joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007e7f
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push dword [0x1001dc90]
call dword [sym.imp.KERNEL32.dll_SetEvent]
nop
xor edi, edi
push edi
push 0xffffffffffffffff
push edi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
nop
push edi
push edi
push 0x12
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
nop
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1388
push dword [esi + 0x1c]
call edi
mov ebx, 0x102
cmp eax, ebx
jne 0x10007ed3
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push dword [esi + 0x10]
call edi
cmp eax, ebx
jne 0x10007ee9
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push dword [esi + 4]
call edi
cmp eax, ebx
jne 0x10007efe
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
push dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [0x1001dc90]
call edi
nop
push dword [esi]
call edi
nop
push dword [esi + 0xc]
call edi
nop
push dword [esi + 0x18]
call edi
nop
push dword [esi + 4]
call edi
nop
push dword [esi + 0x10]
call edi
push dword [esi + 0x1c]
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x10008297
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
nop
push 0x3c
xor edi, edi
pop esi
lea eax, [ebp - 0x44]
push esi
push edi
push eax
call fcn.1000a3e0
nop
mov dword [ebp - 0x44], esi
nop
mov dword [ebp - 0x40], 0x440
nop
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], str.open
mov dword [ebp - 0x34], eax
nop
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
nop
mov dword [ebp - 0x28], edi
nop
lea eax, [ebp - 0x44]
push eax
call fcn.1000180f
add esp, 0x10
test eax, eax
je 0x100082ea
xor eax, eax
jmp 0x10008334
nop
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [0x1001dc90]
mov dword [ebp - 4], eax
nop
push 0x493e0
lea eax, [ebp - 8]
push edi
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
nop
mov esi, 0x102
cmp edi, esi
jne 0x10008324
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, esi
setne al
pop edi
pop esi
leave
ret 8
Function at 0x1000966c
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
mov eax, 0x1001399c
call fcn.1000a92c
sub esp, 0x334
mov al, byte [ebp + 0xb]
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x1c]
push edi
mov byte [ebp - 0x1c], al
call fcn.10003e65
push dword [ebp + 8]
call fcn.1000a990
pop ecx
push eax
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.100040d4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
cmp eax, edi
mov esi, 0x1001435c
jne 0x100096b6
mov eax, esi
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
mov eax, dword [ebp - 0x18]
cmp eax, edi
jne 0x100096c9
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebx
test eax, eax
je 0x100096de
push 1
pop esi
jmp 0x10009786
mov al, byte [ebp + 0xb]
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], al
call fcn.10003e65
mov al, byte [ebp + 0xb]
push edi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
mov byte [ebp - 0x3c], al
call fcn.10003e65
mov byte [ebp - 4], 2
nop
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10009e14
add esp, 0xc
nop
mov al, byte [0x1001c1a0]
push 0x7f
mov byte [ebp - 0x340], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x33f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x340]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
lea eax, [ebp - 0x140]
xor edi, edi
push eax
push edi
lea eax, [ebp - 0x340]
push 0x1001b038
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1000979b
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.10003e65
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10003e65
xor esi, esi
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call fcn.10003e65
mov eax, esi
jmp 0x10009845
lea eax, [ebp - 0x140]
push eax
call ebx
test eax, eax
je 0x10009819
mov eax, dword [ebp - 0x18]
cmp eax, edi
jne 0x100097b1
mov eax, esi
lea ecx, [ebp - 0x140]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x100097d7
cmp dword [ebp - 0x18], edi
je 0x100097cb
mov esi, dword [ebp - 0x18]
push edi
push esi
call fcn.10009854
pop ecx
pop ecx
nop
jmp 0x10009819
mov eax, dword [ebp - 0x18]
cmp eax, edi
jne 0x100097e0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100097fd
lea eax, [ebp - 0x140]
push edi
push eax
call fcn.10009854
pop ecx
pop ecx
jmp 0x10009819
lea eax, [ebp - 0x140]
push eax
call ebx
nop
cmp dword [ebp - 0x18], edi
je 0x1000980f
mov esi, dword [ebp - 0x18]
push edi
push esi
call fcn.10009854
pop ecx
pop ecx
nop
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.10003e65
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10003e65
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call fcn.10003e65
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000efa3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1001b4c0
cmp edx, dword [eax]
je 0x1000efc5
add eax, 8
inc ecx
cmp eax, 0x1001b550
jl 0x1000efb6
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1001b4c0]
jne 0x1000f0f3
mov eax, dword [0x1001dccc]
cmp eax, 1
je 0x1000f0cd
test eax, eax
jne 0x1000eff6
cmp dword [0x1001dcd0], 1
je 0x1000f0cd
cmp edx, 0xfc
je 0x1000f0f3
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000f02d
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1000abd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1000a990
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1000f070
lea eax, [ebp - 0x1a4]
push eax
call fcn.1000a990
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x10014b3c
push edi
call fcn.1000ad20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1000abd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1000abe0
lea eax, [ebp - 0xa0]
push 0x10014b1c
push eax
call fcn.1000abe0
push dword [esi + 0x1001b4c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.1000abe0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.100106ed
add esp, 0x2c
pop edi
jmp 0x1000f0f3
lea eax, [ebp + 8]
lea esi, [esi + 0x1001b4c4]
push 0
push eax
push dword [esi]
call fcn.1000a990
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x10012874
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10013a2c
call fcn.1000a92c
sub esp, 0x464
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x10012930
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], ebx
call fcn.100132d4
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
push ebx
push eax
mov edi, 0x400
lea eax, [ebp - 0x470]
push edi
push eax
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call esi
cmp dword [ebp + 8], ebx
jbe 0x10012908
push dword [ebp + 8]
lea eax, [ebp - 0x470]
lea ecx, [ebp - 0x70]
push eax
call fcn.10013423
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x470]
push edi
push eax
push dword [ebp - 0x14]
jmp 0x100128dd
push dword [ebp + 0xc]
lea ecx, [ebp - 0x70]
call fcn.1001335c
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x10012932
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x100132d4
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], 0x10014d74
push eax
call fcn.1000a3e0
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x708540
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x1f0000]
lea eax, [edi + 0x2e54b8]
push dword [eax]
mov dword [eax], 0x72392e70
push eax
push edi
or ebp, 0xffffffff
jmp 0x708572
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x708579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x708568
mov eax, 1
add ebx, ebx
jne 0x70858b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70859c
jne 0x7085bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7085bb
dec eax
add ebx, ebx
jne 0x7085a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x708580
add ebx, ebx
jne 0x7085b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70860d
xor ecx, ecx
sub eax, 3
jb 0x7085d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x708642
sar eax, 1
mov ebp, eax
jmp 0x7085de
add ebx, ebx
jne 0x7085de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7085ac
inc ecx
add ebx, ebx
jne 0x7085ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7085ac
add ebx, ebx
jne 0x7085f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7085ee
jne 0x70860a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7085ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70862c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70861e
jmp 0x70856e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70862c
add edi, ecx
jmp 0x70856e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x10a1d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70864e
cmp byte [edi], 0x27
jne 0x70864e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x708653
lea edi, [esi + 0x2fb000]
mov eax, dword [edi]
or eax, eax
je 0x7086cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3081e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3083dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x708680
mov ecx, edi
jns 0x7086af
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3083e4]
or eax, eax
je 0x7086c5
mov dword [ebx], eax
add ebx, 4
jmp 0x70869d
call dword [esi + 0x3083e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7086fc
cmp al, 0xef
ja 0x7086ef
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7086d1
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7086de
mov ebp, dword [esi + 0x3083e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x708730
sub esp, 0xffffff80
jmp 0x5ca4f0
Function at 0x403200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004022db
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
cld
invalid
push dword [eax]
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov al, byte [0x38fffffc]
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
cmp al, 0xc6
test dword [ebx + 0x27fffffc], esp
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
test dword [ebx + 0x55fffffc], ebp

Function at 0x407864
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407880
shr eax, 1
xor eax, 0xedb88320
jmp 0x407882
shr eax, 1
dec edx
jne 0x407873
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40786c
pop esi
ret

Function at 0x407898
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bb
call fcn.00407864
push 1
push 0x40c558
call fcn.004043d0
mov eax, edi
test esi, esi
je 0x4078e6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x420ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x420ee4
pop dword [ebp - 0x18]
mov eax, 0x420ee4
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd9168e5c
sub dword [ebp - 0x28], 0x8ac44911
mov dword [ebp - 0x24], 0xc449c0c8
sub dword [ebp - 0x24], 0x92167483
mov dword [ebp - 0x20], 0x19752511
add dword [ebp - 0x20], 0x32d71f1d
mov dword [ebp - 0x1c], 0x7dba97e9
add dword [ebp - 0x1c], 0x82456817
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf2dd04d9
sub dword [ebp - 0x28], 0x7e6a9b83
mov dword [ebp - 0x24], 0xd420b66c
sub dword [ebp - 0x24], 0x92b454f7
mov dword [ebp - 0x20], 0xa51f2675
add dword [ebp - 0x20], 0xbe5045f7
mov dword [ebp - 0x1c], 0x6ab931f
add dword [ebp - 0x1c], 0xf9546ce1
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e664
push 0
call eax
mov ecx, 0x4a96
mov edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x18]
mov esi, 0x91a197a9
add esi, 0xd04f3fab
mov edx, dword [ebx]
xor dword [ebp - 0xc], ecx
xor edx, esi
add dword [ebp - 0x14], ebx
mov dword [edi], edx
sub dword [ebp - 0xc], ecx
add edi, 0xfdc64ca4
sub edi, 0xfdc64ca0
add ebx, 4
loop 0x420feb
add eax, 0x11d2b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x53389922
sub ecx, 0x52f89922
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4078bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ec70]
jne 0x4078c9
repz ret
jmp fcn.0040c1f9

Function at 0x40a71a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004039ac
and dword [ebp - 4], 0
cmp dword [0x43393c], 0
mov ebx, eax
jne 0x40a7cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a87c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a87c
push eax
call fcn.0040393a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43393c], eax
call esi
push eax
call fcn.0040393a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433940], eax
call esi
push eax
call fcn.0040393a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433944], eax
call esi
push eax
call fcn.0040393a
pop ecx
mov dword [0x43394c], eax
test eax, eax
je 0x40a7cb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040393a
pop ecx
mov dword [0x433948], eax
mov eax, dword [0x433948]
cmp eax, ebx
je 0x40a823
cmp dword [0x43394c], ebx
je 0x40a823
push eax
call fcn.004039b5
push dword [0x43394c]
mov esi, eax
call fcn.004039b5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a823
test edi, edi
je 0x40a823
call esi
test eax, eax
je 0x40a81a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a81a
test byte [ebp - 0xc], 1
jne 0x40a823
or dword [ebp + 0x10], 0x200000
jmp 0x40a85c
mov eax, dword [0x433940]
cmp eax, ebx
je 0x40a85c
push eax
call fcn.004039b5
pop ecx
test eax, eax
je 0x40a85c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a85c
mov eax, dword [0x433944]
cmp eax, ebx
je 0x40a85c
push eax
call fcn.004039b5
pop ecx
test eax, eax
je 0x40a85c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43393c]
call fcn.004039b5
pop ecx
test eax, eax
je 0x40a87c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a87e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012b0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1af0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0x1ae8]
mov ebx, dword [esi + 0x1aec]
shr ecx, 0x1c
mov eax, edi
and eax, 0xf
shl ebx, 4
add ecx, ebx
mov edx, edi
shr edx, 4
shl eax, 0x1c
cmp edi, ecx
sbb ecx, ecx
and ecx, 0x10000000
push ecx
push eax
push edx
mov edx, dword [esi + 0x28]
push 4
push edx
mov dword [esi + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0x1af0], eax
je 0x401316
mov dword [esi + 0x18], edi
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x42f9e4]
push 0x4274ac
push str.Debug.txt
mov esi, eax
call fcn.0041269d
push esi
push esi
push 0x4274c8
push str._s_d__x__n
push eax
mov dword [edi], eax
call fcn.004125e3
mov eax, dword [edi]
push eax
call fcn.00412592
push 0xdf
call fcn.004060c0
push eax
call fcn.00406420
add esp, 0x28
pop edi
pop esi
pop ebx
ret 4
Function at 0x401fd0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x401fe1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esi + 0x1af0]
push eax
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x402025
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x402025
mov ecx, dword [esi + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esi + 0x48], 0x7e
lea eax, [esi + 0x48]
mov dword [esi + 0x10], 0
jne 0x402025
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x4076b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4263c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x2c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
push edx
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.0040e830
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esi + 0x4930b4], ecx
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esi], 0x427ee0
mov dword [esi + 0x48b008], eax
call fcn.00409bd0
mov ecx, dword [esp + 8]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x20
Function at 0x410e70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x4c
push esi
xor esi, esi
cmp word [0x431010], si
push edi
jne 0x410e92
push 0x431010
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x410ea8
push 0x5c
push 0x431010
call fcn.00412f59
add esp, 8
cmp eax, esi
je 0x410ea8
mov word [eax], si
push 0x431010
call fcn.004126b0
add esp, 4
cmp eax, 3
jne 0x410ecb
cmp word [0x431014], 0x5c
jne 0x410ecb
mov word [0x431014], si
mov eax, dword [esp + 0x6c]
cmp eax, esi
je 0x410ee1
push eax
push 0x431010
call fcn.00412e5e
add esp, 8
mov eax, dword [esp + 0x68]
push ebx
push eax
push 0x431010
call fcn.00412e34
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x64]
push 0x4279f8
push edi
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0x431010
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x200
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0x88002c
mov word [esp + 0x54], si
mov word [esp + 0x56], si
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 1
mov dword [esp + 0x60], 0x410d30
mov dword [esp + 0x64], esi
call fcn.00412ef1
add esp, 0x10
test eax, eax
jne 0x410f90
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
mov ebx, eax
jmp 0x410f94
mov ebx, dword [esp + 0x70]
push 0x427980
push edi
call fcn.00412ef1
add esp, 8
test eax, eax
jne 0x410fb3
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
mov ebx, eax
cmp ebx, esi
pop ebx
jne 0x410fc0
pop edi
xor eax, eax
pop esi
add esp, 0x4c
ret
push 0x427980
push edi
call fcn.00412ef1
add esp, 8
test eax, eax
jne 0x411014
cmp word [esp + 0x42], si
mov edx, dword [esp + 0x14]
jne 0x411014
mov ecx, dword [esp + 0x20]
lea ecx, [ecx + ecx - 1]
cmp ecx, esi
jbe 0x411003
lea esp, [esp]
mov si, word [edx]
add edx, 2
test si, si
jne 0x410ff0
inc eax
movzx esi, ax
cmp esi, ecx
jb 0x410ff0
add edx, 2
push edx
push 0x431010
call fcn.00412e34
add esp, 8
pop edi
mov eax, 0x431010
pop esi
add esp, 0x4c
ret

Function at 0x411199
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4111ae
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4111c0
xor eax, eax
jmp 0x4111f2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4111e4
cmp esi, eax
jae 0x4111bc
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4111d6
cmp esi, eax
jae 0x4111bc
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret