joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410cbe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
xor eax, eax
mov dword [ebp - 0x34], ecx
push 7
pop ecx
mov dword [ebp - 0x38], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x2c], str.http:__textedit.codeplex.com_
mov dword [ebp - 0x20], 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x411715
Capabilities:
Get file system object information

Disassembly:
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call esi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push eax
push edi
call dword [sym.imp.USER32.dll_SetMenu]
push edi
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0
call esi
push eax
mov ecx, edi
call fcn.00406912
mov ecx, eax
call fcn.00407058
mov ecx, edi
call fcn.00406912
mov esi, eax
mov ecx, esi
call fcn.00407207
pop edi
mov ecx, esi
pop esi
jmp fcn.00407fcc

Function at 0x412ef5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0041f880
push ebx
push esi
push edi
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
mov edi, edx
mov esi, ecx
call fcn.00421460
add esp, 0xc
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push ebx
push eax
push 0xffe
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412fa6
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x1004]
push ebx
call fcn.0041387e
test al, al
mov eax, dword [ebp - 4]
je 0x412f81
shr eax, 1
xor ecx, ecx
mov edx, 0x800
mov word [ebp + eax*2 - 0x1004], cx
lea ecx, [ebp - 0x1004]
call fcn.004129fd
lea eax, [ebp - 0x1004]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x412fa6
mov edx, 0x1000
mov byte [ebp + eax - 0x1004], bl
lea ecx, [ebp - 0x1004]
call fcn.004129b2
lea eax, [ebp - 0x1004]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412fad
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x45ed52
call fcn.0041f258
sub esp, 0x4fc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push 0x463758
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x20a
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.00421460
add esp, 0xc
mov byte [0x47e9f8], 0
lea eax, [ebp - 0x254]
push eax
push 0x105
push 0x465
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
test eax, eax
jle 0x4130ea
lea edx, [ebp - 0x254]
mov ecx, edx
call fcn.0041782e
mov byte [ebp - 0xd], al
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x80000000
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], esi
and dword [ebp - 4], ebx
cmp esi, 0xffffffff
setne cl
mov byte [0x47e9f8], cl
test cl, cl
je 0x4130d6
mov edx, edi
mov ecx, esi
call fcn.00412ef5
push 0x34
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00421460
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x413089
test byte [ebp - 0x48], 1
mov byte [0x47e9f9], bl
je 0x413090
mov byte [0x47e9f9], 1
mov ebx, 0x2b4
lea eax, [ebp - 0x508]
push ebx
push 0
push eax
call fcn.00421460
add esp, 0xc
mov ecx, 0x8101
cmp byte [ebp - 0xd], 0
mov eax, 0x101
cmovne eax, ecx
push eax
push ebx
lea eax, [ebp - 0x508]
push eax
push 0
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebx, dword [ebp - 0x508]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4130ea
cmp esi, 0xffffffff
je 0x4130ea
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x417
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push ebx
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x413847
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov ecx, 0x1000
test eax, eax
pop edi
cmove eax, ecx
mov ecx, 0x10000
cmp eax, ecx
cmova eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4169f7
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x45f3d6
call fcn.0041f258
sub esp, 0x3c
cmp dword [ebp + 8], 0
push ebx
push esi
mov esi, ecx
jne 0x416a3f
push edx
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00416f1b
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov ecx, esi
cmovae edx, dword [ebp - 0x28]
call fcn.00416acc
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004017c6
jmp 0x416ab8
push 0xf003f
call fcn.00417213
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
test esi, esi
setne bl
test esi, esi
je 0x416aa9
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x416aa9
push eax
lea ecx, [ebp - 0x48]
call fcn.00408ad2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004017c6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.004017c6
mov byte [ebp - 4], 1
xor bl, bl
mov dword [ebp - 0x48], vtable.Exception.0
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x416ab8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x416acc
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x45f420
call fcn.0041f258
sub esp, 0x44
push ebx
push esi
push edi
mov edi, edx
mov eax, ecx
xor edx, edx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], cx
mov dword [ebp - 4], edx
mov ebx, edx
push 0x20019
mov edx, edi
mov ecx, eax
call fcn.00417193
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
test esi, esi
jne 0x416b2e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004017c6
xor al, al
jmp 0x416c0f
lea eax, [ebp - 0x30]
push eax
push 0
jmp 0x416b96
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push edi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._1_2
call fcn.004014c8
mov byte [ebp - 4], 2
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 1
call fcn.0040c5ba
add esp, 0x24
mov byte [ebp - 4], 3
lea edx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
mov ecx, dword [ebp - 0x10]
cmovae edx, dword [ebp - 0x50]
call fcn.00416acc
test al, al
jne 0x416b85
inc ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.004017c6
lea eax, [ebp - 0x30]
push eax
push ebx
mov edx, edi
mov ecx, esi
call fcn.00416c84
test al, al
jne 0x416b36
mov byte [ebp - 4], al
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004017c6
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
je 0x416c0c
push esi
lea ecx, [ebp - 0x38]
call fcn.00408ad2
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x50]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
call fcn.004017c6
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.004017c6
or dword [ebp - 4], 0xffffffff
test esi, esi
mov dword [ebp - 0x38], vtable.Exception.0
sete al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416c84
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x45f45c
call fcn.0041f258
sub esp, 0x460
push ebx
push esi
push edi
mov edi, 0x20a
lea eax, [ebp - 0x260]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.00421460
push edi
lea eax, [ebp - 0x46c]
push ebx
push eax
call fcn.00421460
add esp, 0x18
mov dword [ebp - 0x1c], ebx
mov eax, 0x105
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x46c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x416d1a
lea eax, [ebp - 0x260]
push eax
call fcn.0042a10c
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004017f8
jmp 0x416d5e
cmp esi, 0x103
je 0x416d5e
push esi
lea ecx, [ebp - 0x3c]
call fcn.00408ad2
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x54]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x54]
call fcn.004017c6
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.004017c6
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x3c], vtable.Exception.0
mov ecx, dword [ebp - 0xc]
test esi, esi
pop edi
pop esi
sete al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x416d76
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x45f486
call fcn.0041f258
sub esp, 0x248
push ebx
push esi
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x254]
push ebx
push eax
mov esi, ecx
call fcn.00421460
add esp, 0xc
mov dword [ebp - 0x10], 0x105
lea eax, [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x254]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x416de6
lea eax, [ebp - 0x254]
push eax
call fcn.0042a10c
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004017f8
jmp 0x416e2a
cmp esi, 0x103
je 0x416e2a
push esi
lea ecx, [ebp - 0x30]
call fcn.00408ad2
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x48]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
call fcn.004017c6
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004017c6
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], vtable.Exception.0
mov ecx, dword [ebp - 0xc]
test esi, esi
pop esi
sete al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4170c3
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x45f535
call fcn.0041f258
sub esp, 0x218
push ebx
push esi
push edi
push 0x20a
mov edi, ecx
lea eax, [ebp - 0x224]
push 0
mov dword [ebp - 0x14], edi
mov ebx, edx
and dword [ebp - 0x10], 0
push eax
call fcn.00421460
mov esi, dword [ebp + 0x10]
add esp, 0xc
test esi, esi
je 0x41711a
push esi
call fcn.0042a10c
push eax
push esi
lea eax, [ebp - 0x224]
push 0x105
push eax
call fcn.0042aad1
add esp, 0x14
mov edx, dword [ebp + 8]
mov ecx, ebx
push 0x20019
call fcn.00417213
mov esi, eax
mov dword [ebp - 0x18], esi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x41715e
and dword [ebp + 8], 0
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x224]
mov dword [ebp + 0x10], 0x20a
push eax
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
call fcn.004014c8
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0
test esi, esi
je 0x41717e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41733e
Capabilities:
Set registry value

Disassembly:
mov eax, 0x45f5bf
call fcn.0041f258
sub esp, 0x34
push esi
push dword [ebp + 0x14]
lea ecx, [ebp - 0x40]
call fcn.004014c8
and dword [ebp - 4], 0
lea eax, [ebp + 0x18]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040c604
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.004017c6
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00416969
mov esi, eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x4173b3
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 2
test esi, esi
je 0x4173c2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004017c6
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x417413
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x45f5d9
call fcn.0041f258
mov eax, 0x4418
call fcn.0041f880
push ebx
push esi
push edi
push 0x400
xor ebx, ebx
lea eax, [ebp - 0x424]
mov esi, edx
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
call fcn.00421460
push 0x4000
lea eax, [ebp - 0x4424]
push ebx
push eax
call fcn.00421460
add esp, 0x18
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x4000
push ebx
push eax
lea eax, [ebp - 0x4424]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x424]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x417567
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x424]
mov ecx, esi
call fcn.004173dd
mov esi, eax
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
lea edx, [ebp - 0x424]
mov ecx, edi
call fcn.00417692
mov edi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x4174df
test esi, esi
je 0x4174df
mov edx, esi
mov ecx, edi
call fcn.00417599
mov edx, esi
mov ecx, edi
call fcn.00417413
mov byte [ebp - 4], 0
test edi, edi
je 0x4174ea
push edi
call ebx
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4174f5
push esi
call ebx
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x424]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, 0x400
lea eax, [ebp - 0x424]
push esi
push 0
push eax
call fcn.00421460
push 0x4000
lea eax, [ebp - 0x4424]
push 0
push eax
call fcn.00421460
add esp, 0x18
mov dword [ebp - 0x14], esi
xor ecx, ecx
mov dword [ebp - 0x10], 0x4000
lea eax, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x4424]
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x424]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [ebp - 0x1c]
test eax, eax
je 0x417499
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x417599
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x440c
call fcn.0041f880
push ebx
push esi
push edi
push 0x400
xor edi, edi
lea eax, [ebp - 0x40c]
push edi
push eax
mov ebx, edx
mov esi, ecx
call fcn.00421460
push 0x4000
lea eax, [ebp - 0x440c]
push edi
push eax
call fcn.00421460
add esp, 0x18
mov dword [ebp - 8], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x440c]
push eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x417672
push dword [ebp - 4]
lea eax, [ebp - 0x440c]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x40c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x400
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.00421460
push 0x4000
lea eax, [ebp - 0x440c]
push 0
push eax
call fcn.00421460
add esp, 0x18
lea eax, [ebp - 4]
xor ecx, ecx
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 0x440c]
push eax
lea eax, [ebp - 8]
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40c]
push eax
push ecx
push esi
mov dword [ebp - 0xc], 0x400
mov dword [ebp - 4], 0x4000
call edi
test eax, eax
je 0x4175fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418cba
Capabilities:
Create thread

Disassembly:
mov eax, 0x45f808
call fcn.0041f258
sub esp, 0x1c
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push edx
push ecx
push edi
push edi
mov dword [ebp - 0x10], edi
call fcn.0042ca1d
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x418d11
push 0x465f58
lea ecx, [ebp - 0x28]
call fcn.004014c8
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0040915d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004017c6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x418dab
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, 0x45f84c
call fcn.0041f258
sub esp, 0x20
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0x465f9c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x14], eax
cmp dword [edi + 0x14], 8
jb 0x418dfb
mov ecx, dword [edi]
xor eax, eax
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp + 0xc], esi
and dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x418e4a
push str.Unable_to_copy_help_files
lea ecx, [ebp - 0x2c]
call fcn.004014c8
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.0040915d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004017c6
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.00419782
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x418e8e
cmp esi, 0xffffffff
je 0x418e8e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x418ea1
Capabilities:
Delete file

Disassembly:
mov eax, 0x45f866
call fcn.0041f258
sub esp, 0x18
add ecx, 0x34
cmp dword [ecx + 0x14], 8
push ebx
push dword [ebp + 8]
jb 0x418ebd
mov ecx, dword [ecx]
push ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
push str._1_2
call fcn.004014c8
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
or dword [ebp - 4], 0xffffffff
call fcn.0040c5ba
add esp, 0x24
mov dword [ebp - 4], 1
lea eax, [ebp - 0x24]
cmp dword [ebp - 0x10], 8
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004017c6
mov ecx, dword [ebp - 0xc]
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419ad9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x419aea
mov eax, dword [esi + 4]
jmp 0x419aec
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x403
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
test esi, esi
je 0x419b0e
mov eax, dword [esi + 4]
jmp 0x419b10
xor eax, eax
push 0x423
push eax
call edi
push 5
push eax
call ebx
test esi, esi
je 0x419b26
mov eax, dword [esi + 4]
jmp 0x419b28
xor eax, eax
push 0x423
push eax
call edi
movzx ecx, word [ebp + 8]
mov edi, eax
push ecx
push dword [esi + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x467
push edi
call esi
push 0
push 1
mov ebx, 0x465
push ebx
push edi
call esi
push 0xffff0000
push 0xffffffffffffffff
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41a223
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x45fa55
call fcn.0041f258
sub esp, 0xa0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x50]
push edi
mov edi, edx
call fcn.0041bf22
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
jb 0x41a24f
mov esi, dword [esi]
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
push esi
cmovae eax, dword [ebp - 0x50]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.__1___2
call fcn.004014c8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], bl
call fcn.0040c5ba
mov byte [ebp - 4], 2
lea eax, [ebp - 0x90]
push 0x40
push ebx
push eax
mov dword [ebp - 0x94], 0x44
call fcn.00421460
add esp, 0x30
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov word [ebp - 0x64], di
lea ecx, [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x24], 8
lea edi, [ebp - 0x20]
push ecx
stosd dword es:[edi], eax
lea ecx, [ebp - 0x94]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
push 0x4000000
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x68], 1
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x41a305
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x41a327
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.00404340
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.004017c6
test edi, edi
setne bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.004017c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.004017c6
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret