joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d244
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x42e9e8
cmp dword [edi], 0
jne 0x41d2c0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x42e9e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x429b50
mov ecx, 2
call fcn.00403064
mov edx, 0x41d21c
lea eax, [esi + 5]
call fcn.0041d23c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041d23c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41d295
mov dword [0x42e9e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f7f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x41f890
push 0
mov eax, ebx
call fcn.00405378
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x41f86b
mov ebx, esi
test ebx, ebx
je 0x41f841
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.00405378
push eax
push 1
push 0
mov eax, edi
call fcn.00405378
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x41f886
mov ecx, dword [0x429d38]
mov dl, 1
mov eax, dword [0x41dd98]
call fcn.0040c0f4
call fcn.00404930
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x42422c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405368
xor eax, eax
push ebp
push 0x42431b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00405378
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x424305
mov eax, esi
call fcn.00402e74
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4242fe
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push esi
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x424330
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp - 8]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424305
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00402e90
mov bl, 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424322
lea eax, [ebp - 4]
call fcn.00404ee8
ret

Function at 0x424d20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x424d68
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x424d5a
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
mov ebx, eax
sub ebx, esi
cmp edi, ebx
jg 0x424d38
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4254a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406b30
xor eax, eax
push ebp
push 0x4255e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0041f760
xor eax, eax
push ebp
push 0x4255b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
movzx ebx, word [eax + 0x30]
dec ebx
test ebx, ebx
jl 0x425597
inc ebx
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0041f760
mov eax, dword [ebp - 0x1c]
and eax, 2
cmp eax, 2
jne 0x42558f
mov eax, dword [ebp - 0x1c]
and eax, 1
dec eax
jne 0x42558f
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.0041f760
lea eax, [ebp - 8]
call fcn.00406abc
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.0041f760
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0041f760
lea eax, [edi + 4]
mov edx, dword [ebp - 8]
call fcn.00406ad4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00425410
inc esi
dec ebx
jne 0x42550a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4255b9
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x4c]
ret

Function at 0x425dec
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x42eb00]
mov ecx, 0x40
call fcn.00403064
mov dword [0x42ea4c], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x42ea4c
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x425e1a
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x42ea4c]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.00425ccc
mov esi, eax
mov dword [ebx*4 + 0x42ea4c], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.00425ccc
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x425e8a
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x425e3a
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x425f14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x42eaf8]
sub dword [ebx + 8], eax
mov eax, dword [0x42eaf4]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00425ccc
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00425ccc
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x42ea50]
mov edx, edi
call fcn.00425cd4
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x42ea4c]
mov edx, ebp
call fcn.00425cd4
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x425f2e
mov eax, dword [0x42ea50]
sub dword [ebx + 0xc], eax
mov eax, dword [0x42ea4c]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4021c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x41a798
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x422060]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00401ba0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402214
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00401c60
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00401ba0
cmp dword [esp + 0x24], 8
jb 0x40225a
mov eax, dword [esp + 0x10]
push eax
call fcn.0040b5a3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x402a90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x140
mov eax, dword [0x422060]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
push 0x12b
lea eax, [esp + 0x19]
push 0
push eax
mov dword [edi], vtable.core_log::log_device_file.0
mov byte [esp + 0x20], 0
call fcn.0040d560
mov edx, dword [0x42332c]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x42332c
call eax
lea ecx, [esp + 4]
mov esi, eax
push ecx
add esi, 0x10
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.c:MyLog_
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402af8
test al, 0x10
jne 0x402b05
push 0
push str.c:MyLog_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx edx, word [esp + 0xa]
movzx eax, word [esp + 6]
movzx ecx, word [esp + 4]
push edx
push eax
push ecx
push str.c:MyLogMyLog__d__02d__02d.log
push 0xffffffffffffffff
lea edx, [esp + 0x28]
push 0x12c
push edx
call fcn.0040c09e
push 0x41d108
lea eax, [esp + 0x34]
push eax
lea ecx, [edi + 4]
push ecx
call fcn.0040c544
lea eax, [esi - 0x10]
add esp, 0x28
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop esi
jg 0x402b60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x13c]
xor ecx, esp
mov eax, edi
call fcn.0040b949
add esp, 0x140
ret

Function at 0x402bc0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x402bfa
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push 1
push ecx
call fcn.0040bf4a
mov edx, dword [esi + 4]
push edx
push 2
push 1
push 0x41d10c
call fcn.0040bf4a
mov eax, dword [esi + 4]
push eax
call fcn.0040c23b
add esp, 0x24
pop esi
ret 8
Function at 0x403010
Capabilities:
Read file via mapping

Disassembly:
push str.GlobalFA6FBBB1_8C8E_43b1_B8EC_35573A94C231
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
mov dword [esi], eax
je 0x40304a
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 4], eax
jne 0x40304d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
xor eax, eax
ret
mov dword [esi + 8], eax
mov eax, 1
ret

Function at 0x403130
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0x20119
push ebx
push str.SOFTWAREMyLogLog
push 0x80000002
mov dword [esp + 0x1c], ebx
mov byte [0x423ff4], bl
mov byte [0x423ff5], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4031d8
mov eax, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push str.EnableLogToView
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 4
call esi
test eax, eax
jne 0x4031a2
cmp dword [esp + 8], 1
jne 0x4031a2
mov byte [0x423ff4], 1
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push str.EnableLogToFile
push eax
call esi
test eax, eax
pop esi
jne 0x4031cd
cmp dword [esp + 4], 1
jne 0x4031cd
mov byte [0x423ff5], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0xc
ret

Function at 0x403df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
je 0x403f14
cmp word [ebp], 0
je 0x403f14
cmp word [ebp + 2], 0x3a
push ebx
jne 0x403f0f
mov ebx, 0x5c
cmp word [ebp + 4], bx
jne 0x403f0f
mov eax, ebp
lea edx, [eax + 2]
jmp 0x403e30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403e30
sub eax, edx
sar eax, 1
push esi
push edi
mov edi, eax
xor ecx, ecx
lea eax, [edi + 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b59e
add esp, 4
mov esi, eax
lea eax, [edi + 1]
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call ebp
cmp word [esi + edi*2 - 2], bx
lea eax, [esi + edi*2]
je 0x403e83
push 2
push 0x41d2a8
push eax
call ebp
lea ecx, [esi + 6]
push ebx
push ecx
mov dword [esp + 0x1c], 1
call fcn.0040ce7b
mov edi, eax
add esp, 8
test edi, edi
je 0x403efd
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ebx, [ebx]
push esi
mov word [edi], 0
call ebp
cmp eax, 0xffffffff
je 0x403ec1
test al, 0x10
jne 0x403eca
push 0
push esi
call ebx
test eax, eax
je 0x403ef5
mov word [edi], 0x5c
push 0x5c
add edi, 2
push edi
call fcn.0040ce7b
mov edi, eax
add esp, 8
test edi, edi
jne 0x403eb0
push esi
call fcn.0040b9bc
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
mov dword [esp + 0x14], 0
push esi
call fcn.0040b9bc
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
pop ebx
xor eax, eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404620
Capabilities:
Copy file
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41a9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x422060]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push edi
mov eax, dword [0x422060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
mov edi, ecx
push esi
push edi
call ebp
mov ebx, eax
push ebx
push esi
push edi
push str.CopyFile_lpExistingFileName_s_lpNewFileName_s_bResult_d
push 0xc8
push str..FileHandler.cpp
call fcn.004035b0
add esp, 0x18
test ebx, ebx
jne 0x40474e
lea ecx, [esp + 0x10]
call fcn.00404800
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x14]
mov ebx, 8
cmp dword [esp + 0x28], ebx
jae 0x4046a3
lea eax, [esp + 0x14]
push 0
push eax
push edi
call ebp
cmp dword [esp + 0x28], ebx
mov edi, eax
mov eax, dword [esp + 0x14]
jae 0x4046b9
lea eax, [esp + 0x14]
push edi
push eax
push str.CopyFile_strTempFile_s_bResult_d
push 0xc8
push str..FileHandler.cpp
call fcn.004035b0
add esp, 0x14
test edi, edi
je 0x404737
cmp dword [esp + 0x28], ebx
mov eax, dword [esp + 0x14]
jae 0x4046e4
lea eax, [esp + 0x14]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
jae 0x4046fe
lea ebx, [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push esi
push ebx
call ebp
mov edi, eax
push edi
push esi
push ebx
push str.MoveFile_lpExistingFileName_s_lpNewFileName_s_bResult_d
push 0xc8
push str..FileHandler.cpp
call fcn.004035b0
add esp, 0x18
test edi, edi
jne 0x404732
push 5
push esi
push ebx
call ebp
mov edi, eax
mov ebx, 8
cmp dword [esp + 0x28], ebx
jb 0x40474a
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b5a3
add esp, 4
mov eax, edi
jmp 0x404750
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040b949
add esp, 0x2c
ret

Function at 0x404770
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push 1
push 0x80000000
push eax
mov dword [esp + 0x28], ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4047f5
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4047ad
xor ebp, ebp
jmp 0x4047b2
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4047ee
mov edx, dword [esp + 0xc]
mov edi, 1
push edi
push 0
mov dword [esi + 4], 0
mov eax, dword [esi + 4]
push eax
mov ecx, edx
push ecx
call fcn.00419a10
xor ecx, ecx
add eax, ebp
mov dword [esi], eax
mov eax, edi
pop edi
adc edx, ecx
pop ebp
mov dword [esi + 4], edx
pop ebx
pop ecx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x404800
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x422060]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x21a]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x14], edi
mov word [esp + 0x220], di
call fcn.0040d560
add esp, 0xc
lea ecx, [esp + 0x214]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x206
lea edx, [esp + 0x12]
push edi
push edx
mov word [esp + 0x18], di
call fcn.0040d560
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push edi
push str.Samson
lea ecx, [esp + 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0xc]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [esi + 4], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404895
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00405150
mov ecx, dword [esp + 0x41c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b949
add esp, 0x418
ret

Function at 0x404dd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41a6bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x422060]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
push edi
mov eax, dword [0x422060]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor edi, edi
mov eax, 1
test byte [0x424020], al
mov dword [esp + 0xc], edi
jne 0x404e46
or dword [0x424020], eax
push 0x41abf0
mov dword [0x42401c], 7
mov dword [0x424018], edi
mov word [0x424008], di
call fcn.0040c3bb
add esp, 4
cmp dword [0x424018], edi
jne 0x404eec
push 0x206
lea eax, [esp + 0x32]
push edi
push eax
mov word [esp + 0x38], di
call fcn.0040d560
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404e81
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x30]
push edx
mov esi, 0x424004
call fcn.00405150
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.00404930
push 0xffffffffffffffff
push edi
mov ecx, esi
mov dword [esp + 0x248], edi
call fcn.00401ba0
mov dword [esp + 0x240], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x404edb
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b5a3
add esp, 4
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], edi
mov word [esp + 0x14], di
push 0xffffffffffffffff
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], edi
push edi
mov eax, 0x424004
mov ecx, ebx
mov word [ebx + 4], di
call fcn.00401ba0
mov eax, ebx
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0040b949
add esp, 0x238
ret
Function at 0x4055f0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get file attributes
Move file
Set file attributes
Write file on windows

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403de6
test al, 0x10
jne 0x403de6
mov eax, 1
ret
xor eax, eax
ret
push ebx
push ebp
push edi
mov edi, eax
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405620
push str.ResourceToFile_LoadResource_hResData__NULL_Failed
push 0xc8
push str..Resourcecommon.cpp
call fcn.004035b0
add esp, 0xc
xor eax, eax
pop edi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x40561a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x405642
push str.ResourceToFile_SizeofResource_FileSize__0_Failed
jmp 0x405608
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
je 0x405670
push 0x80
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x405670
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x80
push esi
call edi
push 0x41d598
push esi
call fcn.0040d246
mov edi, eax
add esp, 8
test edi, edi
je 0x40561a
push edi
push ebx
push 1
push ebp
call fcn.0040bf4a
add esp, 0x10
cmp eax, ebx
je 0x4056c3
push str.ResourceToFile_RealSize___FileSize_Failed
push 0xc8
push str..Resourcecommon.cpp
call fcn.004035b0
add esp, 0xc
push edi
call fcn.0040cabf
add esp, 4
xor eax, eax
pop edi
pop ebp
pop ebx
ret
push edi
call fcn.0040cabf
add esp, 4
pop edi
pop ebp
mov eax, esi
pop ebx
jmp 0x403dd0
Function at 0x406680
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
jne 0x406698
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, ecx
lea ecx, [edi + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
cmp edx, 0x40000000
jae 0x4066b7
add edx, edx
add edx, edx
cmp dword [ebx], edx
jae 0x4066bf
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
cmp edi, 2
mov ecx, ebp
jbe 0x40674d
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
add edx, 1
lea esp, [esp]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x41f038]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
movzx eax, byte [eax + ebx + 0x41f038]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
add ecx, 1
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + 0x41f038]
add ecx, 1
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x41f038]
add ecx, 1
mov byte [ecx], al
add ecx, 1
add esi, 3
sub edi, 3
sub edx, 1
jne 0x4066e0
mov ebx, dword [esp + 0x18]
test edi, edi
je 0x4067b7
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + 0x41f038]
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jbe 0x406797
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
movzx edx, byte [edx + eax + 0x41f038]
mov byte [ecx], dl
movzx eax, byte [esi + 1]
add ecx, 1
and eax, 0xf
movzx edx, byte [eax*4 + 0x41f038]
mov byte [ecx], dl
jmp 0x4067ae
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + 0x41f038]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
pop esi
mov eax, ecx
sub eax, ebp
pop edi
mov dword [ebx], eax
pop ebp
mov byte [ecx], 0
xor eax, eax
pop ebx
ret