joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085c8
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
je 0x4085df
push 8
mov eax, esi
pop ecx
mov byte [eax], bl
inc eax
dec ecx
jne 0x4085d9
push 0xf0000000
push 0x18
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x408611
lea eax, [esi + 4]
push eax
push ebx
push ebx
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x408615
push esi
call fcn.0040859d
pop ecx
xor al, al
jmp 0x408617
mov al, 1
pop esi
pop ebx
ret

Function at 0x40865a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x148]
push 0x104
push eax
push dword [0x42b380]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp + 8]
call fcn.004010f0
test eax, eax
je 0x408696
lea eax, [ebp - 0x148]
lea ecx, [ebp + 8]
push eax
call fcn.00401168
push esi
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp + 8]
lea ecx, [ebp - 4]
push eax
mov dword [ebp - 0x44], 0x3c
call fcn.0040104d
xor esi, esi
lea ecx, [ebp - 4]
push esi
mov dword [ebp - 0x40], esi
call fcn.004019f3
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], 1
call fcn.0040104d
mov eax, dword [ebp - 8]
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x30], eax
je 0x4086f1
mov dword [ebp - 0x38], str.runas
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.00401a9f
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp + 8]
call fcn.00401a9f
lea ecx, [ebp + 0xc]
call fcn.00401a9f
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40915a
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
lea ecx, [ebp - 0x10]
call fcn.0040108c
mov ax, word [0x41e7e0]
push 0x40
pop esi
mov word [ebp - 0x42c], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x42a]
mov ebx, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x42c]
push ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ecx
lea eax, [ebp - 0x42c]
mov ecx, esp
push eax
call fcn.0040108c
lea eax, [ebp - 0x14]
push eax
call fcn.004090b9
pop ecx
lea eax, [ebp - 0x14]
pop ecx
push str._selfdestruct.bat
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
mov dx, word [0x41e7e0]
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x322]
mov word [ebp - 0x324], dx
mov word [ebp - 0x11c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x11a]
mov word [ebp - 0x220], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x21e]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x11c]
push eax
push ebx
call esi
lea eax, [ebp - 0x220]
push eax
push ebx
call esi
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x11c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x324]
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x324]
lea ecx, [ebp - 8]
push eax
call fcn.0040108c
push esi
push 0x80
push 2
push esi
push esi
lea eax, [ebp - 0x11c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40931a
lea ecx, [ebp - 4]
call fcn.00401041
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.0040164f
add esp, 0x14
lea ecx, [ebp - 4]
push 0x41a284
push 0x41a43c
call fcn.00401374
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x18]
push esi
push eax
lea ecx, [ebp - 4]
call fcn.004010e7
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x220]
push esi
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 8]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409bed
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x410]
mov dword [esi], 0x418438
push 2
push dword [esi + 0x418]
call fcn.00409c4d
mov esi, dword [esi + 8]
test esi, esi
je 0x409c20
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret

Function at 0x409cda
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x409d17
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x409d17
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x409ddb
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x409d7d
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x409d61
dec eax
je 0x409d42
dec eax
je 0x409d61
dec eax
jne 0x409ddb
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x409ddb
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x409d5c
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x409dba
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x409da8
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x409ddb
add eax, 0xffffffe2
jmp 0x409dd8
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409e10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call fcn.00409de0
test eax, eax
je 0x409e49
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.00409cda
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 4
Function at 0x409ec3
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x410], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x40c], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, esi
call fcn.00409e76
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x409efc
mov dword [esi + 0x414], eax
cmp dword [ebp + 0x18], 0
je 0x409f2e
mov eax, dword [esi + 8]
test eax, eax
je 0x409f15
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x409f36
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14

Function at 0x40a355
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov ax, word [0x41e7e0]
push ebx
push esi
push edi
mov word [ebp - 0x404], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x402]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.0040a219
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
lea eax, [ebp - 0x404]
push eax
call esi
lea eax, [ebp - 0x404]
push 0x41a428
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
call esi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp + 8]
push eax
push edi
push 0xf003f
push edi
push edi
lea eax, [ebp - 0x404]
push edi
push eax
push 0x80000001
xor ebx, ebx
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x40a3df
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp ebx, edi
je 0x40a40c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a4ab
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
cmp dword [0x42db60], 0
push esi
jne 0x40a50b
mov ax, word [0x41e7e0]
push edi
mov word [ebp - 0x400], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a24c
add esp, 0xc
mov esi, eax
test esi, esi
pop edi
je 0x40a534
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40a534
cmp dword [ebp + 0x18], 0
jne 0x40a518
mov dword [ebp + 0x18], 0x42dc2c
push dword [ebp + 0x18]
push 0x400
push dword [ebp + 0x14]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x40bad6
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0x10]
push 0x419
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x41d
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret

Function at 0x40bd1f
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x214]
push 0x104
push ecx
push eax
call fcn.0040bd08
mov dx, word [0x41e7e0]
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x10e]
push 0x40
mov word [ebp - 0x110], dx
pop ecx
lea ebx, [ebp - 0x110]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ecx, 0xffffffff
mov edi, 0x41a2f4
xor eax, eax
mov word [ebp - 0x614], dx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x110]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x110]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.___bg
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xff
lea edi, [ebp - 0x612]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor esi, esi
cmp dword [ebp + 0xc], esi
lea ecx, [ebp - 4]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
add eax, 0x80000001
mov dword [ebp - 4], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40be97
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0040ccc6
pop ecx
test eax, eax
pop ecx
je 0x40be93
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x110]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, edi
jmp 0x40be99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404cb6
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x404c82
cmp eax, 2
jne 0x404c9e
mov ecx, dword [ebp - 4]
test esi, esi
je 0x404cb0
test ecx, ecx
je 0x404cab
test cl, 1
jne 0x404c9e
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x404cb0
pop edi
mov eax, 0xd
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405c50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x4da060], 0
je 0x405ceb
cmp byte [0x4df7bc], 0
push esi
jne 0x405cdc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWAREInstallShield29.0Professional
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405ce3
mov esi, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.DoVerboseLogging
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405d1e
cmp dword [ebp - 0x10], 4
jne 0x405d1e
cmp dword [ebp - 8], 1
push ebx
sete bl
test esi, esi
je 0x405cd7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
je 0x405ce3
mov byte [0x4df7bc], 1
mov byte [0x4da060], 0
pop esi
cmp byte [0x4df7bc], 0
je 0x405d18
mov edx, dword [ebp + 0xc]
add edx, 4
cmp dword [edx + 0x14], 8
jb 0x405d02
mov edx, dword [edx]
mov ecx, dword [ebp + 8]
add ecx, 4
cmp dword [ecx + 0x14], 8
jb 0x405d10
mov ecx, dword [ecx]
push dword [ebp + 0x10]
call fcn.004053f0
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
je 0x405ce3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405ce3
Function at 0x40f1c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x40f225
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x40f21d
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.0040f13c
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40f26c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0x7863513
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.00459c53
mov edx, eax
pop ecx
test edx, edx
je 0x40f2b2
push edi
xor edi, edi
test ebx, ebx
je 0x40f2b1
sub esi, edx
mov eax, edi
lea ecx, [edi + edx]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [esi + ecx]
inc edi
mov byte [ecx], al
cmp edi, ebx
jb 0x40f29b
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0x412400
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4d9754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x412510
cmp byte [ebp + 0xc], 0
jne 0x4124be
lea ecx, [edi + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x412510
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push eax
push edi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x412501
call fcn.00473df0
pop ecx
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x412483
xor edi, edi
jmp 0x412499
lea eax, [edi + edi]
call fcn.00459c90
mov eax, esp
push 3
push edi
push esi
push eax
call fcn.004117cc
mov edi, eax
push edi
call fcn.00473ca3
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push edi
call fcn.00413c6d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x412512
lea eax, [edi + 3]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x412510
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push eax
push edi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412500
mov eax, 0xfeff
mov edi, esi
cmp word [esi], ax
jne 0x412499
lea edi, [esi + 2]
jmp 0x412499
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045978b
leave
ret 0xc

Function at 0x413168
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x413177
mov esi, dword [esi]
push esi
call fcn.00473ca3
pop ecx
push 0
push dword [ebp + 0x10]
add eax, eax
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebp
ret 0x10
Function at 0x41946e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040f080
mov ecx, eax
call fcn.0043f127
mov esi, dword [ebp + 8]
mov edi, eax
push esi
push dword [ebp + 0xc]
shr edi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4194b0
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push esi
mov ecx, ebx
call fcn.00419397
test eax, eax
jne 0x4194fe
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jle 0x4194cb
push edi
push esi
mov ecx, ebx
call fcn.00419397
test eax, eax
jne 0x4194fe
push 0x4b65d4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push edi
push 3
call fcn.00457839
add esp, 0xc
test eax, eax
jns 0x4194fe
push esi
push edi
push 4
call fcn.00457839
xor ecx, ecx
add esp, 0xc
test eax, eax
setns cl
mov eax, ecx
jmp 0x419501
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4198ea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
and dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x419966
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x419966
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 4], eax
test eax, eax
je 0x419966
lea edi, [eax + 0x40]
push edi
call fcn.00459c53
mov dword [esi], eax
pop ecx
test eax, eax
je 0x419966
push edi
push 0
push eax
call fcn.004714b0
add esp, 0xc
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi]
call fcn.00471640
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push 0
push 0
call fcn.00471ff8
int3