joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4759
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6dba9c], cl
jne 0x5629ad
jmp 0x511454
or dword [0x6dba9c], ecx
xor eax, eax
jmp 0x511461
lea edx, [eax + 1]
imul edx, edx, 0x3417
xor dx, word [eax*2 + 0x5ce268]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xd
jl 0x511461
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x1ea7
xor dx, word [eax*2 + 0x5ce284]
mov word [ebp + eax*2 - 0x208], dx
jmp 0x562982
add eax, ecx
cmp eax, 5
jl 0x511487
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6dba98], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push edx
push esi
push eax
call dword [0x6dba98]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570f11
mov esp, ebp
pop ebp
ret

Function at 0x4fca68
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.msvcrt.dll_rand]
push edi
mov edi, dword [0x6d753c]
call esi
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x50], 0xa
jmp 0x518834
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x54], 1
mov word [ebp - 0x58], dx
mov edx, ecx
sub edx, dword [ebp - 0x58]
mov word [ebp - 0x56], dx
call esi
and eax, 0x800000ff
jns 0x518860
dec eax
or eax, 0xffffff00
inc eax
cmp byte [ebp - 0x54], 0
mov byte [ebp - 0x53], al
je 0x51887f
mov cl, al
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x518871
push 0
push 0x50
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp byte [ebp - 0x54], 0
jmp 0x597cde
je 0x597cf7
mov cl, byte [ebp - 0x53]
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x597ce9
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00570f11
mov esp, ebp
pop ebp
ret

Function at 0x506eb9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 1
test byte [0x6dbaa4], cl
jne 0x5a69b8
or dword [0x6dbaa4], ecx
xor eax, eax
jmp 0x4c1b6e
lea edx, [eax + 1]
imul edx, edx, 0x1d8b
xor dx, word [eax*2 + 0x5ce240]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xa
jl 0x4c1b6e
jmp 0x5a6972
push ebx
push edi
push 0
push 0
push esi
call dword [0x6dbaa0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570f11
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x4c1b50
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x4c32
xor dx, word [eax*2 + 0x5ce258]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 7
jl 0x5a6974
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6dbaa0], eax
push 0
push 0
jmp 0x4f473e
Function at 0x507b74
Capabilities:
Encode data using xor

Disassembly:
lea edx, [eax + 1]
imul edx, edx, 0x7425
xor dx, word [eax*2 + 0x5ce6ec]
inc eax
mov word [ebp + eax*2 - 0x536], dx
push 0x5bbc38
ret
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.msvcrt.dll_sprintf]
push ebx
lea eax, [ebp - 0x434]
push eax
push ecx
call esi
add esp, 0xc
xor eax, eax
jmp 0x4dcdf6
lea ecx, [eax + 1]
imul ecx, ecx, 0x76b6
xor cx, word [eax*2 + 0x5ce6d4]
inc eax
mov word [ebp + eax*2 - 0x436], cx
cmp eax, 0xa
jl 0x4dcdf6
jmp 0x537a4e
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x538], ecx
xor eax, eax
mov edi, edi
lea edx, [eax + 1]
imul edx, edx, 0x22de
xor dx, word [eax*2 + 0x5ce6c0]
inc eax
mov word [ebp + eax*2 - 0x436], dx
cmp eax, 8
jl 0x507b94
jmp 0x4dcdd8
push ebx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x30c]
push eax
call esi
add esp, 0xc
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x459b5b
cmp edi, 0xffffffff
je 0x459b5b
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x328], eax
push 0x1000
jmp dword [0x537ab0]

Function at 0x51bfdb
Capabilities:
Create tcp socket
Create udp socket
Encode data using xor

Disassembly:
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x973
xor cx, word [eax*2 + 0x5ceabc]
jmp 0x52183e
cmp eax, 0xffffffff
jne 0x40a327
xor eax, eax
nop
lea ecx, [eax + 1]
imul ecx, ecx, 0x3295
xor cx, word [eax*2 + 0x5ceaa8]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 9
jl 0x50f1c6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [ebp - 0x118]
push edx
push 0x6923c8
jmp dword [0x50f205]
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x6d753c], eax
jmp 0x50f1ba
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 5
jl 0x40a330
lea edx, [ebp - 0x118]
push edx
call fcn.0043f760
xor eax, eax
mov ecx, esi
xor ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
xor esi, dword [ebp + 8]
push 0x10
lea edx, [ebp - 0x14]
mov word [ebp - 0x12], ax
push 0x42f9b2
ret
Function at 0x524703
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53b449
xor ecx, ecx
lea edx, [ecx + 1]
imul edx, edx, 0x1991
xor dx, word [ecx*2 + 0x5ce7b4]
inc ecx
mov word [ebp + ecx*2 - 0x318e], dx
cmp ecx, 6
jl 0x4369a2
push eax
lea eax, [ebp - 0x318c]
jmp 0x53b43e
cmp eax, 9
jl 0x53b45c
lea edx, [ebp - 0x33b0]
push edx
mov edx, dword [ebp - 0x33b4]
lea eax, [ebp - 0x5f4]
push eax
push 0
push 0
lea ecx, [ebp - 0x318c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x58b7ef
lea eax, [ebp - 0x5f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4460d6
mov esi, dword [ebp - 0x33b0]
jmp 0x58b7b8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x33bc], eax
mov dword [ebp - 0x33c4], edi
xor eax, eax
lea ecx, [ecx]
lea ecx, [eax + 1]
imul ecx, ecx, 0x7a6c
xor cx, word [eax*2 + 0x5ce794]
inc eax
mov word [ebp + eax*2 - 0x318e], cx
cmp eax, 0xe
jl 0x49e1b1
lea edx, [ebp - 0x33b4]
push edx
push 1
push 0
lea eax, [ebp - 0x318c]
jmp 0x43698c
push ebp
mov ebp, esp
mov eax, 0x33d0
call fcn.00475102
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
jmp 0x49e198
push eax
push edi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x33b0], 0x3e8
mov byte [ebp - 0x5f4], 0
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x72a4
xor cx, word [eax*2 + 0x5ce7c4]
inc eax
mov word [ebp + eax*2 - 0x318e], cx
jmp 0x446096
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x58b7ef
mov bl, 0x20
mov byte [ebp + eax - 0x5f4], bl
lea eax, [ebp - 0x5f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x58b7d7
sub eax, edx
lea edx, [eax + 1]
cmp edx, esi
jb 0x58b7c7
mov dword [ebp - 0x33b0], 0x100
mov byte [ebp - 0x1b74], 0
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x2d3
push 0x4f02d8
ret

Function at 0x55c1d8
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
pop ebp
ret 8
mov dword [0x6d740c], eax
mov byte [0x6d7650], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x6d740c]
lea edx, [ecx + eax*2]
xor eax, eax
mov dword [esi], edx
test edi, edi
jle 0x4ba83e
lea ebx, [ebx]
mov edx, dword [esi]
lea ecx, [eax + 1]
imul ecx, dword [ebp + 8]
xor cx, word [ebx + eax*2]
inc eax
mov word [edx + eax*2 - 2], cx
cmp eax, edi
jl 0x4c8c22
jmp 0x4ba83e
push ebp
mov ebp, esp
cmp byte [0x6d7650], 0
jne 0x4c8c04
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
jmp 0x4c8bf8
Function at 0x595648
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, ax
sub edx, dword [esi + 0x10]
mov eax, dword [esi + 0x1c]
lea ecx, [eax + edx*4]
mov esi, dword [ecx + edi]
mov eax, dword [ebx + edi + 0x78]
cmp esi, eax
jb 0x5625ac
mov edx, dword [ebx + edi + 0x7c]
add edx, eax
cmp esi, edx
ja 0x5625ac
mov ebx, dword [ebp - 0x420]
test ebx, ebx
je 0x4108ab
mov byte [ebx + 0xff], 1
lea eax, [esi + edi]
lea edx, [ebp - 0x10c]
push 0x495a68
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00570f11
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x414]
cmp ecx, 0xffffffff
je 0x43ea55
cmp dword [ebp + 0x10], 0
movzx eax, word [ebp + 0x14]
je 0x41086d
mov edx, dword [esi + 0x24]
lea eax, [edx + ecx*2]
mov cx, word [eax + edi]
jmp dword [0x43ea99]
jne 0x4ae197
add eax, 2
add ecx, 2
test dl, dl
jne 0x583ffb
xor eax, eax
jmp 0x4ae19c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43ea68
mov eax, dword [ebp - 0x414]
add dword [ebp - 0x410], 4
inc eax
mov dword [ebp - 0x414], eax
push 0x43ea4c
ret
add esi, edi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x420], edx
test edx, edx
je 0x4dc051
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4dc043
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
je 0x43ea77
mov dword [ebp - 0x414], ecx
jmp 0x583fd2
push eax
call fcn.00574dae
add esp, 4
add esi, eax
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570f11
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x18], 0
jne 0x4e31ab
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x418]
jmp 0x4e31a0
cmp dword [esi + 0x18], ecx
jbe 0x43ea55
mov eax, dword [esi + 0x20]
add eax, edi
mov dword [ebp - 0x410], eax
jmp 0x583ff1
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
add eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ae197
test dl, dl
je 0x4ae190
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jmp 0x4ae17c
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 0x3c]
mov esi, dword [ebx + edi + 0x78]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0xc]
jmp 0x4dc02a

Function at 0x598dd1
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp edi, 0xffffffff
pop edi
jne 0x53a135
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
jmp dword [0x53a143]
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x6d753c]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x53a135
push edi
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x100000
jle 0x598e00
mov eax, 0x100000
push 0
push eax
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jle 0x53a122
jmp dword [0x598e28]
Function at 0x5b79bd
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x334], eax
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x6f35
xor cx, word [eax*2 + 0x5ce5d0]
inc eax
mov word [ebp + eax*2 - 0x222], cx
cmp eax, 7
jl 0x43b13f
lea edx, [ebp - 0x220]
push edx
mov ecx, esi
call fcn.00574dae
add esp, 4
mov edi, eax
xor eax, eax
jmp 0x43b17c
lea ecx, [eax + 1]
jmp 0x51be1e
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x328], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push edi
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x330], 0x1000
cmp eax, ecx
je 0x5aad0a
mov byte [eax], cl
mov byte [eax + 0xff], cl
jmp 0x5aad0a
imul ecx, ecx, 0x313e
xor cx, word [eax*2 + 0x5ce5e0]
inc eax
mov word [ebp + eax*2 - 0x222], cx
cmp eax, 7
jl 0x43b17c
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x4335
xor dx, word [eax*2 + 0x5ce5f0]
inc eax
mov word [ebp + eax*2 - 0x322], dx
cmp eax, 7
jl 0x51be40
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x320]
jmp dword [0x51be76]
lea ebx, [ebp - 0x330]
lea edi, [ebp - 0x324]
call 0x404f91
xor ebx, ebx
mov dword [ebp - 0x1c], 0x68
mov dword [ebp - 0x18], 0xb800
mov dword [ebp - 0x14], 0xd0ff0000
mov dword [ebp - 0x10], 0x589
mov dword [ebp - 0xc], 0x4c20000
mov byte [ebp - 8], bl
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x18cd
xor cx, word [eax*2 + 0x5ce5c0]
inc eax
mov word [ebp + eax*2 - 0x222], cx
cmp eax, 7
jl 0x5aad45
jmp 0x43b12a
push ebp
mov ebp, esp
sub esp, 0x33c
jmp 0x4500b8
Function at 0x401a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov edx, dword [0x42f00c]
mov eax, dword [ebp + 8]
mov esi, ecx
xor edx, ebp
mov dword [ebp - 8], edx
cmp dword [esi + 0x1c], eax
jne 0x401a52
mov eax, dword [esi + 0x20]
inc eax
jmp 0x401a61
mov dword [esi + 0x1c], eax
mov eax, 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x20], eax
cmp dword [esi + 0x10], 0
je 0x401acf
cmp dword [esi + 0x14], 8
jb 0x401ae1
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push 0x42b27c
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x401acf
push dword [ebp - 0xc]
push 1
push 5
push str.GBP1_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push dword [esi + 0x1c]
push 0x42b22b
push dword [ebp - 0xc]
call fcn.00401b40
add esp, 0xc
push dword [esi + 0x20]
push 0x42b22b
push dword [ebp - 0xc]
call fcn.00401b40
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00427650
add esp, 8
pop esi
pop ebp
ret 4
mov eax, esi
jmp 0x401a72
Function at 0x404800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x42f00c]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x38], 0
je 0x404881
cmp byte [ecx + 0x3d], 0
mov esi, ecx
je 0x404881
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40487f
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x30]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x404895
cmp eax, 1
je 0x40485b
test eax, eax
jne 0x40487f
mov byte [esi + 0x3d], 0
mov ebx, dword [ebp - 0x34]
sub ebx, edi
je 0x404876
push dword [esi + 0x4c]
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x40487f
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x404881
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427650
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x404881
Function at 0x4069b0
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 8], eax
push str.MOZ_CRASHREPORTER_NO_DELETE_DUMP
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x4069dc
cmp byte [eax], 0
jne 0x406abb
cmp dword [0x42f558], 0
je 0x406a29
lea esi, [ebp - 0x20]
mov edx, 0x42f548
mov ecx, esi
call fcn.004129a0
cmp dword [ebp - 0xc], 7
jbe 0x4069fd
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
cmp ecx, 8
jb 0x406a29
mov eax, dword [ebp - 0x20]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x406acb
push edx
push eax
call fcn.00426ce1
add esp, 8
cmp dword [0x42f570], 0
je 0x406a72
lea esi, [ebp - 0x20]
mov edx, 0x42f560
mov ecx, esi
call fcn.004129a0
cmp dword [ebp - 0xc], 7
jbe 0x406a4a
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
cmp ecx, 8
jb 0x406a72
mov eax, dword [ebp - 0x20]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x406ae6
push edx
push eax
call fcn.00426ce1
add esp, 8
cmp dword [0x42f588], 0
je 0x406abb
lea esi, [ebp - 0x20]
mov edx, 0x42f578
mov ecx, esi
call fcn.004129a0
cmp dword [ebp - 0xc], 7
jbe 0x406a93
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
cmp ecx, 8
jb 0x406abb
mov eax, dword [ebp - 0x20]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x406b01
push edx
push eax
call fcn.00426ce1
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00427650
add esp, 0x1c
pop esi
pop ebp
ret
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x406b19
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x406a1f
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x406b19
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x406a68
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x406b19
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x406ab1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x411f10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1c
mov eax, dword [0x42f00c]
lea esi, [ebp - 0x24]
mov edx, ecx
mov ecx, esi
xor eax, ebp
mov dword [ebp - 0xc], eax
call fcn.004129a0
cmp dword [ebp - 0x10], 7
jbe 0x411f37
mov esi, dword [ebp - 0x24]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp ecx, 8
jb 0x411f63
mov eax, dword [ebp - 0x24]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x411f8d
push edx
push eax
call fcn.00426ce1
add esp, 8
test esi, esi
jne 0x411f74
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x411f89
mov bl, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00427650
mov eax, ebx
add esp, 0x1c
pop esi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x411f76
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x411fa5
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x411f59
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x413170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
cmp byte [0x42f620], 1
movzx eax, cx
jne 0x4131fd
push 5
push eax
push 0
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push edi
push dword [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
or byte [esi + 0xa], 0x40
push 0
push dword [ebp + 8]
push dword [ebp - 0x14]
push esi
push 0
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x41320c
push 0
push dword [ebp + 8]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamW]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x415c90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x42f00c]
mov edi, edx
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x10]
cmp dword [ecx + 0x10], eax
je 0x415d41
lea ebx, [ebp - 0x28]
mov edx, edi
mov ecx, ebx
call fcn.004129a0
cmp dword [ebp - 0x14], 7
jbe 0x415cc8
mov ebx, dword [ebp - 0x28]
lea edi, [ebp - 0x40]
mov edx, esi
mov ecx, edi
call fcn.004129a0
cmp dword [ebp - 0x2c], 7
jbe 0x415cdd
mov edi, dword [ebp - 0x40]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x2c]
cmp eax, 1
sete bl
cmp ecx, 8
jb 0x415d0c
mov eax, dword [ebp - 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x415d68
push edx
push eax
call fcn.00426ce1
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x415d2d
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x415d80
push edx
push eax
call fcn.00426ce1
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427650
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esi + 0x14], 0xf
jbe 0x415d98
mov ecx, dword [esi]
cmp dword [edi + 0x14], 0xf
jbe 0x415da0
mov edx, dword [edi]
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x415cb3
mov bl, 1
jmp 0x415d2d
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x415da4
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x415d02
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x415da4
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x415d23
mov ecx, esi
cmp dword [edi + 0x14], 0xf
ja 0x415d4f
mov edx, edi
jmp 0x415d51
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x418650
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x814
mov eax, dword [0x42f00c]
lea esi, [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push 0
push 0x31
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41868f
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
lea ebx, [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x400
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x1c], 8
jb 0x4186b1
mov ebx, dword [ebx]
lea edx, [ebp - 0x818]
push edx
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor esi, esi
test eax, eax
je 0x41874c
lea eax, [ebp - 0x810]
mov ebx, eax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
lea ecx, [ebp - 0x820]
push ecx
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x41874c
mov eax, dword [ebp - 0x818]
mov edx, dword [ebp - 0x820]
lea edi, [ebp + 0x10]
sub eax, edx
js 0x41874f
lea edi, [ebp + 8]
mov esi, dword [edi + 0x24]
mov ecx, dword [edi + 4]
test esi, esi
jne 0x418718
mov esi, dword [ecx + 8]
sub esi, edx
sub esi, dword [ecx]
add esi, eax
cmp byte [edi + 0x20], 0
je 0x418724
sub dword [ecx], esi
jmp 0x418727
add dword [ecx + 8], esi
lea eax, [ebp + 8]
mov ebx, eax
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [eax + 8]
sub ecx, edi
sub eax, edx
push 1
push ecx
push eax
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_MoveWindow]
lea edi, [ebp + 0x10]
lea eax, [ebp + 8]
mov ecx, dword [eax + 0x1c]
cmp ecx, 8
jb 0x418772
mov eax, dword [edi]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x418789
push edx
push eax
call fcn.00426ce1
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427650
mov eax, esi
add esp, 0x814
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x4187a1
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x418768
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3