joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d8e
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00406059
test bl, 8
mov dword [ebp - 8], eax
je 0x405dcd
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429ae8], eax
jmp 0x405f4a
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405de7
test eax, eax
je 0x405ef8
test bl, 2
je 0x405ef8
mov esi, 0x424f50
push edi
push esi
call fcn.00406682
cmp dword [ebp + 8], 0
je 0x405e06
push 0x40a59c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405e0c
push edi
call fcn.00405f9d
cmp word [edi], 0
jne 0x405e1c
cmp word [0x424f50], 0x5c
jne 0x405e27
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405eed
cmp word [ebp - 0x22c], 0x2e
jne 0x405e71
cmp word [ebp - 0x22a], 0
je 0x405ed0
cmp word [ebp - 0x22a], 0x2e
jne 0x405e71
cmp word [ebp - 0x228], 0
je 0x405ed0
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406682
test byte [ebp - 0x258], 0x10
je 0x405e9c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405ed0
push dword [ebp + 0xc]
push edi
call fcn.00405d8e
jmp 0x405ed0
push dword [ebp - 4]
push edi
call fcn.00405d46
test eax, eax
jne 0x405ec8
cmp dword [ebp - 4], eax
je 0x405ec0
push edi
push 0xfffffffffffffff1
call fcn.00405707
push 0
push edi
call fcn.00406442
jmp 0x405ed0
inc dword [0x429ae8]
jmp 0x405ed0
push edi
push 0xfffffffffffffff2
call fcn.00405707
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405e49
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405ef8
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f4a
cmp dword [ebp - 8], esi
jne 0x405f0c
inc dword [0x429ae8]
jmp 0x405f4a
push edi
call fcn.004069df
test eax, eax
je 0x405f4a
push edi
call fcn.00405f51
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d46
test eax, eax
jne 0x405f42
cmp dword [ebp - 4], esi
je 0x405f04
push edi
push 0xfffffffffffffff1
call fcn.00405707
push esi
push edi
call fcn.00406442
jmp 0x405f4a
push edi
push 0xffffffffffffffe5
call fcn.00405707
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402710
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, di
shr edi, 0x10
test esi, esi
mov ebx, eax
jne 0x40272c
pop edi
pop esi
mov eax, 1
pop ebx
ret
test ebx, ebx
jbe 0x40282c
push ebp
cmp ebx, 0x15b0
mov eax, ebx
jb 0x402744
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x4027eb
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
lea ecx, [ecx]
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x402760
test eax, eax
je 0x4027ff
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x4027f0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x402735
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret

Function at 0x402d00
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x402d07
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.00402d10
Function at 0x402d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x402d42
lea esp, [esp]
test cl, 3
je 0x402d42
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x426e70]
add ecx, 1
sub esi, 1
jne 0x402d20
cmp esi, 0x20
push ebx
push edi
jb 0x402f2c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427270]
xor edx, dword [ebx*4 + 0x427670]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x426e70]
add ecx, 4
xor edx, dword [eax*4 + 0x427a70]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427270]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x427670]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x426e70]
add ecx, 4
xor eax, dword [edx*4 + 0x427a70]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427270]
xor edx, dword [ebx*4 + 0x427670]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x426e70]
xor edx, dword [eax*4 + 0x427a70]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427270]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x427670]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x426e70]
xor eax, dword [edx*4 + 0x427a70]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427270]
xor edx, dword [ebx*4 + 0x427670]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x426e70]
xor edx, dword [eax*4 + 0x427a70]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427270]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x427670]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x426e70]
and edx, 0xff
xor eax, dword [edx*4 + 0x427a70]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x427270]
xor edx, dword [ebx*4 + 0x427670]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x426e70]
add ecx, 4
xor edx, dword [eax*4 + 0x427a70]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x427270]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x427670]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x426e70]
and edx, 0xff
xor eax, dword [edx*4 + 0x427a70]
sub edi, 1
jne 0x402d52
cmp esi, 4
jb 0x402f79
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x427270]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x427670]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x426e70]
and eax, 0xff
xor edi, dword [eax*4 + 0x427a70]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x402f36
test esi, esi
pop edi
pop ebx
je 0x402f9d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x426e70]
add ecx, 1
sub esi, 1
jne 0x402f80
not eax
pop esi
ret
Function at 0x404c60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [0x43047c]
push edi
push str.DATA
push 0xcb
push esi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x404cd1
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
ja 0x404ca9
test eax, eax
je 0x404cd0
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00404ce0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.00404a90
lea ecx, [esp + 0x10]
call fcn.00404d40
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x405f70
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
sub esp, 0x34c
mov eax, dword [0x42efe0]
xor eax, esp
mov dword [esp + 0x348], eax
push 0x104
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4060a4
push 0x104
lea ecx, [esp + 0x40]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4060a4
push 0x104
lea eax, [esp + 0x248]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4060a4
push esi
push str._c_del
lea ecx, [esp + 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x148]
push eax
call esi
push str.___nul
lea ecx, [esp + 0x148]
push ecx
call esi
lea ecx, [esp + 4]
lea edx, [esp + 0x248]
lea eax, [esp + 0x144]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], str.Open
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4060a3
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [esp + 0x44]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.00415c68
add esp, 0x34c
ret

Function at 0x406fa0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x406fc0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x406fd6
push 0x80004005
call fcn.00404d90
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x407000
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x407018
push 0x80004005
call fcn.00404d90
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
add esi, eax
add edi, eax
cmp eax, 1
jne 0x407025
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8

Function at 0x4075e0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42efe0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x40764e
test ecx, ecx
je 0x407640
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40765c
test ecx, ecx
je 0x407701
push ecx
jmp 0x4076fb
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x4076ce
jmp 0x407690
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.004075e0
mov edi, eax
test edi, edi
jne 0x40771d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x407690
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4076e5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407701
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00415c68
add esp, 0x11c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40772c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x407703
Function at 0x409080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
call fcn.00408e40
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 5
push edi
push esi
mov dword [esp + 0x20], 0
call ebx
mov ebp, eax
test ebp, ebp
je 0x40915f
push 0xf0
push edi
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
test eax, eax
je 0x4090d4
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebp
push esi
mov dword [esp + 0x18], 0
call edi
test eax, eax
je 0x409138
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x409138
push ebx
push edi
call fcn.004063c0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
add esp, 8
mov ebx, eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push edx
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov esi, eax
test esi, esi
jne 0x409124
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x409146
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x409146
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409155
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40e5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x42efe0]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x3b0]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], ecx
call dword [0x42ef5c]
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x68], esi
je 0x40e688
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
add eax, 1
cdq
push 2
push edx
push eax
call fcn.00416b90
mov edi, eax
add eax, 0x80000000
adc edx, esi
test edx, edx
ja 0x40e688
jb 0x40e64c
cmp eax, 0xffffffff
ja 0x40e688
cmp edi, 0x400
jg 0x40e66c
push edi
call fcn.00406770
add esp, 4
test al, al
je 0x40e66c
mov eax, edi
call fcn.00416b10
mov eax, esp
jmp 0x40e678
push edi
lea ecx, [ebp - 0x6c]
call fcn.00406bc0
mov esi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
push edx
push edi
push ebx
push eax
call fcn.00406db0
test eax, eax
jne 0x40e6bb
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x40e698
lea ecx, [ebp - 0x68]
call fcn.00407580
test esi, esi
je 0x40e6b1
lea esp, [esp]
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.00416401
add esp, 4
test esi, esi
jne 0x40e6a0
mov eax, 0x8007000e
jmp 0x40e7b3
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x40e6d8
call fcn.00406e20
mov edi, eax
jmp 0x40e786
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x70]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40e6f7
call fcn.00406e20
jmp 0x40e77d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x70], eax
jne 0x40e70d
call fcn.00406e20
jmp 0x40e77d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x40e73d
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x40e72e
lea ecx, [ebp - 0x68]
call fcn.00407580
lea ecx, [ebp - 0x6c]
call fcn.00406640
mov eax, 0x8007000e
jmp 0x40e7b3
push eax
lea ecx, [ebp - 0x68]
call fcn.00408190
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x40e754
mov edi, 0x8007000e
jmp 0x40e77f
mov ecx, dword [ebp - 0x70]
push edi
push ecx
push edi
push eax
call fcn.00404e60
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp + 0x3b4]
add esp, 0x10
mov byte [edx + edi], 0
mov ecx, dword [ebp - 0x68]
push eax
push ecx
lea ecx, [ebp - 0x80]
call fcn.004091e0
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x64]
cmp dword [ebp - 0x68], edx
je 0x40e796
lea ecx, [ebp - 0x68]
call fcn.00407580
test esi, esi
je 0x40e7b1
lea ebx, [ebx]
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.00416401
add esp, 4
test esi, esi
jne 0x40e7a0
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.00415c68
add ebp, 0x3a0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411023
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x84], 0
je 0x4110d0
mov eax, dword [esi + 4]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffff0
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, eax
or ecx, 0x800000
cmp eax, ecx
je 0x41105e
push ecx
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call ebx
mov edx, dword [esi + 4]
push 0xffffffffffffffec
push edx
call edi
mov ecx, eax
and ecx, 0xffffff7f
or ecx, 8
cmp eax, ecx
je 0x41107e
mov eax, dword [esi + 4]
push ecx
push 0xffffffffffffffec
push eax
call ebx
mov ecx, dword [esi + 4]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x14]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x54]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop ebx
mov byte [esi + 0x84], 0
mov eax, 1
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x414a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x3c
mov eax, dword [0x42efe0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [0x43047c]
push str.DATA
push 0xcd
push edi
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x414c40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
mov ebp, eax
push edi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push ebp
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test edi, edi
mov dword [esp + 0x1c], eax
ja 0x414abe
test eax, eax
je 0x414c40
mov eax, dword [esi + 0x5c]
xor ebx, ebx
test eax, eax
jne 0x414acf
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x414aed
mov ecx, dword [esi + 0x60]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
mov ebp, eax
xor edi, edi
test ebp, ebp
jle 0x414b18
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x414b06
mov eax, dword [esi + 0x70]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x414b0b
call fcn.0041559b
mov eax, dword [esi + 0x6c]
add ebx, dword [eax + edi*4]
add edi, 1
cmp edi, ebp
jl 0x414af3
mov edi, dword [esp + 0x18]
lea ecx, [ebx + 0x400]
add edi, 0x10
push ecx
mov ecx, edi
call fcn.004134c0
mov ecx, edi
call fcn.00406e80
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
call section..text
mov eax, dword [esp + 0x30]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor ebp, ebp
xor ebx, ebx
cmp dword [esp + 0x14], ebp
jle 0x414c40
mov dword [esp + 0x10], ebp
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x414b84
mov eax, dword [esi + 0x70]
sub eax, ecx
sar eax, 2
cmp ebp, eax
jb 0x414b89
call fcn.0041559b
mov eax, dword [esi + 0x5c]
test eax, eax
mov ecx, dword [esi + 0x6c]
mov edi, dword [ecx + ebp*4]
je 0x414bb2
mov ecx, dword [esi + 0x60]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x414bb7
call fcn.0041559b
mov eax, dword [esi + 0x5c]
add eax, dword [esp + 0x10]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.00403a60
mov edx, dword [esp + 0x24]
push edi
lea eax, [ebx + edx]
push eax
sub esp, 0x1c
mov ecx, esp
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x58]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00403a60
mov ecx, dword [esp + 0x3c]
call fcn.004149d0
add ebx, edi
cmp dword [esp + 0x44], 0x10
jb 0x414c2e
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041546c
add esp, 4
add dword [esp + 0x10], 0x1c
add ebp, 1
cmp ebp, dword [esp + 0x14]
jl 0x414b71
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415c68
add esp, 0x3c
ret 4