joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475670
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4175fc]
call fcn.00405318
xor eax, eax
push ebp
push 0x4757b4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48500c], 0
jne 0x4756c3
mov ecx, dword [0x4850d8]
mov dl, 1
mov eax, dword [0x407f80]
call fcn.0040bc80
call fcn.00403f98
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403038
mov eax, ebx
call fcn.00404f60
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4757c4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040669c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404f70
test eax, eax
jle 0x47575b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x475754
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404878
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404860
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d98
test eax, eax
jne 0x475754
mov ebx, 0x15
jmp 0x475760
mov ebx, 0x10
jmp 0x475760
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x48500c]
call fcn.004755c8
mov eax, dword [ebp - 8]
call fcn.004755c8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004066b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4757bb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040461c
lea eax, [ebp - 0x10]
mov edx, dword [0x4175fc]
call fcn.004053e8
ret

Function at 0x476d6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x476dd0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404860
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409138
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476dd7
lea eax, [ebp - 0xc]
call fcn.004045f8
ret
Function at 0x476e4c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x476ea8
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x476e77
call fcn.0040cedc
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402948
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x476ea8
call fcn.0040cedc
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x47c05c
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x4854e0]
cmp dword [eax], 2
je 0x47c07a
mov ecx, 0x30e
mov edx, 0x47c0ac
mov eax, 0x47c0e8
call fcn.00404554
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x47bffc
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x486fd0], eax
cmp dword [0x486fd0], 0
jne 0x47c0a1
call fcn.0040cedc
ret

Function at 0x47c31c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x485140]
cmp byte [eax], 0
jne 0x47c34a
mov ecx, 0xaf
mov edx, 0x47c398
mov eax, 0x47c3d4
call fcn.00404554
mov eax, ebx
call fcn.00404d1c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x47c389
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404ec8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47c3e8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x485140]
cmp byte [eax], 0
jne 0x47c40b
mov ecx, 0xbd
mov edx, 0x47c44c
mov eax, 0x47c488
call fcn.00404554
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x47c43e
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x47c43e
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x47c43e
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4816a4
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a98
xor eax, eax
push ebp
push 0x481791
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404eb0
push dword [ebp - 0xc]
push 0x4817a4
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 4]
call fcn.00404ee4
push dword [ebp - 0x118]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405040
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0xc]
call fcn.00404878
mov eax, dword [ebp - 0x11c]
call fcn.00409354
test al, al
je 0x48175d
mov eax, dword [ebp - 0xc]
call fcn.00404f60
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481798
lea eax, [ebp - 0x11c]
call fcn.004045f8
lea eax, [ebp - 0x118]
call fcn.00404d1c
lea eax, [ebp - 0xc]
call fcn.00404d1c
lea eax, [ebp - 4]
call fcn.004045f8
ret
Function at 0x482044
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffca4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406048
xor eax, eax
push ebp
push 0x4821ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
mov eax, 2
call fcn.00481a5c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x138], 0x128
mov dword [ebp - 0x35c], 0x224
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0xc]
call fcn.00481a7c
jmp 0x482178
mov edx, dword [ebp - 0x130]
mov eax, 8
call fcn.00481a5c
mov ebx, eax
lea edx, [ebp - 0x35c]
mov eax, ebx
call fcn.00481abc
jmp 0x48215c
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x23c]
mov ecx, 0x104
call fcn.00404860
mov esi, dword [ebp - 0x354]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00481fb0
test al, al
je 0x48214f
cmp word [ebp + 0xa], 0
je 0x48212d
mov ecx, esi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
test al, al
jne 0x48214f
push 0
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
neg eax
mov byte [ebp - 5], al
jmp 0x48214f
push 0
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
neg eax
mov byte [ebp - 5], al
lea edx, [ebp - 0x35c]
mov eax, ebx
call fcn.00481adc
test eax, eax
jne 0x4820cb
push ebx
call sub.kernel32.dll_CloseHandle_1
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0xc]
call fcn.00481a9c
test eax, eax
jne 0x4820a7
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4821b4
lea eax, [ebp - 0x10]
call fcn.004045f8
lea eax, [ebp - 4]
mov edx, dword [0x481f84]
call fcn.00405fe4
ret
Function at 0x482948
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482b41
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402a74
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.004094f0
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x482b54
call fcn.004048fc
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402e08
lea eax, [ebp - 0x1d0]
call fcn.00402ba4
call fcn.004028b4
mov edx, 0x482b6c
lea eax, [ebp - 0x1d0]
call fcn.00404cc4
call fcn.00403238
call fcn.004028b4
push 0x482b7c
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402a74
push dword [ebp - 0x234]
push 0x482b8c
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00404970
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00404cc4
call fcn.00403238
call fcn.004028b4
push 0x482b98
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402a74
push dword [ebp - 0x23c]
push 0x482b8c
push 0x482bac
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404970
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00404cc4
call fcn.00403238
call fcn.004028b4
mov edx, 0x482bc0
lea eax, [ebp - 0x1d0]
call fcn.00404cc4
call fcn.00403238
call fcn.004028b4
lea eax, [ebp - 0x1d0]
call fcn.00402ed0
call fcn.004028b4
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00403038
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404aa8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x482b1b
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482b48
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.0040461c
lea eax, [ebp - 4]
call fcn.004045f8
ret
Function at 0x482bc8
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a98
xor eax, eax
push ebp
push 0x482c9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048b0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x482c0f
lea eax, [ebp - 4]
mov edx, 0x482cb4
call fcn.004048b8
lea eax, [ebp - 4]
mov edx, 0x482cc0
call fcn.004048b8
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409524
xor eax, eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], 3
lea eax, [ebp - 0x2c]
mov ecx, 0x482ccc
mov edx, dword [ebp - 4]
call fcn.004048fc
mov eax, dword [ebp - 0x2c]
call fcn.00404aa8
mov dword [ebp - 0x1e], eax
xor eax, eax
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x450
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
call fcn.0040968c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482ca3
lea eax, [ebp - 0x2c]
call fcn.004045f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040461c
ret
Function at 0x404070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x404099
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4040af
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4040a6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4040e2
nop
cmp esi, ecx
jae 0x4040a6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4040d0
cmp esi, ecx
jae 0x4040a6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40427e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40427e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40427e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404207
cmp esi, ecx
jae 0x40427e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4041f1
cmp esi, ecx
jae 0x40427e
movzx eax, word [esi]
test ax, ax
je 0x40427e
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40423a
push edi
mov ecx, ebx
call fcn.00404770
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40423d
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00587505
add esp, 0x10
cmp eax, 0x50
ja case.0x40425b.1
movzx eax, byte [eax + 0x4042ac]
jmp dword [eax*4 + 0x40429c]
mov ecx, dword [ebx]
cmp edi, dword [ecx - 8]
jg 0x40428c
mov dword [ecx - 0xc], edi
xor edx, edx
mov ecx, dword [ebx]
lea eax, [edx + 1]
mov word [ecx + edi*2], dx
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
call fcn.004166c1
push 0x80070057
call fcn.004048a0
call fcn.004166a7
nop
bound eax, qword [edx + 0x40]
add byte [edi - 1778368446], al
inc edx
inc eax
add byte [esi + 0x4042], dl
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x404300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.004168dd
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x404401
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x404401
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404401
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404401
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404388
cmp esi, ecx
jae 0x404401
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404372
cmp esi, ecx
jae 0x404401
movzx eax, word [esi]
test ax, ax
je 0x404401
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x4043bb
push edi
mov ecx, ebx
call fcn.00404770
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x4043be
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00587505
add esp, 0x10
cmp eax, 0x50
ja case.0x4043dc.1
movzx eax, byte [eax + 0x404430]
jmp dword [eax*4 + 0x404420]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x404411
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004166c1
push 0x80070057
call fcn.004048a0
call fcn.004166a7
jecxz 0x404465
inc eax
add byte [esp + eax*2], cl
inc eax
add byte [ebx], bl
inc esp
inc eax
add byte [ebx], bl
inc esp
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x404490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x40459a
test eax, 0xffff0000
jne 0x40459a
push esi
push edi
movzx edi, ax
push edi
call fcn.004168dd
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x404596
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x404596
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404596
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404596
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404529
cmp esi, ecx
jae 0x404596
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404517
cmp esi, ecx
jae 0x404596
movzx eax, word [esi]
test ax, ax
je 0x404596
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40455c
push edi
mov ecx, ebx
call fcn.00404770
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40455f
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00587505
add esp, 0x10
cmp eax, 0x50
ja case.0x40457d.1
movzx eax, byte [eax + 0x4045c8]
jmp dword [eax*4 + 0x4045b8]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4045ad
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004166a7
call fcn.004166c1
push 0x80070057
call fcn.004048a0
nop
test byte [ebp + 0x40], al
add byte [eax - 1560264635], ch
inc ebp
inc eax
add byte [ebx + 0x4045], ah
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x409600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0xc]
mov edi, edx
push eax
push 0
push 0x2001f
push 0
push 0x6029b8
push 0
push dword [ecx]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40968c
mov eax, dword [esi]
xor ecx, ecx
mov edx, 2
mov eax, dword [eax - 0xc]
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414eea
mov ecx, dword [esi]
add esp, 4
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push 1
push 0
push dword [edi]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f3d2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0054f3d2
mov esp, ebp
pop ebp
ret