joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x49b3e4]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
test edi, edi
je 0x402209
cmp byte [edi], 0
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
jne 0x40217b
xor ecx, ecx
jmp 0x402189
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402180
sub ecx, edx
push ecx
push edi
lea ecx, [esp + 0x2c]
call fcn.004044c0
push 1
push 0x490ecc
lea ecx, [esp + 0x2c]
call fcn.00403d90
push eax
lea ecx, [esp + 0x58]
call fcn.00403be0
cmp byte [esi], 0
jne 0x4021b7
xor ecx, ecx
jmp 0x4021c9
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4021c0
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x5c]
call fcn.00403d90
push eax
lea ecx, [esp + 0x40]
call fcn.00403be0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x10]
call fcn.004025f0
lea ecx, [esp + 0x3c]
call fcn.00403ef0
lea ecx, [esp + 0x54]
call fcn.00403ef0
lea ecx, [esp + 0x24]
call fcn.00403ef0
jmp 0x40222b
cmp byte [esi], 0
jne 0x402212
xor ecx, ecx
jmp 0x402220
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402217
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x14]
call fcn.004044c0
push dword [ebp + 0x14]
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
push edi
cmovae eax, dword [esp + 0x14]
push ebx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 0x20]
cmp eax, 0x10
jb 0x402284
mov ecx, dword [esp + 0xc]
inc eax
cmp eax, 0x1000
jb 0x40227b
test cl, 0x1f
jne 0x402296
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40229b
sub ecx, eax
cmp ecx, 4
jb 0x4022a0
cmp ecx, 0x23
ja 0x4022a5
mov ecx, eax
push ecx
call fcn.00457b70
add esp, 4
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00457d74
mov esp, ebp
pop ebp
ret
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
int3
Function at 0x4022b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x49b3e4]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
lea edx, [esp + 4]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push edx
push dword [ebp + 0x1c]
mov dword [esp + 0x30], 0xf
push 0
push eax
push ecx
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402369
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
ja 0x40232c
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
mov dword [esp + 0x24], ecx
cmovae eax, dword [esp + 0x14]
mov byte [eax + ecx], 0
jmp 0x40233a
sub ecx, eax
push 0
push ecx
lea ecx, [esp + 0x1c]
call fcn.004035c0
cmp dword [esp + 0x28], 0x10
lea ecx, [ebp + 0x18]
push ecx
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push edi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x28], 0x10
lea edx, [esp + 0x14]
mov dword [esi + 0x14], 0xf
cmovae edx, dword [esp + 0x14]
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x402391
xor ecx, ecx
jmp 0x40239f
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402396
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004044c0
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x4023e0
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, 0x1000
jb 0x4023d7
test cl, 0x1f
jne 0x4023f3
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4023f8
sub ecx, eax
cmp ecx, 4
jb 0x4023fd
cmp ecx, 0x23
ja 0x402402
mov ecx, eax
push ecx
call fcn.00457b70
add esp, 4
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00457d74
mov esp, ebp
pop ebp
ret
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
int3

Function at 0x402410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402435
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x402460
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40248b
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x404790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea edx, [ecx + 4]
xor bl, bl
cmp dword [edx + 0x14], 0x10
jb 0x4047a2
mov edx, dword [edx]
lea eax, [ebp - 4]
push eax
mov eax, dword [ecx + 0x24]
or eax, 0x20019
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4047e9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x4047c9
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
mov eax, dword [0x49b3e4]
xor eax, esp
mov dword [esp + 0x160], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x144]
push 0x490ec4
push eax
mov dword [esp + 0x24], edi
movups xmmword [esp + 0x14c], xmm0
mov byte [esp + 0x16c], 0
movups xmmword [esp + 0x15c], xmm0
call fcn.00402bd0
add esp, 0xc
mov dword [esp + 0x34], 0xf
cmp byte [esp + 0x140], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
jne 0x405f0f
xor ecx, ecx
jmp 0x405f29
lea ecx, [esp + 0x140]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405f20
sub ecx, edx
push ecx
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x28]
call fcn.004044c0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x15c], 0xf
push eax
lea ecx, [esp + 0x14c]
mov dword [esp + 0x15c], 0
mov byte [esp + 0x14c], 0
call fcn.00404000
mov eax, dword [esp + 0x150]
lea ecx, [esp + 0x38]
cmp dword [esp + 0x154], 0x10
mov edx, 0x100
mov dword [esp + 0x14], eax
lea eax, [esp + 0x140]
cmovae eax, dword [esp + 0x140]
mov dword [esp + 0x10], eax
xor eax, eax
nop
mov byte [ecx], al
lea ecx, [ecx + 1]
inc eax
cmp ax, dx
jl 0x405fa0
xor dl, dl
mov word [esp + 0x138], 0
xor ebx, ebx
lea esi, [esp + 0x38]
mov edi, 0x100
mov eax, dword [esp + 0x10]
lea esi, [esi + 1]
mov cl, byte [esi - 1]
movzx edx, dl
mov al, byte [eax + edx]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [esp + ebx + 0x38]
mov byte [esi - 1], al
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x14]
mov byte [esp + ebx + 0x38], cl
sub edi, 1
jne 0x405fc2
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
je 0x406046
movzx edx, byte [esp + 0x138]
movzx ebx, byte [esp + 0x139]
nop dword [eax]
inc dl
movzx edx, dl
mov cl, byte [esp + edx + 0x38]
add bl, cl
movzx ebx, bl
movzx eax, byte [esp + ebx + 0x38]
mov byte [esp + edx + 0x38], al
mov byte [esp + ebx + 0x38], cl
movzx eax, byte [esp + edx + 0x38]
add al, cl
mov ecx, dword [esp + 0x1c]
movzx eax, al
movzx eax, byte [esp + eax + 0x38]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jb 0x406010
mov eax, dword [esp + 0x154]
cmp eax, 0x10
jb 0x406084
mov ecx, dword [esp + 0x140]
inc eax
cmp eax, 0x1000
jb 0x40607b
test cl, 0x1f
jne 0x4060d5
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4060da
sub ecx, eax
cmp ecx, 4
jb 0x4060df
cmp ecx, 0x23
ja 0x4060e4
mov ecx, eax
push ecx
call fcn.00457b70
add esp, 4
mov eax, dword [esp + 0x34]
cmp eax, 0x10
jb 0x4060bc
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, 0x1000
jb 0x4060b3
test cl, 0x1f
jne 0x4060e9
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4060ee
sub ecx, eax
cmp ecx, 4
jb 0x4060f3
cmp ecx, 0x23
ja 0x4060f8
mov ecx, eax
push ecx
call fcn.00457b70
add esp, 4
mov ecx, dword [esp + 0x16c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00457d74
mov esp, ebp
pop ebp
ret 8
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
call fcn.00460fd4
int3
Function at 0x406280
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4062b2
mov dword [ebp - 8], 1
jmp 0x4062b9
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x406ca0
Capabilities:
Delete registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473760
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
push 0x4777d0
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SoftwarexiaoyuUpdate
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.Version
push 0x477808
push SysReAllocString
call fcn.00402460
add esp, 0xc
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x28]
call fcn.004045c0
mov dword [ebp - 4], 0
push 0x2001f
push 0
lea eax, [ebp - 0x28]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x80]
call fcn.004046d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00403ef0
push 0x477850
lea ecx, [ebp - 0x40]
call fcn.004045c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00404790
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00403ef0
movzx edx, byte [ebp - 0x81]
test edx, edx
je 0x406da0
push str.xiaoyuNotepaper
lea ecx, [ebp - 0x58]
call fcn.004045c0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x80]
call fcn.00404750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00403ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00404720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457d74
mov esp, ebp
pop ebp
ret

Function at 0x407180
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00459940
add esp, 0xc
push 0
push 0x10
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4778e8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457d74
mov esp, ebp
pop ebp
ret
Function at 0x407480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4737eb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00459940
add esp, 0xc
push 0
push 0xb
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4778fc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x230]
push eax
call fcn.00401e60
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00403c60
push eax
mov ecx, dword [ebp - 0x234]
call fcn.00407200
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00403ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457d74
mov esp, ebp
pop ebp
ret

Function at 0x407570
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x477870
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402410
add esp, 8
movzx eax, al
test eax, eax
je 0x4075a0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallxiaoyu
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x40af60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x40af90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
mov esp, ebp
pop ebp
ret

Function at 0x40bf50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473e09
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x54]
call fcn.004067e0
mov dword [ebp - 4], 0
push 0x47a1e8
lea ecx, [ebp - 0x40]
call fcn.004045c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
or eax, 1
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00401be0
add esp, 8
movzx eax, al
test eax, eax
je 0x40bfd7
lea ecx, [ebp - 0x54]
call fcn.00407160
test eax, eax
jbe 0x40bfd7
mov dword [ebp - 0x58], 1
jmp 0x40bfde
mov dword [ebp - 0x58], 0
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x41], cl
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x48]
and edx, 1
je 0x40bfff
and dword [ebp - 0x48], 0xfffffffe
lea ecx, [ebp - 0x40]
call fcn.00403ef0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x40c101
push 0
push str.xiaoyu_NOTEPAPER_SERVER_WND
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x40c101
push 0x47a22c
lea ecx, [ebp - 0x28]
call fcn.004045c0
mov byte [ebp - 4], 2
push 0x47a248
lea ecx, [ebp - 0x28]
call fcn.00402590
push 0x47a254
lea ecx, [ebp - 0x28]
call fcn.00402590
push 4
push 0x47a28c
lea ecx, [ebp - 0x28]
call fcn.00403c60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 6
jne 0x40c0d1
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x54]
call fcn.00406fb0
jmp 0x40c08d
push 0
lea edx, [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x4c]
call fcn.004069a0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x54]
call fcn.00407100
push eax
lea ecx, [ebp - 0x4c]
call fcn.004068f0
movzx ecx, al
test ecx, ecx
je 0x40c0cf
lea ecx, [ebp - 0x4c]
call fcn.00406950
mov edx, dword [eax]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x64], eax
push 0
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40c07f
jmp 0x40c0f5
mov byte [ebp - 0x42], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00406870
mov al, byte [ebp - 0x42]
jmp 0x40c117
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403ef0
mov byte [ebp - 0x43], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00406870
mov al, byte [ebp - 0x43]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457d74
mov esp, ebp
pop ebp
ret
Function at 0x40c260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47689b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0041a8de
add esp, 4
push 4
call fcn.0041ab5e
add esp, 4
lea ecx, [ebp - 0x94]
push ecx
call fcn.00416540
add esp, 4
mov dword [ebp - 4], 0
call fcn.0041668a
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
je 0x40c2df
cmp dword [ebp - 0xa0], 4
je 0x40c308
jmp 0x40c3c2
push str..._skinUninst_
lea ecx, [ebp - 0x94]
call fcn.0040d57f
lea ecx, [ebp - 0x94]
call fcn.004048a0
push eax
call fcn.0041ab15
add esp, 4
jmp 0x40c3c2
call fcn.0041653a
mov dword [ebp - 0xac], eax
push str.ZIPRES
push str.SKINDATA
mov edx, dword [ebp - 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x40c3c2
mov dword [ebp - 0x9c], 0
call fcn.00416675
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x40c3b5
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jbe 0x40c3b5
mov ecx, dword [ebp - 0x9c]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0041ab6b
add esp, 8
mov eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0040d417
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457d74
mov esp, ebp
pop ebp
ret 4
Function at 0x414180
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x474269
call fcn.004585cc
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0041450f
call fcn.00416684
push eax
lea ecx, [ebp - 0x94]
call fcn.0040d2f0
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00416690
mov ecx, eax
call fcn.0040db13
test al, al
je 0x414296
push ebx
lea ecx, [ebp - 0x94]
call fcn.0040d57f
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.004048a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x414207
push str.Error_opening_file
jmp 0x414377
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x414310
cmp edi, 0x400000
ja 0x414321
and dword [ebp - 0x2c8], 0
push edi
call fcn.004586e8
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x41427f
push ebx
call fcn.00457e1e
pop ecx
mov ecx, esi
call fcn.0041450f
push 0
push str.Could_not_read_file
jmp 0x414377
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.004143c2
push dword [ebp - 0x2cc]
jmp 0x4143a5
call fcn.00416690
push eax
lea ecx, [ebp - 0x94]
call fcn.0040d562
call fcn.004169de
test al, al
je 0x4142b7
call fcn.00416696
jmp 0x4142ce
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.004048a0
push eax
call fcn.00430fe0
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4142df
push eax
push str.Error_opening_zip_file
jmp 0x414377
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.00430a21
add esp, 0x14
test eax, eax
je 0x414306
push 0
push str.Could_not_find_ziped_file
jmp 0x414377
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x414319
push 0
push str.File_is_empty
jmp 0x414377
cmp ebx, 0x400000
jbe 0x41432a
push 0
push str.File_too_large
jmp 0x414377
push ebx
call fcn.004586e8
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.004313a0
add esp, 0x18
test eax, eax
je 0x414382
cmp eax, 0x600
je 0x414382
push dword [ebp - 0x2c8]
call fcn.00457e1e
pop ecx
call fcn.004169de
test al, al
jne 0x414370
push edi
call fcn.0043087b
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.00414537
mov bl, al
jmp 0x4143ad
call fcn.004169de
test al, al
jne 0x414392
push edi
call fcn.0043087b
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.004143c2
push edi
mov bl, al
call fcn.00457e1e
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0040d417
mov al, bl
call fcn.00458587
ret 8
Function at 0x416b08
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x416b2b
or esi, 1
push 1
call edi
test ax, ax
jns 0x416b37
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x416b43
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x416b4f
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret