joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4163c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.0044d300
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x47af9c
push 0xa2
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41649e
test esi, esi
je 0x41648a
test edi, edi
je 0x416445
cmp esi, 0x800
ja 0x416445
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044fb70
add esp, 0xc
jmp 0x41648a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004500f0
add esp, 0xc
test edi, edi
jne 0x41646c
call fcn.0045861e
mov dword [eax], 0x16
jmp 0x41647f
cmp esi, 0x800
jbe 0x416490
call fcn.0045861e
mov dword [eax], 0x22
call fcn.00458520
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x416563
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x4a7630]
push 0x4a7634
call fcn.00404a00
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404650
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41654d
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404720
mov edi, eax
add esp, 0xc
test edi, edi
je 0x416546
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x41653f
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x5647e0
push eax
call fcn.00449d80
lea ecx, [ebp - 0x804]
mov eax, 0x44494552
cmp eax, dword [ecx]
jne 0x41653f
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x41653f
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x7ff]
push 0x4787e4
push eax
call fcn.00403500
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
call fcn.0044d487
int3
Function at 0x416570
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0045e4b4
push 0x479574
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, word [ebp + 0x10]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
mov ebx, eax
lea eax, [ebp - 0x20c]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x416641
push 0
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10

Function at 0x416660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0044d300
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, eax
jae 0x416705
test esi, esi
je 0x4166fd
test edi, edi
je 0x4166cf
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044fb70
add esp, 0xc
jmp 0x4166f1
push eax
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004500f0
add esp, 0xc
call fcn.0045861e
mov dword [eax], 0x16
call fcn.00458520
cmp esi, 0x800
jae 0x416789
mov byte [ebp + esi - 0x804], 0
push 0x800
lea eax, [ebp - 0x1804]
mov ecx, 0x4e2868
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
call fcn.00403200
lea ecx, [ebp - 0x1804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416730
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x1804]
push 0
push 0
push 0
push 0
sub ecx, edx
sar ecx, 1
push ecx
push eax
push 0
push 0xfde9
call esi
push 0
push 0
push eax
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x1804]
push eax
push 0
push 0xfde9
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
call fcn.0044d487
int3
Function at 0x416790
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0x104
push eax
call fcn.0045e4b4
push 0x47ad10
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x47ad28
push 0xaa
push str.ENVIRONMENT
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ad40
push 0xae
push str.CANDIDATE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ad5c
push 0xa1
push str.ERRORURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ad78
push 0x8d
push 0x47ad94
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ada0
push 0xad
push str.INSTITUTION
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47adbc
push 0x85
push str.INTERVAL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47add8
push 0xaf
push str.LANGUAGE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47adf4
push 0x8b
push str.LOGPATH
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.message.bin
push 0x9e
push str.MESSAGE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ae34
push 0x88
push str.OPTIONS
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ae4c
push 0xab
push str.PROGRAM
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ae64
push 0x67
push 0x47ae78
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47ae80
push 0x8e
push 0x47ae98
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47aea0
push 0x6f
push 0x47aeb8
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47aec0
push 0x96
push 0x47aedc
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47aee8
push 0x94
push str.UPDATEURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47af04
push 0x75
push 0x4793a4
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47af14
push 0xa8
push str.KILLLIST
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47af3c
push 0x7c
push str.ALTURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.ecminver.bin
push 0xa5
push str.ECMINVERSION
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push 0x47af70
push 0xbc
push str.KILLONQUITLIST
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00416570
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 4
Function at 0x416a50
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
cmp dword [0x527414], 1
push esi
jne 0x416ace
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.0045e4b4
push 0x479574
push esi
push edi
call fcn.004532c3
add esp, 0x18
jmp 0x416adb
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.0045e4b4
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call fcn.004532c3
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x479574
push esi
push edi
call fcn.004532c3
push 0x479578
push esi
push edi
call fcn.004532c3
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47a67c
push 0xf4
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x416ba4
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
mov ecx, 0x52abf8
call fcn.00421180
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x52abf8
call fcn.00420b00
push 1
mov ecx, 0x52abf8
mov dword [0x53b6b0], 1
mov dword [0x5162c8], 1
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.004186d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416c10
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0045e4b4
push 0x479574
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x479574
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
push str.SBRemoteHandler.tlb
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x20c]
lea ecx, [ecx + 2]
mov word [ecx + 0x55f076], ax
test ax, ax
jne 0x416d00
push 0x47a67c
push 0xa0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
mov ebx, eax
lea eax, [ebp - 0x20c]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x416d99
push 0
lea eax, [ebp - 0x418]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
mov ecx, 0x52abf8
push eax
call fcn.00421180
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x52abf8
call fcn.00420b00
push 1
mov ecx, 0x52abf8
mov dword [0x53b6b0], 1
mov dword [0x5162c8], 1
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.004186d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 4
Function at 0x416e10
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.0045e4b4
push 0x479574
push esi
push ebx
call fcn.004532c3
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.004532c3
add esp, 0x24
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x479574
push esi
push ebx
call fcn.004532c3
push 0x47abd4
push esi
push ebx
call fcn.004532c3
push edi
push esi
push ebx
call fcn.004532c3
push 0x47abf0
push esi
push ebx
call fcn.004532c3
add esp, 0x30
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47a67c
push 0x74
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x416f4f
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
mov ecx, 0x52abf8
call fcn.00421180
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x52abf8
call fcn.00420b00
push 1
mov ecx, 0x52abf8
mov dword [0x53b6b0], 1
mov dword [0x5162c8], 1
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.004186d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x416fc0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.0045e4b4
push 0x479574
push esi
push ebx
call fcn.004532c3
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.004532c3
push 0x479574
push esi
push ebx
call fcn.004532c3
push str.SBU.
push esi
push ebx
call fcn.004532c3
push edi
push esi
push ebx
call fcn.004532c3
add esp, 0x48
push str..exe
push esi
push ebx
call fcn.004532c3
mov edx, 0x560d68
add esp, 0xc
mov ecx, ebx
sub edx, ebx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x417080
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47a67c
push 0x92
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x41711c
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
mov ecx, 0x52abf8
call fcn.00421180
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x52abf8
call fcn.00420b00
push 1
mov ecx, 0x52abf8
mov dword [0x53b6b0], 1
mov dword [0x5162c8], 1
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.004186d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417fa0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x58], edi
mov eax, dword [edi + 0x3710c]
mov byte [eax], 0
cmp byte [ebx], 0
je 0x4180ce
nop
xor edx, edx
xor eax, eax
mov cl, byte [esi + ebx]
mov byte [ebp + eax - 0x54], cl
test cl, cl
je 0x417fe3
inc edx
inc esi
jmp 0x417ff1
cmp eax, 3
jae 0x4180e1
mov byte [ebp + eax - 0x54], 0
inc eax
cmp eax, 3
jl 0x417fd4
test edx, edx
je 0x4180c4
movups xmm0, xmmword [0x47b0c0]
movzx eax, byte [0x47b100]
movzx ecx, byte [ebp - 0x54]
movzx edi, byte [ebp - 0x53]
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x10], al
mov eax, ecx
movups xmm0, xmmword [0x47b0d0]
shr eax, 2
and ecx, 3
shl ecx, 4
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [0x47b0e0]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x47b0f0]
movups xmmword [ebp - 0x20], xmm0
movzx eax, byte [ebp + eax - 0x50]
mov byte [ebp - 0xc], al
mov eax, edi
shr eax, 4
or eax, ecx
movzx eax, byte [ebp + eax - 0x50]
mov byte [ebp - 0xb], al
cmp edx, 1
jle 0x41808d
mov cl, byte [ebp - 0x52]
and edi, 0xf
movzx eax, cl
shr eax, 6
shl edi, 2
or eax, edi
mov al, byte [ebp + eax - 0x50]
mov byte [ebp - 0xa], al
cmp edx, 2
jle 0x418091
movzx eax, cl
and eax, 0x3f
mov al, byte [ebp + eax - 0x50]
jmp 0x418093
mov byte [ebp - 0xa], 0x3d
mov al, 0x3d
mov ecx, dword [ebp - 0x58]
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
mov edx, dword [ecx + 0x3710c]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4180a8
sub ecx, edi
lea eax, [ebp - 0xc]
push 5
push eax
lea eax, [ecx + 6]
push eax
push edx
call fcn.004601d0
add esp, 0x10
cmp byte [esi + ebx], 0
jne 0x417fd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 4
call fcn.0044d487
int3
Function at 0x418a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x418a5a
push 0
lea eax, [ebp + 8]
push eax
push 0x64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4

Function at 0x418b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418b23
test al, 0x10
je 0x418b23
mov bl, 1
jmp 0x418b25
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x418b5b
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418b51
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418b62
push edx
push ecx
call fcn.0044d09e
add esp, 8
mov al, bl
pop ebx
pop ebp
ret 0x18
call fcn.00458530
int3
Function at 0x419ea0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5647dc]
sub esp, 0xc
push esi
mov esi, ecx
test eax, eax
jne 0x419f90
mov ecx, dword [0x514990]
test ecx, ecx
je 0x419f90
push 0x47cb00
push 1
push ecx
call fcn.00449450
add esp, 0xc
mov ecx, esi
call fcn.0041fbb0
mov ecx, 0x514988
call fcn.00408610
cmp dword [esi + 0x474], 0
je 0x419f0b
push dword [esi + 0xf244]
lea eax, [esi + 0xea74]
push eax
push 1
push dword [0x514990]
call fcn.00449000
add esp, 0x10
push dword [esi + 0xd200]
mov dword [esi + 0xd1f0], 0x20
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [0x514990]
call fcn.00449200
add esp, 0x10
mov dword [esi + 0xd1fc], eax
mov eax, dword [esi + 0xd200]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push 0xc
push 1
push eax
mov dword [ebp - 8], 0x100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x419f76
push 0x47daa8
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
push 0x47cb18
push 1
push dword [0x514990]
call fcn.00449450
mov eax, dword [0x5647dc]
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret