joyce8/EMBER2024-capa huggingface dataset:
Function at 0x150dd50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x150ddec
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x150dd7b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x151a090
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x154f290
push 0x1534528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], reloc.MSVCRT.dll_strncpy
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.015346b0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x159d8c1
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
lea ebx, [esi + 1]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0x159d964
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
add ecx, 2
mov edi, ecx
mov al, byte [edi - 2]
shr al, 2
movzx eax, al
push eax
call fcn.0159d877
mov byte [esi - 2], al
mov cl, byte [edi - 2]
mov al, byte [edi - 1]
and cl, 3
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
push eax
call fcn.0159d877
mov byte [esi - 1], al
mov cl, byte [edi - 1]
mov al, byte [edi]
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
push eax
call fcn.0159d877
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
movzx eax, al
push eax
call fcn.0159d877
mov byte [esi + 1], al
lea edi, [edi + 3]
lea esi, [esi + 4]
dec ebx
jne 0x159d8f5
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
jne 0x159d972
mov word [edi + esi*4 + 2], 0x3d3d
jmp 0x159d97c
cmp ecx, 2
jne 0x159d97e
mov byte [edi + esi*4 + 3], 0x3d
mov esi, ebx
mov eax, esi
shl eax, 2
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x16096a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ch
pushal
setge dl
jmp 0x1609726
pop edx
not dh
mov di, sp
xchg dword [esp + 8], edx
xchg word [esp + 0x17], di
jmp 0x1609762
xchg dword [esp + 0xd], edx
mov edx, 0xecd0e743
xchg word [esp + 0x21], bx
mov edx, 0x29835551
shr cx, cl
pop ecx
jmp 0x16096ee
inc eax
mov dword [esp + 0x1f], esp
push word [esp + 0x1f]
lea edi, [esp + eax]
neg ebp
lea ebp, [esi*4]
jmp 0x1609704
sub esp, 0x11
xor bx, 0xb888
mov esi, ebx
lea edx, [ecx + edi]
mov ecx, 0x19a93a88
push word [esp]
jmp 0x160978f
sub esp, 1
mov dword [esp + 4], ebx
neg di
sub esp, 1
mov dx, 0x275d
cmc
jmp 0x160973e
pop ax
cmc
rdtsc
push dword [esp + 0x22]
add esp, 0x12
not dx
jmp 0x16097fe
bts ax, bp
btr ax, si
mov bh, byte [esp + 0x23]
lea esp, [esp + 0xe]
cmc
xchg word [esp + 0x11], bp
jmp 0x1609776
xchg dword [esp + 9], ebp
xchg dx, cx
lea eax, [edi*4]
mov cx, word [esp + 9]
mov eax, ebp
mov ebp, 0x62984d21
jmp 0x16097e8

Function at 0x16096e5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
mov bx, 0x1aac
sub esp, 7
mov bx, 0x7033
jmp 0x160968e
mov dword [esp + 5], edx
mov di, ax
sub ebx, 0x68f57b0
pop word [esp + 3]
rdtsc
rdtsc
jmp 0x1609634
lea esp, [esp + 4]
pushal
stc
mov cx, word [esp]
cpuid
sub esp, 0xb
jmp 0x160964a
bswap edx
add esp, 0xd
add esp, 1
std
mov eax, dword [esp + 4]
jmp 0x16096bf
mov dh, byte [esp + 0x11]
push word [esp + 0xc]
mov ch, 0xfe
inc dx
lea edx, [eax*4]
xchg word [esp + 4], cx
jmp 0x1609678
lea esp, [esp + 4]
clc
lea ebp, [edx*4]
call fcn.016096a9
mov bh, 0x32
mov al, byte [0xbbdb32c7]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0xdd31
lea esp, [esp + 2]
jmp 0x1609667
Function at 0x1609acf
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol ecx, 9
mov byte [esp + 0x22], ch
mov ah, bh
cpuid
mov cx, si
jmp 0x1609aa9
mov word [esp + 0x1c], ax
pop ebx
mov dword [esp + 0x22], ebp
rdtsc
xchg bx, bp
cmc
jmp 0x1609a81
mov ecx, 0x84e4945a
mov word [esp + 0xc], bp
lea edi, [eax + esi]
dec esi
mov ebx, ecx
add esp, 0x23
jmp 0x1609af1
push bp
sub esp, 0xf
bsr ebp, edi
jmp 0x1609a97
mov ebx, esp
mov bx, 0x2476
mov al, ah
pushfd
std
call fcn.01609b03
xchg ebp, eax
sbb ecx, dword [ebx - 0x105e212]
leave
push 0x310fcf0f
bswap edi
rdtsc
add esp, 9
lea ecx, [esi + ebp]
mov ecx, dword [esp]
xchg byte [esp], dl
jmp 0x1609ad9
Function at 0x160a68b
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.01608ffb
jmp 0x160a857
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1608ff6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x160a736
mov word [esp + 1], si
push word [esp + 2]
mov dword [esp], ebx
lea esp, [esp + 2]
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x160a77e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5709d0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xa2c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa2c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa2c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa2c06a
add dl, dl
jne 0xa2c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa2c0dc
xor eax, eax
add dl, dl
jne 0xa2c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa2c17d
add dl, dl
jne 0xa2c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa2c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa2c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa2c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa2c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa2c075
mov eax, 1
add dl, dl
jne 0xa2c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa2c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa2c0e1
sub eax, ebx
mov ebx, 1
jne 0xa2c128
mov ecx, 1
add dl, dl
jne 0xa2c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa2c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa2c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa2c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa2c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa2c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa2c136
cmp eax, 0x7d00
jae 0xa2c16d
cmp eax, 0x500
jb 0xa2c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa2c075
cmp eax, 0x7f
ja 0xa2c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa2c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa2c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa2c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f91a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004456c7
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x4021bf
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.00447add
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x482834
push eax
call fcn.004498b4
push eax
push esi
call fcn.00445a0f
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4086b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x460368
push eax
mov dword fs:[0], esp
sub esp, 0x28
cmp byte [ecx + 0x9d], 0
push ebx
push esi
push edi
jne 0x40888b
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea esi, [ecx + 0x6c]
mov dword [ebp - 4], 0
push str.config.h
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00413950
push 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.004200b0
mov byte [ebp - 4], 0
add esp, 8
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x408735
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00412370
push str.config.asm
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00413950
push 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004200b0
mov byte [ebp - 4], 0
add esp, 8
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x408770
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00412370
push str.libavutil_avconfig.h
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00413950
push 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.004200b0
mov byte [ebp - 4], 0
add esp, 8
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x4087ab
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00412370
push str.libavutil_ffversion.h
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00413950
push 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.004200b0
mov eax, dword [ebp - 0x20]
add esp, 8
cmp eax, 0x10
jb 0x4087e2
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.00412370
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
cmp esi, edi
je 0x40880e
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi + 0x14], 0x10
jb 0x4087fc
mov eax, dword [esi]
jmp 0x4087fe
mov eax, esi
push eax
call ebx
add esi, 0x18
cmp esi, edi
jne 0x4087f2
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x40888b
push dword [ebp - 0x10]
mov edx, edi
push ecx
mov ecx, esi
call fcn.00414a80
mov ecx, dword [ebp - 0x14]
mov eax, 0x2aaaaaab
mov ebx, dword [ebp - 0x1c]
add esp, 8
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xaaaaaaa
jbe 0x408847
call fcn.0044ce5a
lea eax, [eax + eax*2]
shl eax, 3
cmp eax, 0x1000
jb 0x408882
test bl, 0x1f
je 0x40885e
call fcn.0044ce5a
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x40886a
call fcn.0044ce5a
sub ebx, eax
cmp ebx, 4
jae 0x408876
call fcn.0044ce5a
cmp ebx, 0x23
jbe 0x408880
call fcn.0044ce5a
mov ebx, eax
push ebx
call fcn.00446ee6
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x460788
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x41199f
cmp byte [edi + 0x3d], 0
je 0x41199f
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x411898
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
cmp ecx, 0x10
movq qword [ebp - 0x2c], xmm0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
nop
mov eax, dword [edi + 0x38]
lea ebx, [ebp - 0x2c]
cmp ecx, 0x10
lea esi, [ebp - 0x2c]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4118f5
mov dword [ebp - 0x10], esi
xor eax, eax
jmp 0x411916
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [ebp - 0x14]
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub eax, 0
je 0x411929
sub eax, 1
je 0x41192d
sub eax, 2
je 0x41197a
xor bl, bl
jmp 0x41197c
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x41195c
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0044d2b0
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov edx, dword [ebp - 0x2c]
cmp esi, eax
jne 0x411925
cmp byte [edi + 0x3d], 0
je 0x41197a
test esi, esi
jne 0x4118d0
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00411410
jmp 0x4118c8
mov bl, 1
cmp ecx, 0x10
jb 0x41198c
inc ecx
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00412370
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f9a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 8
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00446b47
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0044590c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.004119c0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x412630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45f9a6
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00446b47
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0044590c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f9f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
movzx ecx, si
mov edi, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x10], eax
cmp edi, esi
ja 0x41fa5e
cmp dword [ebx + 0x14], esi
je 0x41fa5e
push 1
push esi
mov ecx, ebx
call fcn.004107e0
test al, al
je 0x41fa5e
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], edi
jb 0x41fa58
mov eax, dword [ebx]
jmp 0x41fa5a
mov eax, ebx
mov byte [eax + edi], 0
mov ecx, dword [ebx + 0x10]
cmp esi, ecx
ja 0x41fa7e
mov dword [ebx + 0x10], esi
cmp dword [ebx + 0x14], 0x10
jb 0x41fa76
mov eax, dword [ebx]
mov byte [eax + esi], 0
jmp 0x41fa8c
mov eax, ebx
mov byte [eax + esi], 0
jmp 0x41fa8c
mov eax, esi
sub eax, ecx
mov ecx, ebx
push 0
push eax
call fcn.00411410
cmp dword [ebx + 0x14], 0x10
jb 0x41fa94
mov ebx, dword [ebx]
push esi
push dword [esp + 0x14]
push ebx
call fcn.00449340
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret

Function at 0x41fdd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov edx, ecx
lea ecx, [esp]
push 0
call fcn.00413b50
add esp, 4
mov dword [esp + 0x18], 0
cmp dword [esp + 0x14], 0x10
lea eax, [esp]
mov dword [esp + 0x1c], 3
cmovae eax, dword [esp]
mov dword [esp + 0x20], eax
mov eax, 0x614
mov word [esp + 0x28], ax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x28], 0x472690
mov dword [esp + 0x2e], 0
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0x472690
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov eax, dword [esp + 0x14]
cmp eax, 0x10
jb 0x41fe54
inc eax
lea ecx, [esp]
push eax
push dword [esp + 4]
call fcn.00412370
mov esp, ebp
pop ebp
ret
Function at 0x41ff10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45f988
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0x10
jb 0x41ff38
mov eax, dword [esi]
jmp 0x41ff3a
mov eax, esi
push eax
call fcn.0044db45
add esp, 4
test eax, eax
je 0x41ffef
call fcn.0044d381
cmp dword [eax], 0x11
je 0x41ffef
call fcn.0044d381
cmp dword [eax], 2
jne 0x41ff92
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], 0x2f
push eax
mov ecx, esi
call fcn.00410a50
cmp eax, 0xffffffff
jne 0x41ffa3
push 1
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], 0x5c
push eax
mov ecx, esi
call fcn.00410a50
cmp eax, 0xffffffff
jne 0x41ffa3
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push eax
push 0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040edf0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0041ff10
test al, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
sete bl
call fcn.0040f2f0
test bl, bl
pop ebx
jne 0x41ff92
mov ecx, esi
call fcn.0041ff10
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret