joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c8e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.0052eb20
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x41c910
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41c910
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x41c988
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x41c96a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x41c988
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x41ca1a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x41ca08
lea eax, [esi + esi]
call fcn.0052f190
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x41ca1a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c9b3
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x41ca1a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.0052be5e
mov esi, eax
add esp, 8
test esi, esi
jne 0x41cabe
call fcn.0053150b
cmp dword [eax], 2
je 0x41ca00
call fcn.0053150b
cmp dword [eax], 9
jne 0x41ca12
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.00530c55
mov esi, eax
add esp, 8
test esi, esi
jne 0x41cabe
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00405740
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x56b910
push eax
push 0x56b90c
push ecx
push str.fopen_
push 5
call fcn.00405320
add esp, 0x2c
call fcn.0053150b
cmp dword [eax], 2
jne 0x41ca90
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00405740
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00405740
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
push 0x5c1b94
call fcn.004042e0
mov edi, eax
add esp, 4
test edi, edi
jne 0x41caf0
push esi
call fcn.0052c1c9
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00403d70
push esi
push 1
push 0x6a
push edi
call fcn.004040d0
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
Function at 0x41d590
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x41d673
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x41d60e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x56ba98]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x56ba98]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x56ba98]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x56ba98]
mov byte [ecx], dl
jmp 0x41d660
shl edx, 0x10
cmp edi, 2
jne 0x41d61f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x56ba98]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x56ba98]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x41d64d
lea edx, [edi + 0x3c]
jmp 0x41d65a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x56ba98]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x41d5b0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x437a30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x437a49
mov esi, edi
mov edi, eax
jmp 0x437a4b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x437a5b
mov eax, ebx
jmp 0x437a65
push eax
push ebx
call fcn.004088b0
add esp, 8
test eax, eax
jne 0x437a6d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x437a89
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x437a74
cmp eax, dword [esi + 4]
jge 0x437aa0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x437a90
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x437ac1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x437abe
dec eax
test eax, eax
jg 0x437ab0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x43c0a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.0052eb20
mov eax, dword [0x5c2b80]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.0041e830
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x43c103
xor eax, eax
jmp 0x43c28d
lea ecx, [esp + 0x2c]
push ecx
call fcn.0044db20
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x43c128
mov dword [esp + 0x148], edi
jmp 0x43c152
cmp dword [esp + 0x148], 0xffffffff
jne 0x43c152
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x43c140
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43c140
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x43c27b
jmp 0x43c168
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x43c16e
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.0044d860
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0044da60
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0044da60
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.0044da70
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.0052e420
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x43c266
dec eax
mov dword [esp + 0x10], eax
jmp 0x43c210
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.0044dc30
add esp, 0x1c
test esi, esi
jle 0x43c25f
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x43c250
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x43c210
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x43c160
lea eax, [esp + 0x2c]
push eax
call fcn.0044dbc0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052ab62
add esp, 0x130
ret
Function at 0x44d860
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0052eb20
mov eax, dword [0x5c2b80]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x44d8af
mov eax, 1
mov dword [esi], ebp
jmp 0x44d8b1
mov ebp, dword [esi]
test ecx, ecx
je 0x44d994
push ebp
call fcn.004232b0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x44d8e0
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.004093f0
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x44d937
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.00427b60
add esp, 0xc
test eax, eax
je 0x44da36
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.00427d10
add esp, 0xc
test eax, eax
je 0x44da36
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.00427d20
add esp, 0xc
test eax, eax
je 0x44da36
jmp 0x44d971
cmp edi, 0x80
jbe 0x44d953
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.004093f0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.0052e420
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x44d99c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.0052ebd0
add esp, 0xc
jmp 0x44d99c
test eax, eax
je 0x44da22
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x44d9a0
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.00427b60
add esp, 0xc
test eax, eax
je 0x44da36
push ebp
call fcn.004232b0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00427d10
add esp, 0x10
test eax, eax
je 0x44da36
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x44d9e4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.00427b60
add esp, 0xc
test eax, eax
je 0x44da36
push ebp
call fcn.004232b0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00427d10
add esp, 0x10
test eax, eax
je 0x44da36
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.00427e80
add esp, 8
test eax, eax
jne 0x44da3a
xor eax, eax
jmp 0x44da3f
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052ab62
add esp, 0x8c
ret
Function at 0x4506e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0052eb20
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.0041e830
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x450921
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x4507a7
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.00408670
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.00403980
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x450759
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x4507db
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x450819
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.00408010
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x450807
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.00405740
add esp, 0x14
jmp 0x450904
cmp esi, 0xfffffffe
jne 0x4507b1
jmp 0x45071d
jge 0x45071d
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.00405740
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x450765
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.00405740
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.0040b350
add esp, 8
test eax, eax
jle 0x450900
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.00427b10
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00427b60
push 8
lea eax, [esp + 0x34]
push 0x5852a0
push eax
call fcn.00427d10
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00427d10
add esp, 0x28
test esi, esi
je 0x450874
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00427d10
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00427e50
lea ecx, [esp + 0x2c]
push ecx
call fcn.00427da0
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.00413960
add esp, 0x24
test eax, eax
jne 0x450900
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x4508d6
xor ecx, ecx
test esi, esi
jle 0x4508d6
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x4508c7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4508ef
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4507fb
push ebp
call fcn.004081b0
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x455a70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov eax, esi
shr eax, 0x1f
push edi
movd xmm0, esi
sub esp, 8
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x5a9bf0]
divsd xmm0, qword [0x5a9a90]
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.00549ff0
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
mulsd xmm0, qword [0x5a9a98]
call fcn.00549dff
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x455bad
mov edi, dword [ebp + 8]
test edi, edi
je 0x455bad
cmp eax, dword [ebp + 0xc]
ja 0x455bad
xor ecx, ecx
test esi, esi
je 0x455b75
cmp ecx, esi
jae 0x455afa
movzx edx, byte [ecx + ebx]
inc ecx
jmp 0x455afc
xor edx, edx
cmp ecx, esi
jae 0x455b0a
movzx eax, byte [ecx + ebx]
inc ecx
mov dword [ebp - 8], eax
jmp 0x455b11
mov dword [ebp - 8], 0
cmp ecx, esi
jae 0x455b1c
movzx eax, byte [ecx + ebx]
inc ecx
jmp 0x455b1e
xor eax, eax
shl edx, 8
add edx, dword [ebp - 8]
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], al
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 3], al
add edi, 4
cmp ecx, esi
jb 0x455af3
mov edi, dword [ebp + 8]
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
lea eax, [edx + edx*2]
mov edx, dword [ebp - 0x10]
sub esi, eax
mov ecx, dword [esi*4 + 0x58d8fc]
test ecx, ecx
jle 0x455b9f
lea eax, [edx - 1]
add eax, edi
mov byte [eax], 0x3d
lea eax, [eax - 1]
dec ecx
jne 0x455b96
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x456940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x456959
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x456994
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x456990
lea ebx, [ebx]
cmp esi, edx
jae 0x456994
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x456980
cmp esi, edx
jb 0x45699b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x457530
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54aa1a
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 1
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0052ebd0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4575eb
mov ecx, edi
call fcn.004f9760
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
or ecx, 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x457740
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x457740
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00457210
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x228]
push 0x5923e4
call fcn.00457210
mov byte [ebp - 4], 4
lea ecx, [ebp + 8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x224]
call fcn.0045bbe0
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x21c]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 4
or esi, 0xffffffff
mov edx, dword [ebp - 0x224]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x45766e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov ecx, esi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x457691
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4576db
mov ecx, edi
call fcn.004f9760
mov dword [ebp - 0x220], 1
mov byte [ebp - 4], 1
mov ecx, esi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4576d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x45771f
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.00456280
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x220], 1
mov byte [ebp - 4], 1
mov ecx, esi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45771f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x457740
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
Function at 0x457e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54abd1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [esi], 0
call fcn.00456bd0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x457ed2
push 0x80004005
call fcn.00456ea0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x10]
or eax, 0x20019
mov dword [ebp - 0x20], 1
push eax
mov eax, dword [ebp - 0x14]
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x457fa3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebx]
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x457fa3
cmp dword [ebp - 0x14], 1
jne 0x457fa3
mov edx, dword [ebp - 0x1c]
shr edx, 1
jns 0x457f47
push 0x80070057
call fcn.00456ea0
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or ecx, eax
jge 0x457f62
push edx
mov ecx, esi
call fcn.00456e30
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebx]
push dword [ebp - 0x18]
call edi
mov eax, dword [esi]
test eax, eax
jne 0x457f7f
xor ecx, ecx
jmp 0x457f91
push dword [eax - 8]
push eax
call fcn.0052b6eb
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x457f3d
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x457f3d
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x457fb1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
Function at 0x457fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
or edi, 0xf003f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 8]
push ecx
push edi
push 0
push dword [eax]
mov dword [ebp - 0xc], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x458042
cmp esi, 2
jne 0x45803e
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push 0
push edi
push 0
push 0
push 0
push dword [eax]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x458067
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebp - 0x14]
push ecx
push 1
push 0
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x458075
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052ab62
mov esp, ebp
pop ebp
ret