joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426bdd
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [edi + 0x2d], 0
je 0x426c7a
cmp dword [edi + 0x3c], 0
mov ebx, dword [ebp + 0xc]
je 0x426c13
cmp dword [edi + 0x40], ebx
jae 0x426c0d
push dword [edi + 0x3c]
call fcn.00449b2b
and dword [edi + 0x3c], 0
pop ecx
cmp dword [edi + 0x3c], 0
jne 0x426c23
lea eax, [ebx + ebx]
push eax
call fcn.00449b05
pop ecx
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], ebx
push ebx
push esi
push dword [edi + 0x3c]
call fcn.00491b80
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x426c77
lea ecx, [edi + 0x30]
mov eax, dword [edi + 0x3c]
mov esi, dword [ecx + 8]
mov bl, byte [edx + eax]
and esi, 0xfffd
mov dl, bl
or esi, 2
call fcn.0042684c
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov ecx, esi
xor ecx, 1
imul ecx, esi
shr ecx, 8
xor cl, bl
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
lea ecx, [edi + 0x30]
cmp edx, dword [ebp + 0xc]
jb 0x426c3c
mov esi, dword [edi + 0x3c]
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x426cac
mov edx, dword [edi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x28]
jb 0x426c98
mov dword [edi + 0x14], 0x30000
jmp 0x426cd0
push ebx
add ecx, edx
push esi
push ecx
call fcn.00491b80
add esp, 0xc
add dword [edi + 0x24], ebx
mov eax, ebx
jmp 0x426cd2
mov eax, dword [edi + 4]
test eax, eax
je 0x426cc9
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x426cd2
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x426f3b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x426f91
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x426fcc
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
push esi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00491b80
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
call fcn.00426768
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x426fce
cmp dword [edi + 0x7c], 0
je 0x426fc5
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426fcc
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.00426768
pop ecx
jmp 0x426f8a
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x427936
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x30
mov eax, 0x4ba86b
call fcn.0048ff65
mov edi, ecx
mov eax, dword [ebp + 8]
or dword [edi + 0xc], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x3c], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
mov dword [ebp - 4], ebx
push eax
mov dword [edi], vtable.KBufFileSendData.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x10], eax
cmp eax, 0xffffffff
jne 0x4279a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4d6f90
lea ecx, [ebp - 0x38]
call fcn.0041ae69
push 0x4e0fc8
lea eax, [ebp - 0x38]
push eax
call fcn.0048fea5
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x4279cb
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4d6fa0
jmp 0x42798a
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x4279fb
push dword [edi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 0x10]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4d6fb4
jmp 0x42798a
push ebx
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0xc], eax
mov dword [edi + 8], esi
mov eax, edi
call fcn.0048ff14
ret 4

Function at 0x428042
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
push 0
push 0
push 0x402
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x42a87e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0
mov dword [ebp - 0x208], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
push str.BINDATA
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x42a924
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42a91e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42a91e
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
push 0x10
mov edi, eax
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x42a90e
lea ecx, [esi + 4]
push ecx
and dword [ecx], 0
push edi
mov dword [esi], vtable.Gdiplus::Image.0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x42a910
xor esi, esi
test edi, edi
je 0x42a91a
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
mov eax, esi
jmp 0x42a97a
mov ebx, dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x42a978
xor eax, eax
push 0x1fc
mov word [ebp - 0x204], ax
xor edi, edi
lea eax, [ebp - 0x202]
push edi
push eax
call fcn.004921d0
push esi
push ebx
lea eax, [ebp - 0x204]
push str.Function:__s__image_id:_d__Last_error:__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x204]
push edi
push str.Error
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x42e487
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push 0x228
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x22c]
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x230], ebx
call fcn.004921d0
add esp, 0xc
mov dword [ebp - 0x240], ebx
push ebx
push 2
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42e4f8
xor eax, eax
jmp 0x42e66e
push edi
lea eax, [ebp - 0x230]
push eax
push ebx
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42e64c
test esi, esi
je 0x42e527
push esi
call edi
xor esi, esi
cmp dword [ebp - 0x234], 0
je 0x42e53f
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x234], 0
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.0048fb94
pop ecx
pop ecx
test eax, eax
jne 0x42e609
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x42e609
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x240], eax
jne 0x42e609
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42e609
lea eax, [ebp - 0x234]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42e609
and dword [ebp - 0x238], 0
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push dword [ebp - 0x234]
call fcn.0042e28e
add esp, 0x10
test eax, eax
je 0x42e609
mov eax, dword [ebp - 0x238]
push dword [eax]
call fcn.0042e3ba
pop ecx
push dword [ebp - 0x238]
test eax, eax
je 0x42e620
call fcn.0042e289
and dword [ebp - 0x238], 0
pop ecx
lea eax, [ebp - 0x230]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42e51e
jmp 0x42e645
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x228]
mov dword [ecx], eax
mov dword [ebp - 0x244], 1
call fcn.0042e289
and dword [ebp - 0x238], 0
pop ecx
test esi, esi
je 0x42e64c
push esi
call edi
cmp dword [ebp - 0x234], 0
je 0x42e664
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x234], 0
push ebx
call edi
mov eax, dword [ebp - 0x244]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x42f36e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
cmp dword [edi + 0x90], 0
jne 0x42f38a
mov eax, 0x80004005
jmp 0x42f495
push esi
push 0x4eb630
lea ecx, [ebp - 4]
call fcn.004044ee
mov ecx, dword [edi + 0x90]
lea eax, [ebp - 4]
push eax
call fcn.0046bbcc
lea eax, [ebp - 4]
push eax
call fcn.00468709
mov esi, dword [ebp + 8]
pop ecx
cmp dword [esi + 0x14], 8
jb 0x42f3bc
mov esi, dword [esi]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0041e1c3
push 0x4eb630
lea ecx, [ebp - 0xc]
call fcn.004044ee
mov ecx, dword [edi + 0x90]
lea eax, [ebp - 0xc]
push eax
call fcn.0046bff3
mov eax, dword [edi + 0x90]
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.00406c4d
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00468709
mov esi, dword [ebp + 0x10]
pop ecx
cmp dword [esi + 0x14], 8
pop ecx
jb 0x42f417
mov esi, dword [esi]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0041e1c3
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x42f456
cmp dword [eax + 0x14], 8
jb 0x42f440
mov eax, dword [eax]
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.00465e47
add esp, 0x14
jmp 0x42f46f
cmp dword [eax + 0x14], 8
jb 0x42f45e
mov eax, dword [eax]
push 0
push dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0046603a
add esp, 0x10
mov ecx, dword [ebp - 8]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov eax, esi
pop esi
pop edi
leave
ret 0xc
Function at 0x42f549
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x90], ebx
je 0x42f687
call fcn.0046855b
test eax, eax
je 0x42f687
mov eax, dword [edi + 0x90]
push esi
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.00406c4d
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00468709
mov esi, dword [ebp + 8]
pop ecx
cmp dword [esi + 0x14], 8
pop ecx
jb 0x42f59d
mov esi, dword [esi]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0041e1c3
push 0x4eb630
lea ecx, [ebp - 0xc]
call fcn.004044ee
mov ecx, dword [edi + 0x90]
lea eax, [ebp - 0xc]
push eax
call fcn.0046bff3
mov eax, dword [edi + 0x90]
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.00406c4d
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00468709
mov esi, dword [ebp + 0x10]
pop ecx
cmp dword [esi + 0x14], 8
pop ecx
jb 0x42f5f8
mov esi, dword [esi]
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0041e1c3
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [ebp + 0xc]
pop esi
je 0x42f637
cmp dword [eax + 0x14], 8
jb 0x42f622
mov eax, dword [eax]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.00465e47
add esp, 0x14
jmp 0x42f64f
cmp dword [eax + 0x14], 8
jb 0x42f63f
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0046603a
add esp, 0x10
test eax, eax
je 0x42f666
push 1
push ebx
push ebx
push dword [ebp - 4]
push str.taskbarpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
pop edi
mov eax, 0x80004005
pop ebx
leave
ret 0xc

Function at 0x42f94c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x42f993
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x4d3c88
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x18
Function at 0x42ff4e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42ff8f
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x42ffb4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x4d3c88
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x18

Function at 0x430500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x4eb630
lea ecx, [ebp - 4]
call fcn.004044ee
mov edi, 0x104
push edi
lea ecx, [ebp - 4]
call fcn.00404e61
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.004070cc
lea eax, [ebp - 4]
push eax
call fcn.00468709
mov edi, str.Licence_ksbrowser
push edi
call fcn.0040481a
pop ecx
pop ecx
push eax
push edi
lea ecx, [ebp - 4]
call fcn.0041e1c3
lea eax, [ebp - 4]
push eax
call fcn.00468709
push 1
push 0
push dword [ebp - 4]
call fcn.004661a4
mov ebx, 0x4bdcf8
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042367e
add esp, 0x1c
push dword [eax]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov edi, str.BINDATA
push edi
push str.business1.html
push 0xdf
push dword [ebp - 4]
mov ecx, esi
call fcn.004306ab
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042367e
add esp, 0xc
mov ecx, esi
push edi
push str.css1.css
push 0xe0
push dword [eax]
call fcn.004306ab
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042367e
add esp, 0xc
push edi
push str.Scrollbar.js
push 0xe1
push dword [eax]
mov ecx, esi
call fcn.004306ab
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042367e
add esp, 0xc
mov ecx, esi
push 0x4bdd50
push str.Scrollbar.png
push 0xe2
push dword [eax]
call fcn.004306ab
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042367e
add esp, 0xc
mov ecx, esi
push edi
push str.Scroller.js
push 0xe3
push dword [eax]
call fcn.004306ab
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov esi, str.business1.html
push esi
call fcn.0040481a
pop ecx
push eax
push esi
lea ecx, [ebp - 4]
call fcn.0041e1c3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00406bd9
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x4306ab
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4306d1
call fcn.004070f8
jmp 0x43075d
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x4eb630
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], eax
call fcn.004044ee
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push dword [ebp + 8]
push str._s_s
push eax
call fcn.00404994
mov esi, dword [ebp + 0x14]
add esp, 0x10
mov dword [ebp + 0xc], edi
push edi
push 0x80
push 2
push edi
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x430739
call fcn.004070f8
mov edi, eax
jmp 0x430752
push edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x4321fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x410], eax
xor eax, eax
push 0x60
push eax
push esi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x408], eax
call ebx
mov edi, eax
test edi, edi
jne 0x432266
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x432266
call fcn.004070f8
mov esi, eax
jmp 0x432307
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x432286
call fcn.004070f8
jmp 0x4322fa
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43227f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x4322ac
mov esi, 0x8007000e
jmp 0x4322fc
push eax
lea ecx, [ebp - 0x408]
call fcn.0043162b
cmp dword [ebp - 0x408], 0
je 0x4322a5
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x43227f
mov eax, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x418]
call fcn.004320c4
mov esi, eax
test edi, edi
je 0x432307
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x432320
lea ecx, [ebp - 0x408]
call fcn.00431989
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 0x10
Function at 0x432a19
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x432a2c
push 0xd
pop eax
jmp 0x432a70
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x432a3f
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x432a37
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x435242
Capabilities:
Delete file
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4eb630
lea ecx, [ebp - 0x4c]
call fcn.004045bb
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00404b04
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.0043582f
push 0x3c
push 0x4be4bc
lea ecx, [ebp - 0x4c]
call fcn.0041e2ec
mov esi, dword [ebp - 0x4c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4eb630
lea ecx, [ebp - 0x48]
call fcn.004045bb
push ebx
lea ecx, [ebp - 0x48]
call fcn.00404b04
push eax
xor ebx, ebx
push ebx
push ebx
push 0x10
push ebx
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x48]
call fcn.0043582f
push 0x13
push 0x4be4fc
lea ecx, [ebp - 0x48]
call fcn.0041e2ec
lea ecx, [ebp - 0x78]
call fcn.00435d92
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x78]
call fcn.00435db9
lea ecx, [ebp - 0x78]
call fcn.00435dc2
lea ecx, [ebp - 0x78]
call fcn.00435e73
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x78]
mov edi, eax
call fcn.00435e73
push eax
lea ecx, [ebp - 0x78]
call fcn.00435e77
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.00491b80
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0xf
pop eax
xor ecx, ecx
mov word [ebp - 0x8c], ax
mov dword [ebp - 0x88], ebx
inc ecx
or dword [ebp - 0x80], 0xffffffff
lea eax, [ebp - 0x54]
push eax
push ecx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call fcn.00435a69
lea eax, [ebp - 0x50]
push eax
call fcn.0043604d
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x14
push str.do_drag_drop_on_main
call ebx
and dword [ebp - 0x58], 0
lea eax, [ebp - 0x58]
push eax
push 5
push dword [ebp - 0x50]
mov byte [0x4ee740], 1
push dword [ebp - 0x54]
call dword [sym.imp.ole32.dll_DoDragDrop]
mov byte [0x4ee740], 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x44]
push str._x__x
push eax
call fcn.00493282
add esp, 0x10
lea eax, [ebp - 0x44]
push eax
call ebx
push str.finish_drag_drop_on_main
call ebx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
lea ecx, [ebp - 0x78]
call fcn.00435da5
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret