joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a80c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a9b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44a998
mov dl, 1
mov eax, dword [0x411c38]
call fcn.0040343c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004041e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a987
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00438774
test al, al
je 0x44a97a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44a9c8
lea eax, [ebp - 0x254]
call fcn.00408c84
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a97a
xor eax, eax
push ebp
push 0x44a973
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44aa00
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a95c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404450
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44a95c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a97a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a87d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415714
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a9be
lea eax, [ebp - 0x260]
call fcn.004041e0
ret

Function at 0x44b300
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x451bb0]
cmp byte [eax + 0xa5], 0
jne 0x44b371
cmp dword [0x451bc8], 0
jne 0x44b332
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44b2bc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x451bc8], eax
cmp dword [0x451bc4], 0
jne 0x44b34d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x451bc4], eax
cmp dword [0x451bcc], 0
jne 0x44b371
push esp
push 0
push 0
push 0x44b260
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x451bcc], eax
pop edx
ret
Function at 0x44ba04
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x451bb0]
cmp dword [eax + 0x30], 0
je 0x44baae
cmp dword [ebx + 0x94], 0
jne 0x44baa8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b994
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44baa8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44ba6e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44baa8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413b84
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44ba7d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44c60c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44c641
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042d0
jmp 0x44c64e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404234
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44d760
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44d7a1
mov eax, esi
call fcn.00433f7c
test al, al
je 0x44d7a1
mov eax, dword [ebx + 0x84]
call fcn.00433ca4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44d7a1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00433ca4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10001368
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
lea edi, [esi + 0x4c]
mov dword [ebp - 4], ebx
je 0x100013d8
cmp dword [ebp + 0xc], ebx
jbe 0x100013d8
push 2
push dword [ebp + 8]
call fcn.1000122d
test eax, eax
je 0x100013d8
mov eax, dword [ebp + 0xc]
push ebx
push eax
push ebx
push ebx
mov dword [ebp + 0xc], eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_LockFile]
lea eax, [ebp + 0xc]
push ebx
push eax
push dword [ebp + 0xc]
push dword [edi]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push ebx
push ebx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov ecx, esi
call fcn.10003ac6
push edi
mov ecx, esi
call fcn.10001204
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10001e99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], 0xffffffff
push edi
mov edi, ecx
je 0x10001ef1
cmp dword [ebp + 0xc], esi
je 0x10001ef1
lea eax, [ebp - 4]
push esi
push eax
and dword [ebp - 4], esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x10001ef1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, edi
push dword [ebp + 8]
add edi, 0xfffffff4
neg eax
sbb eax, eax
push 0x10007274
and eax, edi
add eax, 0x10
push eax
call fcn.1000487e
add esp, 0x10
mov eax, esi
pop edi
pop esi
leave
ret 0xc

Function at 0x10001ef9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
push esi
mov esi, ecx
mov dword [ebp - 4], eax
je 0x10001f4e
cmp dword [ebp + 0xc], eax
je 0x10001f4e
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10001f4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push dword [ebp + 8]
add esi, 0xfffffff4
neg eax
sbb eax, eax
push 0x10007298
and eax, esi
add eax, 0x10
push eax
call fcn.1000487e
add esp, 0x10
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc
Function at 0x100027f8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
je 0x100028e4
xor eax, eax
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [esi + 4]
push 0x10
mov dword [ebp - 0x44], eax
mov al, byte [esi + 0x10]
mov byte [ebp - 0x30], al
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
push str.ConfigDynamicAccount.cfg
lea ecx, [eax + 0xc]
call fcn.100030d3
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100028e4
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x28]
push 0x19
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jbe 0x100028db
push 1
pop edi
push edi
push ebx
push 0xffffffffffffffe7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x28]
cmp eax, dword [esi + 4]
jne 0x100028bd
lea eax, [ebp - 8]
push ebx
push eax
mov dword [ebp - 0xc], edi
push 0x19
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10002859
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
mov byte [ebp - 0x14], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push 0x19
lea eax, [ebp - 0x28]
jmp 0x100028b1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10002f82
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call fcn.10003570
test eax, eax
je 0x10002fa2
push 1
pop eax
jmp 0x10003037
and byte [ebp - 0x20c], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
push esi
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.100035c4
and byte [ebp - 0x108], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 0x14
test eax, eax
pop edi
pop esi
je 0x10003028
and byte [eax], 0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
call fcn.10002f82
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret 4
Function at 0x10003405
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push ebx
push edi
mov edx, ecx
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
add edx, 0xfffffffc
stosb byte es:[edi], al
neg ecx
lea eax, [ebp - 0x104]
push 0x104
sbb ecx, ecx
push eax
push dword [ebp + 8]
and ecx, edx
add ecx, 0xc
call fcn.100035c4
test eax, eax
je 0x1000348f
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x1000348f
lea eax, [ebp - 0x104]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov edi, eax
lea eax, [ebp - 0x104]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
cmp edi, eax
pop esi
jne 0x1000348d
push 1
mov dword [ebx], edi
pop eax
jmp 0x1000348f
xor eax, eax
pop edi
pop ebx
leave
ret 0x10

Function at 0x10003495
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov esi, ecx
je 0x100034c2
cmp dword [ebp + 0xc], ebx
je 0x100034c2
cmp dword [ebp + 0x10], ebx
je 0x100034c2
cmp dword [ebp + 0x14], ebx
je 0x100034c2
cmp dword [ebp + 0x18], ebx
jle 0x100034c2
push 1
pop edx
jmp 0x100034c4
xor edx, edx
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp edx, ebx
pop edi
je 0x1000352e
mov ecx, esi
add esi, 0xfffffffc
neg ecx
lea eax, [ebp - 0x104]
push 0x104
sbb ecx, ecx
push eax
push dword [ebp + 8]
and ecx, esi
add ecx, 0xc
call fcn.100035c4
mov edx, eax
cmp edx, ebx
je 0x1000352e
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0x100074d0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
pop esi
mov eax, edx
pop ebx
leave
ret 0x14
Function at 0x10003add
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0x30]
mov dword [ebp - 0xc], esi
cmp eax, esi
je 0x10003bb7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
push eax
lea ebx, [edi + 0x2d]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.1000557f
test eax, eax
je 0x10003bb7
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x10003b9f
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
add eax, 0xfffffffc
mov ecx, edi
mov dword [esi], eax
call fcn.100039fd
push dword [esi]
add edi, 0x48
mov ecx, ebx
push edi
call fcn.1000557f
test eax, eax
mov dword [ebp - 0xc], eax
je 0x10003b9f
push dword [esi]
push 0
push dword [edi]
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 8]
push 4
push dword [ebp - 4]
push ebx
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 4]
push dword [esi]
add eax, 4
push eax
push dword [edi]
call sub.MSVCRT.dll_memcpy
add esp, 0x24
add dword [ebx], 0xfffffc68
mov esi, dword [ebp - 4]
call fcn.10005631
test eax, eax
je 0x10003bb7
test esi, esi
je 0x10003bb7
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0xc]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10003bc1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x10003c4f
cmp dword [esi + 0x48], ebx
je 0x10003c4f
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
add ecx, 0x398
mov dword [ebp - 8], ecx
push ebx
lea ecx, [edi + 4]
mov dword [ebp + 8], 4
push ecx
push ebx
push ebx
push eax
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_LockFile]
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10003c39
lea eax, [ebp + 0xc]
push ebx
push eax
push edi
push dword [esi + 0x48]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov dword [ebp - 4], 1
jne 0x10003c3c
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
push ebx
add eax, edi
push eax
push ebx
push ebx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8
Function at 0x100041c8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x1000748c
mov dword [ebp - 8], ecx
push dword [ebp + 8]
mov dword [ebp - 4], 1
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
xor eax, eax
pop ecx
cmp edi, eax
pop ecx
je 0x10004269
cmp dword [ebp + 0xc], eax
je 0x10004269
mov ebx, dword [ebp + 0x10]
cmp ebx, eax
jbe 0x10004269
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push eax
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push edi
mov dword [ebp + 8], eax
call esi
lea eax, [ebx + 4]
add esp, 0x1c
cmp dword [ebp + 8], eax
jne 0x1000425a
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 1
lea eax, [ebp + 8]
push 4
push eax
call esi
mov ecx, dword [ebp - 8]
add esp, 0x10
push dword [ebp + 8]
push dword [ebp + 0x14]
call fcn.1000414e
test eax, eax
je 0x1000425a
push edi
push 1
push ebx
push dword [ebp + 0xc]
call esi
add esp, 0x10
jmp 0x1000425e
and dword [ebp - 4], 0
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop esi
jmp 0x1000426c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0x10

Function at 0x10004ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x10007498
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
xor esi, esi
pop ecx
cmp edi, esi
pop ecx
je 0x10004b59
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 2
push esi
push esi
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push esi
push eax
push esi
push ebx
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LockFile]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
lea eax, [ebp + 8]
push 4
push eax
call esi
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
add esp, 0x20
push 0
push dword [ebp - 8]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop ebx
jmp 0x10004b5c
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc
Function at 0x10004bec
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call fcn.10004d16
test eax, eax
je 0x10004c0c
push 1
pop eax
jmp 0x10004ca1
and byte [ebp - 0x20c], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
push esi
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.10004ca5
and byte [ebp - 0x108], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 0x14
test eax, eax
pop edi
pop esi
je 0x10004c92
and byte [eax], 0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
call fcn.10004bec
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret 4

Function at 0x1000530f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call fcn.100054c2
test eax, eax
je 0x1000532f
push 1
pop eax
jmp 0x100053c4
and byte [ebp - 0x20c], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
push esi
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.100051dc
and byte [ebp - 0x108], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 0x14
test eax, eax
pop edi
pop esi
je 0x100053b5
and byte [eax], 0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
call fcn.1000530f
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret 4
Function at 0x401860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401879
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4018b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4018b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4018b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4018a0
cmp esi, eax
jb 0x4018ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401cf0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x110
mov eax, dword [0x4619f8]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x20
mov esi, ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401d3d
mov ecx, dword [esp + 8]
push 1
push str.SeDebugPrivilege
push ecx
mov ecx, esi
call fcn.00401690
jmp 0x401d4b
push 0
push 0
push str.Failed_OpenProcessToken
call fcn.00417790
jmp 0x49b0f5

Function at 0x406b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x448d38
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4619f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], vtable.CBrush.0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 8]
call fcn.0041b387
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 0x24]
push edx
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 4], vtable.CBrush.0
call fcn.004069f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 0x18