joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45870c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x475878]
cmp byte [eax + 0xc], 0
je 0x458879
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458872
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47cec0], 0
jne 0x458760
push 0x458880
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x458888
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cec0], eax
cmp dword [0x473d38], 0
jne 0x45885b
push 0x458898
call sub.kernel32.dll_LoadLibraryA
mov dword [0x473d38], eax
cmp dword [0x473d38], 0
je 0x45885b
push 0x4588a4
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cec4], eax
push 0x4588b4
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cec8], eax
push 0x4588c8
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cecc], eax
push 0x4588e0
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ced0], eax
push 0x4588f8
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ced4], eax
push 0x45890c
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ced8], eax
push 0x458924
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cedc], eax
push 0x45893c
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cee0], eax
push 0x458958
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cee4], eax
push 0x458964
mov eax, dword [0x473d38]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47cee8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458879
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x45f13c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405d14
xor eax, eax
push ebp
push 0x45f271
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x45f244
xor edx, edx
push ebp
push 0x45f23d
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x45f189
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45f212
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x45f201
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x45f1c8
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00405d24
lea ecx, [ebx + 1]
mov edx, esi
call fcn.0040340c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f208
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x47548c]
mov dl, 1
mov eax, dword [0x40a31c]
call fcn.0040ee90
call fcn.00405228
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f278
lea eax, [ebp - 4]
call fcn.00405894
ret
Function at 0x45f280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f43b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00406018
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x45f454
call fcn.00405bac
mov eax, ebx
call fcn.0041edb8
mov edi, eax
dec edi
test edi, edi
jl 0x45f338
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041ed8c
mov edx, dword [0x45d1d4]
call fcn.00404b40
test al, al
je 0x45f334
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0041ed8c
lea edx, [ebp - 0x14]
call fcn.0044b338
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00406018
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405c28
inc esi
dec edi
jne 0x45f2e6
movzx eax, byte [0x45f458]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x45f464
mov eax, dword [ebp - 8]
call fcn.004100f8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040592c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044b338
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x45f454
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0044b338
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x45f454
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x45f454
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x45f470
call fcn.0040c3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f442
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004058b8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004058b8
lea eax, [ebp - 0x14]
call fcn.00405894
lea eax, [ebp - 0x10]
call fcn.00405894
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058b8
ret
Function at 0x460f8c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405d14
xor eax, eax
push ebp
push 0x46100a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405d24
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x460fd5
mov eax, dword [ebx + 4]
call fcn.00405d24
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461011
lea eax, [ebp - 4]
call fcn.00405894
ret

Function at 0x4620ac
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x462251
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403668
cmp word [ebx + 0xa2], 0
je 0x4620f5
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x462109
lea esi, [ebp - 0xc]
jmp 0x46210b
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x462118
xor edi, edi
jmp 0x462125
mov eax, dword [ebx + 0x80]
call fcn.00405d24
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00405d24
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0046175c
mov eax, dword [ebp - 0x14]
call fcn.00405d24
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00405d24
push eax
mov eax, dword [ebp - 4]
call fcn.00405d24
push eax
mov eax, ebx
call fcn.0046189c
push eax
mov eax, ebx
call fcn.00461870
push eax
mov eax, ebx
call fcn.00461828
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00461628
mov eax, dword [ebp - 0x18]
call fcn.00405d24
push eax
mov eax, dword [ebx + 8]
call fcn.00405d24
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x4621ae
call fcn.004105c0
xor edx, edx
push ebp
push 0x462227
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4621ec
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4621e2
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46222e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x462260
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x46228c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405d24
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4622b1
call fcn.004105c0
xor eax, eax
push ebp
push 0x4622e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4622d1
call fcn.004105c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4622ef
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x46c320
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d14
xor eax, eax
push ebp
push 0x46c394
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405894
push 0x400
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
call fcn.00405d24
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
je 0x46c37e
cmp eax, 0x400
jg 0x46c37e
mov edx, ebx
lea eax, [ebp - 0x404]
call fcn.00464f38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c39b
lea eax, [ebp - 4]
call fcn.00405894
ret
Function at 0x4010ef
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0xa8
push ebx
push ebp
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.VerifyVersionInfoA
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebp, ebp
mov dword [esp + 0xc], eax
inc ebp
xor ebx, ebx
test eax, eax
jne 0x401144
push 0x24
push str.Windows_98_ME_Support
push str.This_version_of_the_application_requires_Windows_XP_2003_or_later._r_nDo_you_want_to_go_the_website_and_download_the_Windows_98_ME_version_if_one_is_available_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4011b9
push ebp
push ebx
push ebx
push str.http:__www.nch.com.au_software_win98_index.html
jmp 0x4011ad
mov edx, 0x9c
lea eax, [esp + 0x14]
mov ecx, edx
mov byte [eax], bl
inc eax
dec ecx
jne 0x40114f
push 3
push 2
push ebx
push ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 5
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 3
lea eax, [esp + 0x20]
push eax
call dword [esp + 0x1c]
test eax, eax
jne 0x4011b7
push 0x24
push str.Windows_2000_Support
push str.This_version_of_the_application_requires_Windows_XP_2003_or_later._r_nDo_you_want_to_go_the_website_and_download_the_Windows_2000_version_if_one_is_available_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4011b9
push ebp
push ebx
push ebx
push str.http:__www.nch.com.au_software_win2000_index.html
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4011b9
mov ebp, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xa8
ret
Function at 0x4037c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403831
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4037ff
cmp eax, 2
jne 0x40381b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x40382b
test ecx, ecx
je 0x403826
test cl, 1
jne 0x40381b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40382b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x403d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x403d49
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403d5f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403d56
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x403d92
nop
cmp esi, ecx
jae 0x403d56
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x403d80
cmp esi, ecx
jae 0x403d56
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x403f2e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403f2e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403f2e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x403eb7
cmp esi, ecx
jae 0x403f2e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x403ea1
cmp esi, ecx
jae 0x403f2e
movzx eax, word [esi]
test ax, ax
je 0x403f2e
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x403eea
push edi
mov ecx, ebx
call fcn.00404350
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x403eed
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0054ca99
add esp, 0x10
cmp eax, 0x50
ja case.0x403f0b.1
movzx eax, byte [eax + 0x403f5c]
jmp dword [eax*4 + 0x403f4c]
mov ecx, dword [ebx]
cmp edi, dword [ecx - 8]
jg 0x403f3c
mov dword [ecx - 0xc], edi
xor edx, edx
mov ecx, dword [ebx]
lea eax, [edx + 1]
mov word [ecx + edi*2], dx
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
call fcn.0040717e
push 0x80070057
call fcn.00404660
call fcn.00407164
nop
adc bh, byte [edi]
inc eax
add byte [edi], dh
aas
inc eax
add byte [esi + 0x3f], al
inc eax
add byte [esi + 0x3f], al
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x403fb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.004091ac
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4040b1
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4040b1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4040b1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4040b1
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404038
cmp esi, ecx
jae 0x4040b1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404022
cmp esi, ecx
jae 0x4040b1
movzx eax, word [esi]
test ax, ax
je 0x4040b1
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40406b
push edi
mov ecx, ebx
call fcn.00404350
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40406e
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0054ca99
add esp, 0x10
cmp eax, 0x50
ja case.0x40408c.1
movzx eax, byte [eax + 0x4040e0]
jmp dword [eax*4 + 0x4040d0]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4040c1
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0040717e
push 0x80070057
call fcn.00404660
call fcn.00407164
xchg ebx, eax
inc eax
inc eax
add byte [eax + eax*2 + 0x40cb0040], bh
inc eax
add bl, cl
inc eax
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3

Function at 0x404730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040b540
Function at 0x407cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x407d3a
call fcn.0040e294
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x407d37
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407d8a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x407d67
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5739ac]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x407d67
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x407d88
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x5739ac]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x408bb6
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x408c09
push esi
push dword [ebp + 8]
call fcn.00408d9f
mov edi, eax
test edi, edi
je 0x408c04
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x408c04
mov eax, dword [ebp - 8]
jmp 0x408c1b
mov eax, dword [ebp + 0x10]
jmp 0x408c1b
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x40b5a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0040e294
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40b5dc
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0040b5fb
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8