joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016ee
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x284]
push ebx
sub esp, 0x2cc
mov esi, dword [ebp + 8]
mov eax, dword [0x42fa6c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2a0], eax
mov edi, dword [ebp - 0x27c]
mov edx, dword [ebp - 0x280]
mov esi, dword [ebp - 0x284]
mov eax, edi
mov ebx, edx
shl eax, 0xb
add eax, dword [0x40c974]
shl ebx, 0xb
add ebx, dword [0x40c974]
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x280]
mov dword [0x419100], eax
lea eax, [esi - 2]
cmp eax, 0x43
ja case.0x40175a.66
jmp dword [eax*4 + 0x40c004]
xor eax, eax
mov dword [esp], edx
mov dword [esp + 4], eax
jmp 0x401d5e
inc dword [0x430abc]
cmp dword [ebp - 0x2a0], 0
je 0x40178a
xor esi, esi
mov dword [esp], esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
push edi
mov edx, 0x7fffffff
jmp case.0x40175a.2
mov dword [esp], edx
call fcn.004016ab
xor ecx, ecx
push edx
dec eax
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00403b1b
mov edx, eax
push ebx
push ebx
jmp case.0x40175a.2
xor eax, eax
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004073e6
jmp 0x403627
xor eax, eax
call fcn.004014aa
mov edx, 1
test eax, eax
cmovle eax, edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402ca8
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x402ca8
cmp dword [ebp - 0x278], 0
jg 0x40182d
mov eax, dword [edx*4 + 0x419020]
je 0x401814
mov dword [0x4190fc], eax
jmp 0x40181b
mov dword [edx*4 + 0x419060], eax
mov eax, 1
call fcn.004014aa
mov edx, dword [ebp - 0x280]
jmp 0x40184d
mov eax, dword [edx*4 + 0x419060]
cmp dword [ebp - 0x274], 0
mov dword [edx*4 + 0x419020], eax
jns case.0x40175a.66
mov eax, dword [0x4190fc]
mov dword [edx*4 + 0x419020], eax
jmp case.0x40175a.66
mov ecx, dword [ebp - 0x278]
xor edx, edx
mov eax, dword [ecx*4 + 0x419020]
test eax, eax
sete dl
and eax, dword [ebp - 0x274]
mov dword [ecx*4 + 0x419020], eax
mov edx, dword [ebp + edx*4 - 0x280]
jmp case.0x40175a.2
mov eax, dword [edi*4 + 0x419020]
jmp 0x403223
mov eax, dword [0x430aa8]
test eax, eax
je 0x4018aa
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
mov eax, dword [0x430ab0]
test eax, eax
je case.0x40175a.66
mov edx, dword [ebp - 0x280]
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x402664
mov dword [esp], 0xfffffff0
call fcn.00401458
push edi
mov edx, dword [ebp - 0x27c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x401b8b
mov dword [esp], 0xfffffff0
xor edi, edi
call fcn.00401458
push ebx
invalid
Function at 0x404e64
Capabilities:
Get graphical window text
Hash data using murmur3

Disassembly:
invalid
ja 0x404e04
wait
inc eax
xor edx, esi
neg edx
ror eax, 0xd
inc eax
xor ebx, ecx
ror esi, 0xa
sub esi, eax
neg esi
add edx, 0x745e37e7
sub ecx, 0xdf3b78c6
mov esi, 0x2908197c
dec ebx
call fcn.00406d76
add ecx, eax
xor eax, dword [0x40ba25]
sub dword [0x40b2fd], edx
xor edx, 0x4987b17a
not edx
xor eax, dword [0x40bdd2]
ror edx, 0x1f
xor eax, esi
rol ebx, 0xd
add esi, dword [0x40ba38]
add edx, dword [0x40bde5]
call fcn.004075b1
rol edx, 0x13
xor dword [0x40b829], 0xeabc2260

Function at 0x404ed2
Capabilities:
Get graphical window text
Hash data using murmur3

Disassembly:
neg edi
rol edi, 0x14
xchg ecx, eax
xor edi, dword [0x40be1a]
xchg ecx, eax
ror edi, 0x14
neg edi
ror edx, 0x13
call fcn.00402eb5
ror ebx, 0xd
xor eax, esi
rol edx, 0x1f
not edx
xor edx, 0x4987b17a
or dword [0x40b316], ebx
sub ecx, eax
call fcn.004060a7
inc ebx
add esi, 0xa616df3d
dec eax
sub ebx, 0x9594fd66
neg ebx
or ecx, dword [0x40b9f2]
call fcn.004060a7
xchg ecx, esi
call fcn.004060a7
xor edx, ebp
not ecx
mov dword [0x40b5bb], esi
sub dword [0x40b3e8], ebx
not ecx
xor edx, ebp
call fcn.004018fe
xchg ecx, esi
call fcn.00402764
neg ebx
add ebx, 0x9594fd66
inc eax
xor esi, 0xcf1ef8b9
not esi
call fcn.00401da5
add esi, edx
call fcn.00407386
not ebx
add dword [0x40b867], edx
sub edx, dword [0x40bd88]
call fcn.00407cfb
neg ebx
xor edi, 0x9f08c321
inc ebx
call fcn.00409680
xor edx, 0x3ecf9409
sub ebx, dword [0x40be47]
xor edx, 0x3ecf9409
dec ebx
xor edi, 0x9f08c321
neg ebx
call fcn.00409071
add byte [eax], al
add dword [0x40b556], esi
not ebx
call fcn.004060a7
sub esi, edx
not esi
push esi
mov dword [0x40b35d], eax
or esi, dword [0x40be79]
xchg ecx, eax
add edi, 0x432de896
call fcn.00404419
add eax, 0x9be2f01e

Function at 0x404fa9
Capabilities:
Get graphical window text
Hash data using murmur3

Disassembly:
neg edi
rol edi, 0x14
xchg ecx, eax
xor edi, dword [0x40be1a]
xchg ecx, eax
ror edi, 0x14
neg edi
ror edx, 0x13
call fcn.00402eb5
ror ebx, 0xd
xor eax, esi
rol edx, 0x1f
not edx
xor edx, 0x4987b17a
or dword [0x40b316], ebx
sub ecx, eax
call fcn.004060a7
inc ebx
add esi, 0xa616df3d
dec eax
sub ebx, 0x9594fd66
neg ebx
or ecx, dword [0x40b9f2]
call fcn.004060a7
xchg ecx, esi
call fcn.004060a7
xor edx, ebp
not ecx
mov dword [0x40b5bb], esi
sub dword [0x40b3e8], ebx
not ecx
xor edx, ebp
call fcn.004018fe
xchg ecx, esi
call fcn.00402764
neg ebx
add ebx, 0x9594fd66
inc eax
xor esi, 0xcf1ef8b9
not esi
call fcn.00401da5
add esi, edx
call fcn.00407386
not ebx
add dword [0x40b867], edx
sub edx, dword [0x40bd88]
call fcn.00407cfb
neg ebx
xor edi, 0x9f08c321
inc ebx
call fcn.00409680
xor edx, 0x3ecf9409
sub ebx, dword [0x40be47]
xor edx, 0x3ecf9409
dec ebx
xor edi, 0x9f08c321
neg ebx
call fcn.00409071
add byte [eax], al
add dword [0x40b556], esi
not ebx
call fcn.004060a7
sub esi, edx
not esi
push esi
mov dword [0x40b35d], eax
or esi, dword [0x40be79]
xchg ecx, eax
add edi, 0x432de896
call fcn.00404419
add eax, 0x9be2f01e
Function at 0x405093
Capabilities:
Get graphical window text
Hash data using murmur3

Disassembly:
xor edx, 0xc17ae28c
xchg ecx, eax
call fcn.0040418c
inc ecx
neg eax
inc edx
mov dword [0x40b4bb], edi
add dword [0x40b811], ecx
xor esi, 0xfa0c3d9b
xor ecx, edx
xor ecx, 0x6e68f0d5
xor edx, esp
call fcn.00402649
xor ebx, dword [0x40bb72]
invalid
xlatb
invalid

Function at 0x40512e
Capabilities:
Get graphical window text
Hash data using murmur3

Disassembly:
call fcn.004060a7
xor edx, esp
add ecx, 0xfed7c320
not esi
call fcn.004060a7
xor eax, 0xd9d6c9e4
sub ebx, dword [0x40bbce]
dec edi
xor eax, 0x69bf8e9b
call fcn.004060a7
add ecx, ebx
xor ebx, edi
sub edi, dword [0x40bf68]
inc edi
call fcn.004060a7
add bh, dh
salc
Function at 0x407b18
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov dword [0x4381e0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0x20], 0x4381e0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407b84
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407b88
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407dfe
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
invalid

Function at 0x407e37
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00407dfe
push ecx
cmp eax, 0xffffffff
je 0x407e8c
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x407e84
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407e7d
test byte [ebp + 0xc], 4
jne 0x407e8c
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407e8c
mov eax, 1
jmp 0x407e8e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407e61
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x407e97
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x407eb2
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x4089ed
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x4369e0], 0x55004e
mov dword [0x4369e4], 0x4c
test esi, esi
jne 0x408a46
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4361e0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x408c2e
cmp eax, 0x400
jle 0x408a95
jmp 0x408c2e
xor eax, eax
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00407e97
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4369e0
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x408c2e
cmp eax, 0x400
jle 0x408a17
jmp 0x408c2e
mov dword [esp + 0xc], 0x4361e0
mov dword [esp + 8], 0x4369e0
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x435de0
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x41b950]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x4361e0
mov dword [esp + 4], eax
call fcn.004086ea
push edi
push edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x4361e0
call fcn.00407e97
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x408c2e
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
invalid
Function at 0x401730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401749
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401784
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401780
lea ebx, [ebx]
cmp esi, eax
jae 0x401784
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401770
cmp esi, eax
jb 0x40178a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40485f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4048a7
call fcn.00407fcd
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4048a7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4048ea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4048d3
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4048d3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4048e7
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405d98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00407fcd
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x405dd1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004059e4
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x405e2f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x405e53
cmp dword [edi + 0x54], 0
jne 0x405e53
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00407fcd
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00405df0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40fe67
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40feae
call fcn.00407fcd
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40feae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40feca
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f9df
mov esi, eax
test edi, edi
je 0x40fec8
test ebx, ebx
je 0x40fec8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4106b2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x52307e
call fcn.0050102c
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4106d7
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41071d
lea ecx, [ebp - 0x10]
call fcn.00402cc7
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00442dec
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004017e0
mov eax, esi
call fcn.00501104
ret 8
Function at 0x416241
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x573978]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x41627a
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x4162a1
cmp dword [0x577158], 0
jne 0x4162a1
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x416294
push 0x12
call esi
test bx, ax
je 0x416298
mov eax, edi
jmp 0x416310
push edi
call fcn.0050440b
pop ecx
jmp 0x416310
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00501900
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x4162ca
call fcn.004111d7
call fcn.004065c2
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00500475
leave
ret 4
Function at 0x426512
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
movzx ebx, word [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x42652c
call fcn.004111d7
call fcn.00407fcd
mov esi, dword [eax + 0xc]
push 0xf1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x42654c
xor eax, eax
jmp 0x426667
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x426545
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x426545
movzx eax, word [esi + 6]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401dc3
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x426527
cmp dword [ebp + 0x10], 0
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
push eax
lea ebx, [ecx + 6]
lea edx, [eax + 6]
push ebx
push edx
je 0x4265a9
mov ecx, edi
call fcn.0041ef6f
jmp 0x4265ae
call fcn.0041ee59
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
cmp dword [eax + 4], 0
jne 0x4265c0
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
cmp dword [edi + 0xbe0], 0
jne 0x4265db
push dword [ebp + 0x10]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x310]
test eax, eax
je 0x426653
mov eax, dword [edi + 0xad0]
mov dword [ebp + 0xc], eax
xor eax, eax
xor ebx, ebx
cmp ax, word [esi + 6]
jae 0x42662a
lea eax, [esi + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 8]
mov dword [ecx + ebx*4], eax
jne 0x42661d
test eax, eax
jbe 0x42661d
push eax
mov ecx, 0x56ff0c
call fcn.00458830
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov dword [eax], ecx
movzx eax, word [esi + 6]
add dword [ebp - 4], 2
inc ebx
cmp ebx, eax
jl 0x4265f4
mov eax, dword [ebp + 8]
mov dword [edi + 0xbe0], eax
movzx ecx, word [esi + 6]
mov eax, dword [edi]
push 1
push ecx
push dword [ebp - 8]
mov ecx, edi
call dword [eax + 0x318]
mov ebx, eax
test ebx, ebx
jne 0x426653
and dword [edi + 0xbe0], eax
push dword [ebp - 8]
call fcn.00401dfd
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42c04a
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x42c18b
push esi
push edi
push 0x530bf0
call fcn.00411b52
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp + 8], 0
je 0x42c0da
mov esi, dword [ebx + 0x168]
jmp 0x42c0c6
mov eax, esi
mov edi, dword [eax + 8]
mov esi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42c0c6
push edi
call fcn.0040ca3f
push eax
push 0x570e48
call fcn.00411b70
pop ecx
pop ecx
test eax, eax
je 0x42c0c6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jle 0x42c0c6
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x42c086
lea ecx, [ebx + 0x164]
call fcn.0048dfb8
jmp 0x42c189
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 8], eax
test eax, eax
je 0x42c189
jmp 0x42c0f0
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0xc8]
call fcn.004047c2
mov esi, dword [eax]
test esi, esi
jne 0x42c109
xor ebx, ebx
jmp 0x42c10c
mov ebx, dword [esi + 0x20]
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42c17f
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42c17f
test edi, edi
je 0x42c151
push esi
push 0x570e48
call fcn.00411b70
mov edx, dword [eax]
pop ecx
pop ecx
mov ecx, eax
call dword [edx + 0x180]
push eax
push 0x53bab4
call fcn.00411b70
pop ecx
pop ecx
test eax, eax
je 0x42c17f
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp + 8]
add esi, 0x164
push eax
mov ecx, esi
call fcn.0042b5ff
test eax, eax
jne 0x42c17f
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0042b5cf
cmp dword [ebp - 8], 0
jne 0x42c0ed
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43078b
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x573978]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.00430239
mov ebx, eax
cmp ebx, esi
je 0x4307f8
lea ecx, [ebp - 0x20c]
call fcn.0040538d
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00500475
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x430816
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0043078b
cmp eax, esi
jne 0x43085d
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x430800
lea ecx, [ebp - 0x20c]
call fcn.0040538d
push dword [ebp - 0x214]
mov ecx, edi
call fcn.0043017e
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.0040538d
mov eax, esi
jmp 0x4307e7
Function at 0x433eb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x576ec0], 0
mov dword [ebp - 4], ecx
jne 0x433ecb
xor eax, eax
jmp 0x433f05
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x433edb
call fcn.00407fcd
mov esi, dword [eax + 0xc]
push edi
push dword [0x577c40]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x433f01
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x433f09
xor eax, eax
pop edi
pop esi
leave
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x433f27
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x433f03
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00433dd7
mov esi, eax
jmp 0x433f19