joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, dword [esi + 0x124]
sub eax, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
je 0x4b24a2
dec eax
je 0x4b23a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
mov ecx, dword [esi + 0x20]
push esi
mov edi, ecx
lea eax, [esp + 0x20]
and ecx, 0x1f
mov ebx, 1
push 1
push eax
shr edi, 5
shl ebx, cl
call fcn.004b18f0
test eax, eax
mov ebp, dword [esp + 0x124]
je 0x4b23e4
push esi
push 1
push ebp
call fcn.004b18f0
test eax, eax
je 0x4b23e4
mov eax, 1
jmp 0x4b23e6
xor eax, eax
mov ecx, dword [esp + 0x10]
lea edi, [esp + edi*4 + 0x1c]
cmp ecx, 1
mov dword [edi], ebx
je 0x4b2457
dec ecx
mov dword [esp + 0x10], ecx
test eax, eax
je 0x4b2444
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.004b1c70
test eax, eax
je 0x4b2444
push esi
push ebp
push ebp
push ebp
call fcn.004b1c70
test eax, eax
je 0x4b2444
mov ecx, dword [esp + 0x120]
push esi
push ebp
push ebp
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.004b1ce0
test eax, eax
je 0x4b2444
mov eax, 1
jmp 0x4b2446
xor eax, eax
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
xor edx, ebx
dec ecx
mov dword [edi], edx
mov dword [esp + 0x10], ecx
jne 0x4b23fa
test eax, eax
je 0x4b2397
lea eax, [esp + 0x1c]
push esi
push eax
push ebp
push ebp
push ebp
call fcn.004b1ce0
test eax, eax
je 0x4b2397
mov ecx, dword [esp + 0x120]
push esi
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.004b19b0
test eax, eax
je 0x4b2397
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret 0xc
xor esi, esi
xor edx, edx
test edi, edi
mov edi, dword [esp + 0x124]
je 0x4b24f9
mov ebx, dword [esp + 0x120]
mov eax, edx
shr eax, 5
mov ecx, edx
mov ebx, dword [ebx + eax*4]
and ecx, 0x1f
shr ebx, cl
mov ebp, dword [edi + eax*4]
and ebx, 1
xor esi, ebx
mov ebx, esi
not ebx
and ebx, 1
shl ebx, cl
not ebx
and ebx, ebp
mov ebp, esi
and ebp, 1
shl ebp, cl
or ebx, ebp
inc edx
mov dword [edi + eax*4], ebx
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x4b24b1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + ebx*4 - 4]
xor eax, eax
test esi, esi
sete al
shl edx, cl
shr edx, cl
mov dword [edi + ebx*4 - 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc

Function at 0x4b3720
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov eax, dword [esp + 0x18]
sub eax, 0x182
je 0x4b3754
sub eax, 0x64
je 0x4b3754
sub eax, 0x64
cmp word [esp + 0x20], 6
jb 0x4b3754
push 0xc
call fcn.004b8fb0
add esp, 0x24
ret
push 4
call fcn.004b8fb0
add esp, 0x24
ret
Function at 0x4b8500
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
sub esp, 0x51c
lea edx, [eax + 0x1f]
push ebx
push ebp
lea ebp, [ecx + 0x1f]
push esi
shr edx, 5
shr ebp, 5
cmp edx, ebp
mov ebx, edx
ja 0x4b8525
mov ebx, ebp
mov ecx, dword [esp + 0x53c]
xor esi, esi
xor eax, eax
cmp ecx, esi
setne al
cmp ebx, esi
mov dword [esp + 0xc], eax
je 0x4b872c
cmp ebx, 0x40
ja 0x4b872c
lea eax, [esp + 0x324]
mov ecx, ebx
mov dword [eax - 0x204], esi
mov dword [eax], esi
mov dword [eax - 0x104], esi
mov dword [eax + 0x100], esi
add eax, 4
dec ecx
jne 0x4b8553
mov ecx, dword [esp + 0x120]
mov esi, dword [esp + 0x52c]
xor ecx, 1
push edi
mov dword [esp + 0x124], ecx
mov ecx, edx
lea edi, [esp + 0x224]
push edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x53c]
lea ecx, [ebp*4]
mov dword [esp + 0x24], ecx
mov eax, ecx
lea edi, [esp + 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x534]
push ecx
call fcn.004b7520
push ebp
mov edx, dword [esp + 0x53c]
mov dword [esp + 0x328], eax
push edx
call fcn.004b7520
xor edx, edx
mov dword [esp + 0x528], eax
mov eax, edx
mov dword [esp + 0x18], edx
shl eax, 7
add eax, edx
shl eax, 2
mov ecx, eax
neg ecx
mov esi, dword [esp + ecx + 0x528]
test esi, esi
je 0x4b86ce
lea esi, [esp + eax + 0x124]
lea ebp, [esp + ecx + 0x328]
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x200]
mov ecx, dword [ebp + 0x200]
cmp eax, ecx
jb 0x4b86c0
sub eax, ecx
push ebx
mov edi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [ebp + 0x100]
push edi
push eax
call fcn.004b7310
lea edx, [esi + 0x100]
lea ecx, [esp + 0x24]
mov eax, edx
mov dword [esp + 0x14], ebx
mov ebp, dword [ecx]
add ecx, 4
xor dword [eax], ebp
mov ebp, dword [esp + 0x14]
add eax, 4
dec ebp
mov dword [esp + 0x14], ebp
jne 0x4b8652
push ebx
push edx
call fcn.004b7520
mov dword [esi + 0x200], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b86a4
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ebx
push ecx
push edi
push ebp
call fcn.004b7310
lea ecx, [esp + 0x24]
mov eax, esi
sub ecx, esi
mov edx, ebx
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x4b8697
jmp 0x4b86a8
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0x200]
mov ecx, dword [ebp + 0x200]
cmp eax, ecx
jae 0x4b862b
mov edx, dword [esp + 0x18]
mov eax, 1
sub eax, edx
mov edx, eax
jmp 0x4b85e4
mov edi, dword [esp + 0x544]
test edi, edi
je 0x4b86eb
mov eax, edx
mov ecx, ebx
shl eax, 7
add eax, edx
lea esi, [esp + eax*4 + 0x224]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b871a
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x540]
mov eax, edx
shl eax, 7
add eax, edx
mov edx, ecx
shr ecx, 2
lea esi, [esp + eax*4 + 0x124]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x51c
ret 0x18
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x51c
ret 0x18
Function at 0x4bb99f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x508114], 0
je 0x4bb9b8
mov eax, dword [0x4dd780]
leave
ret
push edi
push esi
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x4bba7a
xor eax, eax
cmp dword [ebp - 0x84], 2
sete al
test eax, eax
mov dword [0x4dd780], eax
je 0x4bba49
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x4bba7a
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.NtQuerySystemInformation
push edi
call esi
test eax, eax
mov dword [0x5080fc], eax
je 0x4bba2d
mov dword [0x4dd778], 0x4000
push str.NtOpenFile
push edi
call esi
push str.RtlInitUnicodeString
push edi
mov dword [0x508100], eax
call esi
mov dword [0x508104], eax
jmp 0x4bba7a
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4bba7a
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4c1060
push edi
call esi
push str.GetMessageTime
push edi
mov dword [0x508108], eax
call esi
mov dword [0x50810c], eax
mov eax, dword [0x4dd780]
pop esi
mov dword [0x508114], 1
pop edi
leave
ret

Function at 0x4bd195
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.004bd1d8
test eax, eax
je 0x4bd1d4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push str.Seed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8

Function at 0x4bd210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x4bd25f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x4bd234
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x4bd271
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x4bd285
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x4bd2cb
xor ecx, ecx
cmp edi, 0x100
jb 0x4bd2a8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4bd570
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x53e1e7
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
xor edx, ebx
add ebx, 4
add eax, edx
dec ecx
jne 0x53e1f4
pop ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x826030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x828b68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x828b68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x828b6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x828b70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x828b78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x828b74], eax
mov eax, dword [0x828b74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x828b78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x828b78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x828b6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x828b70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x828b68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x826030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x300655c]
push ebx
mov ebx, dword [0x3006280]
push esi
mov esi, dword [0x826f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push 0x823e78
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x300655c]
mov dword [0x828d0c], esi
cmp eax, 0x114e
jne 0x40afbb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x300655c]
cmp eax, 0x2f
jne 0x40afdb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x4018f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00401790
add esp, 8
xor ecx, ecx
test eax, eax
jle 0x401938
push ebx
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
add bl, 0x38
mov byte [ecx + edx], bl
mov edx, dword [esp + 4]
mov bl, byte [ecx + edx]
xor bl, 0x7b
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x401912
mov eax, dword [esp + 4]
pop ebx
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401c64
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x407164
push 0x407180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x407188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x407464], 0
mov dword [ebp - 8], eax
jne 0x401e1a
and byte [ebp - 0xd8], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push str.3d3d3R3m1h3c0eQJERYQFxRD
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jmp loc.0040b000
push 0x50
mov word [ebp - 0x18], 2
call dword [ebp - 4]
mov word [ebp - 0x16], ax
push str.www.baidu.com
call fcn.00403b20
pop ecx
mov dword [ebp - 0x14], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [ebp - 0x18]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401e60
push esi
call dword [ebp - 8]
or eax, 0xffffffff
jmp 0x401e62
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x405a12
pop dword [ebp - 4]
mov eax, 0x983ddd75
add eax, 0x68027c9d
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x306b5248
add dword [ebp - 0x14], 0x1de6f303
mov dword [ebp - 0x10], 0x8e371408
sub dword [ebp - 0x10], 0x5c03c7c3
mov dword [ebp - 0xc], 0x7deb4768
sub dword [ebp - 0xc], 0x319f033a
mov dword [ebp - 8], 0xe426607d
add dword [ebp - 8], 0x1bd99f83
lea eax, [ebp - 0x14]
push eax
mov eax, 0xebf2c990
add eax, 0x144db774
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xd9f3783d
sub dword [ebp - 0x14], 0x65810ee7
mov dword [ebp - 0x10], 0xdfdea392
sub dword [ebp - 0x10], 0x9e72421d
mov dword [ebp - 0xc], 0xf70b9207
sub dword [ebp - 0xc], 0x939c259b
mov dword [ebp - 8], 0xd9b95e83
sub dword [ebp - 8], 0xd9b95e83
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x3310b8d2
add eax, 0xcd2fc82e
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x39fd0
push 0
call eax
mov ecx, 0x774010a9
add ecx, 0x88c0435f
mov esi, eax
mov edi, 0xa135f1f0
sub edi, 0xa0ef0df0
add edi, dword [ebp - 4]
mov edx, 0x1c2d7e69
sub edx, 0x673f12fa
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 0xdd94dc00
sub esi, 0xdd94dbfc
add edi, 0xdb5a25cb
add edi, 0x24a5da39
loop 0x405b34
add eax, 0x519f403b
sub eax, 0x519dfd48
xor ebx, ebx
add ebx, eax
add eax, 0x78e59e79
add eax, 0x871a618c
mov ecx, 0xd9f011c6
add ecx, 0x264fee3a
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x402390
Capabilities:
Create thread
Hide graphical window
Terminate process
Terminate thread

Disassembly:
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x34
push 0x404170
push str.WARNING____r_nIt_doesnt_delete_all_your_data_r_nBe_fine___
push 0
call esi
cmp eax, 7
je 0x40259c
push 0x34
push 0x4041f0
push 0x404240
push 0
call esi
cmp eax, 7
je 0x40259c
push 0
push 0
push 0
push 0x4012e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401b80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401d90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401f90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x402190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100048e0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov dword [ebp - 0x21c], 0
test byte [0x10016018], 8
jne 0x10004af0
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x10018230
mov eax, dword [0x1002b010]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], eax
mov eax, dword [0x1002b010]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockResource]
sub esp, 4
mov esi, eax
mov dword [esp + 4], ebx
mov eax, dword [0x1002b010]
lea ebx, [ebp - 0x214]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
mov edi, eax
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov edx, ebx
sub esp, 8
cmp word [ebp - 0x214], 0
je 0x10004999
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x10004990
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.winevulkan.json]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100049a0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edx, eax
cmp eax, 0xffffffff
je 0x10004b19
lea eax, [ebp - 0x220]
mov dword [esp], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [ebp - 0x224], edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x224]
sub esp, 0x14
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x218]
sub esp, 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareKhronosVulkanDrivers
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
je 0x10004aa0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x21c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x218]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x218]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x10004a8e
mov dword [esp + 0xc], 0x1001822c
mov dword [esp + 8], str.DllRegisterServer
mov dword [esp + 4], 0x10016018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10004903
test byte [0x10016018], 2
jne 0x10004b2c
mov eax, 0x8000ffff
jmp 0x10004a90
mov dword [esp + 0xc], str.Unable_to_create_JSON_manifest._n
mov dword [esp + 8], str.DllRegisterServer
mov dword [esp + 4], 0x10016018
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10004b22