joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4538ad
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4aabf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0044a810
mov dword [ebp - 0x14], eax
cmp dword [0x4b8978], esi
jne 0x4539a0
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x45392d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x453a80
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x453a80
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x453a80
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b8978], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b897c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b8980], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b8988], eax
test eax, eax
je 0x45399d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b8984], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4539c5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4539b8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4539da
push 4
pop eax
jmp 0x453a82
cmp dword [ebp - 0x14], esi
je 0x4539da
push dword [0x4b8978]
call dword [0x4aa004]
push 3
jmp 0x4539bf
mov eax, dword [0x4b8984]
mov ebx, dword [0x4aa004]
cmp eax, edi
je 0x453a38
cmp dword [0x4b8988], edi
je 0x453a38
push eax
call ebx
push dword [0x4b8988]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x453a38
test eax, eax
je 0x453a38
call ecx
test eax, eax
je 0x453a2d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x453a2d
test byte [ebp - 8], 1
jne 0x453a38
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x453a68
mov eax, dword [0x4b897c]
cmp eax, edi
je 0x453a65
push eax
call ebx
test eax, eax
je 0x453a65
call eax
mov esi, eax
test esi, esi
je 0x453a65
mov eax, dword [0x4b8980]
cmp eax, edi
je 0x453a65
push eax
call ebx
test eax, eax
je 0x453a65
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b8978]
call ebx
test eax, eax
je 0x453a80
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x453a82
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004481ef
mov esp, ebp
pop ebp
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, 0x5bfe
mov eax, ecx
mov dword [0x4b4752], eax
mov dword [0x4b4739], 0
mov eax, dword [0x4b4739]
mov dword [0x4b48ef], eax
mov dword [0x4b49c1], 0
mov eax, dword [0x4b49c1]
mov eax, ebx
xor ebx, eax
test dword [0x4b428b], eax
jne 0x401045
mov ebx, 0x19c2
sub eax, ebx
dec eax
shl eax, 1
ror eax, 1
or eax, dword [0x4b43b9]
je 0x401077
sub eax, dword [0x4b47dd]
dec eax
mov ebx, 0x11e8
add eax, ebx
dec eax
or eax, ebx
mov ebx, 0x1dd0
sub eax, ebx
add eax, dword [0x4b4a1d]
xor ebx, eax
sub eax, dword [0x4b46db]
shr eax, 1
add dword [0x4b42db], eax
jmp fcn.00402754
Function at 0x7ffe5329
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
nop
push edx
cdq
pop edx
nop
pushal
inc eax
popal
clc
pushal
inc eax
popal
clc
pushal
inc eax
popal
stc
pushal
inc eax
popal
clc
lea esp, [esp]
stc
lea esp, [esp]
clc
lea esp, [esp]
stc
add eax, 0
nop
and bh, 0xff
cld
add eax, 0
cld
add eax, 0
cld
push edx
cdq
pop edx
nop
pushal
inc eax
popal
clc
pushal
inc eax
popal
clc
pushal
inc eax
popal
nop
push edx
cdq
pop edx
cld
push edx
cdq
pop edx
cld
add eax, 0
nop
pushal
inc eax
popal
stc
push edx
cdq
pop edx
cld
add eax, 0
clc
lea esp, [esp]
cld
pushal
inc eax
popal
cld
pushal
inc eax
popal
nop
and bh, 0xff
cld
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
clc
push edx
cdq
pop edx
clc
and bh, 0xff
stc
pushal
inc eax
popal
clc
and bh, 0xff
cld
push edx
cdq
pop edx
cld
add eax, 0
nop
push edx
cdq
pop edx
nop
add eax, 0
cld
push edx
cdq
pop edx
clc
lea esp, [esp]
clc
and bh, 0xff
nop
lea esp, [esp]
cld
push edx
cdq
pop edx
stc
push edx
cdq
pop edx
cld
pushal
inc eax
popal
nop
and bh, 0xff
cld
and bh, 0xff
clc
push edx
cdq
pop edx
nop
pushal
inc eax
popal
clc
pushal
inc eax
popal
clc
clc
call 0x7ffe53fa
pop edx
stc
and bh, 0xff
nop
xor dx, dx
and bh, 0xff
cld
pushal
inc eax
popal
nop
stc
stc
add edx, 0xd5e0
pushal
inc eax
popal
clc
add eax, 0
cld
and bh, 0xff
nop
cld
xor ecx, ecx
nop
pushal
inc eax
popal
stc
stc
mov cl, 0x1e
nop
push edx
cdq
pop edx
clc
xor byte [ecx + edx], 0x86
loop 0x7ffe542f
and bh, 0xff
nop
lea esp, [esp]
nop
push edx
cdq
pop edx
cld
push dword fs:[0x24]
stc
cld
nop
pop dword [edx + 0xa]
mov cl, 0xff
cld
and bh, 0xff
stc
push edx
loop 0x7ffe5455
and bh, 0xff
cld
stc
cld
mov dword [edx + 0x11], 0xffffacbb
and bh, 0xff
cld
cld
mov ecx, dword [eax + 0x2c]
stc
pushal
inc eax
popal
nop
lea esp, [esp]
cld
clc
mov dword [edx + 0x1b], ecx
nop
push edx
cdq
pop edx
cld
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
and bh, 0xff
push 0
push 0
clc
push 0
push 0
nop
stc
clc
push 0x30
clc
cld
push 0x20
cld
push edx
cdq
pop edx
nop
and bh, 0xff
cld
stc
cld
push 0
lea esp, [esp]
cld
lea esp, [esp]
cld
push 0
add eax, 0
nop
add al, 0
nop
add edx, 0xffff7f2d
add eax, 0
stc
add eax, 0
cld
push edx
nop
push edx
push 0
inc esi
dec esi
cld
call dword [edx + 0x8216]
nop
add eax, 0
stc
nop
clc
nop
add esp, 0x3f8
stc
lea esp, [esp]
stc
cld
cld
xor eax, eax
add eax, 0
clc
and bh, 0xff
cld
add eax, 0
stc
inc eax
and bh, 0xff
cld
and bh, 0xff
clc
and bh, 0xff
cld
cld
ret 0xc
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x450d8a
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x450d8a
lcall 0x5de5, 0x8b10c483
jmp loc.0096a960

Function at 0x4026ab
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
jmp 0x4026c8
push 0x18f4
mov eax, dword [esp]
add esp, 4
jmp 0x4026cb
jmp 0x4026b9
jmp 0x4026d7
push 0x74
pop ecx
jmp 0x4026da
jmp 0x4026d0
jmp 0x4026ec
push 0x1b
mov edx, dword [esp]
add esp, 4
jmp 0x4026ef
jmp 0x4026e0
call fcn.00401f55
nop
inc esi
adc esi, dword [ebx - 0x6d]
or byte [ebx], bl
sbb esp, esp
dec eax
pop es
xchg esi, eax
pop esi
out 0x4b, eax
in al, 0x6e
or esp, esp
outsb dx, byte [esi]
pop ss
dec eax
fsub st(1)
in al, 0xe4
sahf
fld xword [edi + 0x16]
in al, 0x6e
pmulhuw mm5, qword [esi - 0x19]
dec ebx
dec eax
mov al, 0xe0
in al, 0xe4
jno 0x40273d
jno 0x402708
in al, 8
invalid
mov edx, ebp
fiadd dword [0x1b6fa26b]
sbb ebx, dword [ebx]
invalid

Function at 0x4031bf
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xd3
xor dword [esi + 0x1a], eax
mov dl, 0xd1
mov bl, 0x33
xor esi, dword [ebx]
inc esi
adc bh, byte [esi + 0xdbacb46]
pop ecx
aaa
pop ecx
xor al, 0x59
int3
inc esi
cmp edi, dword [eax + 0x47f3b635]
xor eax, ebx
xor eax, ebx
xor al, 0xf4
jbe 0x40319d
xor esi, dword [ebx]
xor esi, dword [ebx]
fdivr dword [esi]
add eax, 0x8bc720f8
inc eax
adc byte [ebx], dh
xor ebx, eax
fcom qword ss:[ebx]
fadd st(6)
xchg edi, eax
fdivr dword [esi]
out 0x31, eax
je 0x40323e
mov ch, byte [edi - 0x27cccccd]
in al, dx
xchg ecx, eax
fadd st(6)
push edx
fdivr dword [edi + eax*2]
add al, 0xf7
sub edx, ebx
jns 0x33736503
fdiv dword [esi]
scasd eax, dword es:[edi]
mov cl, 0xd8
invalid
mov bl, 0xa6
push 0x29e
mov ecx, dword [esp]
add esp, 4
jmp 0x40324e
add al, byte [eax]
add byte [ebx - 0x3b7cdbf4], cl
add al, 0xeb
add eax, 0xefeb6f5c
jle 0x40323a
jmp 0x40325e
push cs
or dword [0xba809165], 0x2d
add byte [eax], al
add bl, ch
add eax, 0xf5eb6f2f
imul al
out dx, eax
in al, dx
invalid
mov edx, 0x2d
jmp 0x403261
jmp 0x403255
call fcn.00401f55
ljmp 0x2d2d
Function at 0x41f573
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f5b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f5b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f5b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f5b2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f5b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x431790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4317bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4317bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x4b93051c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7dad67ce
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4a14f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a15cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a15e8
push ebx
push 0x4a15f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1576
mov ax, 0x83
call fcn.004a1118
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a14c8
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a157f
call fcn.004a14c8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15d4
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax

Function at 0x4a16e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
jmp 0x4a17a5
cmp dword [esi + 0x10], 0x1000
jne 0x4a1793
test byte [esi + 0x15], 1
jne 0x4a1793
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1744
cmp ebp, 2
je 0x4a1744
cmp ebp, 0x10
je 0x4a1744
cmp ebp, 0x20
jne 0x4a1760
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1760
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1771
mov eax, dword [esi]
add eax, ebx
call fcn.004a16e0
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1764
cmp byte [esp + 4], 0
je 0x4a1793
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1719
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xd68b8b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd68886
dec esi
inc edx
call fcn.00d68bbf
sub esi, edx
or esi, esi
xor dword [eax], ecx
sub edx, esi
dec esi
add eax, 2
add edx, esi
cmp eax, ebx
jl fcn.00d68b8b
sub esi, edx
sub esi, 0x5d3e7a66
ret
Function at 0x438c9a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
sub edi, 0xce16c73
mov edi, 0x6cb7d2a3
sub edi, ecx
call fcn.00438cee
inc ecx
add edi, 0x261157d5
xor dword [edx], eax
inc edi
push 0xe7b09239
pop edi
sub ecx, 0xba9a3c73
add edx, 1
dec edi
mov edi, 0x9d151435
and edi, ecx
cmp edx, ebx
jne fcn.00438c9a
sub ecx, ecx
mov ecx, 0xc9db4f4e
ret
Function at 0x401ad0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
movzx eax, byte [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], edi
cmp ebx, 0xffffffff
je 0x401b62
push 0
push 0
xorps xmm0, xmm0
movq qword [ebp - 0x44], xmm0
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401b58
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x401b62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x401bb8
test edi, edi
je 0x401b6c
mov dword [edi], 0
test esi, esi
je 0x401b76
mov dword [esi], 0
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.004016e0
test al, al
jne 0x401b8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x401ba3
mov eax, 0x51eb851f
mul dword [ebp - 0x18]
shr edx, 5
cmp edx, 2
je 0x401bb6
mov edi, 0x10dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x401b78
jmp 0x401bb8
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 8]
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0040fb5d
mov esp, ebp
pop ebp
ret
Function at 0x401f60
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x42c00c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
push 0x20
lea eax, [esp + 0x24]
xor esi, esi
push eax
mov edi, ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x402026
cmp eax, 0x20
ja 0x402026
call fcn.00407770
push esi
mov ebx, eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x14]
push eax
push 1
push str.D:P_A_CIOI_FA___SY__A_CIOI_FA___BA__A_CIOI_FRFX___BU_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
test eax, eax
je 0x402026
mov eax, dword [esp + 0x10]
push ebx
push dword [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
push str._sTemp_asw._08x_08x
push edi
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40202e
movzx eax, word [esp + 0x20]
push ebx
push dword [esp + 0x10]
push eax
push str._c:_asw._08x_08x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40202e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40203d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x64]
test esi, esi
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.0040fb5d
mov esp, ebp
pop ebp
ret
Function at 0x402120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x400000
push 0x10
cmovne esi, ecx
mov dword [ebp - 0x18], edx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40221c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40221c
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
push 0x426d10
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40221c
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x426d14
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test ebx, ebx
je 0x4021df
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0Edition
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4021df
push dword [ebp - 0x10]
call fcn.00414131
add esp, 4
mov dword [ebx], eax
test edi, edi
je 0x402209
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0SubEdition
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x402209
push dword [ebp - 0x10]
push 0x40
push edi
call fcn.00414154
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fb5d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fb5d
mov esp, ebp
pop ebp
ret