joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x41c0b0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x413be1
xor eax, eax
jmp 0x413d6a
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x41e780]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x413c1d
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00414f36
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x413cf8
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x413d36
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x413c81
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x413c72
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x413c52
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413cc1
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x413cca
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x413c43
jmp 0x413ccc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x413d65
cmp dword [ebp - 0x6c], edi
je 0x413d36
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x413d2b
call fcn.004127a1
mov dword [eax], 9
call fcn.004127aa
mov dword [eax], esi
jmp 0x413d60
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413d20
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x413ccc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x413ccc
push dword [ebp - 0x6c]
call fcn.004127b3
pop ecx
jmp 0x413d60
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x413d4e
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x413d4e
xor eax, eax
jmp 0x413d68
call fcn.004127a1
mov dword [eax], 0x1c
call fcn.004127aa
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x413d68
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040f289
add ebp, 0x3a0
leave
ret
Function at 0x414c6e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41d518], ebx
push esi
push edi
jne 0x414cee
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x414d29
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x41d518], eax
je 0x414d29
push 0x4193ac
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41d51c], eax
call esi
cmp dword [0x41d06c], 2
mov dword [0x41d520], eax
jne 0x414cee
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41d528], eax
je 0x414cee
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41d524], eax
mov eax, dword [0x41d524]
test eax, eax
je 0x414d33
call eax
test eax, eax
je 0x414d1a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41d528]
test eax, eax
je 0x414d1a
test byte [ebp - 8], 1
jne 0x414d33
cmp dword [0x41d078], 4
jb 0x414d2d
or byte [ebp + 0x12], 0x20
jmp 0x414d52
xor eax, eax
jmp 0x414d62
or byte [ebp + 0x12], 4
jmp 0x414d52
mov eax, dword [0x41d51c]
test eax, eax
je 0x414d52
call eax
mov ebx, eax
test ebx, ebx
je 0x414d52
mov eax, dword [0x41d520]
test eax, eax
je 0x414d52
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41d518]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401b09
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401b44
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401b40
lea ebx, [ebx]
cmp esi, eax
jae 0x401b44
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401b30
cmp esi, eax
jb 0x401b4a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403d80
Capabilities:
Get token membership

Disassembly:
sub esp, 0x58
mov eax, dword [0x4564c4]
xor eax, esp
mov dword [esp + 0x54], eax
push ebp
push esi
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
push 8
mov esi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403dc5
pop esi
pop ebp
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0042dbc0
add esp, 0x58
ret
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [esp + 0xc]
push ecx
push 4
push esi
push 0x12
push edx
call ebx
test eax, eax
je 0x403e52
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebp
push 0x1a
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp dword [esi], 3
jne 0x403e43
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
push 0x13
push ecx
mov dword [esp + 0x28], ebp
call ebx
mov eax, dword [esp + 0x14]
push edi
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
mov esi, 1
jne 0x403e36
mov esi, ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e54
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov dword [edi], eax
mov esi, 1
jmp 0x403e54
mov esi, ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x60]
pop ebx
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0042dbc0
add esp, 0x58
ret
Function at 0x405440
Capabilities:
Get session user name

Disassembly:
sub esp, 0x110
mov eax, dword [0x4564c4]
xor eax, esp
mov dword [esp + 0x10c], eax
push edi
xor eax, eax
push 0xfe
push eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], al
lea eax, [esp + 0x19]
push eax
call fcn.00431520
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x14], 0xff
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edi, [esp + 4]
lea ecx, [esp + 8]
call fcn.00403d80
test eax, eax
pop edi
je 0x4054c4
mov eax, dword [esp + 4]
sub eax, 1
je 0x4054c4
sub eax, 1
je 0x4054c4
sub eax, 1
jne 0x4054c4
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0042dbc0
add esp, 0x110
ret
mov ecx, dword [esp + 0x10c]
xor ecx, esp
mov eax, 1
call fcn.0042dbc0
add esp, 0x110
ret
Function at 0x409300
Capabilities:
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x443fe9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4564c4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x1c], esi
push 0x44b9af
mov ecx, edi
mov dword [esp + 0x14], esi
call fcn.00403330
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x20], esi
push esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 4
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40937d
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0042ea80
add esp, 4
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
movzx eax, byte [esi + 0x199]
movzx ecx, byte [esi + 0x198]
movzx edx, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push ecx
movzx ecx, byte [esi + 0x195]
push edx
movzx edx, byte [esi + 0x194]
push eax
push ecx
push edx
push str._0.2X__0.2X__0.2X__0.2X__0.2X__0.2X
push edi
call fcn.004033f0
add esp, 0x20
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x409cb0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x443f48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4564c4]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x4564c4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
push 0x44b9af
lea ecx, [esp + 0x10]
call fcn.00403330
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x20]
movzx edx, word [esp + 0x22]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*4]
push eax
lea eax, [esp + 0x10]
push 0x44c4fc
push eax
call fcn.004033f0
mov eax, dword [0x45a554]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x457a90]
xor esi, esi
lea edx, [esp + 0x14]
push edx
push esi
push 0x2001f
push esi
push esi
push esi
push eax
push ecx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x409d5e
mov esi, dword [esp + 0x10]
cmp edi, 1
jne 0x409d95
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
mov edi, eax
test ecx, ecx
jne 0x409d7e
push 0x80004005
call fcn.00401520
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push edi
push 1
push 0
push 0x44bdfc
jmp 0x409dca
cmp edi, 3
jne 0x409dd1
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
mov edi, eax
test ecx, ecx
jne 0x409db5
push 0x80004005
call fcn.00401520
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push edi
push 1
push 0
push str.ust3
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x409ddc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409e04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042dbc0
add esp, 0x2c
ret
Function at 0x40cc40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x443da6
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x4564c4]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4564c4]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x13c]
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x20], esi
push 0x103
lea eax, [esp + 0x29]
push ebx
mov dword [esp + 0x13c], ebx
push eax
mov byte [esp + 0x30], bl
call fcn.00431520
add esp, 0xc
push 0x44b9af
lea ecx, [esp + 0x1c]
call fcn.00403330
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push 0x2001f
push ebx
push ebx
mov byte [esp + 0x14c], 1
mov eax, dword [0x45a554]
mov ecx, dword [0x457a90]
push ebx
push eax
push ecx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40ccf4
mov esi, dword [esp + 0x14]
mov dword [esp + 0x20], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push 0x44c2a8
push esi
mov dword [esp + 0x2c], 0x104
call edi
cmp eax, ebx
jne 0x40cd42
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x40cd2c
cmp eax, 2
jne 0x40cd42
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40ce05
cmp byte [esp + eax + 0x23], bl
je 0x40ce09
mov dword [ebp + 0x94], ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push str.time_1
push esi
mov dword [esp + 0x2c], 0x104
call edi
cmp eax, ebx
jne 0x40cd90
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x40cd7a
cmp eax, 2
jne 0x40cd90
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40ce53
cmp byte [esp + eax + 0x23], bl
je 0x40ce57
mov dword [ebp + 0x90], 0x14
cmp esi, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40cdad
push esi
call edi
xor esi, esi
mov dword [esp + 0x20], esi
mov byte [esp + 0x134], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cdd4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x40cddb
push esi
call edi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0042dbc0
add esp, 0x124
ret 4
mov byte [esp + 0x24], bl
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40ce10
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x20]
call fcn.00401760
mov eax, dword [esp + 0x18]
push 0x44bc4c
push eax
call fcn.0042f58c
add esp, 8
cmp eax, ebx
sete al
xor ecx, ecx
cmp al, bl
setne cl
mov dword [ebp + 0x94], ecx
jmp 0x40cd48
mov byte [esp + 0x24], bl
lea eax, [esp + 0x24]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40ce60
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x20]
call fcn.00401760
mov eax, dword [esp + 0x18]
push eax
call fcn.0042f686
add esp, 4
mov dword [ebp + 0x90], eax
jmp 0x40cd9a
Function at 0x40cf40
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4564c4]
xor eax, esp
mov dword [esp + 8], eax
mov edx, dword [0x45a554]
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [0x457a90]
xor esi, esi
lea ecx, [esp + 8]
push ecx
push esi
push 0x2001f
push esi
push esi
push esi
push edx
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40cf83
mov esi, dword [esp + 4]
push 0x44bc4c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0x44bc4c
push 1
push 0
push 0x44bdf8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x40cfb2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0042dbc0
add esp, 0xc
ret
Function at 0x40fad0
Capabilities:
Set registry value

Disassembly:
test esi, esi
jne 0x40fade
push 0x80004005
call fcn.00401520
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
add eax, 1
push eax
mov eax, dword [esp + 0xc]
push esi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x40fb30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40fb8f
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40fb6d
cmp eax, 2
jne 0x40fb7f
test esi, esi
mov eax, dword [esp]
je 0x40fb8b
test eax, eax
je 0x40fb88
cmp byte [eax + esi - 1], 0
je 0x40fb8b
mov eax, 0xd
pop ecx
ret 8
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x413d72
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x4564c4]
xor eax, ebp
mov dword [ebp + 0xdc], eax
cmp dword [ebp + 0xec], 0x800
mov eax, dword [ebp + 0xe8]
push esi
mov dword [ebp - 0x3c], eax
mov esi, ecx
lea eax, [ebp - 0x40]
jne 0x413e0a
push 0x446f44
push 4
push eax
call fcn.0042f610
push eax
call fcn.00403240
add esp, 0x10
push ebx
push edi
call fcn.004314d2
mov edi, dword [eax]
call fcn.004314d2
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0042efbe
add esp, 0x18
mov dword [ebp - 0x3c], eax
call fcn.004314d2
cmp dword [eax], ebx
je 0x413e21
call fcn.004314d2
push dword [eax]
call fcn.0040ff0a
pop ecx
jmp 0x413e28
push 4
push eax
push 3
push dword [ebp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x413dbe
jmp 0x413e9a
call fcn.004314d2
mov dword [eax], edi
cmp dword [ebp - 0x3c], 0xffffffff
je 0x413e96
cmp dword [ebp - 0x3c], esi
jae 0x413e96
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.00431520
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x413e88
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x413e88
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x413e88
push ebx
push ebx
push esi
jmp 0x413e8e
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x413e98
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
pop esi
call fcn.0042dbc0
add ebp, 0xe0
leave
ret
Function at 0x415dd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x415e1c
call fcn.00413151
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x415e1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x415e5f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x415e48
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x415e48
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x415e5c
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41784c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x442a8c
call fcn.004313c0
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00413151
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x417897
call fcn.00413151
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x4178a8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x4178b5
or eax, 0xffffffff
jmp 0x417a11
mov ecx, esi
call fcn.00417393
mov dword [ebp - 0x14], eax
call fcn.0041a0b0
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x417933
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x417933
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x417933
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00413d5f
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x417933
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x417933
mov ecx, ebx
call fcn.0041d808
test eax, eax
je 0x417933
push 0
mov ecx, ebx
call fcn.0041d823
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0041b9f0
push dword [ebp - 0x14]
call fcn.0041a008
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00417654
xor edi, edi
cmp eax, edi
je 0x417990
test byte [esi + 0x3c], 0x10
je 0x41797a
push 4
pop edi
mov ecx, esi
call fcn.0041d6ef
test ax, 0x100
je 0x417970
push 5
pop edi
push edi
mov ecx, esi
call fcn.00419b9e
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x417990
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041d9cd
or dword [ebp - 4], 0xffffffff
jmp 0x4179bb
cmp dword [ebp - 0x28], edi
je 0x4179c9
push 1
mov ecx, ebx
call fcn.0041d823
cmp dword [ebp - 0x2c], edi
je 0x4179d9
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4179f2
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4179f2
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004173cd
cmp dword [esi + 0x58], edi
je 0x417a0e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.00431465
ret
Function at 0x41ca1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41ca60
call fcn.00413151
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41ca60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41ca7b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041c5d4
test ebx, ebx
mov esi, eax
je 0x41ca79
test edi, edi
je 0x41ca79
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f006
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41f034
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41f052
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041ef70
jmp 0x41f052
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41f052
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0041ef70
test edi, edi
mov eax, edi
jne 0x41f03c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x459638]
test ecx, ecx
je 0x41f115
jmp 0x41f005
ret 8

Function at 0x42dbc0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4564c4]
jne 0x42dbca
repz ret
jmp fcn.00433cf8