joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43e7dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
mov ecx, dword [str.___656Z5RTfgZW__]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x425047
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jge 0x425098
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 8]
mov ecx, dword [str.___656Z5RTfgZW__]
movzx edx, word [ecx + edx*2]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 4]
mov eax, dword [0x43e7dc]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
sub eax, ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], al
jmp 0x42503e
mov esp, ebp
pop ebp
ret

Function at 0x4251c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00405920
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x42520d
xor eax, eax
jmp 0x42521f
cmp dword [ebp - 0x118], 1
jae 0x42521a
xor eax, eax
jmp 0x42521f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret

Function at 0x4253e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4403f0], 1
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0
jmp 0x42540c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [0x440410], 0
je 0x425425
cmp dword [ebp - 4], 0x1e
jge 0x425425
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x425403
push 2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_EndDialog]
mov esp, ebp
pop ebp
ret
Function at 0x425440
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x43e800], 0
je 0x4254c7
mov dword [0x43e800], 0
mov dword [ebp - 0x10], 0xedb88320
mov dword [ebp - 8], 0
jmp 0x425472
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4254c7
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 8
jmp 0x425493
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jle 0x4254b8
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x4254ae
mov ecx, dword [ebp - 0xc]
shr ecx, 1
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
jmp 0x4254b6
mov edx, dword [ebp - 0xc]
shr edx, 1
mov dword [ebp - 0xc], edx
jmp 0x42548a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax*4 + 0x440be8], ecx
jmp 0x425469
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], 0
jmp 0x4254df
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0xc]
jge 0x425519
mov edx, dword [ebp + 8]
mov al, byte [edx]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
shr edx, 8
movzx eax, byte [ebp - 0x19]
mov ecx, dword [ebp - 4]
and ecx, 0xff
xor eax, ecx
xor edx, dword [eax*4 + 0x440be8]
mov dword [ebp - 4], edx
jmp 0x4254d6
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4256b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d668
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x43d210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1f40
call fcn.004048b4
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push 0x439358
push 0x43938c
mov ecx, dword [ebp + 8]
push ecx
push str.Option_Explicit_r_nDim_ShellApp__FSO__Desktop_r_nSet_ShellApp__CreateObject__Shell.Application___r_nSet_FSO__CreateObject__Scripting.FileSystemObject___r_nSet_Desktop___ShellApp.NameSpace___s___r_nDim_LnkFile_r_nLnkFile__Desktop.Self.Path__s.lnk__r_n_r_nIf_FSO.FileExists_LnkFile___Then_r_n____Dim_tmp__verb_r_n_tDim_desktopImtes__item_r_n____Set_desktopImtes__Desktop.Items___r_n_r_n____For_Each_item_in_desktopImtes_r_n________If__item.Name____s___Then_r_n____________MsgBox_item.Name__r_n____________For_Each_verb_in_item.Verbs_r_n________________If__verb.Name___Unpin_from_Taskbar___Then_r_n____________________verb.DoIt_r_n_t____________Else_r_n_t_t____________If__verb.Name___Von_Taskleiste_l
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00424720
mov dword [ebp - 4], 0
push str._removefromtaskbar.vbs
lea ecx, [ebp - 0x1c]
call fcn.00424510
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00424640
push eax
call fcn.00429b20
add esp, 0x10
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00404808
add esp, 4
push 5
push 0
push 0x439af4
lea ecx, [ebp - 0x1c]
call fcn.00424640
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00424660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4257b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d68b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x43d210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x3e80
call fcn.004048b4
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push 0x438acc
push 0x438b00
mov ecx, dword [ebp + 8]
push ecx
push str.Option_Explicit_r_nDim_ShellApp__FSO__Desktop_r_nSet_ShellApp__CreateObject__Shell.Application___r_nSet_FSO__CreateObject__Scripting.FileSystemObject___r_nSet_Desktop___ShellApp.NameSpace___s___r_nDim_LnkFile_r_nLnkFile__Desktop.Self.Path__s.lnk__r_n_r_nMsgBox_LnkFile__r_nIf_FSO.FileExists_LnkFile___Then_r_n____Dim_tmp__verb_r_n_tDim_desktopImtes__item_r_n____Set_desktopImtes__Desktop.Items___r_n_r_nDim_i_r_n_tFor_i__0_To_2_r_n____For_Each_item_in_desktopImtes_r_n________If__item.Name____s___Then_r_n
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push str.MsgBox_item.Name__r_n____________For_Each_verb_in_item.Verbs_r_n_t_t_tMsgBox_verb.Name__r_n________________If__verb.Name___Pin_to_Taskbar___Then_r_n____________________verb.DoIt_r_n_t_t_t_t_tWScript.Quit_r_n_t____________Else_r_n_t_t____________If__verb.Name___An_Taskleiste_anheften___Then_r_n_______________________MsgBox_verb.Name__r_n_t_t______________verb.DoIt_r_n_t_t_t_t_t__WScript.Quit_r_n_t_t____________End_If_r_n_t_t____________End_If_r_n____________Next_r_n__________End_If_r_n____Next_r_n_tWScript.Sleep_2000_r_n_tNext_r_nEnd_If_r_n_r_nSet_FSO__Nothing_r_nSet_ShellApp__Nothing_r_n_r_n
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00424720
mov dword [ebp - 4], 0
push str._addtotaskbar.vbs
lea ecx, [ebp - 0x1c]
call fcn.00424510
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00424640
push eax
call fcn.00429b20
add esp, 0x10
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00404808
add esp, 4
push 5
push 0
push 0x438f14
lea ecx, [ebp - 0x1c]
call fcn.00424640
push eax
push 0x43934c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00424660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x425bc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x425be6
mov eax, 1
jmp 0x425cd3
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x425c08
mov eax, 1
jmp 0x425cd3
cmp dword [ebp + 0xc], 0x26
jne 0x425c71
mov ecx, dword [ebp + 8]
mov word [ecx], 0
push 0x104
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x425c59
push 0x3a
mov eax, dword [ebp + 8]
push eax
call fcn.00401090
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x425c59
push str.Program_files
mov ecx, dword [ebp - 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x425c68
push str.c:Program_files
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 1
jmp 0x425cd3
cmp dword [ebp + 0xc], 0x1a
jne 0x425ca2
push str._APPDATA_
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
test eax, eax
je 0x425ca0
mov eax, 1
jmp 0x425cd3
jmp 0x425cd1
cmp dword [ebp + 0xc], 0x28
jne 0x425cd1
push str._HOMEDRIVE__HOMEPATH_
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
test eax, eax
je 0x425cd1
mov eax, 1
jmp 0x425cd3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4261c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.00424970
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push 0
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x426201
xor eax, eax
jmp 0x426289
mov dword [ebp - 0x218], 0
jmp 0x42621c
mov ecx, dword [ebp - 0x218]
add ecx, 1
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x220], 0x104
mov dword [ebp - 0x21c], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x426260
jmp 0x426271
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
call fcn.00424810
jmp 0x42620d
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [edx], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret
Function at 0x426450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x10
lea eax, [ebp - 0x2d8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4264ee
call fcn.004251c0
test eax, eax
je 0x426496
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2d8]
push edx
call fcn.004256b0
add esp, 8
push 0x438a1c
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x438a20
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str..lnk
lea edx, [ebp - 0x2d8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2d8]
push eax
call fcn.00404c36
add esp, 4
push 0
lea ecx, [ebp - 0x2d8]
push ecx
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x168
lea edx, [ebp - 0x2d8]
push edx
push str.LnkFile
push 0x438a70
call fcn.00422400
add esp, 0x10
test eax, eax
je 0x426532
lea eax, [ebp - 0x2d8]
push eax
call fcn.00404c36
add esp, 4
push 0
lea ecx, [ebp - 0x2d8]
push ecx
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret
Function at 0x426540
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b0
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x42f45c
push 1
push 0
push 0x42f46c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4266d1
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x50]
call edx
lea eax, [ebp - 0xc]
push eax
push 0x42f47c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4266c3
push 0
push 0x10
lea edx, [ebp - 0x5b0]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42666c
push 0x104
lea eax, [ebp - 0x2e0]
push eax
push 0x438904
push 0x438948
call fcn.00422400
add esp, 0x10
test eax, eax
jne 0x42666c
lea ecx, [ebp - 0x5b0]
push ecx
lea edx, [ebp - 0x2e0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x43889c
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x438914
lea ecx, [ebp - 0x2e0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4389a4
lea edx, [ebp - 0x2e0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2e0]
push eax
push 0x4389b0
push 0x4389c0
call fcn.00422490
add esp, 0xc
push 1
lea ecx, [ebp - 0x2e0]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x2e0]
push eax
push 5
push 2
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
call fcn.004251c0
test eax, eax
je 0x4266c3
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x5b0]
push eax
call fcn.004257b0
add esp, 8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 8]
call ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret

Function at 0x426820
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00405920
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jae 0x426887
push 0x40
push str.winver_error
call fcn.00424a70
add esp, 4
push eax
push 0
call fcn.00423660
add esp, 0xc
xor eax, eax
jmp 0x42688c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret
Function at 0x4268a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0
push 0x8000000
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x426935
cmp dword [ebp + 8], 0
je 0x426931
mov ecx, dword [ebp + 0xc]
push ecx
push str.couldnotsave
call fcn.00424a70
add esp, 4
push eax
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x42
lea eax, [ebp - 0x830]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423660
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jne 0x426922
xor eax, eax
jmp 0x426969
cmp dword [ebp - 0xc], 5
jne 0x42692f
mov eax, 1
jmp 0x426969
jmp 0x4268b3
xor eax, eax
jmp 0x426969
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x14]
xor eax, eax
cmp ecx, dword [ebp - 8]
sete al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret
Function at 0x426cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x978
mov eax, dword [0x43d210]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x648]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425aa0
add esp, 8
lea edx, [ebp - 0x328]
push edx
push 0x43824c
push str.code
lea eax, [ebp - 0x648]
push eax
call fcn.004258b0
add esp, 0x10
movzx ecx, word [ebp - 0x328]
test ecx, ecx
je 0x426dd2
lea edx, [ebp - 0x648]
push edx
lea eax, [ebp - 0x328]
push eax
call fcn.00425950
add esp, 8
mov dword [ebp - 0x970], 0x3e8
mov ecx, dword [ebp - 0x970]
add ecx, 5
push ecx
call fcn.004048b4
add esp, 4
mov dword [ebp - 0x974], eax
mov edx, dword [ebp - 0x974]
mov dword [ebp - 0x96c], edx
lea eax, [ebp - 0x648]
push eax
push str.https:__videodownloaderultimate.com__libs_db__cmdReleaseUseddata_s
lea ecx, [ebp - 0x968]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea edx, [ebp - 0x970]
push edx
mov eax, dword [ebp - 0x96c]
push eax
lea ecx, [ebp - 0x968]
push ecx
call fcn.00423d60
add esp, 0x10
mov edx, dword [ebp - 0x96c]
mov dword [ebp - 0x978], edx
mov eax, dword [ebp - 0x978]
push eax
call fcn.00404808
add esp, 4
lea ecx, [ebp - 0x648]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.54634578.log
lea edx, [ebp - 0x648]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x648]
push eax
call fcn.00404c36
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042ce
mov esp, ebp
pop ebp
ret
Function at 0x429a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x43a3d8
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xe
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004042e0
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x429b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0
push 0x10000000
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x429b52
xor eax, eax
jmp 0x429ccb
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 2
jne 0x429bf7
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
lea eax, [edx + edx + 0xa]
push eax
call fcn.004048b4
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xc], ecx
push 0
push 0
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xef
mov byte [ebp - 0x13], 0xbb
mov byte [ebp - 0x12], 0xbf
push 0
lea edx, [ebp - 8]
push edx
push 3
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00404808
add esp, 4
jmp 0x429cb0
cmp dword [ebp + 0x14], 1
jne 0x429c37
mov byte [ebp - 0x1c], 0xff
mov byte [ebp - 0x1b], 0xfe
push 0
lea edx, [ebp - 8]
push edx
push 2
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
shl eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x429cb0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + ecx + 0xa]
push edx
call fcn.004048b4
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
push 0
push 0
mov ecx, dword [ebp - 0x24]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00404810
add esp, 4
mov dword [ebp - 0x28], eax
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00404808
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push eax
call fcn.004250a0
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x429f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x43a334
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [0x440444]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x429f6a
xor eax, eax
jmp 0x429fe1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x440444]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x429f87
xor eax, eax
jmp 0x429fe1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0x440444]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x429fa5
xor eax, eax
jmp 0x429fe1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call fcn.004268a0
add esp, 0x10
test eax, eax
jne 0x429fd0
xor eax, eax
jmp 0x429fe1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004250a0
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219