joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b2d
Capabilities:
Receive http response

Disassembly:
push ebx
push edi
mov edi, dword [esi + 0xb0]
push edi
call fcn.00430751
pop ecx
push 0
mov ebx, eax
mov eax, dword [esi + 0xc4]
push edi
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x401b93
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x40]
mov dword [esi + 0x84], eax
cmp dword [ecx + 0x14], 8
jb 0x401b6a
mov ecx, dword [ecx]
push ecx
push eax
mov ecx, str.dJz671zzj9tHw7vODsWB3Qbc_6sZ2Y3AU5fv7g7Sio8O3Miidg
call fcn.00420467
push eax
call fcn.0041f822
push ebx
mov dword [esi + 0x80], 3
call fcn.004307e5
add esp, 0x10
xor al, al
jmp 0x401b95
mov al, 1
pop edi
pop ebx
ret

Function at 0x401b98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0xcc], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0xb0], edi
jne 0x401c2d
cmp dword [0x47c8c4], 8
jb 0x401bdb
mov eax, dword [0x47c8b0]
mov dword [ebp - 0x210], eax
jmp 0x401be5
mov dword [ebp - 0x210], 0x47c8b0
call fcn.0042b67c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x469c0c
push dword [ebp - 0x210]
call dword [0x47f4e4]
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.004022c5
lea eax, [ebp - 0x20c]
push 0x469c14
push eax
call fcn.004308dd
pop ecx
pop ecx
mov dword [esi + 0xcc], eax
push dword [esi + 0xcc]
push edi
push 1
push ebx
call fcn.00430a92
push ebx
call fcn.004307e5
add dword [esi + 0xb4], edi
add esp, 0x14
cmp dword [esi + 0xb8], 0
je 0x401c63
cmp byte [esi + 0xac], 0
je 0x401c63
add dword [0x47f504], edi
pop edi
lea eax, [esi + 0x80]
cmp dword [eax], 3
pop esi
pop ebx
je 0x401c77
mov dword [eax], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fd59
leave
ret 8
Function at 0x402896
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00402839
cmp eax, dword [ebx]
pop ecx
mov dword [ebx], eax
jle 0x4028ac
xor al, al
pop ebp
ret
push esi
xor esi, esi
cmp esi, dword [ebp + 0x10]
jge 0x402933
mov eax, dword [ebp + 0xc]
push edi
mov ecx, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
inc esi
cmp esi, dword [ebp + 0x10]
jge 0x4028cf
mov edx, dword [ebp + 8]
movzx edi, byte [esi + edx]
inc esi
jmp 0x4028d1
xor edi, edi
cmp esi, dword [ebp + 0x10]
jge 0x4028e0
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
inc esi
jmp 0x4028e2
xor edx, edx
shl ecx, 8
add ecx, edi
shl ecx, 8
add ecx, edx
mov edx, ecx
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], dl
mov edx, ecx
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 0x3f
mov byte [eax + 2], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
cmp esi, dword [ebp + 0x10]
jl 0x4028b8
pop edi
mov eax, dword [ebp + 0x10]
cdq
push 3
pop esi
idiv esi
xor ecx, ecx
lea eax, [edx*4 + 0x47c864]
cmp dword [eax], ecx
jle 0x40295a
mov edx, dword [ebx]
mov esi, dword [ebp + 0xc]
sub edx, ecx
inc ecx
mov byte [edx + esi - 1], 0x3d
cmp ecx, dword [eax]
jl 0x402949
mov al, 1
pop esi
pop ebp
ret
Function at 0x407117
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
push ebx
mov ebx, dword [ebp + 0x3bc]
and dword [ebx], 0
push esi
push edi
push 0x104
lea eax, [ebp + 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x1a4]
push eax
lea esi, [ebp - 0x80]
call fcn.004022ed
push str._bitsadmin.exe
mov eax, esi
push eax
call fcn.00408d24
cmp dword [ebp - 0x6c], 8
mov eax, dword [ebp - 0x80]
jae 0x407177
mov eax, esi
mov edi, str.dpjv4zregspjgfL4CMS5
push eax
mov ecx, edi
call fcn.00420467
push eax
mov esi, str.shlwapi.dll
push esi
call fcn.0042748c
pop ecx
pop ecx
call eax
test eax, eax
jne 0x4071f8
push eax
push 0x26
lea eax, [ebp - 0x64]
push eax
push 0
mov ecx, str.dbHc7gjknspFkPrnOtiCy0OLyoI37k
call fcn.00420467
push eax
push str.shell32.dll
call fcn.0042748c
pop ecx
pop ecx
call eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004022c5
push str.Support_Tools_bitsadmin.exe
lea eax, [ebp - 0x80]
push eax
call fcn.00408d24
cmp dword [ebp - 0x6c], 8
mov eax, dword [ebp - 0x80]
jae 0x4071e1
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.00420467
push eax
push esi
call fcn.0042748c
pop ecx
pop ecx
call eax
test eax, eax
je 0x4071fe
mov dword [ebx], 1
push 1
xor edi, edi
lea esi, [ebp - 0x80]
call fcn.00402342
mov ecx, dword [ebp + 0x3ac]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042fd59
add ebp, 0x3b0
leave
ret 8
Function at 0x4075a0
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1020]
mov eax, 0x1020
call fcn.00445f70
push 0xffffffffffffffff
push 0x45efe1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp + 0x101c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x47c8c4], 8
mov esi, dword [0x47c8b0]
jae 0x4075f0
mov esi, 0x47c8b0
xor edi, edi
xor eax, eax
mov dword [ebp + 0x14], 7
mov dword [ebp + 0x10], edi
mov word [ebp], ax
push 0x6a
lea ecx, [ebp]
mov dword [ebp - 4], edi
call fcn.00402f55
lea eax, [ebx + 0x1ac]
pop ecx
cmp word [eax], di
je 0x407627
cmp byte [ebx + 0x1a1], 0
mov dword [ebp - 0x10], eax
jne 0x40762a
mov dword [ebp - 0x10], esi
cmp dword [ebp + 0x14], 8
mov edi, dword [ebp]
jae 0x407636
lea edi, [ebp]
call fcn.00428a55
push eax
push esi
push esi
push esi
push edi
push dword [ebp - 0x10]
mov ecx, str.A4rHoVnExIFKl_CCWcSPwkJ8vMZ28DMQJ6Srg_Wg8YM1_mDJmHzEnwvvhZxMSBQ4Hgg
push 0x2d99
call fcn.004204c2
pop ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0040b25a
mov esi, eax
add esp, 0x20
lea eax, [ebp + 0x1c]
push eax
push 0x128
mov ecx, str.Ypzo_w7YlZFlvWxXJK9pQ
call fcn.00420467
pop ecx
push eax
call fcn.0041f822
pop ecx
xor eax, eax
pop ecx
test esi, esi
js 0x407698
lea ecx, [ebp + eax*2 + 0x1c]
cmp word [ecx], 9
jne 0x407693
xor edx, edx
mov word [ecx], dx
inc eax
cmp eax, esi
jle 0x407684
lea esi, [ebx + 0x88]
cmp dword [esi + 0x14], 8
jb 0x4076a8
mov eax, dword [esi]
jmp 0x4076aa
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4076de
cmp dword [esi + 0x14], 8
jb 0x4076bd
mov esi, dword [esi]
push esi
push 0x79ad
push 0x1bd3
mov ecx, str.Ypzo_w7YlZFlvWxXPGHw0PZvK4vkM7LQ5X_xnT5A
call fcn.00420467
pop ecx
pop ecx
push eax
call fcn.0041f822
pop ecx
pop ecx
jmp 0x407707
cmp dword [esi + 0x14], 8
jb 0x4076e6
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x3f9f
mov ecx, str.Ypzo_w7YlZFlvWxXPGPxkrZ7Rc04vDQ43qxregsoG3r7YW5eNwEKcu64YvQ
call fcn.00420467
pop ecx
push eax
call fcn.0041f822
add esp, 0xc
mov ecx, str.dbHd4hDSod9Di_r_FdiAA
call fcn.00420467
push eax
call fcn.004274db
pop ecx
mov edx, eax
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, 0x1494
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
call edx
push eax
mov ecx, str.Ypzo_w7YlZFlvWxXOSm6UV_sQM0pzOUpD05SuXnMwb3PB
call fcn.00420467
push eax
call fcn.0041f822
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp]
call fcn.00402342
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x101c]
xor ecx, ebp
call fcn.0042fd59
add ebp, 0x1020
leave
ret
Function at 0x407840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x47c8c4], 8
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x210], eax
mov eax, dword [0x47c8b0]
push edi
mov ebx, ecx
jae 0x407874
mov eax, 0x47c8b0
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x46b2ec
push eax
call dword [0x47f4e4]
lea eax, [ebp - 0x20c]
push eax
call dword [0x47f490]
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40789f
mov esi, str..ico
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push 0x469c14
push eax
movsw word es:[edi], word [esi]
call fcn.004308dd
mov esi, eax
push esi
push dword [ebp + 0xc]
push 1
push dword [ebp - 0x210]
call fcn.00430a92
push esi
call fcn.0043069e
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
add ebx, 0x88
push ebx
call fcn.004022c5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fd59
leave
ret 8

Function at 0x4082c7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi - 0x60]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfff7ffff
cmp eax, ecx
je 0x4082f0
push ecx
push 0xfffffffffffffff0
push dword [esi - 0x60]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi - 0x60]
call edi
push 5
push dword [esi - 0x60]
call edi
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x40a09c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x138
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push esi
mov esi, dword [0x47e308]
push 0xf0
push 0xc9
push esi
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40a225
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a225
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a225
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push edi
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x40a223
mov ecx, dword [esi + 4]
mov edi, eax
movzx eax, word [esi + 2]
mov dword [ebp - 0xa0], ecx
mov ecx, 0x403
add esi, 8
cmp cx, ax
jne 0x40a197
lea eax, [ebp - 0x90]
push 3
mov dword [ebp - 0x94], eax
push esi
lea eax, [ebp - 0x94]
push eax
call fcn.0040afef
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x9c]
push 0
push 0x143
push edi
push dword [eax + 4]
call ebx
cmp eax, 0xffffffff
jne 0x40a177
and dword [ebp - 0x98], 0
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x40a210
push dword [ebp - 0x94]
call fcn.004307e5
pop ecx
jmp 0x40a210
mov ecx, 0x1234
cmp cx, ax
jne 0x40a210
or dword [ebp - 0xc0], 0xffffffff
lea eax, [ebp - 0x90]
push 3
mov dword [ebp - 0x94], eax
push esi
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0xc4], 1
call fcn.0040afef
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xbc], eax
cmp eax, ecx
je 0x40a1ea
push eax
call fcn.004307e5
pop ecx
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0x9c]
push 0
push 0x40b
push edi
push dword [eax + 4]
call ebx
cmp eax, 0xffffffff
jne 0x40a210
and dword [ebp - 0x98], 0
add esi, dword [ebp - 0xa0]
cmp dword [ebp - 0x98], 0
jne 0x40a10d
pop edi
pop ebx
mov ecx, dword [ebp + 0x70]
mov eax, dword [ebp - 0x98]
xor ecx, ebp
pop esi
call fcn.0042fd59
add ebp, 0x74
leave
ret 4
Function at 0x41169e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
call fcn.00411287
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
or dword [esp + 0x10], 0xffffffff
push 5
mov ebx, 0xc9
push ebx
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x41175b
push 0xf0
push ebx
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4116e8
push eax
push esi
call edi
push eax
call ebx
and dword [esp + 0xc], 0
push ebp
push esi
call edi
xor ebp, ebp
cmp eax, ebp
je 0x411741
push eax
call ebx
mov edi, eax
cmp edi, ebp
je 0x411741
call fcn.0041153a
push ebp
push 0x40b0ca
push ebp
mov ebx, eax
push ebx
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x411723
cmp eax, 0xffffffff
jne 0x41172d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp ebx, edi
je 0x41174b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x41174b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], ebp
je 0x41175b
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x411956
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x84
lea ebp, [esp - 4]
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x14
mov eax, 0x45db54
call fcn.00435847
mov ebx, ecx
mov edi, edx
xor esi, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
push dword [edi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], esi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x14], eax
mov dword [ebp], esi
mov byte [ebp - 4], 1
cmp eax, esi
jle 0x4119fe
inc eax
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.00411934
jmp 0x4119c7
cmp dword [ebp], 0
jne 0x4119e0
lea eax, [ebp + 4]
test eax, eax
je 0x4119dc
lea eax, [ebp]
call fcn.00412a95
xor eax, eax
jmp 0x411a29
mov eax, dword [ebp - 0x14]
inc eax
push eax
push dword [ebp]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4119fc
lea eax, [ebp + 4]
cmp dword [ebp], eax
jmp 0x4119d2
xor esi, esi
push dword [ebp]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
cmp dword [ebp - 0x14], esi
je 0x411a17
xor ecx, ecx
cmp eax, esi
setne cl
mov esi, ecx
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x411a27
lea eax, [ebp]
call fcn.00412a95
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.0042fd59
add ebp, 0x88
leave
ret

Function at 0x412a72
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc
Function at 0x412f84
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
call fcn.00412f32
mov ebx, eax
cmp ebx, esi
je 0x412ff3
lea esi, [ebp - 0x21c]
call fcn.0041309f
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fd59
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x413011
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00412f84
cmp eax, esi
jne 0x413056
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x412ffb
lea esi, [ebp - 0x21c]
call fcn.0041309f
push dword [ebp - 0x220]
call fcn.00413110
lea esi, [ebp - 0x21c]
mov edi, eax
call fcn.0041309f
mov eax, edi
jmp 0x412fe2
Function at 0x413a18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x430
mov eax, 0x45e620
call fcn.004358b3
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, edx
mov dword [ebp - 0x43c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x424], edi
push 2
push edi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x428], eax
cmp eax, edi
jne 0x413a70
call fcn.004122f1
mov esi, eax
jmp 0x413b45
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x413a89
call fcn.004122f1
jmp 0x413b37
push esi
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x42c], eax
cmp eax, edi
je 0x413a7f
push esi
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x430], ebx
cmp eax, ebx
jae 0x413ac3
mov esi, 0x8007000e
jmp 0x413b39
lea esi, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.004122cf
mov dword [ebp - 4], 1
jmp 0x413af0
cmp dword [ebp - 0x424], edi
je 0x413abc
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp - 0x42c]
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x413a7f
mov edx, dword [ebp - 0x424]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x424]
lea edx, [ebp - 0x438]
call fcn.004138ef
mov esi, eax
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x413b5e
lea eax, [ebp - 0x424]
call fcn.00412a95
mov eax, esi
call fcn.0043590f
ret 0xc
Function at 0x4141d7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x24c]
push eax
mov dword [0x47f50c], ecx
call fcn.004182a8
push 0x4202
push 0x7628
mov ecx, str.YZX06R3bsu5LsPX4COix_VOX8uUb6N8
call fcn.004204c2
pop ecx
pop ecx
push eax
call fcn.0042c080
mov esi, 0x47f668
push 1
mov eax, esi
call fcn.0042c008
push 0x4cca
mov ecx, str.Z5TS5Q_DsfB0jPXiEtA
mov ebx, eax
call fcn.004204c2
pop ecx
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor edi, edi
mov dword [0x47f510], eax
cmp ebx, edi
je 0x4142f7
push 0x1e3c
mov ecx, str.VJzvQXZj9k
call fcn.004204c2
push eax
call fcn.00418459
pop ecx
pop ecx
test al, al
je 0x4142bf
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push eax
push str.retrynav
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], edi
call fcn.00418378
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov eax, esi
inc edi
call fcn.0042c008
mov ebx, eax
test ebx, ebx
je 0x4142b3
cmp edi, 0xa
jl 0x414293
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.00402342
test ebx, ebx
je 0x4142f7
push 0
push 0
push dword [0x47f510]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x24c]
call fcn.00418350
mov ecx, dword [ebp - 4]
push 3
pop eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042fd59
leave
ret 0x10
push 0x25ad
mov ecx, str.A63exiySss5LkPfkG5ma11I
call fcn.004204c2
push eax
call fcn.0041f6bc
push 1
lea ecx, [ebp - 0x20]
call fcn.0041849e
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x414321
mov eax, dword [eax]
push eax
call fcn.0041f80a
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x20]
call fcn.00402342
call fcn.00413d97
push 0x47f670
mov esi, eax
call fcn.0042bf0b
xor eax, eax
push esi
mov dword [0x47f670], eax
mov dword [0x47f66c], eax
mov dword [0x47f668], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x30e7
push 0x608
mov ecx, str.a5jy5VzDht1DmPrWdPOykid_u9ckoql
call fcn.00420467
pop ecx
pop ecx
push eax
call fcn.0041f822
add esp, 0xc
call fcn.0041f90e
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x414db9
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x47f6a8], eax
cmp eax, esi
jne 0x414dd4
xor eax, eax
jmp 0x414e02
push edi
lea eax, [esp + 8]
push eax
push esi
push 0x47f678
push 0x41577e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x414dff
push dword [0x47f6a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x41f822
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x405c
call fcn.00445f70
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x47f870], 0
je 0x41f902
cmp byte [0x47f871], 0
je 0x41f902
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x4054]
push eax
call fcn.0041f926
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x41f901
cmp dword [0x47f874], 0
je 0x41f8ef
lea eax, [ebp - 0x405c]
push eax
call fcn.00430451
lea eax, [ebp - 0x405c]
push eax
call fcn.004316e0
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x54]
push 0x50
push eax
call fcn.00433602
lea eax, [ebp - 0x54]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f8af
push dword [0x47f874]
sub eax, edx
push eax
lea eax, [ebp - 0x54]
push 1
push eax
call fcn.00430a92
push dword [0x47f874]
lea eax, [ebp - 0x4054]
push esi
push 1
push eax
call fcn.00430a92
push dword [0x47f874]
call fcn.004337cb
add esp, 0x24
jmp 0x41f901
call fcn.0042b67c
lea eax, [ebp - 0x4054]
push eax
call dword [0x47f4f4]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fd59
leave
ret

Function at 0x41faee
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4222c4
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0xc
mov eax, 0x45f52d
call fcn.00435814
mov eax, dword [ebp + 0x41c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
lea esi, [edi + 4]
mov dword [edi], vtable.CFsWrite.0
call fcn.004022ed
lea esi, [edi + 0x20]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov byte [ebp - 4], 2
call fcn.0042b67c
lea eax, [ebp]
push eax
push 0x104
call dword [0x47f4a4]
call fcn.0042b67c
lea eax, [ebp + 0x208]
push eax
push ebx
push 0x46ec60
lea eax, [ebp]
push eax
call dword [0x47f4a4]
call fcn.0042b67c
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp + 0x208]
push eax
call dword [0x47f4fc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004185b5
test al, al
jne 0x4223a6
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x420]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp + 0x208]
push eax
push esi
call fcn.004022c5
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.0042bf0b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0042fd59
add ebp, 0x414
leave
ret 8