joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4461b0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x446343
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x44632d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4461ff
lea ebx, [eax + 0xe]
jmp 0x44620b
cmp eax, 0x17
jne 0x4462ba
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4462ba
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4462ba
cmp eax, ebx
jb 0x4462ba
push 0x20
call dword [0x5b5aa4]
mov esi, eax
add esp, 4
test esi, esi
je 0x446322
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x5b5aa4]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x446311
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4462a5
push eax
call dword [0x5b5ab0]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4462f7
test ebp, ebp
jne 0x4462ab
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4462b6
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4461f2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4462d9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x446329
push ebp
call fcn.00446170
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x5b5aa8]
push esi
call dword [0x5b5aa8]
add esp, 8
jmp 0x4462c9
push esi
mov ebx, 8
call dword [0x5b5aa8]
add esp, 4
jmp 0x4462c9
mov ebx, 8
jmp 0x4462c9
test ebp, ebp
jne 0x446339
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x446790
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.00446740
mov al, 1
ret
Function at 0x44c1eb
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x5b7e34
cmp dword [0x5b7e30], edi
jne 0x44c21a
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x5b7e30], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x5b7e2c]
test esi, esi
je 0x44c275
test edi, edi
jne 0x44c3bc
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x44c24b
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x44c23c
jmp 0x44c267
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.0044c194
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x44c22b
test edi, edi
jne 0x44c3bc
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x44c3bc
mov esi, dword [0x5b7e2c]
jmp 0x44c2b6
cmp dword [esi + 0xc], 0x3f
jl 0x44c357
mov esi, dword [esi]
test esi, esi
jne 0x44c2aa
push 0x310
push 8
push dword [0x5b7550]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x44c3b6
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 8], eax
test eax, eax
je 0x44c3a8
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x44c3cf
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x44c3a3
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.0044c194
mov eax, dword [0x5b7e2c]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x44c34f
mov dword [eax + 4], esi
mov dword [0x5b7e2c], esi
jmp 0x44c3bc
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.0044c194
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x44c3bc
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x5b7550]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x5b7e34
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x876e40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2f0000]
push edi
or ebp, 0xffffffff
jmp 0x876e62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x876e69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x876e58
mov eax, 1
add ebx, ebx
jne 0x876e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x876e8c
jne 0x876eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x876eab
dec eax
add ebx, ebx
jne 0x876e98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x876e70
add ebx, ebx
jne 0x876ea7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x876efd
xor ecx, ecx
sub eax, 3
jb 0x876ec3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x876f32
sar eax, 1
mov ebp, eax
jmp 0x876ece
add ebx, ebx
jne 0x876ece
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x876e9c
inc ecx
add ebx, ebx
jne 0x876edc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x876e9c
add ebx, ebx
jne 0x876ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x876ede
jne 0x876efa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x876ede
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x876f1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x876f0e
jmp 0x876e5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x876f1c
add edi, ecx
jmp 0x876e5e
pop esi
mov edi, esi
mov ecx, 0xfc50
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x876f3a
cmp byte [edi], 0x71
jne 0x876f3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x876f3f
lea edi, [esi + 0x45e000]
mov eax, dword [edi]
or eax, eax
je 0x876fb7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x47ba04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x47baec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x876f6c
mov ecx, edi
jns 0x876f9b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x47baf4]
or eax, eax
je 0x876fb1
mov dword [ebx], eax
add ebx, 4
jmp 0x876f89
call dword [esi + 0x47baf0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x876fe8
cmp al, 0xef
ja 0x876fdb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x876fbd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x876fca
mov ebp, dword [esi + 0x47baf8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x87701c
sub esp, 0xffffff80
jmp 0x5d2bc6
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, reloc.opengl32.dll_glShadeModel
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x40bcf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x618000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x40bd17
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40bd1e
mov al, 1
jmp 0x40bdf9
call fcn.0040f850
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.0040f850
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0040f890
add esp, 8
movzx eax, al
test eax, eax
je 0x40bd5a
xor al, al
jmp 0x40bdf9
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.004117d0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40bd96
cmp dword [ebp - 0x34], 1
je 0x40bd9d
cmp dword [ebp - 0x34], 3
je 0x40bdec
jmp 0x40bdf7
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x40bdcc
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00580aa5
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x40bdcc
xor al, al
jmp 0x40bdf9
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40bde0
mov dword [ebp - 0x3c], 1
jmp 0x40bde7
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x40bdf9
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x40bdf9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c1db
mov esp, ebp
pop ebp
ret
Function at 0x40fff0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x618000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x41002c
xor al, al
jmp 0x4101c1
mov byte [ebp - 0x231], 0
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4101ae
mov dword [ebp - 0x23c], 0x5b639c
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x238], edx
mov eax, dword [ebp - 0x238]
mov cx, word [eax]
mov word [ebp - 0x24a], cx
mov edx, dword [ebp - 0x23c]
cmp cx, word [edx]
jne 0x4100ca
cmp word [ebp - 0x24a], 0
je 0x4100be
mov eax, dword [ebp - 0x238]
mov cx, word [eax + 2]
mov word [ebp - 0x24c], cx
mov edx, dword [ebp - 0x23c]
cmp cx, word [edx + 2]
jne 0x4100ca
add dword [ebp - 0x238], 4
add dword [ebp - 0x23c], 4
cmp word [ebp - 0x24c], 0
jne 0x410064
mov dword [ebp - 0x254], 0
jmp 0x4100d5
sbb eax, eax
or eax, 1
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x25c], ecx
cmp dword [ebp - 0x25c], 0
je 0x41018a
mov dword [ebp - 0x244], str.vmtoolsd.exe
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x240], edx
mov eax, dword [ebp - 0x240]
mov cx, word [eax]
mov word [ebp - 0x24e], cx
mov edx, dword [ebp - 0x244]
cmp cx, word [edx]
jne 0x41016a
cmp word [ebp - 0x24e], 0
je 0x41015e
mov eax, dword [ebp - 0x240]
mov cx, word [eax + 2]
mov word [ebp - 0x250], cx
mov edx, dword [ebp - 0x244]
cmp cx, word [edx + 2]
jne 0x41016a
add dword [ebp - 0x240], 4
add dword [ebp - 0x244], 4
cmp word [ebp - 0x250], 0
jne 0x410104
mov dword [ebp - 0x258], 0
jmp 0x410175
sbb eax, eax
or eax, 1
mov dword [ebp - 0x258], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
jne 0x410193
mov byte [ebp - 0x231], 1
jmp 0x4101ae
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x248]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41004e
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x231]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c1db
mov esp, ebp
pop ebp
ret
Function at 0x410590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x618000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x38], ecx
call fcn.0040f850
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040f890
add esp, 8
movzx edx, al
test edx, edx
je 0x4105d5
lea eax, [ebp + 8]
push eax
call fcn.00410440
add esp, 4
jmp 0x410752
mov ecx, dword [ebp - 0x38]
call fcn.00410920
test eax, eax
je 0x410617
mov ecx, dword [ebp - 0x38]
call fcn.00410920
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0040f870
cmp esi, eax
jae 0x410617
lea ecx, [ebp + 8]
push ecx
call fcn.004113d0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x38]
call fcn.0040d8c0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x410752
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x4c], 0
jne 0x41062a
call fcn.0040f850
jmp 0x410752
mov ecx, dword [ebp - 0x38]
call fcn.0040da00
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x410679
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.004113d0
add esp, 4
movzx ecx, al
push ecx
call fcn.00402fe0
add esp, 8
movzx edx, al
test edx, edx
je 0x410669
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
jmp 0x410671
call fcn.0040f850
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
jmp 0x410752
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.004113d0
add esp, 4
mov byte [ebp - 0x2a], al
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x29]
push eax
lea ecx, [ebp - 0x2a]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x38]
call fcn.00410550
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4106d0
cmp dword [ebp - 0x3c], 1
je 0x4106d0
cmp dword [ebp - 0x3c], 3
je 0x41071d
jmp 0x41074d
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x40], ecx
je 0x410702
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00580aa5
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x410702
call fcn.0040f850
jmp 0x410752
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x410716
mov eax, dword [ebp + 8]
jmp 0x410752
call fcn.0040f850
jmp 0x410752
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.00402fe0
add esp, 8
movzx eax, al
test eax, eax
je 0x410740
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
jmp 0x410748
call fcn.0040f850
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x410752
call fcn.0040f850
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c1db
mov esp, ebp
pop ebp
ret 4
Function at 0x411c00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x618000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x411c2a
jl 0x411c21
cmp dword [ebp + 0xc], 0
ja 0x411c2a
xor eax, eax
xor edx, edx
jmp 0x411d61
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x411c4c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00411d80
jmp 0x411d61
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.0040cae0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x411cbb
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00402b50
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0040fc70
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040e690
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0040fb80
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x411d52
mov ecx, dword [ebp - 0x10]
call fcn.0040da00
mov dword [ebp - 0x24], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x411d2b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0058041e
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x411d29
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x411d61
jmp 0x411cd7
cmp dword [ebp - 8], 0
jbe 0x411d52
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0058041e
add esp, 0x10
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c1db
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4132a4
xor eax, eax
jmp 0x413324
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4132bb
xor eax, eax
jmp 0x413324
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x413307
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x413307
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4132de
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x413313
xor eax, eax
jmp 0x413324
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x413321
xor eax, eax
jmp 0x413324
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4165c0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x416613
push esi
push dword [ebp + 8]
call fcn.004167a9
mov edi, eax
test edi, edi
je 0x41660e
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41660e
mov eax, dword [ebp - 8]
jmp 0x416625
mov eax, dword [ebp + 0x10]
jmp 0x416625
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x4180d7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x41811c
call fcn.004256b8
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x418119
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x418163
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x41813f
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5b59d0]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x418160
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x5b59d0]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x4299d7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x429a16
call fcn.004256b8
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x429a16
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x429a1e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.004aeb30
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x42a415
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42a4a1
cmp dword [esi + 0x20], 0
je 0x42a4a1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42a4a1
cmp dword [ebp + 8], 0
je 0x42a4a1
xor edi, edi
mov ebx, edi
call fcn.004256b8
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x42a485
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42a4a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.004af62a
mov edi, eax
add esp, 0xc
test edi, edi
je 0x42a49d
mov ecx, esi
call fcn.0042a1b3
mov eax, edi
jmp 0x42a4a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4