joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4082d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x44106c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.00402a70
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.004029f0
add esp, 8
movzx edx, al
test edx, edx
je 0x408315
lea eax, [ebp + 8]
push eax
call fcn.00402a20
add esp, 4
jmp 0x408496
mov ecx, dword [ebp - 0x2c]
call fcn.00409fa0
test eax, eax
je 0x408357
mov ecx, dword [ebp - 0x2c]
call fcn.00409fa0
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.00409f20
cmp esi, eax
jae 0x408357
lea ecx, [ebp + 8]
push ecx
call fcn.004029d0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.00409dd0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x408496
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x40836a
call fcn.00402a70
jmp 0x408496
mov ecx, dword [ebp - 0x2c]
call fcn.00409870
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x4083b9
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.004029d0
add esp, 4
movzx ecx, al
push ecx
call fcn.00404180
add esp, 8
movzx edx, al
test edx, edx
je 0x4083a9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x4083b1
call fcn.00402a70
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x408496
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.004029d0
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.00408c00
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x408491
cmp dword [ebp - 0x34], 1
jle 0x408414
cmp dword [ebp - 0x34], 3
je 0x408461
jmp 0x408491
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x408446
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00419e53
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x408446
call fcn.00402a70
jmp 0x408496
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x40845a
mov eax, dword [ebp + 8]
jmp 0x408496
call fcn.00402a70
jmp 0x408496
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.00404180
add esp, 8
movzx eax, al
test eax, eax
je 0x408484
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x40848c
call fcn.00402a70
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x408496
call fcn.00402a70
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413262
mov esp, ebp
pop ebp
ret 4
Function at 0x409900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x44106c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x409927
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40992e
mov al, 1
jmp 0x409a02
call fcn.00402a70
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00402a70
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.004029f0
add esp, 8
movzx eax, al
test eax, eax
je 0x40996a
xor al, al
jmp 0x409a02
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.0040a250
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4099a6
cmp dword [ebp - 0x30], 1
je 0x4099ad
cmp dword [ebp - 0x30], 3
je 0x4099fc
jmp 0x409a00
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x4099dc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00419e53
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x4099dc
xor al, al
jmp 0x409a02
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4099f0
mov dword [ebp - 0x38], 1
jmp 0x4099f7
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x409a02
mov al, 1
jmp 0x409a02
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413262
mov esp, ebp
pop ebp
ret
Function at 0x411960
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push eax
call fcn.00411890
add esp, 4
sub eax, 3
sbb edx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
push 0x43cc78
mov ecx, dword [ebp + 8]
push ecx
call fcn.00419bf9
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41199d
jmp 0x411a9b
xor edx, edx
mov word [ebp - 4], dx
mov byte [ebp - 2], dl
mov eax, dword [ebp - 8]
push eax
push 1
push 3
lea ecx, [ebp - 4]
push ecx
call fcn.0041a896
add esp, 0x10
mov dword [ebp - 0xc], 0
mov edx, 1
imul eax, edx, 0
movzx ecx, byte [ebp + eax - 4]
cmp ecx, 0xef
jne 0x411a37
mov edx, 1
shl edx, 0
movzx eax, byte [ebp + edx - 4]
cmp eax, 0xbb
jne 0x411a37
mov ecx, 1
shl ecx, 1
movzx edx, byte [ebp + ecx - 4]
cmp edx, 0xbf
jne 0x411a37
cmp dword [ebp - 0x18], 0
jl 0x411a37
jg 0x411a0c
cmp dword [ebp - 0x1c], 0
jbe 0x411a37
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00413785
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0041a896
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.00419f21
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x411a9b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x43cc80
mov ecx, dword [ebp + 8]
push ecx
call fcn.00419bf9
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00419e53
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.00419f21
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004132d4
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x420278
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004200f7

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0xd41212f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x5d245224
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0xfb4000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xfb400a
jmp 0xfb600f
jmp fcn.00b1e058
Function at 0x40cf30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cbe0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x439b84
call fcn.0040f9cf
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040ee86
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420a03
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420879
Function at 0x409974
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x4099b3
call fcn.00402fdb
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4099b3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4099bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.004135fc
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40a3be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40a44a
cmp dword [esi + 0x20], 0
je 0x40a44a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40a44a
cmp dword [ebp + 8], 0
je 0x40a44a
xor edi, edi
mov ebx, edi
call fcn.00402fdb
push 0x565eb0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x40a42e
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a44a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0041439d
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40a446
mov ecx, esi
call fcn.0040a15c
mov eax, edi
jmp 0x40a44c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40ea2c
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5559a5
call fcn.00536284
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x40ea52
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40eaac
lea ecx, [ebp - 0x10]
call fcn.00402bce
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x56491c]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0053d945
push eax
call fcn.004023d8
add esp, 0x14
test esi, esi
je 0x40ea9f
push esi
call fcn.0053dcf0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040327f
mov eax, ebx
call fcn.00536252
ret 8
Function at 0x4109ed
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0040e972
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x410a29
call fcn.00410c0a
mov dword [esi + 0xc], 1
jmp 0x410a2e
call fcn.00410c0a
cmp dword [esi], 0
je 0x410a79
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x410a54
push edi
call fcn.00403931
lea ecx, [edi + 1]
push ecx
jmp 0x410a63
push 0xff
call fcn.004031fd
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00403954
pop edi
jmp 0x410a9d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x410a9d
push dword [esi]
push dword [ebp - 4]
call fcn.004101dc
pop esi
leave
ret 0xc

Function at 0x410b61
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00410c0a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x410ba9
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00403931
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00403954
jmp 0x410bb4
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004101dc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x415009
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x415034
cmp dword [edi + 0x80], 0
jne 0x415034
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.00402fdb
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004152a7
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x415061
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402fdb
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x415094
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.004150a7
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x417222
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x417278
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x417251
call fcn.00411934
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x417266
call fcn.00411934
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x417278
call fcn.00411934
call fcn.00402fdb
cmp dword [eax + 0x3c], 0
je 0x41728d
push edi
mov ecx, ebx
call fcn.00416945
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00417473
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4172b6
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4172c2
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4367f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x43680c
call fcn.00402fdb
mov esi, dword [eax + 0xc]
push 0x56cc50
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x43684e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43684e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x43684e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00436857
jmp 0x436850
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4d3995
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x55ed87
call fcn.005362b7
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404b99
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x56546c
call fcn.0041393a
cmp eax, 0xffffffff
jne 0x4d3a70
push 0
push 0x56cc0c
lea ecx, [ebp - 0x4d0]
call fcn.0041393a
cmp eax, 0xffffffff
jne 0x4d3a70
push 0
push 0x566d88
lea ecx, [ebp - 0x4d0]
call fcn.0041393a
cmp eax, 0xffffffff
jne 0x4d3a70
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404b99
add eax, 0x10
pop ecx
mov dword [ebp - 0x4d8], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x4d4], edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4d3a3f
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56491c]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.0040327f
jmp 0x4d3aa9
lea eax, [ebp - 0x218]
push eax
call fcn.0053dcf0
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00404186
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040327f
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4d3a96
mov edi, dword [ebp - 0x4cc]
jmp 0x4d3aa9
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56491c]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040327f
mov eax, edi
call fcn.00536266
ret

Function at 0x4ed8ca
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00547090
pop ecx
test eax, eax
jne 0x4ed90c
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00405a35
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ed8d2
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x100022a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100022c4
xor eax, eax
jmp 0x10002344
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100022db
xor eax, eax
jmp 0x10002344
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10002327
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10002327
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100022fe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10002333
xor eax, eax
jmp 0x10002344
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10002341
xor eax, eax
jmp 0x10002344
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10005c20
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ba4bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push 0
mov ecx, dword [ebp + 0xc]
call fcn.10006d10
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x10005c86
push str.Failed_to_calculate_base64_decoded_size.
lea ecx, [ebp - 0x40]
call fcn.10005bc0
push 0x1022edcc
lea ecx, [ebp - 0x40]
push ecx
call fcn.1019239e
nop
lea ecx, [ebp - 0xd]
call fcn.10002610
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10006c90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.10006990
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
call fcn.10006d10
mov dword [ebp - 0x28], eax
push 0
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x10005cfe
push str.Failed_to_decode_base64_string.
lea ecx, [ebp - 0x4c]
call fcn.10005bc0
push 0x1022edcc
lea edx, [ebp - 0x4c]
push edx
call fcn.1019239e
nop
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
call fcn.10006b40
mov ecx, dword [ebp - 0x18]
or ecx, 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10006b20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret