joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x40fa3b
cmp ebx, 8
jg 0x40fa3b
mov eax, 1
jmp 0x40fa3d
xor eax, eax
mov esi, dword [esp + 0x14]
push str.bad_pack_level
push eax
push esi
call fcn.0040e3b0
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x40fa74
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x442fc2]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x442fc0]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x442fc4]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x442fc6]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x40fad5
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x40fae1
cmp ebx, 8
jl 0x40fae1
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x40fb5a
cmp eax, 0xffffffff
je 0x40fb5a
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x40fb25
push esi
call fcn.0040fd70
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x40fb2d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x410df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x410dfb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x410efe
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x443010]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x443010]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x443010]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x443010]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x443010]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x443010]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x443010]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x443010]
xor eax, edx
inc ecx
dec edi
jne 0x410e16
pop edi
test esi, esi
je 0x410f20
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x443010]
xor eax, edx
inc ecx
dec esi
jne 0x410f02
pop esi
pop ebx
not eax
ret

Function at 0x410f30
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x443010]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x443010]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x411150
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x411172
mov eax, 0x200
pop esi
add esp, 0x44
ret
mov eax, dword [esp + 0x14]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x411185
mov ebp, 1
test al, 2
je 0x41118c
or ebp, 2
test al, 4
je 0x411193
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x41119d
or ebp, 0x10
test al, 0x20
je 0x4111a4
or ebp, 0x20
test ecx, ecx
je 0x4111b0
or ebp, 0x40000000
jmp 0x4111b6
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x4111c6
or ebp, 0x800000
push ebx
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x411275
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x60]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x58], 0x54ad
jne 0x411275
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x411275
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x41126f
cmp eax, 0x454e
je 0x41126f
cmp eax, 0x454c
je 0x41126f
cmp eax, 0x4550
jne 0x411275
or ebp, 0x400000
mov eax, dword [esp + 0x5c]
pop edi
test eax, eax
pop ebx
je 0x411281
mov dword [eax], ebp
mov eax, dword [esp + 0x58]
pop ebp
test eax, eax
je 0x411290
mov edx, dword [esp + 8]
mov dword [eax], edx
mov esi, dword [esp + 0x58]
test esi, esi
je 0x4112d9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.004110b0
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x34]
push edx
push eax
call fcn.004110b0
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.004110b0
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x411318
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
call fcn.004110e0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [esi], ecx
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x4114d0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x104
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x114]
mov al, byte [ebx + 0x2d]
push esi
mov esi, dword [esp + 0x114]
push edi
test al, al
mov edi, esi
je 0x411563
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x41150f
cmp dword [ebx + 0x40], ebp
jae 0x41150f
push eax
call fcn.00438bb8
add esp, 4
mov dword [ebx + 0x3c], 0
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x411529
lea eax, [ebp + ebp]
push eax
call fcn.00438b8f
add esp, 4
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], ebp
mov edi, dword [ebx + 0x3c]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
test ebp, ebp
jbe 0x411560
lea edi, [ebx + 0x30]
mov eax, dword [ebx + 0x3c]
mov cl, byte [esi + eax]
push ecx
push edi
call fcn.00410f90
mov edx, dword [ebx + 0x3c]
add esp, 8
mov byte [esi + edx], al
inc esi
cmp esi, ebp
jb 0x411545
mov edi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4115f8
mov eax, dword [ebx + 0x24]
mov esi, dword [ebx + 0x28]
lea edx, [eax + ebp]
cmp edx, esi
jb 0x4115c9
mov al, byte [0x454aa4]
mov ecx, 0x3f
mov byte [esp + 0x14], al
xor eax, eax
lea edi, [esp + 0x15]
push edx
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x1c]
push 0x451df8
push ecx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov dword [ebx + 0x14], 0x30000
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret 8
mov edx, dword [ebx + 0x20]
mov ecx, ebp
mov esi, edi
lea edi, [eax + edx]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x24]
pop edi
add eax, ebp
pop esi
mov dword [ebx + 0x24], eax
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 8
mov eax, dword [ebx + 4]
test eax, eax
je 0x411620
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
pop edi
pop esi
mov dword [ebx + 0x14], 0x1000000
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret 8
Function at 0x411ac0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x84]
test edx, edx
je 0x411b39
mov eax, dword [ebx + 0x8c]
mov ebp, dword [ebx + 0x88]
cmp eax, ebp
jae 0x411b8a
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x411aef
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x8c]
mov ecx, dword [ebx + 0x74]
mov eax, dword [ebx + 0x78]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x8c], edx
mov dword [ebx + 0x74], ecx
call fcn.00410df0
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x411b83
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411b8a
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x74]
add ecx, eax
push eax
mov eax, dword [ebx + 0x78]
push esi
push eax
mov dword [ebx + 0x74], ecx
call fcn.00410df0
add esp, 0xc
mov dword [ebx + 0x78], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0x14], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x4128b0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x440ef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov ecx, 0x454f50
call fcn.0041b020
push 0x200
lea ecx, [esp + 0x14]
call fcn.00413440
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0
call fcn.004136c0
push 0x451f4c
push str.C:winrun.log
mov ebx, eax
call fcn.00424722
mov esi, eax
add esp, 8
test esi, esi
je 0x41297b
lea eax, [esp + 0xc]
push eax
call fcn.00424735
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
call fcn.004244d8
push eax
push 0x451f38
lea edx, [esp + 0x2c]
push 0x4f
push edx
call fcn.00423c26
lea eax, [esp + 0x34]
push eax
push 0x451f34
push esi
call fcn.004246b5
mov edx, dword [esp + 0xa0]
lea ecx, [esp + 0xa4]
push ecx
push edx
push esi
call fcn.0042655e
push 0x451f30
push esi
call fcn.004246b5
push esi
call fcn.00424638
add esp, 0x3c
mov ecx, 0x80
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x80]
push eax
push ecx
push 0x1ff
push ebx
call fcn.0042650e
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
push ebx
call esi
push 0x451f30
call esi
mov ecx, 0x454f50
call fcn.0041b040
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.00413510
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret

Function at 0x412a10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret
Function at 0x412a30
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x440f1b
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebp
push esi
mov esi, dword [esp + 0x140]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x412c26
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x412c26
call edi
cmp eax, 3
je 0x412c26
call edi
cmp eax, 0x91
je 0x412a90
xor al, al
jmp 0x412c28
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xff
push ecx
lea ecx, [esp + 0x14]
call fcn.00413440
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], 0
call fcn.004136c0
mov ebp, eax
test ebp, ebp
jne 0x412ae0
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00413510
xor al, al
jmp 0x412c28
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x451f58
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x451f54
mov ebx, ecx
or ecx, 0xffffffff
add ebx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
push ebp
call fcn.004236e8
add esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x412bd3
cmp byte [esp + 0x34], 0x2e
je 0x412baf
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [esp + 0x24], 0x10
je 0x412ba9
call fcn.00412a30
add esp, 4
jmp 0x412baf
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.004237b5
add esp, 8
cmp eax, 0xffffffff
jne 0x412b6f
mov edx, dword [esp + 0x10]
push edx
call fcn.0042387d
add esp, 4
mov eax, dword [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
pop ebx
jne 0x412c12
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x412c12
call esi
cmp eax, 3
je 0x412c12
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00413510
xor al, al
jmp 0x412c28
lea ecx, [esp + 0x10]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00413510
mov al, 1
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x134
ret
Function at 0x412c40
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push esi
mov esi, dword [esp + 0x218]
push 0
push esi
call fcn.0042b2d7
add esp, 8
test eax, eax
jne 0x412c67
mov al, 1
pop esi
add esp, 0x210
ret
push ebx
push 0
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x412d7c
lea eax, [esp + 8]
push eax
push 0x4477a0
push 1
push 0
push 0x447790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x412d76
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x224]
test eax, eax
je 0x412cc3
mov ecx, dword [esp + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x228]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x230]
test eax, eax
je 0x412d07
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x238]
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x44]
pop edi
mov ecx, dword [esp + 0x238]
test ecx, ecx
je 0x412d1d
mov eax, dword [esp + 8]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x447780
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x412d6c
lea eax, [esp + 0x10]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x412d62
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, bl
pop ebx
pop esi
add esp, 0x210
ret
Function at 0x412f50
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x412f7d
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
test al, 0x10
push ebx
je 0x412f99
call fcn.00412a30
add esp, 4
and eax, 0xff
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x412fb2
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x412fc9
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
mov al, byte [0x454aa4]
push edi
mov byte [esp + 0x10], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov al, byte [esp + 0x10]
test al, al
jne 0x413036
mov edi, str.Temp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
cmp eax, 0xffffffff
jne 0x413036
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
call fcn.00425379
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push 0xb
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push eax
push ebx
call esi
test eax, eax
pop edi
je 0x41308f
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x4130a6
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
lea ecx, [esp + 0xc]
push 7
push ecx
push ebx
call esi
neg eax
sbb eax, eax
pop esi
pop ebp
pop ebx
neg eax
add esp, 0x104
ret
Function at 0x413af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
xor esi, esi
push edi
test eax, eax
mov ebp, ecx
je 0x413b09
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x413b3e
test esi, esi
je 0x413bcd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x413bc2
cmp ebx, 0x138a706
jae 0x413bc2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x413b74
test esi, esi
je 0x413bcd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x413b95
test esi, esi
je 0x413bcd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push ebx
mov ecx, ebp
call fcn.004135a0
mov edx, dword [ebp + 4]
mov eax, dword [ebp + 8]
push edx
push edi
push eax
call fcn.00425810
add esp, 0xc
test esi, esi
je 0x413bb9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
test esi, esi
je 0x413bcd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
Function at 0x413db0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ebx, 1
mov ecx, edi
mov dword [esp + 0x24], 2
shl ebx, cl
cmp edi, 1
jle 0x413dd2
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, str.GIF87a
jl 0x413de4
mov eax, str.GIF89a
mov esi, dword [esp + 0x14]
push esi
push 6
push 1
push eax
call fcn.00413fb0
mov ebp, dword [esp + 0x3c]
push esi
mov eax, dword [ebp]
push eax
call fcn.00413ff0
mov ecx, dword [ebp + 4]
push esi
push ecx
call fcn.00413ff0
mov edx, edi
push esi
shl edx, 5
sub edx, 0x20
dec edi
or edx, edi
or dl, 0x80
push edx
call fcn.004268ab
mov eax, dword [esp + 0x44]
push esi
push eax
call fcn.004268ab
push esi
push 0
call fcn.004268ab
add esp, 0x38
test ebx, ebx
jle 0x413e6a
mov edi, dword [esp + 0x28]
xor ecx, ecx
push esi
mov cl, byte [edi]
push ecx
call fcn.004268ab
xor edx, edx
push esi
mov dl, byte [edi + 1]
push edx
call fcn.004268ab
xor eax, eax
push esi
mov al, byte [edi + 2]
push eax
call fcn.004268ab
add esp, 0x18
add edi, 3
dec ebx
jne 0x413e3e
mov edi, dword [esp + 0x20]
test edi, edi
jl 0x413eb7
push esi
push 0x21
call fcn.004268ab
push esi
push 0xf9
call fcn.004268ab
push esi
push 4
call fcn.004268ab
push esi
push 1
call fcn.004268ab
push esi
push 0
call fcn.004268ab
push esi
push 0
call fcn.004268ab
push esi
push edi
call fcn.004268ab
push esi
push 0
call fcn.004268ab
add esp, 0x40
mov eax, dword [0x4521f8]
test eax, eax
je 0x413f15
cmp byte [eax], 0
je 0x413f15
push esi
push 0x21
call fcn.004268ab
push esi
push 0xfe
call fcn.004268ab
mov edi, dword [0x4521f8]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call fcn.004268ab
mov eax, dword [0x4521f8]
add esp, 0x18
movsx ecx, byte [eax]
push esi
push ecx
call fcn.004268ab
mov eax, dword [0x4521f8]
add esp, 8
mov dl, byte [eax]
inc eax
test dl, dl
mov dword [0x4521f8], eax
jne 0x413ef7
push esi
push 0x2c
call fcn.004268ab
push esi
push 0
call fcn.00413ff0
push esi
push 0
call fcn.00413ff0
mov eax, dword [ebp]
push esi
push eax
call fcn.00413ff0
mov ecx, dword [ebp + 4]
push esi
push ecx
call fcn.00413ff0
mov ebx, dword [esp + 0x40]
add esp, 0x28
test ebx, ebx
push esi
je 0x413f51
push 0x40
jmp 0x413f53
push 0
call fcn.004268ab
mov edi, dword [esp + 0x2c]
add esp, 8
push esi
push edi
call fcn.004268ab
add esp, 8
cmp eax, 0xffffffff
jne 0x413f82
push str.Writing_output
call fcn.00426820
add esp, 4
push 1
call fcn.0042672d
push ebx
push ebp
inc edi
push esi
push edi
call fcn.0041b420
push esi
push 0
call fcn.004268ab
push esi
push 0x3b
call fcn.004268ab
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x413fb0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
call fcn.004256c8
add esp, 0x10
cmp eax, esi
pop esi
je 0x413fe6
push str.Write_error:
call fcn.00426820
add esp, 4
push 1
call fcn.0042672d
xor eax, eax
ret