joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x1001a6c8
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x1001a6c1
mov edx, esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 5], edx
mov byte [ebp - 1], al
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 5]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov byte [edx + ecx], al
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x1001a6d8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.10019f54
cmp byte [ebp - 1], 0
jne 0x1001a802
xor eax, eax
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 1
jne 0x1001a903
mov dword [ebp - 0xc], 0xf
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x14], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x1001a818
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx + 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x1001a836
push 5
lea eax, [ebp - 0x18]
push eax
push 3
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
lea ecx, [eax*2 + 0x451fc4]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.1001a54c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x14]
mov edx, dword [ebp - 0x10]
xor al, byte [ebp + edx - 0x18]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx + 4], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x1001a877
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1001a813
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx + 4]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x14], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x1001a8aa
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx + 4], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x1001a8c9
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x1001a8ea
Function at 0x1001b2f4
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x1001b3f1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
movzx ecx, byte [ebx + ecx]
shr ecx, 2
mov cl, byte [ecx + 0x44c3b4]
mov byte [eax + edx], cl
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov al, byte [edx + eax]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + edx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x44c3b4]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov al, byte [edx + eax + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + edx + 2]
shr edx, 6
add eax, edx
mov al, byte [eax + 0x44c3b4]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx + 2], al
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + ecx + 2]
and cl, 0x3f
and ecx, 0xff
mov cl, byte [ecx + 0x44c3b4]
mov byte [eax + edx + 3], cl
add dword [ebp - 0x1c], 4
add dword [ebp - 0x18], 3
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x1001b337
mov eax, dword [ebp - 0xc]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x1001b407
dec edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
movzx ecx, byte [ebx + ecx]
shr ecx, 2
mov cl, byte [ecx + 0x44c3b4]
mov byte [eax + edx], cl
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + ecx]
and cl, 3
and ecx, 0xff
shl ecx, 4
mov cl, byte [ecx + 0x44c3b4]
mov byte [eax + edx + 1], cl
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov byte [eax + edx + 2], 0x3d
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov byte [eax + edx + 3], 0x3d
jmp 0x1001b4e3
Function at 0x401332
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
mov esi, ecx
call fcn.00558fd0
add esp, 0xc
mov dword [ebp - 0x54], edi
push 3
pop eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
xor edi, edi
push esi
inc edi
push ebx
mov dword [ebp - 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401388
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x40139a
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40139f
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.ChromeAutofillViewer_Verion_Checker
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x4013d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4014b7
push ebx
push 0x50
push str.www.securityxploded.com
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4013fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4014b4
push esi
push pe_nt_image_headers32
xor ecx, ecx
push ecx
push ecx
push ecx
push str._product_versions.xml
push 0x5acafc
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
jne 0x401429
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4014ae
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x401449
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x401451
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4014ab
xor edi, edi
and dword [ebp - 4], edi
jmp 0x401487
mov ecx, dword [ebp - 4]
cmp ecx, 1
jb 0x40149c
lea eax, [edi + ecx]
cmp eax, 0x30d40
ja 0x40149c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push ecx
add eax, edi
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x401496
add edi, dword [ebp - 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x401458
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0xc]
mov byte [edi + eax], 0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov edi, dword [ebp - 0x10]
push esi
call ebx
push dword [ebp - 0x14]
call ebx
pop esi
push edi
call ebx
pop edi
pop ebx
leave
ret
Function at 0x4041e5
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x5d64b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, str.cav_tmp1
lea edi, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x77
lea eax, [ebp - 0x93]
push 0
push eax
mov dword [ebp - 0x48c], ecx
movsb byte es:[edi], byte [esi]
call fcn.00558fd0
and dword [ebp - 0x488], 0
add esp, 0xc
mov esi, str.select__from_autofill_
push 6
pop ecx
lea edi, [ebp - 0x1c]
lea eax, [ebp - 0x484]
rep movsd dword es:[edi], dword [esi]
push eax
mov esi, 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x484]
push esi
push eax
call fcn.00555e4d
add esp, 0xc
lea eax, [ebp - 0x484]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40427f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404285
lea ebx, [ebp - 0x484]
push 0
push 1
lea edx, [ebp - 0x488]
mov ecx, ebx
call fcn.0043da42
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48c]
pop edi
pop esi
pop ebx
test eax, eax
je 0x4042b8
push 0x10
push str.Chrome_Autofill_Viewer
push str.Failed_to_open_the_specified_autofill_file._n_nMake_sure_Chrome_browser_is_not_running_and_try_again
call fcn.00446c73
jmp 0x4042e0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x488]
call fcn.00403fdb
push dword [ebp - 0x488]
call fcn.0043cf95
pop ecx
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00554591
leave
ret 4

Function at 0x404488
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x5d64b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x207
lea eax, [ebp - 0x237]
push 0
push eax
mov byte [ebp - 0x238], 0
call fcn.00558fd0
add esp, 0xc
mov esi, str.GoogleChromeUser_DataDefaultWeb_Data
push 0xa
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x440]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x4044e9
xor eax, eax
jmp 0x404544
lea eax, [ebp - 0x440]
push eax
mov esi, 0x208
lea eax, [ebp - 0x238]
push esi
push eax
call fcn.00554c9f
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x238]
push esi
push eax
call fcn.00555e4d
add esp, 0x18
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404530
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4044e5
lea eax, [ebp - 0x238]
push eax
push esi
push ebx
call fcn.00554c9f
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00554591
leave
ret 4
Function at 0x405043
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x5d64b0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x3fc], 0
push ebx
push esi
push edi
mov esi, str.cav_rem_tmp
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3f8]
push eax
mov esi, 0x3e8
push esi
mov ebx, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3f8]
push esi
push eax
call fcn.00555e4d
add esp, 0xc
lea eax, [ebp - 0x3f8]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4050b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
jmp 0x4050bc
xor edi, edi
lea ecx, [ebp - 0x3f8]
inc edi
push 0
push 2
lea edx, [ebp - 0x3fc]
call fcn.0043da42
pop ecx
pop ecx
test eax, eax
je 0x4050d5
xor eax, eax
jmp 0x405135
mov ecx, dword [ebp - 0x3fc]
call fcn.00404f86
push dword [ebp - 0x3fc]
mov esi, eax
call fcn.0043cf95
pop ecx
test esi, esi
jne 0x405105
test edi, edi
je 0x4050d1
lea eax, [ebp - 0x3f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4050d1
test edi, edi
je 0x405132
push 0
push ebx
lea eax, [ebp - 0x3f8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x405125
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4050f6
lea ecx, [ebp - 0x3f8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00554591
leave
ret
Function at 0x4092c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], ecx
xorps xmm2, xmm2
mov edi, esi
jmp 0x4092e3
inc ecx
movzx eax, byte [ecx]
test byte [eax + 0x5b1b80], 1
jne 0x4092e2
mov al, byte [ecx]
cmp al, 0x2d
jne 0x4092fb
or dword [ebp - 4], 0xffffffff
jmp 0x4092ff
cmp al, 0x2b
jne 0x409300
inc ecx
cmp byte [ecx], 0x30
je 0x4092ff
movsd xmm4, qword [0x5b5b08]
jmp 0x409327
movsx eax, dl
sub eax, 0x30
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm2, xmm4
inc ecx
inc edi
addsd xmm2, xmm0
mov dl, byte [ecx]
movzx eax, dl
test byte [eax + 0x5b1b80], 4
jne 0x40930f
movsd xmm1, qword [0x5b5ae8]
cmp dl, 0x2e
jne 0x40938c
inc ecx
movapd xmm3, xmm1
test edi, edi
jne 0x40937a
jmp 0x409352
mulsd xmm3, xmm4
inc ecx
cmp byte [ecx], 0x30
je 0x40934d
jmp 0x40937a
cmp edi, 0x12
jge 0x409379
movsx eax, dl
sub eax, 0x30
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm2, xmm4
mulsd xmm3, xmm4
inc edi
addsd xmm2, xmm0
inc ecx
mov dl, byte [ecx]
movzx eax, dl
test byte [eax + 0x5b1b80], 4
jne 0x409359
divsd xmm2, xmm3
mov al, byte [ecx]
cmp al, 0x65
je 0x40939a
cmp al, 0x45
jne 0x409444
xor edi, edi
inc edi
inc ecx
mov al, byte [ecx]
cmp al, 0x2d
jne 0x4093a9
or edi, 0xffffffff
jmp 0x4093ad
cmp al, 0x2b
jne 0x4093ae
inc ecx
mov dl, byte [ecx]
movzx eax, dl
test byte [eax + 0x5b1b80], 4
je 0x409436
imul esi, esi, 0xa
movsx eax, dl
add eax, 0xffffffd0
add esi, eax
inc ecx
mov dl, byte [ecx]
movzx eax, dl
test byte [eax + 0x5b1b80], 4
jne 0x4093bc
cmp esi, 0x40
jl 0x4093f2
mov edx, esi
shr edx, 6
mov eax, edx
imul eax, eax, 0xffffffc0
add esi, eax
mulsd xmm1, qword [0x5b5bd8]
dec edx
jne 0x4093e7
cmp esi, 0x10
jl 0x40940e
mov edx, esi
shr edx, 4
mov eax, edx
imul eax, eax, 0xfffffff0
add esi, eax
mulsd xmm1, qword [0x5b5bc0]
dec edx
jne 0x409403
cmp esi, 4
jl 0x40942a
mov edx, esi
shr edx, 2
mov eax, edx
imul eax, eax, 0xfffffffc
add esi, eax
mulsd xmm1, qword [0x5b5b80]
dec edx
jne 0x40941f
cmp esi, 1
jl 0x409436
mulsd xmm1, xmm4
dec esi
jne 0x40942f
test edi, edi
jns 0x409440
divsd xmm2, xmm1
jmp 0x409444
mulsd xmm2, xmm1
cmp dword [ebp - 4], 0
jge 0x409452
xorpd xmm2, xmmword [0x5b5c20]
mov eax, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
pop edi
movsd qword [eax], xmm2
mov eax, ecx
pop esi
leave
ret
Function at 0x40993e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov eax, esi
cdq
sub eax, edx
sar eax, 1
push edi
lea edx, [eax + 1]
mov dword [ebp - 8], ebx
call fcn.0040786b
mov edi, eax
dec esi
test edi, edi
je 0x4099c2
xor edx, edx
mov dword [ebp - 4], edx
test esi, esi
jle 0x4099b7
mov dword [ebp + 8], 7
movsx ecx, byte [ebx + edx]
movsx ebx, byte [ebx + edx + 1]
mov eax, ebx
sar eax, 6
and al, 1
imul byte [ebp + 8]
sub bl, al
mov eax, ecx
sar eax, 6
and al, 1
imul byte [ebp + 8]
sub cl, al
mov eax, edx
cdq
sub eax, edx
mov edx, dword [ebp - 4]
and bl, 0xf
shl cl, 4
xor bl, cl
sar eax, 1
add edx, 2
mov byte [eax + edi], bl
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp edx, esi
jl 0x409974
mov eax, edx
cdq
sub eax, edx
sar eax, 1
mov byte [eax + edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a4e3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x5d64b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5e1214]
push ebx
push esi
push edi
mov ebx, edx
test eax, eax
je 0x40a520
push eax
push 0x5ae1c4
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.0040890d
add esp, 0x10
jmp 0x40a596
call fcn.00409d23
mov esi, 0xe6
test eax, eax
je 0x40a55f
lea eax, [ebp - 0x318]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x318]
call fcn.00409dd3
mov edi, eax
test edi, edi
jne 0x40a57a
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00554591
leave
ret
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x218]
call fcn.00409e88
jmp 0x40a547
push edi
push 0x5ae1c4
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.0040890d
push edi
call fcn.00554841
add esp, 0x14
lea ecx, [ebp - 0x110]
call fcn.0040905a
test eax, eax
je 0x40a5af
cmp byte [ecx + eax - 1], 0x5c
jne 0x40a5af
dec eax
jne 0x40a5a5
cmp eax, 0x105
jae 0x40a611
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
push str._setilqs_
push ebx
push 0xe7
call fcn.0040890d
mov ecx, ebx
call fcn.0040905a
mov esi, eax
lea ecx, [ebx + esi]
push ecx
push 0x14
pop edi
push edi
call fcn.00408a48
add esp, 0x18
movzx eax, byte [ebx + esi]
xor edx, edx
push 0x3e
pop ecx
div ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx + esi], al
inc esi
dec edi
jne 0x40a5ee
mov byte [ebx + esi], 0
xor eax, eax
jmp 0x40a550
call fcn.005552b5
int3
Function at 0x40a9cc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5d64b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
push eax
push 0x104
push edx
mov edi, 0x200
push ecx
mov dword [ebp - 0x118], edi
call fcn.0040a901
add esp, 0x10
test eax, eax
jne 0x40aaa5
lea ecx, [ebp - 0x110]
call fcn.0040a4a7
mov esi, eax
test esi, esi
je 0x40aaab
call fcn.00409d23
test eax, eax
mov eax, esi
je 0x40aa66
xor ecx, ecx
cmp word [esi], cx
je 0x40aa47
cmp word [eax], 0x5c
je 0x40aa42
add eax, 2
cmp word [eax], cx
jne 0x40aa32
jmp 0x40aa47
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x40aa98
cmp byte [esi], 0
je 0x40aa7b
cmp byte [eax], 0x5c
je 0x40aa78
inc eax
cmp byte [eax], 0
jne 0x40aa6b
jmp 0x40aa7b
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov ebx, eax
call fcn.00554841
pop ecx
test ebx, ebx
je 0x40aaab
mov edi, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00554591
leave
ret
Function at 0x420d1b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, edx
push esi
mov eax, ecx
push edi
mov dword [esp + 0xc], eax
test ebx, ebx
jne 0x420d38
xor eax, eax
jmp 0x420e1a
push 0x44
pop edx
call fcn.0040786b
mov edi, eax
test edi, edi
je 0x420d31
mov esi, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [esp + 0xc]
push esi
call fcn.00420a48
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi], eax
mov edx, dword [ebx + 8]
push esi
call fcn.00420b4b
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push 0
push esi
call fcn.00420823
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push esi
call fcn.00420a48
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov edx, dword [ebx + 0x14]
push 0
push esi
call fcn.00420823
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push esi
call fcn.00420a48
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
add esp, 0xc
mov byte [edi + 4], al
mov edx, dword [ebx + 0x1c]
push esi
call fcn.00420d1b
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push 0
push esi
call fcn.00420823
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], eax
mov edx, dword [ebx + 0x2c]
push 0
push esi
call fcn.00420823
mov dword [edi + 0x2c], eax
xor edx, edx
mov dword [edi + 0x30], edx
mov dword [edi + 0x34], edx
mov ax, word [ebx + 6]
mov ecx, 0xfff7
and ax, cx
mov word [edi + 6], ax
mov dword [edi + 0x24], edx
or dword [edi + 0x38], 0xffffffff
or dword [edi + 0x3c], 0xffffffff
add esp, 0x10
or dword [edi + 0x40], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e243
Capabilities:
Create process on windows

Disassembly:
push 0
mov eax, 0x57351c
call fcn.00556e56
mov edi, ecx
push 2
xor eax, eax
push eax
push eax
mov dword [ebp - 4], eax
push dword [ebp + 8]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [edi + 0x20]
mov esi, eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004463fb
mov ecx, dword [ebp + 8]
cmp esi, 0x20
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0040101a
mov al, bl
call fcn.00556e24
ret 4
Function at 0x445aed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5d64b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5da1d0]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x445b39
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x445b56
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5da1d0], eax
jmp 0x445b42
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x445b56
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x445bc3
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x445b71
xor eax, eax
jmp 0x445bc3
lea eax, [ebp - 0x210]
push eax
call fcn.00556e0b
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x445ba2
push 0x580ffc
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005590b9
add esp, 0xc
test eax, eax
jne 0x445b6d
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005590b9
add esp, 0xc
test eax, eax
jne 0x445b6d
lea eax, [ebp - 0x210]
push eax
call fcn.0044a83a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00554591
leave
ret

Function at 0x446393
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x4463d8
call fcn.00441a15
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4463d8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4463f4
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00450ef0
mov ebx, eax
test edi, edi
je 0x4463f2
test esi, esi
je 0x4463f2
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x44aac2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x573352
call fcn.00556e56
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x44aae8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x44ab3c
call fcn.0044069a
push eax
lea ecx, [ebp - 0x10]
call fcn.00401054
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0055733b
push eax
call fcn.00402862
add esp, 0x14
test edi, edi
je 0x44ab2f
push edi
call fcn.00556d80
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040101a
mov eax, esi
call fcn.00556e24
ret 8