joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
mov dword [ebx + 0x10], edi
test edi, edi
jne 0x435afe
push ebp
call fcn.00435a20
pop ecx
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.kernel32.dll_LoadResource
mov edi, eax
mov dword [ebx + 0x14], edi
test edi, edi
jne 0x435b18
push ebp
call fcn.00435a20
pop ecx
mov edi, ebx
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x10]
push eax
push esi
call sub.kernel32.dll_SizeofResource
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x438c00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x438c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
jne 0x438c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x3c]
add dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
cmp dword [eax], 0x4550
jne 0x438c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
movzx eax, word [eax + 0x14]
cmp eax, 0xe0
jne 0x438c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
cmp word [eax + 0x18], 0x10b
jne 0x438c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dword [edx + 4], eax
pop ecx
pop ebp
ret
Function at 0x439700
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor edi, edi
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 8], eax
movzx edx, bx
mov eax, esi
call fcn.00417bec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4397cb
and bx, 0xf
cmp bx, 2
jne 0x439748
mov ebx, 8
mov esi, 1
jmp 0x439752
mov ebx, 2
mov esi, 4
push 0
push 0
push 0
push ebx
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x439776
push ebp
call fcn.004396a0
pop ecx
jmp 0x4397cb
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x439798
push ebp
call fcn.004396a0
pop ecx
jmp 0x4397cb
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
jne 0x4397b1
push ebp
call fcn.004396a0
pop ecx
jmp 0x4397cb
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4394ec]
call fcn.00439c00
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x439fcf
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x439fcf
cmp dword [eax + 0x3c], 0
je 0x439fcf
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x439fcd
cmp dword [esi], 0x4550
je 0x439fcf
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x439fe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x43a02f
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x43a02f
cmp dword [eax + 0x3c], 0
je 0x43a02f
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0x108
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x43a02d
cmp dword [esi], 0x4550
je 0x43a02f
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43a4a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43a5c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, dword [0x43a2f8]
call fcn.00409be0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43a5a7
xor eax, eax
push ebp
push 0x43a5a0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.psapi.dll_EnumProcessModules
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43a577
mov ebx, dword [ebp - 0x10]
shr ebx, 2
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x43a2f8]
call fcn.00409abc
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.psapi.dll_EnumProcessModules
test eax, eax
je 0x43a587
dec ebx
test ebx, ebx
jl 0x43a587
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + esi*4]
mov eax, dword [ebp - 0xc]
call fcn.0043a330
pop ecx
inc esi
dec ebx
jne 0x43a55e
jmp 0x43a587
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0043a410
pop ecx
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a5a7
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a5cc
lea eax, [ebp - 4]
mov edx, dword [0x43a2f8]
call fcn.00409be0
pop eax
jmp eax
Function at 0x442870
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x442893
mov eax, dword [ebp - 8]
call fcn.00407a40
push eax
call sub.kernel32.dll_OutputDebugStringW
pop ecx
pop ecx
pop ebp
ret
Function at 0x44df10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
call fcn.00405c1c
mov ebx, edx
mov esi, eax
cmp byte [esi + 0x1c], 0
jne 0x44df40
mov edx, dword [esi + 0x28]
mov eax, esi
call fcn.0044dfe0
test al, al
jne 0x44df40
push 1
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov dl, 0xfc
and dl, bl
mov eax, esi
call fcn.0044e110
lea eax, [esi + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.004058a0
lea eax, [esi + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov dword [edx], ecx
call fcn.004058a0
test bl, bl
jle 0x44df84
mov eax, esi
call fcn.00405bc4
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x44e720
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44e8e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407344
cmp dword [ebp - 4], 0
je 0x44e763
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x44e763
xor eax, eax
jmp 0x44e765
mov al, 1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x44e780
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407dc8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0044ea90
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x44e85d
xor edx, edx
push ebp
push 0x44e856
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0044f0f0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0044eb40
test al, al
je 0x44e832
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004070a4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x44e832
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00407a40
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x44e82c
mov eax, dword [ebp - 8]
call fcn.00407a40
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00407a90
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.0044e720
dec ebx
cmp ebx, 0xffffffff
jne 0x44e7df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e85d
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0044f0f0
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00407a40
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0044e930
push eax
call sub.advapi32.dll_RegDeleteKeyExW
cmp eax, 0x78
je 0x44e898
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x1c], eax
test eax, eax
sete bl
jmp 0x44e8be
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00407a40
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0044e930
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov dword [ebx + 0x1c], eax
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e8ea
lea eax, [ebp - 0x3c]
call fcn.00406f58
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406fb8
pop eax
jmp eax
Function at 0x44e950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
mov esi, ebx
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00407a40
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [esi + 0x1c], eax
test eax, eax
je 0x44e997
xor eax, eax
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
cmp dword [ebp - 8], 1
jne 0x44e9a4
mov al, 1
jmp 0x44e9c4
cmp dword [ebp - 8], 2
jne 0x44e9ae
mov al, 2
jmp 0x44e9c4
cmp dword [ebp - 8], 4
jne 0x44e9b8
mov al, 3
jmp 0x44e9c4
cmp dword [ebp - 8], 3
jne 0x44e9c2
mov al, 4
jmp 0x44e9c4
xor eax, eax
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov eax, edx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x44e9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, esi
xor ecx, ecx
mov edx, 8
call fcn.00405454
mov edi, ebx
lea eax, [esi + 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00407a40
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [edi + 0x1c], eax
test eax, eax
sete dl
cmp dword [ebp - 8], 1
jne 0x44ea30
mov al, 1
jmp 0x44ea50
cmp dword [ebp - 8], 2
jne 0x44ea3a
mov al, 2
jmp 0x44ea50
cmp dword [ebp - 8], 4
jne 0x44ea44
mov al, 3
jmp 0x44ea50
cmp dword [ebp - 8], 3
jne 0x44ea4e
mov al, 4
jmp 0x44ea50
xor eax, eax
mov byte [esi], al
mov eax, edx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x44f130
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44f1f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 4]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0044eb40
test al, al
je 0x44f1d2
mov ecx, dword [ebp - 0x28]
add ecx, 2
lea eax, [ebp - 4]
xor edx, edx
call fcn.004070a4
mov ebx, dword [ebp - 0x2c]
dec ebx
test ebx, ebx
jl 0x44f1d2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00407a40
push eax
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.00407a40
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00407a90
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00436fd0
inc esi
dec ebx
jne 0x44f186
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f1f9
lea eax, [ebp - 0x30]
call fcn.00406f58
lea eax, [ebp - 4]
call fcn.00406f58
pop eax
jmp eax
Function at 0x44f200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44f2c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 4]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0044eb40
test al, al
je 0x44f2a2
mov ecx, dword [ebp - 0x20]
add ecx, 2
lea eax, [ebp - 4]
xor edx, edx
call fcn.004070a4
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x44f2a2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00407a40
push eax
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.00407a40
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00407a90
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00436fd0
inc esi
dec ebx
jne 0x44f256
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f2c9
lea eax, [ebp - 0x30]
call fcn.00406f58
lea eax, [ebp - 4]
call fcn.00406f58
pop eax
jmp eax

Function at 0x44fdf0
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x52534d42
call sub.kernel32.dll_GetSystemFirmwareTable
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jbe 0x44febe
mov eax, dword [ebp - 0xc]
call fcn.00404fbc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x44feb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x52534d42
call sub.kernel32.dll_GetSystemFirmwareTable
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
ja 0x44fe5f
call fcn.00406744
jmp 0x44febe
mov eax, dword [ebp - 0xc]
sub eax, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, 8
call fcn.00405160
mov eax, dword [ebp - 0x14]
lea edx, [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp eax, dword [ebp - 0x10]
je 0x44fe9b
call fcn.00406744
jmp 0x44febe
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44febe
mov eax, dword [ebp - 0x14]
call fcn.00404fd8
pop eax
jmp eax
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450540
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45061e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00406f58
lea eax, [ebp - 0xc]
call fcn.00450480
mov eax, dword [0x4918f4]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4505f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov edx, 0x105
call fcn.00407b38
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00407410
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00407a40
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407a40
push eax
call sub.kernel32.dll_GetVolumeInformationW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4505fe
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
pop eax
jmp eax

Function at 0x4513a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00407a40
jmp 0x4513d2
mov ecx, ebx
add ecx, ecx
add ecx, ecx
shr ebx, 0x1e
or ecx, ebx
movzx edx, dx
xor ecx, edx
mov ebx, ecx
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x4513bd
mov edi, ebx
and edi, 0xff
mov edx, dword [0x4510b0]
mov eax, 0xc
call fcn.00409098
mov ebx, eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004072fc
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + edi*4 + 4]
mov dword [ebx], eax
mov dword [esi + edi*4 + 4], ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x451490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, esi
call fcn.00407a40
jmp 0x4514bc
mov ecx, ebx
add ecx, ecx
add ecx, ecx
shr ebx, 0x1e
or ecx, ebx
movzx edx, dx
xor ecx, edx
mov ebx, ecx
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x4514a7
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
lea ebx, [edx + eax*4 + 4]
jmp 0x4514e2
mov eax, dword [edi + 4]
mov edx, esi
call fcn.00407d48
je 0x4514e8
mov ebx, edi
mov edi, dword [ebx]
test edi, edi
jne 0x4514d4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x454c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x454d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00406f58
lea eax, [ebp - 0xc]
call fcn.00406f58
mov edx, dword [0x48a530]
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.00417194
test al, al
jne 0x454cf3
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4000
mov eax, dword [ebp - 0x14]
push eax
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x454cf3
cmp dword [ebp - 0x10], 0
je 0x454cf3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407a90
mov eax, dword [ebp - 0x10]
push eax
call sub.ole32.dll_CoTaskMemFree
jmp 0x454d35
lea eax, [ebp - 0xc]
mov edx, 0x105
call fcn.00407b38
cmp dword [ebp - 4], 0
jl 0x454d35
mov eax, dword [ebp - 0xc]
call fcn.00407a40
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x454d35
lea eax, [ebp - 0xc]
call fcn.00430a90
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004072fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454d54
lea eax, [ebp - 0xc]
call fcn.00406f58
pop eax
jmp eax
Function at 0x462770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x462b01
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4627b7
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407a40
push eax
call sub.kernel32.dll_LoadLibraryExW
mov dword [ebp - 0x28], eax
jmp 0x4627c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x462ae1
xor eax, eax
push ebp
push 0x4628f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
push eax
push 1
push 0x10
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FindResourceExW
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x462800
call fcn.00406744
jmp 0x462ae1
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x462820
call fcn.00406744
jmp 0x462ae1
xor eax, eax
push ebp
push 0x4628cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x10
xor ecx, ecx
call fcn.004078cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040741c
test eax, eax
jle 0x4628b4
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x4628ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0040741c
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.004074e0
mov edx, eax
mov eax, dword [ebp - 0x34]
pop ecx
call fcn.00405160
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4628b4
mov eax, dword [ebp - 0x30]
call fcn.0040de38
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4628d4
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_FreeResource
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462b08
lea eax, [ebp - 0x14]
call fcn.00406f58
lea eax, [ebp - 0xc]
call fcn.00406f58
pop eax
jmp eax