte [eax + 0x7113112e], dh
jl 0x618b7c
nop
rol byte [ecx - 0x12f4e5b7], 1
and dword [ecx + 0x1f], esp
pop ds
sub eax, 0x518ce11f
lock dec byte [edx + 0x72]
stosb byte es:[edi], al
sar dword [ebx - 0x6ee00eda], 0xdf
inc eax
or dh, byte [eax - 0xa]
js 0x618ad4
inc edx
jecxz 0x618b7e
jnp 0x618b0e
add ebp, dword [ecx]
mov bl, 0x21
adc edx, dword [esi]
push ebx
inc ecx
inc eax
invalid
mov edx, 0xe18efb03
sti
mov fs, ecx
adc ah, dl
fld dword [eax + 0x1fc6b002]
xchg byte [edi], dh
scasb al, byte es:[edi]
popal
jmp 0x618ba5
sub ch, byte [eax - 0x2b]
imul ecx, ecx, 0x5f
and edi, dword [ecx + 0x6ba1e070]
jmp 0x618bc6
int1
invalid

Function at 0x62cbe2
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xebd0a7e9
nop
invalid
pop es
pop ds
fbld tbyte [edi + 0x61]
rol dword [edx + 0x22], 1
rcl byte [eax]
mov ch, pe_nt_image_headers32
mov edi, 0x775a3df6
pop edx
ja 0x62cc37
jno 0x62cbb7
sbb dword [ecx - 0x498a8777], esp
sar byte [edi], 1
inc ecx
mov al, byte [0x24ff8cf3]
xor al, 0x1d
inc edx
adc dword [0x6df0f819], ebp
and ecx, dword [ecx - 0x276e9fe0]
adc dword [ebx + 0x65], ebx
sahf
cmp esp, dword [eax]
aaa
cmpsd dword [esi], dword es:[edi]
sbb al, byte [edx]
invalid
Function at 0x40159e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov edi, 1
push 0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40161d
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.004036ed
add esp, 8
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00403732
add esp, 8
test eax, eax
je 0x4015f6
mov ecx, eax
lea edx, [ebp - 0x108]
sub ecx, edx
cmp ecx, 3
jge 0x4015f6
xor edi, edi
jmp 0x40161d
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call fcn.0040159e
add esp, 4
mov edi, eax
test edi, edi
je 0x40161d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
sbb edi, edi
inc edi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x40248c
mov esi, 0x800
mov edi, 0x404398
cmp dword [0x404b9c], 0
jne 0x402452
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [0x404ba0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402495
mov eax, dword [ebp - 4]
mov dword [0x404b9c], eax
test eax, eax
je 0x40248c
add dword [0x404ba8], esi
mov dword [0x404ba4], edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x404b9c]
cmp ebx, eax
jb 0x402460
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x40247b
push ebx
mov eax, dword [0x404ba4]
push eax
push dword [ebp + 8]
call fcn.00403790
add esp, 0xc
add dword [ebp + 8], ebx
add dword [0x404ba4], ebx
sub dword [0x404b9c], ebx
sub dword [ebp + 0xc], ebx
jne 0x402419
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call fcn.004023c5
add esp, 4
mov eax, 1
jmp 0x40248e

Function at 0x4024d5
Capabilities:
Write file on windows

Disassembly:
sub esp, 4
mov ecx, dword [0x4041f4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x4054c0
test esi, esi
lea edx, [esi - 1]
je 0x402520
mov al, byte [edi]
inc edi
xor al, cl
movzx ebx, al
mov eax, 8
test bl, 1
je 0x40250f
xor ebx, 0x248ef9be
shr ebx, 1
not ebx
jmp 0x402511
shr ebx, 1
dec eax
jne 0x4024fe
shr ecx, 8
mov eax, edx
xor ecx, ebx
dec edx
test eax, eax
jne 0x4024f1
mov dword [0x4041f4], ecx
test esi, esi
je 0x40256a
cmp dword [0x4041f8], 0
jne 0x40256a
lea eax, [esp + 0xc]
push 0
push eax
push esi
push 0x4054c0
push dword [0x404390]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402556
cmp esi, dword [esp + 0xc]
je 0x40256a
push 2
call fcn.004023c5
mov dword [0x4041f8], 1
add esp, 4
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4026f7
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push 0
push 0
push dword [esp + 0x10]
push dword [0x404ba0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp]
push 0
push ecx
mov dword [0x404ba8], eax
push 0x800
push 0x404398
push dword [0x404ba0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, 1
je 0x402744
mov eax, dword [esp]
mov dword [0x404b9c], eax
xor eax, eax
add esp, 4
ret
Function at 0x68fdd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x68fdd9
lcall 0x5de5, 0x8b10c483
jmp loc.018ccfc0
Function at 0x401214
Capabilities:
Create thread

Disassembly:
call fcn.00401309
pop eax
pop edx
pop dword [0x44c6f4]
pop ecx
test edx, edx
push eax
je 0x401213
push ebx
push esi
push edi
push ebp
mov ebx, 0x44a6e4
mov ebp, 0x44c708
xor eax, eax
mov dword [ebp - 0x10], eax
test cl, 1
mov esi, 0x401018
jne 0x40124f
test cl, 2
lea esi, [esi + 0xc]
jne 0x40124f
lea esi, [esi - 0x14]
test cl, 8
setne byte [ebp - 0x18]
and cl, 0x10
mov byte [ebp - 0x17], cl
mov edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
cmp dword [ebp - 4], eax
jne 0x40126e
mov word [ebp - 4], 0x8000
push eax
push eax
push eax
push eax
push eax
push eax
push section..text
push 0xffffffffffffffff
push ebx
call dword [sym.imp.WINMM.dll_waveOutOpen]
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [ebx - 8], eax
je 0x40129d
mov dword [ebp - 0xc], esi
call fcn.00401a9c
xchg edi, eax
call dword [ebp + 8]
test edi, edi
je 0x40130d
mov esi, 0x45c718
mov dword [esi + 4], 0x10000
or dword [esi + 0x14], 0xffffffff
push 0xc
mov dword [esi], 0x44c718
pop dword [esi + 0x10]
push 0x20
push esi
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
xor edi, edi
call fcn.004013d2
cmp dword [ebx + 4], edi
jne 0x4012c7
mov dword [ebx + 8], edi
push 0x20
push esi
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveOutWrite]
test eax, eax
jne 0x40130d
push ebp
push edi
push edi
push 0x40137c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebx - 4], eax
je 0x40130d
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xchg ebx, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402910
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.SoundsActivated.mp3]
mov ax, word [0x446e64]
push esi
movdqu xmmword [ebp - 0x40], xmm0
push edi
movdqu xmm0, xmmword [0x446e4c]
push 0
push str.Sounds
movdqu xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x18], ax
movq xmm0, qword [0x446e5c]
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x48], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4029f2
push 0xa
push 0x7cf
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4029f2
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x4029f2
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4029f2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4029f2
push 0
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043847c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x402a10
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.SoundsDeactivated.mp3]
mov eax, dword [0x446ea0]
push esi
movdqu xmmword [ebp - 0x40], xmm0
push edi
movdqu xmm0, xmmword [0x446e88]
mov dword [ebp - 0x18], eax
mov ax, word [0x446ea4]
movdqu xmmword [ebp - 0x30], xmm0
push 0
movq xmm0, qword [0x446e98]
push str.Sounds
movq qword [ebp - 0x20], xmm0
mov word [ebp - 0x14], ax
mov dword [ebp - 0x48], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x44], eax
cmp eax, 0xffffffff
je 0x402afb
push 0xa
push 0x7d0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x402afb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x402afb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402afb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x402afb
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x48]
push 0
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043847c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x402b10
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.SoundsTrainerActivated.mp3]
push esi
push edi
movdqu xmmword [ebp - 0x50], xmm0
push 0
movdqu xmm0, xmmword [0x446eb8]
push str.Sounds
mov dword [ebp - 0x58], 0
movdqu xmmword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [0x446ec8]
movdqu xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x446ed8]
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402bf5
push 0xa
push 0x7d1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x402bf5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x402bf5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402bf5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x402bf5
push 0
lea ecx, [ebp - 0x58]
push ecx
push dword [ebp - 0x54]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043847c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x402c10
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.SoundsTrainerDeactivated.mp3]
mov eax, dword [0x446f18]
push esi
movdqu xmmword [ebp - 0x50], xmm0
push edi
movdqu xmm0, xmmword [0x446ef0]
push 0
push str.Sounds
movdqu xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x18], eax
movdqu xmm0, xmmword [0x446f00]
mov dword [ebp - 0x58], 0
movdqu xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x446f10]
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x54], eax
cmp eax, 0xffffffff
je 0x402cfe
push 0xa
push 0x7d2
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x402cfe
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x402cfe
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402cfe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x402cfe
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0x58]
push 0
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043847c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x402d80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0
push 0
push eax
call fcn.0043ae60
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x402ded
cmp esi, 0xffffffff
je 0x402ded
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
je 0x402e00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043847c
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x402e10
lea eax, [ebp - 0x20c]
push str.The_Hat_Man.exe
push eax
call fcn.00438513
add esp, 8
test eax, eax
je 0x402e52
lea eax, [ebp - 0x230]
push eax
push esi
call edi
cmp eax, 1
je 0x402e10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043847c
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
xor ecx, ebp
pop edi
pop esi
call fcn.0043847c
mov esp, ebp
pop ebp
ret 4
Function at 0x4038c0
Capabilities:
Create process on windows

Disassembly:
cmp byte [0x45d9f0], 1
push esi
mov esi, ecx
jne 0x4038db
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret
cmp byte [0x45d9f1], 1
jne 0x403907
push 1
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [0x44a1d0], 1
mov dword [0x460128], 0
pop esi
ret
cmp byte [0x45d5ae], 1
jne 0x403933
push 1
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [0x44a1d0], 2
mov dword [0x460128], 0
pop esi
ret
cmp byte [0x45d5da], 1
jne 0x40395f
push 1
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [0x460128], 3
mov dword [0x44a1d0], 3
pop esi
ret
mov eax, dword [0x44a1d0]
cmp eax, 3
jne 0x403993
cmp byte [0x45d5d9], 1
jne 0x40397e
mov dword [0x45d5e8], 1
pop esi
ret
cmp byte [0x45d5db], 1
jne 0x403993
mov dword [0x45d614], 1
pop esi
ret
cmp byte [0x45d5ad], 1
jne 0x4039f1
cmp eax, 1
jne 0x4039f1
mov ecx, dword [0x45d5f8]
cmp ecx, eax
jne 0x4039cd
push 0
push 0
push 0
call fcn.00401214
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45d5f8], 0
pop esi
ret
test ecx, ecx
jne 0x4039f1
push ecx
push ecx
push 1
call fcn.00401214
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x45d5f8], 1
pop esi
ret
cmp byte [0x45d9f3], 1
jne 0x403ab2
cmp eax, 2
jne 0x403ab2
mov eax, dword [0x45d5dc]
test eax, eax
jne 0x403a7b
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push dword [0x45d628]
push eax
push eax
push 0x159
push 0xcd
push 1
call esi
sub eax, 0x159
cdq
sub eax, edx
sar eax, 1
push eax
push 0
call esi
sub eax, 0xcd
cdq
sub eax, edx
sar eax, 1
push eax
push 0xc80000
push str.Numpad_Edit_X_V1.0
push str.Numpad_Edit_X_V1.0
push 0x80000
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 2
push 0xfa
push 0
push eax
mov dword [0x45d5dc], eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov eax, dword [0x45d5dc]
push 5
push eax
mov dword [0x45d608], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x45d5dc]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x45d5dc]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x45d5c0], 1
pop esi
ret
cmp byte [0x45d5af], 1
jne 0x403ad5
push 1
push 0
push 0
push str.www.cheathappens.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 2
push 0xa1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret