joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405425
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004056e3
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405464
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423748], eax
jmp 0x4055ee
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40547e
test eax, eax
je 0x40559c
test bl, 2
je 0x40559c
mov esi, 0x420cc8
push edi
push esi
call fcn.00405b65
cmp dword [ebp + 8], 0
je 0x40549d
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054a3
push edi
call fcn.0040563c
cmp byte [edi], 0
jne 0x4054b1
cmp byte [0x420cc8], 0x5c
jne 0x4054bc
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405592
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405620
cmp byte [eax], 0
je 0x405502
cmp byte [ebp - 0x1c], 0
je 0x405502
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405518
mov al, byte [esi + 1]
test al, al
je 0x405571
cmp al, 0x2e
jne 0x405518
cmp byte [esi + 2], 0
je 0x405571
push esi
push ebx
call fcn.00405b65
test byte [ebp - 0x14c], 0x10
je 0x40553d
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405571
push dword [ebp + 0xc]
push edi
call fcn.00405425
jmp 0x405571
push dword [ebp - 4]
push edi
call fcn.004053dd
test eax, eax
jne 0x405569
cmp dword [ebp - 4], eax
je 0x405561
push edi
push 0xfffffffffffffff1
call fcn.00404e50
push 0
push edi
call fcn.00405a19
jmp 0x405571
inc dword [0x423748]
jmp 0x405571
push edi
push 0xfffffffffffffff2
call fcn.00404e50
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054e0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40559c
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4055ee
cmp dword [ebp - 0xc], esi
jne 0x4055b0
inc dword [0x423748]
jmp 0x4055ee
push edi
call fcn.00405e69
test eax, eax
je 0x4055ee
push edi
call fcn.004055f5
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004053dd
test eax, eax
jne 0x4055e6
cmp dword [ebp - 4], esi
je 0x4055a8
push edi
push 0xfffffffffffffff1
call fcn.00404e50
push esi
push edi
call fcn.00405a19
jmp 0x4055ee
push edi
push 0xffffffffffffffe5
call fcn.00404e50
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4056e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4210c8
push esi
call fcn.00405b65
push esi
call fcn.0040568e
mov edi, eax
test edi, edi
jne 0x405704
xor eax, eax
jmp 0x405756
push edi
call fcn.00405dd0
test byte [0x4236d8], 0x80
je 0x40571d
mov al, byte [edi]
test al, al
je 0x405700
cmp al, 0x5c
je 0x405700
sub edi, esi
jmp 0x405735
call fcn.00405e69
test eax, eax
je 0x40572f
test byte [eax], 0x10
je 0x405700
push esi
call fcn.0040563c
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405721
call fcn.004055f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057d1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4057f0
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x4057f6
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405825
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409368]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40586a
test edi, edi
jne 0x405830
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405864
Function at 0x40589d
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x421a50
push 0x409384
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x4058ec
push 1
push 0
push esi
call fcn.004057f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405a13
cmp eax, ebx
jg 0x405a13
mov esi, 0x421e50
push ebx
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405a13
cmp eax, ebx
jg 0x405a13
push esi
push edi
push str._s_s_r_n
push 0x421650
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x4236d0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b87
push 4
push 0xc0000000
push esi
call fcn.004057f6
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405a13
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0c
push edi
push esi
push ebp
call fcn.0040586e
test eax, eax
je 0x405a0c
push str._Rename__r_n
push esi
call fcn.0040575b
test eax, eax
jne 0x4059a2
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4059d7
add eax, 0xa
push 0x40936c
push eax
call fcn.0040575b
mov ebp, eax
test ebp, ebp
je 0x4059d3
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4059c4
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4059be
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x4059d9
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x421650
push eax
call fcn.004057b1
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405a4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405abd
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405aac
cmp dword [ebp + 0x14], 1
je 0x405aae
cmp dword [ebp + 0x14], 2
je 0x405aae
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405f02
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422254], 0
push esi
jne 0x405f39
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f13
mov dword [ecx*4 + 0x422250], eax
inc ecx
cmp ecx, 0x100
jl 0x405f0e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f6a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422250]
xor eax, esi
inc ecx
dec edx
jne 0x405f4c
pop edi
not eax
pop esi
ret 0xc
Function at 0x4125cd
Capabilities:
Encode data using xor

Disassembly:
shr byte [esi + 0x1a], 1
xchg esp, eax
std
mov bh, byte [edx]
leave
xchg ecx, eax
sti
insb byte es:[edi], dx
in eax, 0xb0
test eax, 0xe29d4bfb
cmp edi, dword [esp + edx - 0x58506398]
sbb dh, byte [edi + 0xd]
lahf
cmpsd dword [esi], dword es:[edi]
cmp eax, dword [esp + ebp*4 + 0x4cc0250a]
xor dl, byte [ebp + 0x2e6f908e]
pop ss
push 0x9d6dd688
salc
insd dword es:[edi], dx
popfd
push esp
sbb al, 0x58
mov ecx, 0x1eaa3d13
popal
or byte [eax], cl
pop ss
scasd eax, dword es:[edi]
arpl word [edi - 0x638a23ff], si
aaa
sub ebp, dword [ebx + 0x2199919a]
stc
mov bl, 0xbf
insb byte es:[edi], dx
sub dh, byte [edi - 0x7b]
adc eax, 0xd3cda81
or al, bl
clc
mov ah, 0xc
xchg ecx, eax
sbb al, 0x9d
bound esi, qword [edi - 0x56]
fld dword [edx + ebp + 0x195f958e]
jge 0x41263a
inc dword [ecx]
or eax, esi
popfd
mov bl, byte [esi]
fisub dword [ecx]
jp 0x412674
add dword [ecx], ecx
invalid
jmp 0x4125fc
arpl word [esi - 0x5e], sp
imul ebp, ebp, 2
mov ebx, 0x782ca5fd
sub eax, 0xa9cd63db
or ch, byte fs:[ecx - 0x53e6aa98]
in al, 0xc2
add eax, 0x63c20a6f
cmp ebx, ebx
das
arpl word [ecx], di
fld xword [edi]
jp 0x4126a0
cmp sp, word cs:[ebp + ecx - 0x31]
aas
mov byte [0x8d7d8e59], al
and eax, 0xe8bc10b9
ja 0x4126f4
invalid
nop
outsb dx, byte gs:[esi]
pop edx
sub eax, dword [ebp - 0x1e83aa63]
test eax, 0xbf07c7cc
dec ebx
mov esi, 0xd26f0c58
rcl bh, cl
je 0x4126ba
mov byte [edx + 0x53], cl
inc ecx
jno 0x4126db
pop eax
xor dword [ebx - 0x53f1a3e4], ebx
dec edx
xchg esi, eax
push esp
push ds
add al, 0xed
arpl word [esi - 0x2e], bx
jo 0x412691
sub eax, 0x3f8432d7
in eax, dx
mov ah, 0x1a
and bl, byte [esi - 0x3a56655f]
mov ebx, 0x23654c2a
scasb al, byte es:[edi]
mov ecx, 0x714ff698
cwde
xor eax, 0x30245f4f
fstp xword [edx + 0x74]
ffree st(6)
fsubp st(0)
js 0x412735
push es
movsd dword es:[di], dword [si]
rcl dword [esi + 0x3e34769f], cl
mov eax, dword [0x16cf378a]
xchg ebp, ecx
pop ebp
outsb dx, byte [esi]
xchg ebp, eax
mov dl, 0xb2
add dword [ebx + 0x25], edx
les edx, [edx + edx*2]
rcl dword [ebp + ecx*8 - 0x74c35a2a], 0x32
inc ecx
pop ds
cmp al, 0x8b
xor al, byte [ecx + 0x1f]
mov ebx, 0xb4bd278b
ficomp word [edx + edx*4 - 0x49caa24f]
xchg esp, eax
or byte [edx - 0x71554287], 0xdf
mov al, byte [0xfe836dea]
pop ebp
in al, 0x76
std
jnp 0x412723
push cs
ja 0x41276e
pop ebx
inc ecx
je 0x412716
sbb dword [ebx], esp
add cl, byte [esp + eax*8 + 0x6b]
xchg ebp, eax
in al, 0x4f
iretd
mov ch, 0xb3
ret

Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417c36
mov eax, dword [0x6357e0]
test eax, eax
je 0x417c2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
test dword [ebx - 0x7c057427], 0xaef2ffc9
Function at 0x43bb93
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xd4
ficom dword [edx + ebx]
mov cl, 0xbc
or dword [ebx + ebx + 0x72], esi
outsd dx, dword [esi]
adc bl, byte [esi]
mov esp, 0x16d1ecb1
xlatb
retf 0x7241
mov eax, dword [0x14bcb1ba]
pop edx
pop ebx
mov edx, 0x64b1bcb6
pop ecx
mov ecx, 0x66b21e4c
mov esi, 0x2dc84ca4
cmp dword [edx + 0x3ec4b5da], ecx
push esp
mov esi, 0x24b37979
jo 0x43bb76
fimul dword [eax + 0x3d]
lds edx, [ecx]
mov cl, 0x45
mov cl, 0x83
xor al, 0x28
in al, dx
mov ebp, 0xdafc8071
invalid

Function at 0x4455bc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, 0xc952c8e7
nop
cmp dh, ch
xchg ecx, eax
out dx, al
xchg ebp, eax
pop es
je 0x4455c8
dec edi
out dx, al
pop ebp
test byte [edi], dh
pushal
rol dword [edi + edi*2], cl
and ch, byte [edx - 0x450877eb]
or eax, esp
dec eax
nop
dec ebp
ljmp 0x569
insb byte es:[edi], dx
dec esp
and eax, 0x727779a3
mov bh, 0x90
cli
adc dh, byte [esi]
xlatb
dec esi
neg ebp
jg 0x44556a
dec ebp
jnp 0x4455ba
outsb dx, byte [esi]
les ebp, [ecx - 0xd]
xor ch, byte [ebp + 0x3fd525b7]
aas
xchg edi, esp
or eax, 0xd92b7b5b
loopne 0x4455bf
js 0x4455a9
out 0x44, eax
mov edi, 0xc9510370
mov al, byte [0x9c4aba3a]
add eax, dword [edx + 6]
mov byte [ebx + 0x1c96b812], dh
mov ebx, 0xaa0abbcc
aaa
or ebx, dword [ebx]
movsd dword es:[edi], dword [esi]
in al, 0x93
pop es
invalid

Function at 0x48551a
Capabilities:
Encode data using xor

Disassembly:
rol dl, 0xcf
fst dword [0x72c4071e]
dec dword [esi - 0x2a]
call 0x360fe0cb
dec ebp
xchg esi, eax
por mm2, mm1
sub al, 0x3d
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
mov dword [esi - 0xb], edx
pop ss
out 0xb8, al
add eax, 0x599b59d1
push cs
aaa
pop ebp
lea eax, [0x1879577a]
test byte [eax - 0x1b9434b7], 0x3f
test dword [edx - 0x41854be2], esp
neg byte [ebx - 0x10af79b7]
sub edx, 0x8fbd7fe1
out dx, al
daa
sti
invalid
Function at 0x628d85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323b8
cmp edx, dword [eax]
je 0x628da7
add eax, 8
inc ecx
cmp eax, 0x632448
jl 0x628d98
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323b8]
jne 0x628ed5
mov eax, dword [0x636d8c]
cmp eax, 1
je 0x628eaf
test eax, eax
jne 0x628dd8
cmp dword [0x6322e0], 1
je 0x628eaf
cmp edx, 0xfc
je 0x628ed5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628e0f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629770
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629c00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628e52
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629c00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea5c
push edi
call fcn.0062bad0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629770
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629780
lea eax, [ebp - 0xa0]
push 0x62ea3c
push eax
call fcn.00629780
push dword [esi + 0x6323bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629780
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062ba44
add esp, 0x2c
pop edi
jmp 0x628ed5
lea eax, [ebp + 8]
lea esi, [esi + 0x6323bc]
push 0
push eax
push dword [esi]
call fcn.00629c00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401129
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401164
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401160
lea ebx, [ebx]
cmp esi, eax
jae 0x401164
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401150
cmp esi, eax
jb 0x40116a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43dd3b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x450610]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ebx, [esi + 4]
call fcn.0041a128
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x402ef9
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
push edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
push 0x44196f
mov ecx, ebx
mov dword [esp + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.00401a90
or eax, 0xffffffff
push edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esi + 8], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.0042900c
push edi
call fcn.0042900c
push edi
call fcn.0042900c
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x404050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43df86
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x450610]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.CIRDeleteFiles.0
lea ebx, [esi + 4]
call fcn.0041a128
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4040a0
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x20], edi
lea ebp, [esi + 0x2c]
call fcn.0041a128
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4040cf
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 1
call fcn.00403d00
mov ecx, ebx
call fcn.004015d0
mov ebx, 1
mov ecx, ebp
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
call fcn.004015d0
mov dword [esi + 0x20], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x24], 0x32
mov dword [esi + 0x58], ebx
mov dword [esi + 0x28], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x404140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43dfc6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x450610]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CIRDeleteFiles.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 1
call fcn.00401ee0
mov eax, dword [esi + 0x2c]
sub eax, 0x10
mov byte [esp + 0x14], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esi + 4]
sub esi, 0x10
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041c9
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x406a60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp method.CDialog.virtual_332
push 0x24
mov eax, 0x43fb43
call fcn.0042cb79
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0041a01a
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x41d129
call fcn.0041a01a
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x41d13a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x41d147
or eax, 0xffffffff
jmp 0x41d2a4
mov ecx, esi
call fcn.0041cc54
mov dword [ebp - 0x14], eax
call fcn.00421215
and dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x14], ebx
je 0x41d1c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x41d1c5
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41d1c5
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041c115
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x41d1c5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x128]
test eax, eax
je 0x41d1c5
mov ecx, ebx
call fcn.0041b0ba
test eax, eax
je 0x41d1c5
push 0
mov ecx, ebx
call fcn.0041b0d5
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.00422c4d
push dword [ebp - 0x14]
call fcn.0042115c
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041cf28
xor edi, edi
cmp eax, edi
je 0x41d223
test byte [esi + 0x3c], 0x10
je 0x41d20d
push 4
pop edi
mov ecx, esi
call fcn.0041afec
test eax, 0x100
je 0x41d203
push 5
pop edi
push edi
mov ecx, esi
call fcn.00420d19
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x41d223
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041b161
or dword [ebp - 4], 0xffffffff
jmp 0x41d24e
cmp dword [ebp - 0x28], edi
je 0x41d25c
push 1
mov ecx, ebx
call fcn.0041b0d5
cmp dword [ebp - 0x2c], edi
je 0x41d26c
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41d285
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x41d285
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0041cc90
cmp dword [esi + 0x58], edi
je 0x41d2a1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0042cc1e
ret
Function at 0x408d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43e5ae
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x450610]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 2
call fcn.00407400
cmp dword [esi + 0x2c], 0
lea edi, [esi + 0x2c]
mov byte [esp + 0x18], 1
je 0x408d8e
mov ecx, edi
call fcn.00407f80
mov dword [edi], 0
mov eax, dword [esi + 4]
sub eax, 0x10
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408db8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
sub eax, 0x10
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408dde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret