joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70048ee9
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x7005f474]
mov ecx, dword [ebp + 0x98]
push ebx
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x7005f558]
je 0x70048f1e
inc eax
cmp eax, 0x13
jb 0x70048f0f
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x7005f558]
jne 0x70049041
mov eax, dword [0x700608c8]
cmp eax, 1
je 0x7004901c
cmp eax, edx
jne 0x70048f4e
cmp dword [0x700608cc], 1
je 0x7004901c
cmp ecx, 0xfc
je 0x70049041
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x70048f84
lea eax, [ebp - 0x7c]
push 0x700038cc
push eax
call fcn.7004b070
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.7004b170
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x70048fb8
mov eax, edi
push eax
call fcn.7004b170
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x700038c8
push edi
call fcn.7004fd70
add esp, 0x10
push edi
call fcn.7004b170
push dword [esi + 0x7005f55c]
mov ebx, eax
call fcn.7004b170
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.70047670
mov ebx, esp
push 0x700038ac
push ebx
call fcn.7004b070
push edi
push ebx
call fcn.7004b080
push 0x700038a8
push ebx
call fcn.7004b080
push dword [esi + 0x7005f55c]
push ebx
call fcn.7004b080
push 0x12010
push 0x70003880
push ebx
call fcn.7003bec4
add esp, 0x2c
jmp 0x70049041
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x7005f55c]
push dword [esi]
call fcn.7004b170
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x8c]
call fcn.7004719b
pop edi
pop esi
pop ebx
add ebp, 0x90
leave
ret
Function at 0x7005088c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x7005f474]
xor ecx, ecx
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x700508c6
xor eax, eax
jmp 0x70050a30
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x70062020]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x70050904
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.7003bec4
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x7005099e
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x70050a01
jmp 0x70050928
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x70050963
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x70050954
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x70050934
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x700509c2
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x700509cb
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x70050926
jmp 0x700509cb
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x700509c2
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x700509cb
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x70050a2b
cmp dword [ebp - 0x68], eax
je 0x700509fe
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x700509f3
call fcn.7004bd57
mov dword [eax], 9
call fcn.7004bd65
mov dword [eax], esi
jmp 0x70050a26
push dword [ebp - 0x68]
call fcn.7004bd73
pop ecx
jmp 0x70050a26
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x70050a13
cmp byte [edi], 0x1a
jne 0x70050a13
xor eax, eax
jmp 0x70050a2e
call fcn.7004bd57
mov dword [eax], 0x1c
call fcn.7004bd65
and dword [eax], 0
or eax, 0xffffffff
jmp 0x70050a2e
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
pop edi
call fcn.7004719b
add ebp, 0x3a4
leave
ret
Function at 0x100023dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100023eb
pop dword [ebp - 0x20]
mov eax, 0x72385f0b
sub eax, 0x62383b20
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe3a457c1
add dword [ebp - 0x30], 0x6aaded8a
mov dword [ebp - 0x2c], 0x16222db0
add dword [ebp - 0x2c], 0x1c111e95
mov dword [ebp - 0x28], 0xc67c0030
sub dword [ebp - 0x28], 0x7a2fbc02
mov dword [ebp - 0x24], 0x2dd7c3a5
add dword [ebp - 0x24], 0xd2283c5b
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe920ccc4
sub eax, 0xd9202cc0
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xaf9ebb68
sub dword [ebp - 0x30], 0x3b2c5212
mov dword [ebp - 0x2c], 0x2860348
add dword [ebp - 0x2c], 0x3ee65e2d
mov dword [ebp - 0x28], 0x479c159f
sub dword [ebp - 0x28], 0xe42ca933
mov dword [ebp - 0x24], 0x78f4e362
sub dword [ebp - 0x24], 0x78f4e362
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x145026e8
sub eax, 0x44f86e0
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3869f
push 0
call eax
mov ecx, 0xb7a36ba0
add ecx, 0x485ce39e
xor edi, edi
add edi, eax
mov ebx, 0x1000f800
add ebx, dword [ebp - 0x20]
mov esi, 0x49f4c467
sub esi, 0x1a7831b1
xor dword [ebp - 0x1c], edx
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0xa3d78511
xor edx, esi
mov dword [edi], edx
xor dword [ebp - 0x18], esi
add edi, 0xc26140f2
add edi, 0x3d9ebf12
add ebx, 4
loop 0x10002509
add eax, 0x5128dd3f
add eax, 0xaed8528c
xor ebx, ebx
add ebx, eax
add eax, 0xbde0705e
add eax, 0x421f8fa7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10003ece
pop dword [ebp - 0x44]
mov eax, 0x3bc2416f
add eax, 0xd43dfd5f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x89d82ee4
add dword [ebp - 0x54], 0xc47a1667
mov dword [ebp - 0x50], 0x571bf754
add dword [ebp - 0x50], 0xdb1754f1
mov dword [ebp - 0x4c], 0xaa547ef
add dword [ebp - 0x4c], 0x41a6fc3f
mov dword [ebp - 0x48], 0xbeaad9b4
sub dword [ebp - 0x48], 0xbeaad9b4
lea eax, [ebp - 0x54]
push eax
mov eax, 0x7e2f9f00
sub eax, 0x6e2f4ebc
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x7891d17c
sub dword [ebp - 0x54], 0x41f6826
mov dword [ebp - 0x50], 0x972242d4
sub dword [ebp - 0x50], 0x55b5e15f
mov dword [ebp - 0x4c], 0xcc8f10a6
sub dword [ebp - 0x4c], 0x691fa43a
mov dword [ebp - 0x48], 0x946e357c
sub dword [ebp - 0x48], 0x946e357c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x72f52d43
sub eax, 0x62f4dd03
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x373ca
push 0
call eax
mov ecx, 0xc7a1aca6
sub ecx, 0xc7a1623c
xor ebx, ebx
add ebx, eax
mov esi, 0x1000b600
add esi, dword [ebp - 0x44]
mov edi, 0x2fb623fd
add edi, 0x24d3cde4
sub dword [ebp - 0x40], ebx
mov edx, dword [esi]
xor dword [ebp - 0x14], 0xe2528c76
xor edx, edi
mov dword [ebx], edx
add dword [ebp - 0x2c], ebx
add ebx, 0x947a2111
sub ebx, 0x947a210d
add esi, 0x3c4f85ee
sub esi, 0x3c4f85ea
loop 0x10003fec
add eax, 0x901aee69
sub eax, 0x9019d1ee
xor ebx, ebx
add ebx, eax
add eax, 0x2642321b
add eax, 0xd9bdcdea
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1003ab50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1003ab5f
pop dword [ebp - 0x48]
mov eax, 0x430a0092
add eax, 0xccf9aacd
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x72fb05fd
sub dword [ebp - 0x58], 0x24a8c0b2
mov dword [ebp - 0x54], 0x825c90
add dword [ebp - 0x54], 0x31b0efb5
mov dword [ebp - 0x50], 0x5f50f4f0
add dword [ebp - 0x50], 0xecfb4f3e
mov dword [ebp - 0x4c], 0x7c2d0ec2
add dword [ebp - 0x4c], 0x83d2f13e
lea eax, [ebp - 0x58]
push eax
mov eax, 0xc8b1ac94
add eax, 0x4752c434
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x7f2f30e1
sub dword [ebp - 0x58], 0xabcc78b
mov dword [ebp - 0x54], 0xc6742658
add dword [ebp - 0x54], 0x7af83b1d
mov dword [ebp - 0x50], 0xfd81fa65
add dword [ebp - 0x50], 0x65ed7207
mov dword [ebp - 0x4c], 0x11ae6bcd
sub dword [ebp - 0x4c], 0x11ae6bcd
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x4de0a18f
sub eax, 0x3ddc30ab
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x420a0
push 0
call eax
mov ecx, 0x959a0fa4
sub ecx, 0x9599c941
xor edx, edx
add edx, eax
mov ebx, 0x10063000
add ebx, dword [ebp - 0x48]
mov esi, 0xa3b9891c
add esi, 0xa52040d8
xor dword [ebp - 0x28], esi
mov edi, dword [ebx]
sub dword [ebp - 0x24], 0xd78f1e29
add edi, esi
add dword [ebp - 0x2c], esi
mov dword [edx], edi
sub dword [ebp - 0x44], 0x5afbd9f2
add edx, 0x6b4e69b0
add edx, 0x94b19654
add ebx, 4
loop 0x1003ac7d
add eax, 0x10c5f
mov ebx, eax
add eax, 0xbdf2113a
add eax, 0x420deecb
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000f721
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000f730
pop dword [ebp - 0x38]
mov eax, 0x1000f730
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xe79e3cc5
add dword [ebp - 0x48], 0x66b40886
mov dword [ebp - 0x44], 0x44543c40
add dword [ebp - 0x44], 0xeddf1005
mov dword [ebp - 0x40], 0x59455d70
add dword [ebp - 0x40], 0xf306e6be
mov dword [ebp - 0x3c], 0x7c956cf0
sub dword [ebp - 0x3c], 0x7c956cf0
lea eax, [ebp - 0x48]
push eax
mov eax, 0xe43e691e
sub eax, 0xd43d292e
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x559b48e6
sub dword [ebp - 0x48], 0xe128df90
mov dword [ebp - 0x44], 0x4bb817ce
sub dword [ebp - 0x44], 0xa4bb659
mov dword [ebp - 0x40], 0x3a783d90
sub dword [ebp - 0x40], 0xd708d124
mov dword [ebp - 0x3c], 0xb72e25fd
sub dword [ebp - 0x3c], 0xb72e25fd
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x683808f0
add eax, 0xa7c93708
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3750a
push 0
call eax
mov ecx, 0x3a7ecff4
add ecx, 0xc5817b0c
xor edi, edi
add edi, eax
mov ebx, 0x587c6488
sub ebx, 0x487aca88
add ebx, dword [ebp - 0x38]
mov edx, 0x2a2ab637
sub edx, 0x3eb23e34
mov dword [ebp - 0x14], 0x392547b4
mov esi, dword [ebx]
sub dword [ebp - 0x14], ebx
xor esi, edx
add dword [ebp - 0x28], edx
mov dword [edi], esi
mov dword [ebp - 0x14], 0xc1b6436
add edi, 4
add ebx, 0xd21b255f
sub ebx, 0xd21b255b
loop 0x1000f84f
add eax, 0x2fa62d0a
add eax, 0xd05af1c9
mov ebx, eax
add eax, 0x83024731
add eax, 0x7cfdb8d4
mov ecx, sym.clearkey.dll_Ordinal_0
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x402b08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402b17
pop dword [ebp - 0x44]
mov eax, 0x41f281ad
add eax, 0xbe4da96a
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xfc09f477
add dword [ebp - 0x54], 0x524850d4
mov dword [ebp - 0x50], 0x188aa7b1
sub dword [ebp - 0x50], 0xe6575b6c
mov dword [ebp - 0x4c], 0x1f5da87f
sub dword [ebp - 0x4c], 0xd3116451
mov dword [ebp - 0x48], 0x420534d4
sub dword [ebp - 0x48], 0x420534d4
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x9e45fa65
sub dword [ebp - 0x54], 0x29d3910f
mov dword [ebp - 0x50], 0x2a280f9b
add dword [ebp - 0x50], 0x174451da
mov dword [ebp - 0x4c], 0x25409f5f
sub dword [ebp - 0x4c], 0xc1d132f3
mov dword [ebp - 0x48], 0xc750df2a
sub dword [ebp - 0x48], 0xc750df2a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39c5d
push 0
call eax
mov ecx, 0x6c82bd65
sub ecx, 0x6c826fc9
mov edi, eax
mov ebx, 0xb9fe0d8d
add ebx, 0x46433073
add ebx, dword [ebp - 0x44]
mov edx, 0xd5ccd7b2
mov esi, dword [ebx]
xor dword [ebp - 0x24], 0xc5278146
xor esi, edx
add dword [ebp - 0x2c], 0x8711f2c5
mov dword [edi], esi
add dword [ebp - 0x28], 0x9b3ff3da
add edi, 0xfe74983e
sub edi, 0xfe74983a
add ebx, 4
loop 0x402c29
add eax, 0x408d861b
sub eax, 0x408c5cd8
mov ebx, eax
add eax, 0x19dc678
sub eax, 0x19dc673
mov ecx, 0xbfb6e4bc
add ecx, 0x40891b44
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4107d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4107e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x410824
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x410820
lea ebx, [ebx]
cmp esi, edx
jae 0x410824
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x410810
cmp esi, edx
jb 0x410829
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x412040
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x412055
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x412060
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412060
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4120e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4120f9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412105
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x412100
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4134c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54bdc6
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x5ad1b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x41356c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x41356c
call fcn.00413be0
mov esi, eax
jmp 0x413667
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41358f
call fcn.00413be0
jmp 0x41365a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x4135ad
call fcn.00413be0
jmp 0x41365a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4135ce
mov esi, 0x8007000e
jmp 0x41365c
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00411900
jmp 0x413603
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x41361a
mov esi, 0x8007000e
jmp 0x41365c
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x41363a
call fcn.00413be0
jmp 0x41365a
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00413360
mov esi, eax
test edi, edi
je 0x413667
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x413680
lea ecx, [ebp - 0x418]
call fcn.004118b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00531343
mov esp, ebp
pop ebp
ret 0x10

Function at 0x413d10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041c145
Function at 0x415610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c12b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5ad1b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], ecx
xor eax, eax
xor bl, bl
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.005340d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x415762
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00410d30
push ecx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.00415820
mov eax, dword [ebp - 0x21c]
mov edi, dword [eax - 0xc]
lea esi, [edi + 1]
test esi, esi
jns 0x4156bd
push 0x80070057
call fcn.00413c00
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x4156e0
push esi
lea ecx, [ebp - 0x21c]
call fcn.00410b00
mov eax, dword [ebp - 0x21c]
mov ecx, 0x5c
mov word [eax + edi*2], cx
mov eax, dword [ebp - 0x21c]
cmp esi, dword [eax - 8]
jg 0x4156b3
mov edi, dword [ebp - 0x220]
xor ecx, ecx
mov dword [eax - 0xc], esi
mov eax, dword [ebp - 0x21c]
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x21c]
mov dword [edi + 8], ecx
test eax, eax
jne 0x41571a
xor edx, edx
jmp 0x41572f
mov edx, eax
lea esi, [edx + 2]
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x415720
sub edx, esi
sar edx, 1
push edx
push eax
lea ecx, [edi + 4]
call fcn.00410be0
mov dword [ebp - 4], 0xffffffff
mov bl, 1
mov edx, dword [ebp - 0x21c]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415762
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531343
mov esp, ebp
pop ebp
ret
Function at 0x416280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c238
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5ad1b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 4], 0
mov dword [ebp - 0x20], 0
push 0x58e378
jne 0x4162db
mov ecx, dword [ebp + 8]
call fcn.00410d30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
call fcn.00410d30
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 0
push ebx
push dword [edi + 4]
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x14]
mov dword [edi + 8], eax
test edx, edx
je 0x4163c7
mov eax, dword [ebp - 0x18]
cmp eax, 2
je 0x416379
cmp eax, 6
je 0x416379
cmp eax, 7
je 0x416379
cmp eax, 1
je 0x416379
cmp eax, 4
jne 0x4163c7
mov dword [ebp - 0x1c], eax
xor esi, esi
lea eax, [ebp - 0x1c]
mov dword [ebp + 0xc], esi
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push esi
push ebx
push dword [edi + 4]
call eax
test eax, eax
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
cmove esi, dword [ebp + 0xc]
push esi
push 0x58df78
push eax
call fcn.00410710
add esp, 0xc
jmp 0x4163c7
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00416996
mov esi, eax
add esp, 4
test esi, esi
je 0x4163c7
lea eax, [ebp - 0x14]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push ebx
push dword [edi + 4]
call eax
mov dword [edi + 8], eax
test eax, eax
jne 0x4163be
push esi
lea ecx, [ebp - 0x10]
call fcn.00410ce0
push esi
call fcn.00416991
add esp, 4
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00410550
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
add esi, 0xfffffff0
mov dword [edi], eax
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x416402
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x416740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x416756
mov eax, 3
pop edi
pop ebp
ret 8
push esi
mov esi, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push esi
call fcn.00410d30
mov eax, esi
lea edx, [eax + 2]
jmp 0x416770
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416770
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [ebp + 0xc]
mov edi, eax
add esi, 0xfffffff0
or edx, 0xffffffff
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4167b7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop esi
mov eax, edi
pop edi
pop ebp
ret 8

Function at 0x41c1a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041a2e4
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41c1d8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0041c1f9
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4203b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4203fc
call fcn.0041a2e4
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4203fc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x420418
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042e3b0
mov ebx, eax
test edi, edi
je 0x420416
test esi, esi
je 0x420416
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4