joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f54
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x18
mov eax, 0x437bf7
call fcn.0041a581
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
xor ebx, ebx
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401f9f
call fcn.0041393c
push 0xc7
push eax
push ecx
mov esi, esp
call fcn.00413c5e
push eax
mov ecx, esi
call fcn.00413a4e
mov ecx, edi
call fcn.004142d3
jmp 0x402031
test al, 1
jne 0x401fab
mov dword [edi], 1
jmp 0x402020
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
test al, al
jne 0x40201e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
mov ecx, edx
cmovle ecx, eax
test ecx, ecx
jns 0x401fe0
test eax, eax
cmovle edx, eax
jmp 0x401fe5
mov edx, 0x80004005
push 0xcd
push edx
push ecx
mov esi, esp
call fcn.00413c5e
push eax
mov ecx, esi
call fcn.00413a4e
lea ecx, [ebp - 0x24]
call fcn.004142d3
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.0040153c
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
jmp 0x402031
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00413c5e
push eax
lea ecx, [edi + 8]
call fcn.00413a4e
mov eax, edi
call fcn.0041a54a
ret

Function at 0x402065
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x45106c]
xor eax, esp
mov dword [esp + 0x68], eax
and dword [esp], 0
lea ecx, [esp + 4]
push ebx
call fcn.004138e0
lea ecx, [esp + 4]
add eax, 4
push ecx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
lea ecx, [esp + 8]
neg ebx
sbb bl, bl
call fcn.004138aa
add bl, 1
je 0x4020b0
xor al, al
jmp 0x4020b8
cmp dword [esp + 4], 0
setne al
mov ecx, dword [esp + 0x6c]
pop ebx
xor ecx, esp
call fcn.0041a00c
mov esp, ebp
pop ebp
ret
Function at 0x4020c8
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push 0x268
mov eax, 0x437c3b
call fcn.0041a5b5
mov ebx, ecx
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x4020fe
test ebx, ebx
je 0x4020f4
push 0x449ab4
call fcn.004140fd
mov edi, 0x80070057
jmp 0x4022d4
push 0x445258
lea edx, [ebp + 8]
xor edi, edi
lea ecx, [ebp - 0x26c]
call fcn.0040fd4a
pop ecx
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
cmp eax, 0xffffffff
je 0x40226f
mov esi, eax
push 0x449ab4
lea edx, [ebp + 8]
lea ecx, [ebp - 0x270]
call fcn.0040fd4a
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x264]
call fcn.0040fd4a
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x270]
lea ecx, [ecx - 0x10]
call fcn.004142bb
test byte [ebp - 0x260], 0x10
je 0x4021ec
lea eax, [ebp - 0x234]
push eax
push 0x445260
call fcn.00420f96
pop ecx
pop ecx
test eax, eax
je 0x402240
lea eax, [ebp - 0x234]
push eax
push 0x445268
call fcn.00420f96
pop ecx
pop ecx
test eax, eax
je 0x402240
push ecx
mov ecx, dword [ebp - 0x264]
mov esi, esp
mov dword [ebp - 0x274], esi
lea ecx, [ecx - 0x10]
call fcn.0041423d
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.004020c8
mov esi, dword [ebp - 0x268]
pop ecx
test eax, eax
jns 0x402240
mov edi, eax
jmp 0x402240
mov ecx, dword [ebp - 0x264]
call fcn.00402039
test eax, eax
jne 0x402240
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x402229
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x40222e
mov edi, 0x80004005
test ebx, ebx
je 0x402240
lea eax, [ebp - 0x264]
mov ecx, ebx
push eax
call fcn.004136ae
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.004142bb
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40213c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
test edi, edi
js 0x4022d4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4022d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x4022c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x4022c5
mov edi, 0x80004005
test ebx, ebx
je 0x4022d4
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.004136ae
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004142bb
mov eax, edi
call fcn.0041a55f
ret
Function at 0x402d74
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x28
mov eax, 0x437e80
call fcn.0041a581
mov dword [ebp - 0x10], edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
push eax
push eax
push 3
push eax
push 1
push 1
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x402f6e
test esi, esi
je 0x402f6e
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
setne al
test al, al
jne 0x402e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
mov ecx, edx
cmovle ecx, eax
test ecx, ecx
jns 0x402df1
test eax, eax
cmovle edx, eax
jmp 0x402df6
mov edx, 0x80004005
push 0x30e
push edx
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0x34]
call fcn.004142d3
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.0040153c
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
jmp 0x402f9b
cmp dword [ebp + 0xc], 0
mov edi, dword [ebp - 0x28]
je 0x402e71
cmp dword [ebp - 0x24], 0
jl 0x402e71
jg 0x402e49
cmp edi, dword [ebp + 0xc]
jbe 0x402e71
push 0x313
push 0x80004005
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0x34]
call fcn.004142d3
mov byte [ebp - 4], 3
jmp 0x402e18
push ecx
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00413490
test al, al
jne 0x402ea5
push 0x31c
push 0x8007000e
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
mov ecx, ebx
call fcn.004142d3
jmp 0x402f9b
test edi, edi
jne 0x402ec3
and dword [ebx], 0
and dword [ebx + 4], 0
call fcn.00413c5e
push eax
lea ecx, [ebx + 8]
call fcn.00413a4e
jmp 0x402f9b
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push edi
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00410c02
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
test al, al
jne 0x402f35
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
mov ecx, edx
cmovle ecx, eax
test ecx, ecx
jns 0x402f09
test eax, eax
cmovle edx, eax
jmp 0x402f0e
mov edx, 0x80004005
push 0x323
push edx
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0x34]
call fcn.004142d3
mov byte [ebp - 4], 4
jmp 0x402e18
cmp dword [ebp - 0x14], edi
sete al
test al, al
jne 0x402ea9
push 0x324
push 0x80004005
push ecx
mov edi, esp
call fcn.00413c5e
push eax
mov ecx, edi
call fcn.00413a4e
lea ecx, [ebp - 0x34]
call fcn.004142d3
mov byte [ebp - 4], 5
jmp 0x402e18
call fcn.0041393c
push 0x308
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
mov edx, str.Error_opening_file:
call fcn.0040fcda
pop ecx
mov ecx, ebx
call fcn.004142d3
cmp esi, 0xffffffff
je 0x402fa2
test esi, esi
je 0x402fa2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov eax, ebx
call fcn.0041a54a
ret
Function at 0x4035f5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x437f66
call fcn.0041a5ec
mov eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
xor esi, esi
lea edx, [ebp - 0x18]
push edx
push esi
lea edx, [ebp - 0x14]
mov dword [ebp - 4], esi
push edx
push esi
push eax
push ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
je 0x403653
movzx eax, dx
or eax, 0x80070000
test edx, edx
mov ecx, eax
cmovle ecx, edx
test ecx, ecx
jns 0x403649
test edx, edx
cmovle eax, edx
jmp 0x403718
mov eax, 0x80004005
jmp 0x403718
cmp dword [ebp - 0x14], 1
je 0x40365f
cmp dword [ebp - 0x14], 2
jne 0x403649
mov ebx, dword [ebp - 0x18]
test ebx, ebx
jne 0x403675
mov ecx, dword [ebp + 8]
call fcn.00413e84
xor eax, eax
jmp 0x403718
cmp ebx, 1
je 0x403649
mov edi, dword [ebp + 8]
mov ecx, edi
shr ebx, 1
lea eax, [ebx + 1]
push eax
call fcn.00413fb3
mov dword [ebp - 0x1c], eax
mov ecx, edi
lea eax, [ebx + 1]
push eax
call fcn.00414038
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x4036e3
mov ecx, dword [ebp + 8]
push esi
call fcn.00414038
movzx ecx, di
or ecx, 0x80070000
test edi, edi
mov eax, ecx
cmovle eax, edi
test eax, eax
jns 0x4036da
test edi, edi
cmovle ecx, edi
jmp 0x4036df
mov ecx, 0x80004005
mov eax, ecx
jmp 0x403718
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov word [eax + ebx*2], cx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x403702
push dword [eax - 8]
push eax
call int.00420dda
pop ecx
pop ecx
mov esi, eax
push esi
mov ecx, ebx
call fcn.00414038
jmp 0x40366e
call fcn.0041a54a
ret

Function at 0x40396d
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437ffa
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4039c9
test al, 0x10
jne 0x4039c9
test al, 1
je 0x4039c1
mov edx, dword [esi]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401f54
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004142bb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.004142bb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403ec2
Capabilities:
Reference http user-agent string

Disassembly:
push 0xc58
mov eax, 0x4380e8
call fcn.0041a5b5
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0xc48], ebx
and dword [ebp - 0xc58], 0
lea eax, [ebp - 0xc40]
mov edi, 0xc30
push edi
push 0
push eax
call fcn.0041b4e0
add esp, 0xc
mov dword [ebp - 0xc48], edi
lea eax, [ebp - 0xc48]
xor edi, edi
push eax
lea eax, [ebp - 0xc40]
push eax
push edi
call dword [sym.imp.urlmon.dll_ObtainUserAgentString]
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], edi
call fcn.00413c5e
push eax
lea ecx, [ebp - 0xc4c]
call fcn.00413a4e
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc54], edi
jge 0x403fa6
cmp dword [ebp - 0xc50], edi
push 0x64
pop eax
cmovne eax, dword [ebp - 0xc50]
push eax
push dword [ebp - 0xc54]
push ecx
mov esi, esp
mov dword [ebp - 0xc44], esi
mov edi, dword [ebp - 0xc4c]
lea ecx, [edi - 0x10]
call fcn.0041423d
add eax, 0x10
lea ecx, [ebp - 0xc64]
mov dword [esi], eax
call fcn.004142d3
lea eax, [ebp - 0xc64]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0040153c
mov ecx, dword [ebp - 0xc5c]
add ecx, 0xfffffff0
call fcn.004142bb
lea ecx, [edi - 0x10]
call fcn.004142bb
jmp 0x403ffe
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc4c]
lea ecx, [ecx - 0x10]
call fcn.004142bb
lea eax, [ebp - 0xc40]
push eax
lea ecx, [ebp - 0xc44]
call fcn.0041310c
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004136ae
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc44]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov dword [ebx], edi
mov dword [ebx + 4], edi
call fcn.00413c5e
push eax
lea ecx, [ebx + 8]
call fcn.00413a4e
mov eax, ebx
call fcn.0041a55f
ret
Function at 0x4083b7
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x43840d
call fcn.0041a581
xor edi, edi
cmp dword [ecx + 8], 0xffffffff
mov dword [ebp - 0x14], edi
je 0x4084c8
cmp dword [ecx + 8], edi
je 0x4084c8
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x10], edi
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
jne 0x408462
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
mov ecx, edx
cmovle ecx, eax
test ecx, ecx
jns 0x40841d
test eax, eax
cmovle edx, eax
jmp 0x408422
mov edx, 0x80004005
push 0x113
push edx
push ecx
mov esi, esp
call fcn.00413c5e
push eax
mov ecx, esi
call fcn.00413a4e
lea ecx, [ebp - 0x20]
call fcn.004142d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], edi
call fcn.0040153c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004142bb
mov eax, dword [ebp + 8]
jmp 0x4084ef
cmp dword [ebp - 0x10], esi
sete al
test al, al
jne 0x4084d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
mov ecx, edx
cmovle ecx, eax
test ecx, ecx
jns 0x40848d
test eax, eax
cmovle edx, eax
jmp 0x408492
mov edx, 0x80004005
push 0x114
push edx
push ecx
mov esi, esp
call fcn.00413c5e
push eax
mov ecx, esi
call fcn.00413a4e
lea ecx, [ebp - 0x2c]
call fcn.004142d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], 1
call fcn.0040153c
mov ecx, dword [ebp - 0x24]
jmp 0x408452
push edi
push dword [ebp + 0x18]
add ecx, 0x10
push dword [ebp + 0x14]
call fcn.0040f802
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.00413c5e
push eax
lea ecx, [esi + 8]
call fcn.00413a4e
mov eax, esi
call fcn.0041a54a
ret 0x14
Function at 0x40c3ed
Capabilities:
Access the windows event log

Disassembly:
push 0x18
mov eax, 0x43935b
call fcn.0041a581
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00413c5e
push eax
lea ecx, [ebp - 0x10]
call fcn.00413a4e
mov byte [ebp - 4], 1
mov eax, dword [0x45305c]
cmp dword [eax - 0xc], ebx
je 0x40c466
push 0x45305c
mov edx, str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x14]
call fcn.0040fcda
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
push ecx
push str.DisplayName
push dword [eax]
mov edx, 0x80000002
lea ecx, [ebp - 0x24]
call fcn.0040371e
mov ecx, dword [ebp - 0x1c]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004142bb
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
jne 0x40c47e
push str.Ninite_Service
lea ecx, [ebp - 0x10]
call fcn.004140fd
mov esi, dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
test edi, edi
je 0x40c4ad
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea ecx, [esi - 0x10]
call fcn.004142bb
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004142bb
call fcn.0041a54a
ret

Function at 0x40ce53
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea ebx, [ecx + 0x25]
mov dword [ebp - 4], ecx
push 0
mov dword [ebx], 0x3a8
mov dword [ecx + 0x2d], 1
mov dword [ecx + 0x31], 7
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
push 0
push 0x32
call esi
push eax
push 0x31
call esi
push eax
push 1
push 1
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, dword [ebp - 4]
mov dword [esi + 0x39], eax
lea ecx, [esi + 0x3d]
mov eax, dword [esi + 4]
mov dword [esi + 0x29], eax
push dword [0x453054]
call fcn.00412d78
push ebx
xor ebx, ebx
mov dword [esi + 0x35], 0x401
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push ebx
push ebx
push dword [esi + 4]
push 0x40cb72
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x453048], eax
test eax, eax
jne 0x40cf1d
call fcn.0041393c
push ebx
push ebx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.004131cf
pop ecx
pop ecx
push ebx
push str.Error
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004142bb
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40cfd8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp edi, 1
jne 0x40d016
push ecx
mov ecx, esi
mov dword [esi + 0x3e4], 1
call fcn.0040ce53
mov dword [ebx], eax
cmp dword [esi + 0x3e4], 0
je 0x40d06b
xor eax, eax
inc eax
jmp 0x40d0de
cmp edi, 0x111
jne 0x40d06b
movzx eax, word [ebp + 0xc]
mov dword [esi + 0x3e4], 1
cmp eax, 6
je 0x40d05a
cmp eax, 0x8004
jne 0x40d066
cmp byte [0x453000], 0
jne 0x40d066
lea eax, [esi + 0x25]
push eax
push 2
call ecx
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40d066
lea eax, [esi + 0x25]
push eax
push 2
call ecx
mov byte [esi + 0x24], 1
and dword [ebx], 0
jmp 0x40d005
cmp edi, dword [esi + 0x3e0]
jne 0x40d09f
cmp byte [esi + 0x24], 0
mov dword [esi + 0x3e4], 1
jne 0x40d08f
lea eax, [esi + 0x25]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
and dword [ebx], 0
cmp dword [esi + 0x3e4], 0
jne 0x40d00e
cmp edi, 0x401
jne 0x40d0e5
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x3e4], 1
sub eax, 0x7b
je 0x40d0c5
sub eax, 0x186
je 0x40d0c5
sub eax, 3
jne 0x40d0cc
mov ecx, esi
call fcn.0040cf28
and dword [ebx], 0
cmp dword [esi + 0x3e4], 0
jne 0x40d00e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
cmp edi, 0x400
jne 0x40d113
mov dword [esi + 0x3e4], 1
lea ecx, [esi + 0x3d]
push dword [0x453054]
call fcn.00412d78
lea eax, [esi + 0x25]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x40d0cc
cmp edi, 2
jne 0x40d0dc
lea eax, [esi + 0x25]
mov dword [esi + 0x3e4], 1
push eax
push edi
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40d0cc
Function at 0x413d5e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x413db9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x413daa
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x413da6
cmp esi, ecx
jae 0x413daa
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x413d94
cmp esi, ecx
jb 0x413dae
xor eax, eax
jmp 0x413db8
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x414306
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], vtable.SHA1.0
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x60], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov word [ecx + 0x64], ax
mov eax, ecx
ret
Function at 0x4143c7
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x45106c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x158], esi
xor edi, edi
lea edx, [esi + 0x21]
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
lea edx, [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + edi*4 - 0x144], ecx
inc edi
cmp edi, 0x10
jl 0x4143ea
push 0x40
lea ecx, [ebp - 0x13c]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x414421
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
and dword [ebp - 0x154], edx
mov dword [ebp - 0x14c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x148], eax
mov eax, dword [esi + 0x14]
mov esi, dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
mov edx, dword [ebp - 0x14c]
mov ecx, ebx
not ecx
rol edx, 5
and ecx, esi
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x154]
add edx, ecx
mov ecx, dword [ebp - 0x150]
add ecx, 0x5a827999
mov dword [ebp - 0x150], esi
mov esi, edi
mov edi, ebx
add edx, dword [ebp + eax*4 - 0x144]
mov ebx, dword [ebp - 0x14c]
add edx, ecx
ror edi, 2
inc eax
push 0x14
pop ecx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x154], eax
cmp eax, ecx
jl 0x414466
mov dword [ebp - 0x148], esi
mov eax, esi
xor eax, edi
rol edx, 5
xor eax, ebx
add edx, eax
mov eax, dword [ebp - 0x150]
add edx, dword [ebp + ecx*4 - 0x144]
add eax, 0x6ed9eba1
add edx, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x14c]
ror edi, 2
inc ecx
mov dword [ebp - 0x14c], edx
cmp ecx, 0x28
jl 0x4144c7
push 0x28
pop esi
mov ecx, edi
rol edx, 5
or ecx, ebx
add edx, 0x8f1bbcdc
add edx, dword [ebp - 0x150]
and ecx, eax
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x148]
add ecx, dword [ebp + esi*4 - 0x144]
mov dword [ebp - 0x150], eax
add edx, ecx
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 0x14c]
ror edi, 2
inc esi
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
cmp esi, 0x3c
jl 0x414512
mov esi, dword [ebp - 0x158]
push 0x3c
pop ecx
xor eax, edi
rol edx, 5
add edx, dword [ebp - 0x150]
xor eax, ebx
add eax, 0xca62c1d6
add eax, dword [ebp + ecx*4 - 0x144]
add edx, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x150], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x14c]
ror edi, 2
inc ecx
mov dword [ebp - 0x14c], edx
cmp ecx, 0x50
jl 0x41456a
add dword [esi + 0xc], edi
add dword [esi + 0x10], eax
add dword [esi + 8], ebx
add dword [esi + 4], edx
mov eax, dword [ebp - 0x150]
add dword [esi + 0x14], eax
and dword [esi + 0x60], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a00c
mov esp, ebp
pop ebp
ret
Function at 0x4145da
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov byte [eax + esi + 0x20], 0x80
inc dword [esi + 0x60]
cmp eax, 0x37
mov eax, dword [esi + 0x60]
jle 0x414627
jmp 0x4145fd
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x40
jl 0x4145f2
call fcn.004143c7
jmp 0x414614
mov eax, dword [esi + 0x60]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
cmp dword [esi + 0x60], 0x38
jl 0x414609
jmp 0x41462c
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x38
jl 0x41461c
mov al, byte [esi + 0x1f]
mov ecx, esi
mov byte [esi + 0x58], al
mov al, byte [esi + 0x1e]
mov byte [esi + 0x59], al
mov al, byte [esi + 0x1d]
mov byte [esi + 0x5a], al
mov al, byte [esi + 0x1c]
mov byte [esi + 0x5b], al
mov al, byte [esi + 0x1b]
mov byte [esi + 0x5c], al
mov al, byte [esi + 0x1a]
mov byte [esi + 0x5d], al
mov al, byte [esi + 0x19]
mov byte [esi + 0x5e], al
mov al, byte [esi + 0x18]
mov byte [esi + 0x5f], al
pop esi
jmp fcn.004143c7