joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ebe
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
mov esi, ecx
push esi
push 0x42251c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00422b05
test al, al
je 0x422f4a
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x422f4a
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 0x10
jb 0x422ef3
mov eax, dword [eax + 4]
jmp 0x422ef6
add eax, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x18], 0x10
jb 0x422f0c
mov eax, dword [eax + 4]
jmp 0x422f0f
add eax, 4
push eax
push 0x40f
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov al, 1
jmp 0x422f4c
xor al, al
pop esi
pop ebp
ret 0x14

Function at 0x423365
Capabilities:
Get graphical window text

Disassembly:
push 0x18
mov eax, 0x443f18
call fcn.004298b3
push 0x40b
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xe
push eax
mov dword [ebp - 0x14], eax
call esi
lea edi, [eax + 1]
lea eax, [ebp - 0xd]
push eax
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 0xd], 0
call fcn.004230e5
push dword [ebp - 0x20]
and dword [ebp - 4], 0
push edi
push 0xd
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
call fcn.0040898b
lea ecx, [ebp - 0x24]
call fcn.00409751
call fcn.0042999f
ret 4

Function at 0x4234db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, dword [esi]
jne 0x4234f6
test ebx, ebx
jbe 0x4234f6
push 0x57
pop eax
jmp 0x423570
movzx eax, word [ebp + 0xc]
push edi
push eax
push dword [ebp + 0x10]
push dword [0x44b7d8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x42356a
push edi
push dword [0x44b7d8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x18], eax
test eax, eax
je 0x42356a
push edi
push dword [0x44b7d8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jbe 0x42353c
mov dword [esi], edi
jmp 0x423563
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42355a
push edi
push eax
push dword [ebp + 0x14]
call fcn.0042ad10
add esp, 0xc
xor eax, eax
jmp 0x42356f
xor eax, eax
inc eax
cmp dword [esi], eax
mov dword [esi], eax
jae 0x423556
mov eax, 0xea
jmp 0x42356f
mov eax, 0x716
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4235e2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004299e0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x423626
xor al, al
leave
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x423634
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x42363d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
leave
ret

Function at 0x4238ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4238d6
cmp byte [eax], 0
je 0x4238d6
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4238d2
test al, 0x10
jne 0x4238d2
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4238df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x423909
cmp byte [eax], 0
je 0x423909
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x423905
test al, 0x10
jbe 0x423905
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x424683
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44a170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.004299e0
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.004299e0
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, ebx
je 0x42474d
cmp eax, esi
jae 0x42474d
lea eax, [ebp - 0x108]
push eax
push ebx
push 0x403e78
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x42474d
lea eax, [ebp - 0x108]
push eax
call fcn.004238ac
pop ecx
test al, al
je 0x424734
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
call fcn.004238ac
pop ecx
test al, al
jne 0x42474d
lea eax, [ebp - 0x108]
push eax
mov ecx, edi
call fcn.0040898b
push edi
call fcn.00424550
pop ecx
mov al, 1
jmp 0x42474f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042989f
leave
ret
Function at 0x424c8a
Capabilities:
Create directory

Disassembly:
push 0x58
mov eax, 0x443cef
call fcn.00429926
mov edx, dword [ebp + 8]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424c9e
sub eax, esi
cmp eax, 0x104
jbe 0x424cb6
xor al, al
call fcn.004299b8
ret
push edx
lea ecx, [ebp - 0x48]
call fcn.0040a2a8
xor esi, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.00408032
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 1
jae 0x424cdc
lea eax, [ebp - 0x44]
push esi
push esi
push esi
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.00424763
lea eax, [ebp - 0x2c]
push eax
call fcn.00424550
mov eax, dword [ebp - 0x28]
add esp, 0x18
cmp dword [ebp - 0x14], 0x10
jae 0x424d01
lea eax, [ebp - 0x28]
push eax
call fcn.004238df
pop ecx
test al, al
jne 0x424d24
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407cc4
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00407cc4
jmp 0x424cae
mov esi, dword [ebp - 0x18]
push esi
mov edi, 0x403e7c
push edi
lea ecx, [ebp - 0x48]
call fcn.0040f5d6
mov ebx, eax
jmp 0x424db5
mov eax, ebx
sub eax, esi
inc eax
push eax
push esi
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040a2d4
push 0xffffffffffffffff
xor esi, esi
push esi
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004097bf
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x424d6e
lea eax, [ebp - 0x28]
push eax
call fcn.004238df
pop ecx
test al, al
jne 0x424d91
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x424d85
lea eax, [ebp - 0x28]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x424dbc
lea esi, [ebx + 1]
cmp esi, dword [ebp - 0x34]
jae 0x424de6
push esi
push edi
lea ecx, [ebp - 0x48]
call fcn.0040f5d6
push 0
push 1
lea ecx, [ebp - 0x64]
mov ebx, eax
mov byte [ebp - 4], 1
call fcn.00407cc4
cmp ebx, 0xffffffff
jne 0x424d3a
jmp 0x424df2
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.00407cc4
xor bl, bl
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407cc4
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00407cc4
mov al, bl
jmp 0x424cb0
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00407cc4
mov bl, 1
xor esi, esi
jmp 0x424dc9
Function at 0x424dfd
Capabilities:
Copy file

Disassembly:
push 0x60
mov eax, 0x443d31
call fcn.00429926
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push edi
push ebx
mov dword [ebp - 0x6c], ebx
call fcn.00429160
pop ecx
pop ecx
test eax, eax
jne 0x424e27
mov al, 1
call fcn.004299b8
ret
lea ecx, [ebp - 0x48]
call fcn.00408032
xor esi, esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], esi
call fcn.00408032
lea ecx, [ebp - 0x2c]
call fcn.00408032
push ebx
mov byte [ebp - 4], 2
call fcn.004238ac
pop ecx
push esi
test al, al
jne 0x424e78
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00407cc4
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.00407cc4
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00407cc4
xor al, al
jmp 0x424e21
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
call fcn.00424763
mov ecx, dword [ebp - 0x60]
add esp, 0x14
cmp dword [ebp - 0x4c], 0x10
jae 0x424e96
lea ecx, [ebp - 0x60]
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x424ea2
lea eax, [ebp - 0x44]
push esi
push esi
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00424875
add esp, 0x14
test al, al
jne 0x424eb9
push esi
jmp 0x424e54
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x424ec5
lea eax, [ebp - 0x28]
push eax
call fcn.00424c8a
xor ebx, ebx
inc ebx
pop ecx
test al, al
jne 0x424ed6
push esi
jmp 0x424e57
push ebx
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x424f0e
mov byte [ebp - 0x65], al
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00407cc4
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.00407cc4
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00407cc4
mov al, byte [ebp - 0x65]
jmp 0x424e21
mov byte [ebp - 0x65], bl
jmp 0x424ee8

Function at 0x424f18
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x44a170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004299e0
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
lea edi, [esi - 2]
cmp eax, edi
ja 0x424f73
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.00424956
pop ecx
pop ecx
test eax, eax
jne 0x424fb2
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004299e0
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec eax
cmp eax, edi
ja 0x424fab
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.00424956
pop ecx
pop ecx
test eax, eax
jne 0x424fb2
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042989f
leave
ret
Function at 0x425a3b
Capabilities:
Get file version info

Disassembly:
push 0x128
mov eax, 0x443dc1
call fcn.00429926
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x112]
xor ebx, ebx
push eax
push ebx
lea ecx, [ebp - 0x134]
mov byte [ebp - 0x111], bl
mov byte [ebp - 0x112], bl
call fcn.004230e5
mov dword [ebp - 4], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
cmp edi, ebx
je 0x425baa
push edi
call fcn.004238ac
pop ecx
test al, al
je 0x425baa
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x425aa8
sub eax, esi
lea esi, [eax + 1]
push ebx
push esi
lea ecx, [ebp - 0x134]
call fcn.00425578
push 0xffffffffffffffff
push edi
push esi
push dword [ebp - 0x130]
call fcn.00429ef5
add esp, 0x10
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x130]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x425b97
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x425b97
push edi
push esi
push dword [ebp - 0x11c]
push dword [ebp - 0x130]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x425b90
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x120]
push eax
push 0x403fdc
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x425b90
cmp dword [ebp - 0x118], ebx
je 0x425b90
mov ecx, dword [ebp - 0x120]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x403fe0
lea eax, [ebp - 0x110]
push 0xff
push eax
call fcn.00423abd
add esp, 0x1c
test eax, eax
jl 0x425b90
mov ecx, dword [ebp - 0x124]
lea eax, [ebp - 0x110]
push eax
call fcn.0040898b
mov byte [ebp - 0x111], 1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x134]
call fcn.00409751
mov al, byte [ebp - 0x111]
jmp 0x425bb7
lea ecx, [ebp - 0x134]
call fcn.00409751
xor al, al
call fcn.004299b8
ret

Function at 0x425bc2
Capabilities:
Get common file path

Disassembly:
push 0x140
mov eax, 0x443df9
call fcn.00429926
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14c]
call fcn.0040aa89
and dword [ebp - 4], 0
lea eax, [ebp - 0x14c]
push eax
push 0x404028
push 0x403fec
call fcn.00425728
add esp, 0xc
test al, al
je 0x425c2a
cmp dword [ebp - 0x14c], 1
jne 0x425c2a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x148]
push eax
mov ecx, edi
call fcn.00408397
lea ecx, [ebp - 0x14c]
call fcn.00409f0e
mov al, 1
jmp 0x425c62
mov esi, 0x104
push esi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x425c55
cmp eax, esi
ja 0x425c55
lea eax, [ebp - 0x114]
push eax
mov ecx, edi
call fcn.0040898b
jmp 0x425c1b
lea ecx, [ebp - 0x14c]
call fcn.00409f0e
xor al, al
call fcn.004299b8
ret
Function at 0x42606f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x44a170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
call fcn.00423772
pop ecx
pop ecx
xor ecx, ecx
cmp dword [ebp - 0x214], ebx
mov byte [ebp - 0x20d], al
movzx eax, byte [ebp - 0x218]
setne cl
shl eax, 8
or eax, ecx
cmp byte [ebp - 0x20d], bl
jne 0x426176
cmp eax, 0x500
jae 0x426181
cmp byte [ebp - 0x20d], bl
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push dword [ebp + 8]
sete byte [ebp - 0x214]
push ebx
push dword [ebp - 0x214]
call fcn.0042538c
add esp, 0x18
test eax, eax
jl 0x42612a
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x426116
sub eax, edx
sar eax, 1
jne 0x426211
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0x214]
call fcn.0042538c
add esp, 0x18
test eax, eax
jl 0x426166
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x426152
sub eax, edx
sar eax, 1
jne 0x426211
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042989f
leave
ret
cmp eax, 0x45a
jb 0x4260e0
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x218], ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4260e0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp - 0x214], ebx
cmp dword [ebp - 0x218], ebx
je 0x4261f4
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4261f4
mov eax, dword [ebp - 0x214]
cmp eax, ebx
je 0x4261f4
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4261fd
sub eax, edx
sar eax, 1
je 0x4260e0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00425f89
pop ecx
pop ecx
jmp 0x426168
Function at 0x426480
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push 0x48
mov eax, 0x443ef0
call fcn.004298b3
or dword [ebp - 0x1c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], bl
cmp dword [ebp + 0xc], ebx
je 0x4265ef
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4264c6
sub eax, edx
je 0x4265ef
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
call fcn.004255db
pop ecx
pop ecx
test al, al
je 0x4265f2
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4265f2
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x8004
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4265f2
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp + 8]
call dword [0x44b2b0]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x4265f2
mov esi, 0x4000
push esi
lea ecx, [ebp - 0x34]
call fcn.004256e1
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp + 0xc], ebx
push ebx
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp - 0x30]
push dword [ebp - 0x1c]
call edi
test eax, eax
jne 0x42658f
lea ecx, [ebp - 0x34]
call fcn.00409751
jmp 0x4265f2
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x42656f
jmp 0x42655d
cmp dword [ebp + 0xc], ebx
jne 0x426579
lea ecx, [ebp - 0x34]
call fcn.00409751
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x4265f2
mov eax, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x50]
sub eax, edi
cmp dword [ebp - 0x18], eax
jne 0x4265f2
push ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
call fcn.00425578
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x40]
push 2
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x4265f2
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x40]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
sete byte [ebp - 0xd]
jmp 0x4265f2
mov byte [ebp - 0xd], bl
cmp dword [ebp - 0x20], ebx
je 0x426601
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x14], ebx
je 0x42660f
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x1c], 0xffffffff
je 0x42661e
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x44]
call fcn.00409751
lea ecx, [ebp - 0x54]
call fcn.00409751
mov al, byte [ebp - 0xd]
call fcn.0042999f
ret
Function at 0x42663c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x18
mov eax, 0x443f18
call fcn.004298b3
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4266fe
cmp byte [eax], bl
je 0x4266fe
movzx ecx, word [ebp + 8]
push ecx
push eax
push dword [0x44b7d8]
xor esi, esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x4266fe
push edi
push dword [0x44b7d8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4266fe
push edi
push dword [0x44b7d8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jbe 0x4266a9
mov esi, edi
jmp 0x4266c6
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4266c3
push edi
push eax
push ebx
call fcn.0042ad10
add esp, 0xc
jmp 0x4266c9
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
shr esi, 1
push esi
lea ecx, [ebp - 0x24]
call fcn.004256bc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x44b7d8]
call fcn.004234db
add esp, 0x14
test eax, eax
je 0x426706
lea ecx, [ebp - 0x24]
call fcn.00409751
xor al, al
call fcn.0042999f
ret
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call fcn.00425f89
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
mov bl, al
call fcn.00409751
mov al, bl
jmp 0x426700
Function at 0x426f3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, dword [esi]
jne 0x426f55
test ebx, ebx
jbe 0x426f55
push 0x57
pop eax
jmp 0x426fc6
movzx eax, word [ebp + 0xc]
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [0x44b2b8]
mov edi, eax
test edi, edi
je 0x426fc0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x18], eax
test eax, eax
je 0x426fc0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jbe 0x426f92
mov dword [esi], edi
jmp 0x426fb9
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x426fb0
push edi
push eax
push dword [ebp + 0x14]
call fcn.0042ad10
add esp, 0xc
xor eax, eax
jmp 0x426fc5
xor eax, eax
inc eax
cmp dword [esi], eax
mov dword [esi], eax
jae 0x426fac
mov eax, 0xea
jmp 0x426fc5
mov eax, 0x716
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4274ce
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push ebx
push eax
mov dword [ebp - 8], ebx
call fcn.00423772
push 0x3c
mov byte [ebp - 1], al
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.004299e0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
add esp, 0x14
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x40
cmp byte [ebp + 0x10], bl
je 0x427539
cmp byte [ebp - 1], bl
jne 0x427539
cmp dword [ebp - 8], 6
jl 0x427539
mov ecx, dword [0x44a13c]
push 0x4014e8
call fcn.00407c9e
mov dword [ebp - 0x38], 0x4014dc
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x42754b
xor al, al
jmp 0x427564
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x427559
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x427562
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ebx
leave
ret
Function at 0x42867f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x18
mov eax, 0x443f18
call fcn.004298b3
mov ecx, dword [ebp + 0xc]
xor esi, esi
cmp ecx, esi
je 0x428736
cmp word [ecx], si
je 0x428736
movzx edx, word [ebp + 8]
mov eax, dword [0x44b7d8]
push edx
push ecx
push eax
mov dword [ebp - 0x10], esi
mov ebx, eax
call dword [0x44b2b8]
mov edi, eax
test edi, edi
je 0x428736
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x428736
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jbe 0x4286df
mov esi, edi
jmp 0x4286fd
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4286fa
push edi
push eax
push 0
call fcn.0042ad10
add esp, 0xc
jmp 0x428700
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
shr esi, 1
push esi
lea ecx, [ebp - 0x24]
call fcn.004256bc
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x44b7d8]
call fcn.00426f3a
add esp, 0x14
test eax, eax
je 0x42873e
lea ecx, [ebp - 0x24]
call fcn.00409751
xor al, al
call fcn.0042999f
ret
push dword [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
call fcn.004089b3
lea ecx, [ebp - 0x24]
call fcn.00409751
mov al, 1
jmp 0x428738

Function at 0x42989f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a170]
jne 0x4298a9
repz ret
jmp fcn.00430c11