joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493510
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x4935f3
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x49358e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x4935e0
shl edx, 0x10
cmp edi, 2
jne 0x49359f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x4935cd
lea edx, [edi + 0x3c]
jmp 0x4935da
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x493530
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret

Function at 0x497150
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [ebp - 8]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x49cf10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov edx, dword [eax + 8]
push edi
lea ecx, [esi + 0x20]
call edx
mov ebx, dword [esi + 0x28]
test ebx, ebx
je 0x49cf64
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49cf49
call fcn.0040b660
cmp byte [esi + 0xc], 0
je 0x49cf64
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x14]
push edx
lea ecx, [edi + ebx]
push ecx
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.004143b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49cf70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b48
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x52de08]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp + 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x49cff4
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov ebx, dword [eax]
mov esi, dword [edx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp esi, edi
setne al
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edi
cmp eax, edi
jne 0x49cffd
lea esi, [edi + 0xd]
jmp 0x49d01d
mov dword [ebp - 4], 0xffffffff
jmp 0x49d034
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push edi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp ecx, edi
je 0x49d032
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], edi
mov eax, esi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dbe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0d68
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x52de08]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x98], ebx
mov eax, dword [0x52ddd4]
mov edx, dword [eax + 0xc]
mov ecx, 0x52ddd4
mov dword [ebp - 0x9c], esi
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], ebx
mov cl, 0x2f
push ebx
mov byte [ebp - 0x70], cl
push 0x31
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x44], 0x373a7e5d
mov dword [ebp - 0x40], 0x48454020
mov dword [ebp - 0x3c], 0x951055c
mov dword [ebp - 0x38], 0x65177f26
mov dword [ebp - 0x34], 0x47511517
mov dword [ebp - 0x30], 0x73441608
mov dword [ebp - 0x2c], 0x786f0c55
mov dword [ebp - 0x28], 0x3354505f
mov dword [ebp - 0x24], 0x462c3e2f
mov dword [ebp - 0x20], 0x4f030175
mov dword [ebp - 0x1c], 0x56033111
mov dword [ebp - 0x18], 0x6e7b7774
mov byte [ebp - 0x14], 0x7b
mov dword [ebp - 0x78], 0x175f0c1c
mov dword [ebp - 0x74], 0x68302f59
mov dword [ebp - 0x6f], 0x66c2370
mov dword [ebp - 0x6b], 0x37107806
mov dword [ebp - 0x67], 0x7c293062
mov dword [ebp - 0x63], 0x751c3036
mov dword [ebp - 0x5f], 0x3c160e6f
mov dword [ebp - 0x5b], 0x5b133835
mov dword [ebp - 0x57], 0x1c664956
mov dword [ebp - 0x53], 0x703b706f
mov dword [ebp - 0x4f], 0x376f5d
mov dword [ebp - 0x4b], 0x4400141e
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
call fcn.0040e580
mov eax, dword [ebp - 0x94]
mov edi, 0x10
cmp dword [ebp - 0x80], edi
jae 0x49dd2b
lea eax, [ebp - 0x94]
push 0x31
push ebx
push eax
call fcn.004aab30
mov eax, dword [ebp - 0x94]
add esp, 0xc
mov dword [ebp - 0x84], 0x31
cmp dword [ebp - 0x80], edi
jae 0x49dd52
lea eax, [ebp - 0x94]
mov byte [eax + 0x31], bl
mov dword [ebp - 4], 2
xor eax, eax
jmp 0x49dd65
mov edi, 0x10
cmp dword [ebp - 0x80], edi
mov edi, dword [ebp - 0x94]
jae 0x49dd76
lea edi, [ebp - 0x94]
mov cl, byte [ebp + eax - 0x78]
xor cl, byte [ebp + eax - 0x44]
inc eax
mov byte [edi + eax - 1], cl
cmp eax, 0x31
jb 0x49dd60
cmp dword [ebp - 0x80], 0x10
jb 0x49dd9c
mov edx, dword [ebp - 0x94]
cmp edx, ebx
jne 0x49dda2
xor eax, eax
jmp 0x49ddb0
lea edx, [ebp - 0x94]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x49dda7
sub eax, edi
push eax
push edx
mov ecx, esi
call fcn.00406820
mov byte [ebp - 4], bl
cmp dword [ebp - 0x80], 0x10
jb 0x49ddd1
mov edx, dword [ebp - 0x94]
push edx
call fcn.004aa533
add esp, 4
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aaa9b
mov esp, ebp
pop ebp
ret
Function at 0x49e420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0e79
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x52de08]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov eax, dword [0x52ddd4]
mov edx, dword [eax + 0xc]
mov ecx, 0x52ddd4
mov dword [ebp - 0x54], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], esi
push esi
lea ebx, [esi + 0x10]
push ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x30], 0x6339634f
mov dword [ebp - 0x2c], 0xd424e2e
mov dword [ebp - 0x28], 0x853250f
mov dword [ebp - 0x24], 0x621d7267
mov dword [ebp - 0x20], 0x175f0c1c
mov dword [ebp - 0x1c], 0x68302f59
mov dword [ebp - 0x18], 0x6c23702f
mov dword [ebp - 0x14], 0x10780606
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x4c], 0
call fcn.0040e580
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], ebx
jae 0x49e4d5
lea ecx, [ebp - 0x4c]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x38], ebx
jae 0x49e4f0
lea eax, [ebp - 0x4c]
mov byte [eax + 0x10], 0
mov dword [ebp - 4], 2
xor eax, eax
lea ecx, [ecx]
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], ebx
jae 0x49e50b
lea ecx, [ebp - 0x4c]
mov dl, byte [ebp + eax - 0x20]
xor dl, byte [ebp + eax - 0x30]
mov byte [ecx + eax], dl
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], ebx
jae 0x49e521
lea ecx, [ebp - 0x4c]
mov dl, byte [ebp + eax - 0x1f]
xor dl, byte [ebp + eax - 0x2f]
mov byte [ecx + eax + 1], dl
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], ebx
jae 0x49e538
lea ecx, [ebp - 0x4c]
mov dl, byte [ebp + eax - 0x1e]
xor dl, byte [ebp + eax - 0x2e]
mov byte [ecx + eax + 2], dl
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], ebx
jae 0x49e54f
lea ecx, [ebp - 0x4c]
mov dl, byte [ebp + eax - 0x1d]
xor dl, byte [ebp + eax - 0x2d]
add eax, 4
mov byte [ecx + eax - 1], dl
cmp eax, ebx
jb 0x49e500
cmp dword [ebp - 0x38], ebx
jb 0x49e572
mov edx, dword [ebp - 0x4c]
test edx, edx
jne 0x49e575
xor eax, eax
jmp 0x49e589
lea edx, [ebp - 0x4c]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49e580
sub eax, esi
push eax
push edx
mov ecx, edi
call fcn.00406820
mov byte [ebp - 4], 0
cmp dword [ebp - 0x38], ebx
jb 0x49e5a7
mov eax, dword [ebp - 0x4c]
push eax
call fcn.004aa533
add esp, 4
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aaa9b
mov esp, ebp
pop ebp
ret
Function at 0x4aa376
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x530dac], 0
push esi
push edi
jne 0x4aa2ec
call fcn.004aa258
test eax, eax
je 0x4aa331
mov eax, dword [0x530dac]
cmp eax, 1
jne 0x4aa30d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4aa331
jmp 0x4aa373
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4aa373
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4aa335
xor eax, eax
jmp 0x4aa373
mov eax, dword [esi]
push dword [0x530dac]
call edi
mov edi, eax
test edi, edi
je 0x4aa357
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4aa373
lea edi, [esi + 0xff0]
push esi
push dword [0x530dac]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4aa35d
mov eax, esi
pop edi
pop esi
ret
jmp 0x4aa2d8

Function at 0x4aaa9b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x52de08]
jne 0x4aaaa5
repz ret
jmp fcn.004b162c
Function at 0x4bedf7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52de08]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004b1027
and dword [ebp - 0x14], 0
cmp dword [0x531cbc], 0
mov dword [ebp - 0x18], eax
jne 0x4beeaa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4bef52
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x509174
push ebx
call edi
test eax, eax
je 0x4bef52
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x509164
push ebx
mov dword [0x531cbc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x531cc0], eax
call edi
push eax
call esi
push 0x509134
push ebx
mov dword [0x531cc4], eax
call edi
push eax
call esi
mov dword [0x531ccc], eax
test eax, eax
je 0x4beeaa
push 0x50911c
push ebx
call edi
push eax
call esi
mov dword [0x531cc8], eax
mov eax, dword [0x531cc8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4bef03
cmp dword [0x531ccc], ecx
je 0x4bef03
push eax
call esi
push dword [0x531ccc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4bef03
test ebx, ebx
je 0x4bef03
call edi
test eax, eax
je 0x4beefa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4beefa
test byte [ebp - 8], 1
jne 0x4bef03
or dword [ebp + 0x10], 0x200000
jmp 0x4bef36
mov eax, dword [0x531cc0]
cmp eax, dword [ebp - 0x18]
je 0x4bef36
push eax
call esi
test eax, eax
je 0x4bef36
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4bef36
mov eax, dword [0x531cc4]
cmp eax, dword [ebp - 0x18]
je 0x4bef36
push eax
call esi
test eax, eax
je 0x4bef36
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x531cbc]
call esi
test eax, eax
je 0x4bef52
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4bef54
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaa9b
leave
ret
Function at 0x4ca6ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x4ca6d1
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x4ca6e9
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x4ca718
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x4ca75a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x4ca82e
sub edx, 0x10000
js 0x4ca82e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x4ca740
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x4ca740
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x4ca7b1
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x4ca7ae
add edx, 8
jne 0x4ca795
jmp 0x4ca81f
add edx, 4
test eax, 0xffff
jne 0x4ca7be
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x4ca81f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x4ca7f2
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4ca740
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x4ca82e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4ca740
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4ca83f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401aa9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401ae4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401ae0
lea ebx, [ebx]
cmp esi, eax
jae 0x401ae4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401ad0
cmp esi, eax
jb 0x401aea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push str.SoftwareKGB_Archiver
mov esi, 0x80000001
push esi
mov dword [esp + 0x20], 0x409
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4020ec
push esi
call edi
test eax, eax
mov esi, dword [esp + 8]
jne 0x4020ec
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.lang
push esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ecx, word [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
test esi, esi
je 0x4020ff
push esi
call edi
pop edi
pop esi
add esp, 0x10
ret

Function at 0x402570
Capabilities:
Terminate process

Disassembly:
push str.Out_of_memory_n
call fcn.0047f330
add esp, 4
push 1
call fcn.0047f671
int3

Function at 0x402f70
Capabilities:
Terminate process

Disassembly:
push edi
xor edi, edi
cmp eax, 4
mov dword [esi], eax
mov dword [esi + 4], edi
lea ecx, [eax - 4]
ja 0x402f85
mov ecx, 1
mov eax, 0x10
shl eax, cl
push 1
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
add eax, 0x40
push eax
mov dword [esi + 0x10], edi
call fcn.0047f81b
add esp, 8
cmp eax, edi
jne 0x402fac
jmp fcn.00402570
mov ecx, eax
and ecx, 0x3f
sub eax, ecx
add eax, 0x40
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
pop edi
ret
Function at 0x403d60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498338
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b0f34]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [0x4b25c4]
cmp eax, 6
setge cl
mov edx, 4
mov dword [esi], vtable.MatchModel.0
sub eax, ecx
lea ecx, [eax + 0x11]
mov eax, 1
shl eax, cl
mov dword [esi + 4], ecx
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00470050
mov ecx, dword [esi + 4]
mov edx, 1
shl edx, cl
mov dword [esi + 0x30], eax
add edx, edx
add edx, edx
push edx
push edi
push eax
call fcn.00482bd0
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
add esp, 0x10
mov dword [esi + 0x20], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x1c], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4042f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4b25c4]
xor ecx, ecx
cmp eax, 6
setge cl
push ebx
mov ebx, eax
xor edx, edx
push ebp
mov dword [edi], vtable.RecordModel.0
sub ebx, ecx
add ebx, 0x10
cmp eax, 4
setge dl
imul ebx, edx
cmp eax, 5
mov dword [edi + 4], ebx
jl 0x40432a
lea eax, [ebx - 2]
cmp eax, 1
lea ecx, [eax - 1]
jg 0x40432f
mov ecx, 1
mov eax, 1
shl eax, cl
push 2
xor ebp, ebp
mov dword [edi + 8], ecx
push eax
mov dword [edi + 0x10], ebp
call fcn.0047f81b
add esp, 8
cmp eax, ebp
mov dword [edi + 0xc], eax
jne 0x404355
jmp fcn.00402570
push esi
lea esi, [edi + 0x14]
mov eax, ebx
call fcn.00402f70
cmp dword [0x4b25c4], 5
mov ebx, dword [edi + 4]
jl 0x404377
lea eax, [ebx - 2]
cmp eax, 1
lea ecx, [eax - 1]
jg 0x40437c
mov ecx, 1
mov edx, 1
shl edx, cl
push 2
mov dword [edi + 0x48], ecx
mov dword [edi + 0x50], ebp
push edx
call fcn.0047f81b
add esp, 8
cmp eax, ebp
mov dword [edi + 0x4c], eax
jne 0x4043a0
jmp fcn.00402570
lea esi, [edi + 0x54]
mov eax, ebx
call fcn.00402f70
cmp dword [0x4b25c4], 5
mov ebx, dword [edi + 4]
jl 0x4043c1
lea eax, [ebx - 2]
cmp eax, 1
lea ecx, [eax - 1]
jg 0x4043c6
mov ecx, 1
mov eax, 1
shl eax, cl
push 2
mov dword [edi + 0x88], ecx
mov dword [edi + 0x90], ebp
push eax
call fcn.0047f81b
add esp, 8
cmp eax, ebp
mov dword [edi + 0x8c], eax
jne 0x4043f3
jmp fcn.00402570
lea esi, [edi + 0x94]
mov eax, ebx
call fcn.00402f70
cmp dword [0x4b25c4], 5
mov ebx, dword [edi + 4]
jl 0x404417
lea eax, [ebx - 2]
cmp eax, 1
lea ecx, [eax - 1]
jg 0x40441c
mov ecx, 1
mov edx, 1
shl edx, cl
push 2
mov dword [edi + 0xc8], ecx
mov dword [edi + 0xd0], ebp
push edx
call fcn.0047f81b
add esp, 8
cmp eax, ebp
mov dword [edi + 0xcc], eax
jne 0x404449
jmp fcn.00402570
lea esi, [edi + 0xd4]
mov eax, ebx
call fcn.00402f70
cmp dword [0x4b25c4], 5
mov ebx, dword [edi + 4]
jl 0x40446d
lea eax, [ebx - 2]
cmp eax, 1
lea ecx, [eax - 1]
jg 0x404472
mov ecx, 1
mov eax, 1
shl eax, cl
push 2
mov dword [edi + 0x108], ecx
mov dword [edi + 0x110], ebp
push eax
call fcn.0047f81b
add esp, 8
cmp eax, ebp
mov dword [edi + 0x10c], eax
jne 0x40449f
jmp fcn.00402570
lea esi, [edi + 0x114]
mov eax, ebx
call fcn.00402f70
pop esi
pop ebp
mov dword [edi + 0x148], 2
mov dword [edi + 0x14c], 3
mov eax, edi
pop ebx
ret