joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049e70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x10049ea3
push esi
call fcn.10058210
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x10049e9c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10049f29
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10049f12
mov eax, dword [esi + 8]
test eax, eax
je 0x10049ec7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x10049f0e
cmp eax, 2
je 0x10049f12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10049eba
cmp eax, 3
je 0x10049eed
cmp eax, 1
jne 0x10049eba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x10049eba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x10049eba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10049f50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10049f38
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10049f50
add esp, 4
pop esi
ret

Function at 0x1004a7c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1004a7e1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x1004a7e1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1004a7e1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1004ac30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1004ac3b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1004ad3e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x1008ba98]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008ba98]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008ba98]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008ba98]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008ba98]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1008ba98]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1008ba98]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1008ba98]
xor eax, edx
inc ecx
dec edi
jne 0x1004ac56
pop edi
test esi, esi
je 0x1004ad60
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1008ba98]
xor eax, edx
inc ecx
dec esi
jne 0x1004ad42
pop esi
pop ebx
not eax
ret
Function at 0x10078c94
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10078ccc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10076d3b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10076d13
jmp 0x10078cd8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1007a38e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1007a3d0
call fcn.1007fd26
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1007a3d0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1007a3c7
xor eax, eax
jmp 0x1007a3d8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1007a3de
pop edi
pop esi
pop ebx
ret 4
Function at 0x72c93170
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x72c96074], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventW]
push edi
mov edi, 0x100002
jne 0x72c931fe
mov ebx, 0x72c911a8
push ebx
push 1
push edi
call esi
test eax, eax
mov dword [0x72c96074], eax
jne 0x72c931fe
push 0xe0000000
call fcn.72c939c1
test eax, eax
mov dword [ebp - 4], eax
je 0x72c932a1
and dword [ebp - 8], 0
push ebx
push 0
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0xc
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebp - 4]
mov dword [0x72c96074], eax
call fcn.72c93b39
cmp dword [0x72c96074], 0
jne 0x72c931fe
push ebx
push 1
push edi
call esi
test eax, eax
mov dword [0x72c96074], eax
je 0x72c932a1
cmp dword [0x72c96078], 0
jne 0x72c9326d
mov ebx, 0x72c9116c
push ebx
push 1
push edi
call esi
test eax, eax
mov dword [0x72c96078], eax
jne 0x72c9326d
push 0xe0000000
call fcn.72c939c1
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 4], eax
je 0x72c932a1
push ebx
push ecx
mov dword [ebp - 0xc], eax
push ecx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebp - 4]
mov dword [0x72c96078], eax
call fcn.72c93b39
cmp dword [0x72c96078], 0
jne 0x72c9326d
push ebx
push 1
push edi
call esi
test eax, eax
mov dword [0x72c96078], eax
je 0x72c932a1
xor esi, esi
cmp dword [0x72c9607c], esi
jne 0x72c932a8
push 0x72c96080
push 4
push esi
push 0x72c930e8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x72c9607c], eax
je 0x72c932a1
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x72c932a8
call fcn.72c93ef2
jmp 0x72c932aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x72c93b8d
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [0x72c9608c], esi
jne 0x72c93bdc
push str.GlobalWDMAUD_Callbacks
push esi
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, esi
mov dword [0x72c96088], eax
je 0x72c93bdc
push 0x404
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
jne 0x72c93bdc
push dword [0x72c96088]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x72c96088], esi
mov eax, edi
pop edi
pop esi
ret

Function at 0x72c93be6
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 6
call fcn.72c939c1
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x72c93c03
xor eax, eax
jmp 0x72c93c6f
push esi
push str.GlobalWDMAUD_Callbacks
mov esi, 0x404
push esi
push ebx
push 4
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push edi
mov dword [0x72c96088], eax
call fcn.72c93b39
mov eax, dword [0x72c96088]
cmp eax, ebx
jne 0x72c93c48
xor eax, eax
jmp 0x72c93c6e
push esi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
jne 0x72c93c6c
push dword [0x72c96088]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x72c96088], ebx
jmp 0x72c93c44
mov dword [eax], ebx
pop esi
pop edi
pop ebx
leave
ret
Function at 0x72c94707
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x58]
push edi
xor edi, edi
cmp dword [ecx + 0x30], edi
je 0x72c94722
xor eax, eax
jmp 0x72c947dc
mov eax, dword [esi + 8]
cmp eax, edi
je 0x72c94744
cmp eax, 1
je 0x72c94744
cmp eax, 2
jne 0x72c9473c
mov dword [ebp + 8], 0x72c94af0
jmp 0x72c9474b
xor eax, eax
inc eax
jmp 0x72c947dc
mov dword [ebp + 8], 0x72c9457b
cmp dword [ecx + 4], edi
push ebx
jne 0x72c9479c
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
call ebx
mov ecx, dword [esi + 0x58]
push edi
push edi
push edi
push edi
mov dword [ecx + 0x1c], eax
call ebx
mov ecx, dword [esi + 0x58]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0x58]
add eax, 8
push eax
push edi
push esi
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0x58]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x58]
cmp dword [eax + 4], edi
je 0x72c9479c
push 0xf
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x58]
cmp dword [eax + 4], edi
jne 0x72c947cd
mov eax, dword [eax + 0x1c]
cmp eax, edi
je 0x72c947c8
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov eax, dword [esi + 0x58]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x58]
push dword [eax + 0x20]
call ebx
mov eax, dword [esi + 0x58]
mov dword [eax + 0x20], edi
xor eax, eax
inc eax
jmp 0x72c947db
push 1
add eax, 0x30
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x409600
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x47d144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4096a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4096a3
cmp eax, 3
je 0x40963b
cmp eax, 2
jne 0x4096b8
push 0x5c
push edi
call fcn.0043fefe
mov esi, eax
add esp, 8
test esi, esi
je 0x4096b8
sub esi, edi
lea eax, [ebp - 0x20c]
sar esi, 1
push esi
push edi
push 0x104
push eax
call fcn.004474cf
add esi, esi
add esp, 0x10
cmp esi, 0x208
jae 0x4096ca
xor eax, eax
lea ecx, [ebp - 0x20c]
mov word [ebp + esi - 0x20c], ax
call fcn.00409600
test eax, eax
je 0x4096b8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4096a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4096b8
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004281b1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004281b1
mov esp, ebp
pop ebp
ret
call fcn.004283bd
int3
Function at 0x409d10
Capabilities:
Create directory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x47d144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0x88]
mov dword [ebp - 0x2ac], ecx
push 0
push eax
call fcn.00440840
push 0x208
lea eax, [ebp - 0x290]
push 0
push eax
call fcn.00440840
add esp, 0x18
mov eax, 0xa
lea ebx, [ebx]
dec eax
mov dword [ebp - 0x2b0], eax
xor eax, eax
mov dword [ebp - 0x2a0], eax
xor ebx, ebx
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], eax
nop
call fcn.004474da
mov esi, eax
shl esi, 0xc
call fcn.004474da
mov edi, eax
xor edi, esi
shl edi, 8
call fcn.004474da
xor eax, edi
mov dword [ebp + ebx*4 - 0x2a0], eax
inc ebx
cmp ebx, 4
jb 0x409d90
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x29c]
test eax, eax
je 0x409de3
xor edi, dword [ebp - 0x2a4]
xor edi, dword [ebp - 0x2a8]
mov dword [ebp - 0x29c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor ebx, dword [ebp - 0x298]
mov dword [ebp - 0x298], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
shl esi, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
xor edx, esi
xor edx, dword [ebp - 0x294]
mov ecx, edx
mov dword [ebp - 0x294], edx
shr ecx, 0x18
push ecx
mov ecx, edx
shr ecx, 0x10
movzx eax, cl
push eax
mov eax, edx
shr eax, 8
movzx eax, al
push eax
movzx eax, dl
push eax
mov eax, ebx
shr eax, 0x18
push eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ebx
shr eax, 8
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, word [ebp - 0x29a]
push eax
movzx eax, di
push eax
push dword [ebp - 0x2a0]
lea eax, [ebp - 0x88]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x40
push eax
call fcn.0040a130
add esp, 0x38
cmp eax, 0xffffffff
je 0x409f1b
mov esi, dword [ebp - 0x2ac]
lea eax, [ebp - 0x290]
push esi
push 0x104
push eax
call fcn.004476de
add esp, 0xc
test eax, eax
jne 0x409f29
lea eax, [ebp - 0x290]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409eb0
sub eax, edx
sar eax, 1
je 0x409ee9
mov ecx, 0x5c
cmp cx, word [ebp + eax*2 - 0x292]
je 0x409ee9
push 0x471e4c
lea eax, [ebp - 0x290]
push 0x104
push eax
call fcn.00447669
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x290]
push 0x104
push eax
call fcn.00447669
add esp, 0xc
test eax, eax
jne 0x409f29
push eax
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x409f3c
mov eax, dword [ebp - 0x2b0]
test eax, eax
jne 0x409d60
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004281b1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x290]
push eax
push 0x104
push esi
call fcn.004476de
mov ecx, dword [ebp - 4]
add esp, 0xc
test eax, eax
sete al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004281b1
mov esp, ebp
pop ebp
ret
Function at 0x412420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
mov edi, ecx
mov esi, ebx
mov al, byte [ebx]
test al, al
je 0x412450
movsx eax, al
lea esi, [esi + 1]
add eax, edx
imul edx, eax, 0x401
mov eax, edx
shr eax, 6
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x412435
lea eax, [edx + edx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
and ecx, 0x3f
mov esi, dword [edi + ecx*4]
test esi, esi
je 0x4124c0
mov eax, dword [esi]
dec eax
cmp eax, 3
ja case.default.0x41246c
jmp dword [eax*4 + 0x4124d4]
lea eax, [esi + 0x1c]
jmp 0x412489
lea eax, [esi + 0x10]
jmp 0x412489
lea eax, [esi + 0xc]
jmp 0x412489
lea eax, [esi + 9]
jmp 0x412489
xor eax, eax
mov ecx, ebx
jmp 0x412490
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4124b0
test dl, dl
je 0x4124ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4124b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x412490
xor eax, eax
jmp 0x4124b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4124c9
mov esi, dword [esi + 4]
test esi, esi
jne 0x412464
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x419a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x419a6a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x419a6a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 8], eax
test eax, eax
je 0x419a6a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x419a73
mov dword [esi + 8], eax
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
Function at 0x41a9d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41aa29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41aa29
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x41aa18
cmp esi, edx
jae 0x41aa29
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x41aa06
cmp esi, edx
jae 0x41aa29
cmp word [esi], 0
je 0x41aa29
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x41b9a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41ba65
movzx ecx, ax
mov edx, 5
call fcn.00409f70
movzx ecx, word [edi + 0x10]
mov ebx, eax
push 5
push ecx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41ba65
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.00443adb
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41ba65
push esi
push dword [ebp - 4]
push ebx
call fcn.004402b0
add esp, 0xc
cmp dword [edi + 0x18], 0
jne 0x41ba25
mov eax, dword [0x4808d0]
test eax, eax
je 0x41ba1f
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [edi + 0x18], eax
mov ecx, dword [edi]
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 0xc]
push eax
mov esi, dword [ecx + 0x40]
mov ecx, esi
call dword [0x4623b8]
mov ecx, edi
call esi
push edi
push 0x41ba70
push dword [edi + 0x18]
push ebx
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
mov esi, eax
call fcn.00443ae6
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cb80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ff75
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x47d144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x54]
push eax
push 1
push 0x4023c0
push 0x401c20
push 0x402310
push 0x402260
push 0x401ab0
push 0x401ca0
push 0x401c80
call fcn.0042570c
add esp, 0x24
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0x10
xor eax, eax
mov dword [ebp - 0x18], 0
push 0x47359c
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00402cf0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x38]
je 0x41cc6f
mov eax, dword [ebp - 0x28]
mov edx, 7
mov dword [ecx + 0x10], 0
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x14], eax
xor eax, eax
add dword [ebp - 0x3c], 0x18
mov word [ebp - 0x28], ax
jmp 0x41cc7f
lea eax, [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.00402870
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x41ccba
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ccb0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41cd79
push edx
push ecx
call fcn.004281c2
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x41cd3b
push 0xa
push 0x7da
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x41cd3b
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41cd3b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41cd3b
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
push eax
call fcn.00401630
test al, al
je 0x41cd3b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
sub eax, ecx
and eax, 0xfffffffc
cmp eax, 4
jne 0x41cd3b
push dword [edi + 0x214]
lea eax, [edi + 0x218]
push ecx
mov ecx, dword [ecx]
push eax
call fcn.00401ec0
test al, al
je 0x41cd3b
mov bl, 1
jmp 0x41cd53
mov eax, dword [edi]
push 0x3f4
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4623b8]
mov ecx, edi
call esi
xor bl, bl
lea ecx, [ebp - 0x58]
call fcn.00401400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004281b1
mov esp, ebp
pop ebp
ret
call fcn.00443d74
int3
Function at 0x41d240
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, ecx
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41d2a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 5
je 0x41d293
cmp ecx, 0x2e4
je 0x41d293
cmp ecx, 0x4c7
je 0x41d293
mov eax, dword [edi]
push ecx
push 0x10000
mov esi, dword [eax]
mov ecx, esi
call dword [0x4623b8]
mov ecx, edi
call esi
jmp 0x41d2a9
mov eax, dword [edi]
push 0x3f5
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4623b8]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x41d2cf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebx + 0x38]
call dword [0x47d03c]
mov eax, dword [edi]
push dword [ebp - 4]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4623b8]
mov ecx, edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4