joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d32
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4242b4]
and dword [ebp - 0x110], 0
push ebx
push edi
mov edi, ecx
mov dword [ebp - 4], eax
lea eax, [edi + 0x58c]
push eax
lea eax, [edi + 0x74]
push eax
xor ebx, ebx
lea eax, [ebp - 0x108]
inc ebx
push eax
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x10c], ebx
call fcn.0040c2ca
test eax, eax
jne 0x410d8c
push 0x4040dc
call fcn.0040be00
pop ecx
xor eax, eax
jmp 0x410efb
push esi
mov esi, 0x4040c8
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0040e2de
test eax, eax
jne 0x410daa
mov eax, ebx
jmp 0x410efa
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0040c3c7
cmp eax, 0xffffffff
jne 0x410dd4
push 0x404090
call fcn.0040be00
xor eax, eax
jmp 0x410ef9
test eax, eax
jbe 0x410ee1
mov ebx, dword [ebp - 0x110]
cmp byte [ebx], 0
je 0x410ee8
jmp 0x410df9
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x114]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebx], 0x3b
lea eax, [ebx + eax + 1]
mov dword [ebp - 0x118], eax
je 0x410ebb
push 0x2c
push ebx
call fcn.0041b7d0
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x410e3d
mov byte [esi], 0
jmp 0x410e34
cmp al, 0x20
je 0x410e34
cmp al, 9
je 0x410e34
cmp al, 0xa
jne 0x410e3f
inc esi
mov al, byte [esi]
test al, al
jne 0x410e28
jmp 0x410e3f
xor esi, esi
add edi, 0x384
push edi
push ebx
call fcn.0040c335
test eax, eax
je 0x410ebb
push ebx
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x108]
push eax
call fcn.00410c5b
test eax, eax
je 0x410eb4
test esi, esi
je 0x410e88
push 0x404080
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x410ebb
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x410ecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x404048
call fcn.0040be00
add esp, 0xc
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x118]
cmp byte [eax], 0
jne 0x410ded
jmp 0x410ee8
lea eax, [ebp - 0x108]
push eax
push 0x40402c
call fcn.0040be00
pop ecx
pop ecx
jmp 0x410ebb
and dword [ebp - 0x10c], 0
push dword [ebp - 0x110]
call fcn.0041afa4
mov eax, dword [ebp - 0x10c]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0041a84f
leave
ret
Function at 0x410f0c
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4242b4]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5c
push dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ebx
call fcn.0041af50
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x41c], eax
je 0x4110ef
push 0
push dword [esi]
call fcn.0040c335
test eax, eax
jne 0x410fb0
push 0x108
call fcn.0041af8c
mov edi, eax
test edi, edi
pop ecx
je 0x410fa6
and dword [edi + 0x104], 0
push 0x104
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebx + 0x75f4]
test ecx, ecx
jne 0x410f90
mov dword [ebx + 0x75f4], edi
jmp 0x4110ef
mov ecx, dword [eax]
lea eax, [ecx + 0x104]
cmp dword [eax], 0
jne 0x410f8e
mov dword [ecx + 0x104], edi
jmp 0x4110ef
push 0x404154
jmp 0x4110e9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, 0x104
push ebx
push dword [esi + 4]
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
lea eax, [ebp - 0x108]
push 0x401a54
push eax
call fcn.0041b470
test eax, eax
pop ecx
pop ecx
jne 0x4110ef
push ebx
push dword [esi]
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push ebx
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push eax
call edi
mov esi, 0x401fb4
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0041b470
test eax, eax
pop ecx
pop ecx
jne 0x411079
mov esi, 0x401600
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0041b470
test eax, eax
pop ecx
pop ecx
jne 0x411079
mov esi, 0x401fc4
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0041b470
test eax, eax
pop ecx
pop ecx
jne 0x411079
mov esi, 0x402000
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0041b470
test eax, eax
pop ecx
pop ecx
je 0x41107c
push esi
jmp 0x411081
push 0x401fcc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x418]
add eax, 0x74
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.0040c2fe
test eax, eax
je 0x4110e4
push 0
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4110ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x404128
call fcn.0040be00
pop ecx
jmp 0x4110ee
push 0x404108
call fcn.0040be00
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.0041a84f
leave
ret 4
Function at 0x411106
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x4242b4]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40422c
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x411147
push 0x404208
call fcn.0040be00
pop ecx
jmp 0x411277
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x350], eax
je 0x411277
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x401d88
lea eax, [ebp - 0x320]
push eax
call esi
test eax, eax
je 0x411213
push 0x401d84
lea eax, [ebp - 0x320]
push eax
call esi
test eax, eax
je 0x411213
lea eax, [ebp - 0x320]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
je 0x411230
lea eax, [ebp - 0x320]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c2ca
test eax, eax
je 0x411237
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
cmp dword [ebp + 0x10], 0
je 0x4111f9
cmp dword [ebp + 0x10], 1
jne 0x411213
lea eax, [ebp - 0x108]
push 0x404200
push eax
call fcn.0041b470
test eax, eax
pop ecx
pop ecx
jne 0x411213
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x411244
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x411171
jmp 0x41126a
push 0x4041d8
jmp 0x41123c
push 0x4041a8
call fcn.0040be00
pop ecx
jmp 0x41126a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], 0
jne 0x41126a
cmp eax, 0x20
je 0x41126a
push eax
lea eax, [ebp - 0x320]
push eax
push 0x404170
call fcn.0040be00
add esp, 0xc
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0041a84f
leave
ret 0xc
Function at 0x411ae5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [0x4242b4]
and dword [ebp - 0x56c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0x404a9c
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 0x570], 3
call fcn.0040be00
pop ecx
pop ecx
lea eax, [ebp - 0x56c]
push eax
xor edi, edi
inc edi
push edi
push 0
push 0x404a80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411b56
push 0x403678
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x411bb8
push 0x404a4c
jmp 0x411bbd
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push esi
push dword [ebp - 0x56c]
mov dword [ebp - 0x578], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411b3f
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c4db
test eax, eax
jne 0x411bc8
lea eax, [ebp - 0x108]
push eax
push 0x404a10
call fcn.0040be00
pop ecx
pop ecx
mov dword [ebp - 0x570], edi
jmp 0x411d2e
push 0x4049b0
call fcn.0040be00
pop ecx
jmp 0x411d2e
push 0x403678
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x411beb
lea eax, [ebx + 0xadc]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c4db
push 0x40499c
lea eax, [ebx + 0x17c]
push eax
lea eax, [ebp - 0x568]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x411c0e
push 0x40496c
jmp 0x411c2a
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x568]
push eax
call fcn.0040c246
test eax, eax
jne 0x411c34
push 0x404928
call fcn.0040be00
jmp 0x411bac
mov eax, dword [ebp - 0x5a4]
lea esi, [ebx + 0xae4]
mov dword [esi], eax
mov eax, dword [ebp - 0x5a0]
lea edi, [ebx + 0xae8]
mov dword [edi], eax
lea eax, [ebp - 0x108]
push eax
push 0x404908
call fcn.0040be00
movzx eax, word [edi]
push eax
movzx eax, word [edi + 2]
push eax
movzx eax, word [esi]
push eax
movzx eax, word [esi + 2]
push eax
push 0x4048e0
call fcn.0040be00
add esp, 0x1c
push esi
lea eax, [ebp - 0x574]
push eax
call fcn.0040e18d
cmp eax, 2
mov dword [ebp - 0x570], eax
jne 0x411d2e
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x4048dc
push dword [ebp - 0x56c]
mov dword [ebp - 0x578], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411d2e
mov ecx, ebx
call fcn.00410752
inc eax
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x310]
push eax
call fcn.0041b286
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041b286
mov edi, eax
push esi
push edi
push 0x4048b4
call fcn.0040be00
add esp, 0x14
cmp esi, edi
jle 0x411d25
mov dword [ebp - 0x570], 3
mov dword [ebx + 8], 1
jmp 0x411d2e
jge 0x411d2e
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x56c], 0
pop edi
pop esi
pop ebx
je 0x411d57
push dword [ebp - 0x56c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x411d57
push eax
push 0x404880
call fcn.0040be00
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x570]
call fcn.0041a84f
leave
ret 4
Function at 0x411da5
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x411e0f
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, eax
test esi, esi
jne 0x411df2
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x404b70
call fcn.0040be00
add esp, 0xc
jmp 0x411e04
cmp esi, 2
je 0x411e04
push esi
push 0x404b3c
call fcn.0040be00
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x411e21
cmp esi, 2
je 0x411e21
push esi
push 0x404b08
call fcn.0040be00
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x414148
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4242b4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.0040d401
test eax, eax
jne 0x414176
call fcn.0040d7cb
test eax, eax
je 0x41423c
mov esi, 0x406534
push esi
lea ebx, [edi + 0x74]
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x4141a2
push esi
push 0x406510
call fcn.0040be00
pop ecx
pop ecx
jmp 0x4143b6
mov esi, 0x406500
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c2ca
test eax, eax
je 0x414190
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c335
test eax, eax
je 0x414229
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41420c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x4064cc
call fcn.0040be00
add esp, 0x10
jmp 0x4143b6
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x402f00
call fcn.0040be00
add esp, 0xc
jmp 0x41423c
lea eax, [ebp - 0x20c]
push eax
push 0x4064a4
call fcn.0040be00
pop ecx
pop ecx
test byte [edi + 0x6b], 8
jne 0x4143ba
mov ecx, edi
call fcn.004115c4
test eax, eax
jne 0x4143ba
push 4
mov ecx, edi
call fcn.00413da3
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push 0x4013dc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4143ba
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push 0x406498
push eax
call esi
add esp, 0xc
add edi, 0x74
push edi
push 0x40648c
lea eax, [ebp - 0x108]
push eax
call fcn.0040f335
test eax, eax
je 0x4143b6
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push 0x406480
push eax
call esi
add esp, 0xc
push edi
push 0x406474
lea eax, [ebp - 0x108]
push eax
call fcn.0040f335
test eax, eax
je 0x4143b6
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push 0x406468
push eax
call esi
add esp, 0xc
push edi
push 0x40645c
lea eax, [ebp - 0x108]
push eax
call fcn.0040f335
test eax, eax
je 0x4143b6
call fcn.0040db35
test eax, eax
jne 0x4143ba
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push 0x406450
push eax
call esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push 0x406444
push eax
call esi
add esp, 0x18
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.0040c335
test eax, eax
je 0x4143ba
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c335
test eax, eax
je 0x4143ba
push edi
push 0x406434
lea eax, [ebp - 0x108]
push eax
call fcn.0040f335
test eax, eax
je 0x4143b6
push edi
push 0x406428
lea eax, [ebp - 0x20c]
push eax
call fcn.0040f335
test eax, eax
jne 0x4143ba
xor eax, eax
jmp 0x4143bd
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041a84f
leave
ret
Function at 0x417ae9
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
sub eax, edi
je 0x417b96
dec eax
jne 0x417bf7
push 0x408e40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x424f50], edi
jne 0x417b70
push 0x7608
call fcn.0041af8c
cmp eax, edi
pop ecx
je 0x417b2f
mov ecx, eax
call fcn.0040e4b1
jmp 0x417b31
xor eax, eax
cmp eax, edi
mov dword [0x424f50], eax
je 0x417b92
push 0x408e2c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x417b78
call edi
cmp eax, 0xb7
je 0x417b78
mov eax, dword [0x424f50]
mov dword [eax + 0x70], esi
mov eax, dword [ebp + 8]
mov ecx, dword [0x424f50]
mov dword [ecx + 0x58], eax
inc dword [0x424f4c]
jmp 0x417bf7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x417b92
call edi
push eax
push 0x408df4
call fcn.0040be00
pop ecx
pop ecx
xor eax, eax
jmp 0x417bfa
push 0x408de0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x424f50]
dec dword [0x424f4c]
cmp eax, edi
je 0x417bf7
cmp dword [0x424f4c], edi
jne 0x417bf7
mov dword [eax + 0x64], edi
mov eax, dword [0x424f50]
push dword [eax + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x417be0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x408da8
call fcn.0040be00
pop ecx
pop ecx
mov ecx, dword [0x424f50]
cmp ecx, edi
je 0x417bf1
push 1
call fcn.00416090
mov dword [0x424f50], edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x418857
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x424f50]
test eax, eax
jne 0x41889a
push 0x7608
call fcn.0041af8c
test eax, eax
pop ecx
je 0x41887d
mov ecx, eax
call fcn.0040e4b1
jmp 0x41887f
xor eax, eax
test eax, eax
mov dword [0x424f50], eax
jne 0x41889a
push 0x4097ec
call fcn.0040be00
pop ecx
push 0xfffffffffffffff7
pop eax
pop ebp
ret 0xc
mov ecx, eax
pop ebp
jmp fcn.00417e9a
Function at 0x418b5d
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x4242b4]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x528], 0xf750e6c3
mov word [ebp - 0x524], 0x38ee
mov word [ebp - 0x522], 0x11d1
mov byte [ebp - 0x520], 0x85
mov byte [ebp - 0x51f], 0xe5
mov byte [ebp - 0x51e], bl
mov byte [ebp - 0x51d], 0xc0
mov byte [ebp - 0x51c], 0x4f
mov byte [ebp - 0x51b], 0xc2
mov byte [ebp - 0x51a], 0x95
mov byte [ebp - 0x519], 0xee
je 0x418cfd
push 0x409bc0
call fcn.0040be00
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x418c07
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409b84
jmp 0x418cf0
push esi
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
cmp eax, ebx
jne 0x418c2a
push 0x409b58
jmp 0x418d02
push ebx
push ebx
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x518]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x418c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x409b1c
jmp 0x418cf0
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
push 0x409b08
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0041ae94
add esp, 0x1c
test eax, eax
jge 0x418c89
push 0x409ae4
jmp 0x418d02
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.0040c335
test eax, eax
je 0x418d08
call fcn.0040d401
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x418cb2
call fcn.0040d7cb
test eax, eax
je 0x418cd7
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x418cd7
call esi
push eax
push 0x409aac
call fcn.0040be00
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418cf8
call esi
push eax
push 0x409a78
call fcn.0040be00
pop ecx
jmp 0x418d07
xor eax, eax
inc eax
jmp 0x418d0a
push 0x409a20
call fcn.0040be00
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041a84f
leave
ret 0x10
Function at 0x419016
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x424f50]
push edi
mov edi, dword [ebp + 8]
push 0x409ef8
push edi
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x419047
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x409ed4
jmp 0x41906a
push eax
mov eax, dword [0x424f50]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
jne 0x419076
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x409eb0
call fcn.0040be00
add esp, 0xc
xor eax, eax
jmp 0x4190e9
push ebx
mov ebx, dword [ebp + 0xc]
push esi
inc ebx
push ebx
call fcn.0041af8c
mov esi, eax
test esi, esi
pop ecx
jne 0x419091
push edi
push 0x409e88
jmp 0x4190d9
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push ebx
push dword [ebp - 4]
mov ecx, edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor edi, edi
xor eax, eax
cmp dword [ebp + 0xc], edi
jle 0x4190c5
movsx ecx, byte [eax + esi]
add edi, ecx
inc eax
cmp eax, dword [ebp + 0xc]
jl 0x4190b9
push esi
call fcn.0041af7c
cmp edi, dword [ebp + 0x10]
pop ecx
je 0x4190e4
push dword [ebp + 8]
push 0x409e74
call fcn.0040be00
pop ecx
pop ecx
xor eax, eax
jmp 0x4190e7
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
leave
ret 0xc
Function at 0x419827
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4242b4]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [0x424f50], ebx
mov dword [ebp - 0x20], eax
je 0x4198a9
call fcn.004190f3
test eax, eax
jne 0x419860
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x40a358
jmp 0x4198a3
mov cx, word [ebp + 0x10]
cmp cx, bx
je 0x4198b0
mov byte [ebp - 0x1c], bl
xor eax, eax
cmp word [eax*8 + 0x4241d8], cx
je 0x419880
inc eax
cmp eax, 0xf
jb 0x41986e
jmp 0x419896
push dword [eax*8 + 0x4241dc]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x1c], bl
jne 0x4198b9
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x40a310
call fcn.0040be00
pop ecx
xor eax, eax
jmp 0x4199c1
lea eax, [ebp - 0x1c]
push eax
call fcn.00419286
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push 0x40a1a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x409ef8
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x424f50]
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
jne 0x41990c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x40a2c0
call fcn.0040be00
add esp, 0xc
xor eax, eax
jmp 0x4199c0
mov eax, dword [0x424f50]
push edi
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 0xc], ebx
jne 0x419926
inc eax
jmp 0x4199c0
push esi
lea esi, [eax + 1]
cmp dword [ebp + 0xc], esi
jae 0x419946
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x40a28c
call fcn.0040be00
pop ecx
xor eax, eax
jmp 0x4199bf
mov eax, dword [0x424f50]
push edi
push dword [eax + 0x58]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
jne 0x41996d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40a250
call fcn.0040be00
pop ecx
jmp 0x419941
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
jne 0x419981
push 0x40a220
jmp 0x41993c
cmp dword [ebp - 0x20], ebx
jne 0x419995
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x40a1f0
jmp 0x41993c
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x4199b2
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x40a1b8
jmp 0x41993c
push esi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0041a84f
leave
ret 0xc