joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a8bf8e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x2a8bf900
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x2a8c4ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x2a8c4db0
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x2a8c4d4e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.2a8c4940
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x2a8c4d20
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x2a8c4e57
call 0x2a8c4d60
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x2a8c4e00
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.2a8c4940
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x2a8c4dbd
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x2a8c4e57
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.2a8c4940
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x2a8c4e55
jmp 0x2a8c4e57
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x2a8c4ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x2a8c4f99
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x2a8c4f37
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.2a8c4a80
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x2a8c4f09
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x2a8c5040
call 0x2a8c4f49
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x2a8c4fe9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.2a8c4bb0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x2a8c4fa6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x2a8c5040
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.2a8c4bb0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x2a8c503e
jmp 0x2a8c5040
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10011140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10043a41
call fcn.1001f59e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100111a1
call fcn.1000e50a
mov esi, eax
jmp 0x10011279
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100111bf
call fcn.1000e50a
jmp 0x10011270
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100111b5
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100111f2
mov esi, 0x8007000e
jmp 0x10011272
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100387ac
mov dword [ebp - 4], 1
jmp 0x10011226
cmp dword [ebp - 0x418], 0
je 0x100111e8
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100111b5
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.100387ac
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10011292
lea ecx, [ebp - 0x418]
call fcn.10011348
mov eax, esi
call fcn.1001f5f7
ret 0x10
Function at 0x1001f1ed
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x100463b8
call fcn.10021546
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001f27b
call fcn.10021514
test eax, eax
jne 0x1001f211
xor eax, eax
jmp 0x1001f347
call fcn.10020948
test eax, eax
jne 0x1001f221
call fcn.10021532
jmp 0x1001f20a
call fcn.100214c8
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10193274], eax
call fcn.100387ac
mov dword [0x101913dc], eax
call fcn.100387ac
test eax, eax
jns 0x1001f24b
call fcn.10020621
jmp 0x1001f21a
call fcn.100387ac
test eax, eax
js 0x1001f274
call fcn.10021100
test eax, eax
js 0x1001f274
push 0
call fcn.100387ac
pop ecx
test eax, eax
jne 0x1001f274
inc dword [0x101913d8]
jmp 0x1001f344
call fcn.100210ad
jmp 0x1001f244
xor edi, edi
cmp eax, edi
jne 0x1001f2da
cmp dword [0x101913d8], edi
jle 0x1001f20a
dec dword [0x101913d8]
mov dword [ebp - 4], edi
cmp dword [0x10191744], edi
jne 0x1001f29f
call fcn.10020e3b
cmp dword [ebp + 0x10], edi
jne 0x1001f2b3
call fcn.100210ad
call fcn.10020621
call fcn.10021532
mov dword [ebp - 4], 0xfffffffe
call fcn.1001f2c6
jmp 0x1001f344
cmp eax, 2
jne 0x1001f338
call fcn.100205ed
push 0x214
push 1
call fcn.100387ac
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1001f20a
push esi
push dword [0x1004a940]
push dword [0x10191724]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x1001f32c
push edi
push esi
call fcn.10020662
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1001f344
push esi
call fcn.100387ac
pop ecx
jmp 0x1001f20a
cmp eax, 3
jne 0x1001f344
push edi
call fcn.100387ac
pop ecx
xor eax, eax
inc eax
call fcn.1002158b
ret 0xc

Function at 0x1001f4a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a900]
jne 0x1001fc43
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10191500], eax
mov dword [0x101914fc], ecx
mov dword [0x101914f8], edx
mov dword [0x101914f4], ebx
mov dword [0x101914f0], esi
mov dword [0x101914ec], edi
mov word [0x10191518], ss
mov word [0x1019150c], cs
mov word [0x101914e8], ds
mov word [0x101914e4], es
mov word [0x101914e0], fs
mov word [0x101914dc], gs
pushfd
pop dword [0x10191510]
mov eax, dword [ebp]
mov dword [0x10191504], eax
mov eax, dword [ebp + 4]
mov dword [0x10191508], eax
lea eax, [ebp + 8]
mov dword [0x10191514], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10191450], 0x10001
mov eax, dword [0x10191508]
mov dword [0x10191404], eax
mov dword [0x101913f8], 0xc0000409
mov dword [0x101913fc], 1
mov eax, dword [0x1004a900]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1004a904]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10191448], eax
push 1
call fcn.10022bfb
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10003a64
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10191448], 0
jne 0x1001fd2f
push 1
call fcn.10022bfb
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10033620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x10033636
push dword [esi + 0x34]
call fcn.100387ac
mov dword [esi + 0x34], ebx
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033646
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x44], ebx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10033656
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x48], ebx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10033666
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x50], ebx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10033676
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x4c], ebx
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x10033686
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x54], ebx
push edi
push 7
lea edi, [esi + 0x58]
pop ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x1003369c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [edi], 0
add edi, 4
dec ebx
jne 0x1003368d
mov ecx, dword [esi + 0x7c]
pop edi
test ecx, ecx
je 0x100336b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x7c], ebx
jmp 0x100336b7
xor ebx, ebx
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x100336c7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x78], ebx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x100336d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x264], ebx
cmp dword [esi + 0x260], ebx
je 0x100336f1
mov dword [esi + 0x260], ebx
mov eax, dword [esi + 0x2d4]
test eax, eax
je 0x10033708
push eax
call fcn.100387ac
pop ecx
mov dword [esi + 0x2d4], ebx
mov eax, dword [esi + 0x150]
test eax, eax
je 0x1003371f
push eax
call fcn.100387ac
pop ecx
mov dword [esi + 0x150], ebx
mov ecx, esi
pop esi
pop ebx

Function at 0x100387ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100387bb
pop dword [ebp - 0x48]
mov eax, 0xa51f9476
sub eax, 0x951c0cbb
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x40186
push 0
mov eax, 0xea12c24b
add eax, 0x25ed4f35
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xd8dd37a4
add ecx, 0x27230e25
xor ebx, ebx
add ebx, eax
mov esi, 0x1019f800
add esi, dword [ebp - 0x48]
mov edi, 0x8a45d7d
add edi, 0x6b7cfe2b
add dword [ebp - 0x28], edx
mov edx, dword [esi]
xor dword [ebp - 0x34], edx
add edx, edi
sub dword [ebp - 0x40], edx
mov dword [ebx], edx
sub dword [ebp - 0xc], 0x2f4d4aae
add ebx, 4
add esi, 0xec3cf52
sub esi, 0xec3cf4e
loop 0x10038816
add eax, 0xad60a9c4
sub eax, 0xad5f9fcd
mov ebx, eax
add eax, 0x6b25b895
sub eax, 0x6b25b890
mov ecx, 0x77d88371
add ecx, 0x98277c8f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000c334
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x10011d84
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x10026204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jl 0x10011e41
movzx eax, word [edi]
cmp eax, 0x2e
je 0x10011de6
cmp eax, 0x5c
je 0x10011e20
cmp eax, 0x2f
je 0x10011e20
cmp word [edi + 2], 0x3a
je 0x10011e20
lea eax, [ebp - 0x224]
mov esi, 0x10e
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
jmp 0x10011e01
lea eax, [ebp - 0x224]
mov esi, 0x10e
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x10011e41
cmp eax, esi
jae 0x10011e41
push dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
movzx esi, word [edi + 6]
xor eax, eax
push edi
mov word [edi + 6], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
mov word [edi + 6], si
cmp eax, 3
sete cl
mov eax, ecx
jmp 0x10011e43
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100137a3
leave
ret 8
Function at 0x402160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004352dd

Function at 0x402960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 4], ecx
test eax, eax
je 0x402a6f
test eax, 0xffff0000
jne 0x402a6f
push ebx
push edi
movzx edi, ax
push edi
call fcn.004366db
mov ebx, eax
test ebx, ebx
je 0x402a6b
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402a6b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402a6b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402a6a
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4029f9
cmp esi, ecx
jae 0x402a6a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4029e3
cmp esi, ecx
jae 0x402a6a
cmp word [esi], 0
je 0x402a6a
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x402a77
mov ebx, dword [ebp - 4]
mov ecx, 1
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x402a41
push edi
mov ecx, ebx
call fcn.00403440
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402a77
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
pop esi
pop edi
mov dl, 1
pop ebx
mov al, dl
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402130
int3
Function at 0x404f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.004366db
mov ebx, eax
test ebx, ebx
jne 0x404fa0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x405087
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405087
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405087
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x405008
cmp esi, ecx
jae 0x405087
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404ff2
cmp esi, ecx
jae 0x405087
cmp word [esi], 0
je 0x405087
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x405092
mov ebx, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebx]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or edx, ecx
jge 0x405050
push edi
mov ecx, ebx
call fcn.00403440
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x405092
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402130
int3
Function at 0x408630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69735d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x75f140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SoftwareMyRxjh
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40868e
lea eax, [ebp - 0x10]
push eax
push str.SoftwareMyRxjh
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
lea ecx, [eax - 0x10]
mov esi, dword [eax - 0xc]
jle 0x4086ae
push dword [ecx + 4]
lea ecx, [ebp + 8]
call fcn.00402aa0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
add dword [ecx + 0xc], 0xffffffff
jne 0x4086bb
mov dword [ecx + 0xc], 0xffffffff
push esi
push dword [ebp + 8]
push 1
push 0
push str.Path
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4086f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret