joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4102c5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x417978], 0x10
jl 0x407da8
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x407d9a
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x407dc7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x407dc7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n1::rg_n4576.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x407e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410efd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x417978], 0x10
jl 0x407eeb
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x407edd
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x407f0a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x407f0a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n1::rg_n4576.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n4576.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410ff8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.rg_n1::rg_n4580.0
cmp dword [0x417978], 0x18
jl 0x4084f5
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x4084e7
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x408514
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x408514
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 3
lea eax, [ecx + 8]
mov dword [ecx], vtable.CRefObjectWithData_class_rg_n1::rg_n4576_.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 4
mov dword [eax], vtable.rg_n1::rg_n4576.0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410a3d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x417978], 0xc
jl 0x408998
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x40898a
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x4089b7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4089b7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x4179a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6432.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x408a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410a85
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x417978], 0xc
jl 0x408aeb
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x408add
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x408b0a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x408b0a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x4179a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6432.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6432.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411165
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x417978], 0xc
jl 0x408eb8
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x408eaa
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x408ed7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x408ed7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x4179a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6432.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n12022.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x408fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4111bd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x417978], 0xc
jl 0x40901b
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x40900d
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x40903a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40903a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x4179a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6432.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n12022.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n12022.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4112fd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x41248f
push 2
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
add esp, 8
call fcn.00408cf0
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 8]
mov dword [0x417a60], ecx
mov ecx, dword [ebp + 0xc]
mov dword [0x417a5c], eax
mov dword [0x417a64], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x417a68], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x4179a4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x412d70
mov edi, eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x409421
push str.GetDpiForMonitor
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40941a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x409448
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp + 8]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x412e98]
divsd xmm1, qword [0x412ea0]
maxsd xmm0, xmm1
movsd qword [0x4179a8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x4179a0], eax
mov esi, dword [eax]
call fcn.004096e0
mov ecx, dword [0x4179a0]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
jne 0x4094a2
mov ecx, dword [0x4179a0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00409280
mov ecx, 0x4179d4
mov esi, eax
call fcn.0040e6a0
mov ecx, dword [0x4179a0]
test ecx, ecx
je 0x4094cc
mov edx, dword [ecx]
call dword [edx + 0x30]
mov dword [0x4179a0], 0
mov ecx, 0x417a34
call fcn.00409b90
mov ecx, 0x417980
call fcn.0040d000
push 0x4179b0
mov dword [ebp + 8], 0x4179b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [0x4179c8]
test eax, eax
je 0x409513
push eax
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov dword [0x4179c8], 0
mov dword [ebp - 4], 0xffffffff
push 0x4179b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4102c5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x417978], 0xc
jl 0x409678
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x40966a
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x409697
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x409697
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x4179a0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41016d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x417978], 0x28
jl 0x40b388
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x40b37a
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x40b3a7
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40b3a7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.0040b6a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b4a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411775
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x417978], 0x28
jl 0x40b4fc
push 0x41797c
call fcn.0040e480
mov esi, dword [0x417974]
add esp, 4
test esi, esi
je 0x40b4ee
mov eax, dword [esi]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test esi, esi
jne 0x40b51b
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40b51b
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.0040b6a0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.0040b610
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ba80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410d3d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x417978], 0xc
jl 0x40badb
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x40bacd
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x40bafa
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40bafa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x4179a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bf20
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x41700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x417960], 0x412cfc
mov dword [0x417968], 0x412e54
push 0
mov dword [ebp - 0x14], 0x417960
mov dword [0x41797c], 1
mov dword [0x417978], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40bf97
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ecx + 0x400000]
mov dword [0x417974], ecx
mov dword [0x417970], eax
mov edx, 0x1555
mov eax, dword [0x417978]
mov dword [0x41796c], ecx
nop dword [eax + eax]
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x417978]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x417978]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x417978]
add ecx, eax
sub edx, 1
jne 0x40bfc0
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x417980
mov dword [ebp - 0x18], 0x417980
mov dword [ebp - 0x1c], 0x417980
mov dword [0x417980], 0x41243c
mov dword [0x417984], edx
mov dword [0x417988], edx
mov byte [ebp - 4], 1
mov dword [0x417980], 0x4123d8
mov dword [0x41798c], edx
mov dword [0x417994], edx
mov dword [0x417990], edx
mov dword [0x417998], 0x40
mov byte [ebp - 4], 2
mov dword [0x417998], 0x80
mov byte [ebp - 4], 5
mov dword [0x41799c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4179b0
mov dword [ebp - 0x20], 0x4179b0
call esi
mov byte [ebp - 4], 7
mov dword [0x4179c8], 0
mov byte [ebp - 4], 8
push 0x4179d4
mov dword [ebp - 0x24], 0x4179d4
call esi
mov byte [ebp - 4], 9
mov dword [0x4179ec], 0x3e8
mov dword [ebp - 0x28], 0x417a00
mov dword [ebp - 0x2c], 0x417a00
mov dword [0x417a00], 0x41243c
mov dword [0x417a04], 0
mov dword [0x417a08], 0
mov byte [ebp - 4], 0xa
mov dword [0x417a00], 0x4123d8
mov dword [0x417a0c], 0
mov dword [0x417a14], 0
mov dword [0x417a10], 0
mov dword [0x417a18], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x417a18], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [0x4179f4], 0x3e80
mov dword [0x4179f8], 1
mov dword [0x4179fc], 0
lea eax, [eax*2 + 2]
mov dword [0x4179f0], eax
mov byte [ebp - 4], 0xe
push 0x417a1c
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x417a34
call fcn.0040b6a0
mov byte [ebp - 4], 0x10
mov dword [0x4179a0], 0
mov dword [0x417a5c], 0
movsd xmm0, qword [0x412e98]
movsd qword [0x4179a8], xmm0
xorps xmm0, xmm0
mov dword [0x417a60], 0
mov dword [0x417a64], 0
mov dword [0x417a68], 0
mov dword [0x4179a4], 0
movq qword [0x4179cc], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x417960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ca20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x40ca3f
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40cb15
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x40cb15
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40cb0c
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x40caf0
cmp edi, 1
jne 0x40cab5
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x40cb07
cmp edi, 2
jne 0x40cac8
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x40cb07
cmp edi, 4
jne 0x40cad9
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x40cb07
cmp edi, 8
jne 0x40caf0
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x40cb07
test edi, edi
jle 0x40cb07
push edi
mov ecx, esi
call fcn.0040daa0
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40ce30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x417978]
jg 0x40ce6b
push 0x41797c
call fcn.0040e480
mov ecx, dword [0x417974]
add esp, 4
test ecx, ecx
je 0x40ce5d
mov eax, dword [ecx]
mov dword [0x417974], eax
mov dword [0x41797c], 1
test ecx, ecx
jne 0x40ce89
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40ce89
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x40cef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x41796c]
jb 0x40cf64
cmp esi, dword [0x417970]
jae 0x40cf64
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x417978]
jle 0x40cf79
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40cf7d
push dword [0x417978]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
push 0x41797c
call fcn.0040e480
mov eax, dword [0x417974]
add esp, 0x10
mov dword [esi], eax
mov dword [0x417974], esi
mov esi, edi
mov dword [0x41797c], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
jne 0x40cf5d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
jmp loc.00410d08
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4