joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404513
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404589
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push str.SeShutdownPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push edi
push edi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x404589
push edi
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
jmp 0x40458b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004060ae
leave
ret

Function at 0x404671
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, 0x422a80
push edi
push ebx
xor edi, edi
mov ebp, str.Options
push edi
push str.Auto
push ebp
call esi
mov dword [0x422004], eax
sub eax, edi
je 0x40470d
sub eax, 1
je 0x4046e7
sub eax, 1
jne 0x40471b
push edi
push ebx
push 0xf
push str.Interval
push ebp
call esi
imul eax, eax, 0xea60
push eax
push 2
push dword [0x421b34]
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 1
push 0x41ce94
push ebp
call esi
push ebx
push 0xf
push str.Reach
push ebp
mov dword [0x422008], eax
call esi
mov dword [0x422000], eax
jmp 0x40471b
push edi
push 0x124f80
push 2
push dword [0x421b34]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x422008], 4
mov dword [0x422000], edi
jmp 0x40471b
push 2
push dword [0x421b34]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x404723
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x828], ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
shr edi, 2
call fcn.00407000
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatW]
test edi, edi
je 0x4047d6
lea esi, [ebp - 0x61c]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x4047ce
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4047ce
push 0x41cea8
lea eax, [ebp - 0x20c]
push eax
call ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call ebx
push 0x41ceb0
lea eax, [ebp - 0x20c]
push eax
call ebx
add esi, 8
sub edi, 1
jne 0x40478c
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp word [ebp - 0x20c], 0
je 0x404856
mov ecx, 0x41ceb4
call fcn.004020bf
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
mov ecx, 0x41cebc
call fcn.004020bf
push eax
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
mov ecx, 0x41cec4
call fcn.004020bf
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
push 0x30
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004060ae
leave
ret

Function at 0x404865
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [ecx]
test ax, ax
je 0x404882
mov edx, eax
xor edx, 1
mov word [ecx], dx
lea ecx, [ecx + 2]
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x40486f
xor eax, eax
ret

Function at 0x404ded
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
jmp 0x404e15
movzx eax, word [edi]
dec ecx
xor eax, esi
lea edi, [edi + 2]
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x41bd08]
test ecx, ecx
jg 0x404dff
not esi
pop edi
mov eax, esi
pop esi
ret

Function at 0x4051da
Capabilities:
Empty the recycle bin
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, 0x41c610
push edi
mov edi, 0x422a80
push edi
push 0
push str.RecConf
push ebp
call esi
push edi
push 0
push str.RecNoUI
push ebp
mov ebx, eax
call esi
push 0x422a80
push 0
push str.RecNoSound
push ebp
mov edi, eax
call esi
neg eax
sbb ecx, ecx
and ecx, 4
neg edi
sbb edi, edi
xor eax, eax
and edi, 2
or ecx, edi
test ebx, ebx
setne al
or ecx, eax
push ecx
push 0
push dword [0x421b34]
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x405244
Capabilities:
Get disk information

Disassembly:
sub esp, 0x23c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x24], 0x14
xorps xmm0, xmm0
push eax
push 0x104
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, dword [esp + 0x1c]
mov esi, eax
mov edi, dword [esp + 0x18]
shr esi, 2
test esi, esi
je 0x4052f4
mov eax, dword [esp + 0x14]
lea ebp, [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4052e2
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
add edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
adc ebx, dword [esp + 0x2c]
add ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
adc eax, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jmp 0x4052e6
mov ecx, dword [esp + 0x10]
add ebp, 8
sub esi, 1
jne 0x4052a8
mov ebp, dword [esp + 0x18]
jmp 0x4052fc
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [0x4207e0]
test eax, eax
je 0x405317
shrd edi, ebx, 0x14
cdq
shr ebx, 0x14
cmp ebx, edx
ja 0x40532b
jb 0x405317
cmp edi, eax
ja 0x40532b
mov eax, dword [0x421c3c]
test eax, eax
je 0x405335
cdq
cmp ebp, edx
jb 0x405335
ja 0x40532b
cmp ecx, eax
jbe 0x405335
call fcn.004051da
xor eax, eax
inc eax
jmp 0x405337
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004060ae
add esp, 0x23c
ret
Function at 0x405350
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar
Read .ini file

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
mov ebp, str.BUTTON
push ebx
push ebp
mov esi, eax
push ebx
push esi
call edi
push ebx
push str.ReBarWindow32
push ebx
push esi
mov dword [esp + 0x20], eax
call edi
push str.Quick_Launch
push str.ToolbarWindow32
mov ebx, eax
push 0
push ebx
call edi
push 0
push str.MSTaskSwWClass
push 0
push ebx
mov dword [esp + 0x24], eax
call edi
push 0
push str.TrayNotifyWnd
push 0
push esi
mov dword [esp + 0x28], eax
call edi
push 0
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call edi
push ebp
push str.SysPager
push ebp
push esi
call edi
push ebp
push str.TrayClockWClass
push ebp
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
push 0x422a80
push 0
push str.Hide1
push 0x41c610
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x4053ff
push 5
jmp 0x405401
push 0
push dword [esp + 0x14]
call esi
push 0x422a80
push 0
push str.Hide2
push 0x41c610
call edi
test eax, eax
jne 0x405422
push 5
jmp 0x405424
push 0
push ebx
call esi
push 0x422a80
xor ebx, ebx
push ebx
push str.Hide3
push 0x41c610
call edi
test eax, eax
jne 0x405443
push 5
jmp 0x405444
push ebx
push dword [esp + 0x18]
call esi
push 0x422a80
push ebx
push str.Hide4
push 0x41c610
call edi
test eax, eax
jne 0x405464
push 5
jmp 0x405465
push ebx
push dword [esp + 0x1c]
call esi
push 0x422a80
push ebx
push str.Hide5
push 0x41c610
call edi
test eax, eax
jne 0x405485
push 5
jmp 0x405486
push ebx
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x405491
Capabilities:
Create thread
Open clipboard
Read .ini file

Disassembly:
push ecx
push esi
push edi
push 0x422a80
xor edi, edi
mov esi, ecx
push edi
push str.Clipboard
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4054c5
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 4
pop edx
mov ecx, str.Free
call fcn.00401d66
imul eax, eax, 0xffa80
push 0x49
mov dword [0x421a04], eax
pop eax
mov word [0x4207d8], ax
cmp dword [0x4207dc], edi
je 0x405502
lea eax, [esp + 8]
push eax
push edi
push edi
push 0x401e68
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ecx
ret

Function at 0x405506
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x422058
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.killproc.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
mov eax, 0x41c59c
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [0x421b34]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004060ae
leave
ret
Function at 0x40556a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x422058
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.killproc.exe_1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
mov eax, 0x41c59c
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push dword [0x421b34]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004060ae
leave
ret
Function at 0x405b72
Capabilities:
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1810
call fcn.00415410
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x180c], eax
push ebx
push edi
mov edi, 0x422a80
xor ebx, ebx
push edi
push ebx
push 0x41d158
push 0x41c610
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x405c90
push ebp
push esi
mov esi, 0x7fe
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x22]
push ebx
push eax
call fcn.00407000
xor eax, eax
push esi
mov word [esp + 0x82c], ax
lea eax, [esp + 0x82e]
push ebx
push eax
call fcn.00407000
xor eax, eax
push esi
mov word [esp + 0x1038], ax
lea eax, [esp + 0x103a]
push ebx
push eax
call fcn.00407000
add esp, 0x24
lea eax, [esp + 0x14]
mov esi, 0x400
push ebx
push ebx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x1034]
push eax
push 0x41d160
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push 0x41d168
push esi
push eax
call fcn.00406080
add esp, 0x10
lea eax, [esp + 0x81c]
mov ebp, str.Trash
mov ebx, str.SYSFILES
push edi
push esi
push eax
mov esi, 0x41c59c
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x81c]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x405c8e
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Temp
push ebx
call esi
push edi
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
call esi
pop esi
pop ebp
mov ecx, dword [esp + 0x1814]
pop edi
pop ebx
xor ecx, esp
call fcn.004060ae
add esp, 0x1810
ret
Function at 0x405ca7
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x2a8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor edx, edx
mov ecx, str.rvsmr
call fcn.00401d66
test eax, eax
je 0x405ced
push 0x422a80
push str.37474384
push str.Data
push 0x41c610
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
jmp 0x405dbd
push esi
xor eax, eax
push 0x98
push eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x26]
push eax
call fcn.00407000
add esp, 0xc
lea eax, [ebp - 0x28]
push 0x422a80
push 0x4d
push eax
push 0x41c59c
push str.Temp
push str.SYSFILES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x405dba
lea ecx, [ebp - 0x28]
call fcn.00404865
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x28]
push eax
call esi
cmp eax, 0x14
jl 0x405dba
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
push eax
call fcn.00407000
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x28]
push eax
call esi
sub eax, 0x10
lea ecx, [ebp - 0x28]
lea esi, [eax + eax]
add ecx, esi
call fcn.00404ded
mov edi, eax
cmp esi, 0x208
jae 0x405dcc
xor eax, eax
mov word [ebp + esi - 0x230], ax
lea eax, [ebp - 0x230]
push eax
call fcn.00408bbd
pop ecx
xor ecx, ecx
cmp edi, eax
pop edi
sete cl
mov eax, ecx
jmp 0x405dbc
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.004060ae
add ebp, 0x78
leave
ret
call fcn.004061de
int3
Function at 0x405f80
Capabilities:
Copy file
Create directory
Get common file path
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebp, 0x422a80
push edi
push ebp
push 0x41c620
mov edi, str.TEST
push edi
push edi
call esi
push ebp
xor ebx, ebx
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x405fd3
push ebp
push 0x41c60c
push edi
push edi
call esi
xor eax, eax
jmp 0x406061
xor eax, eax
push 0x206
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push ebx
push eax
call fcn.00407000
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40605e
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
push str.WinTools
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x10]
push ebx
push eax
call esi
push str.RAMSaverPro
lea eax, [esp + 0x14]
push eax
call edi
push ebx
lea eax, [esp + 0x14]
push eax
call esi
push str._ramsaverpro.ini
lea eax, [esp + 0x14]
push eax
call edi
push 1
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004060ae
add esp, 0x20c
ret

Function at 0x4069b3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4069f2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4069f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4069f2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4069f2
cmp dword [ecx + 0x74], 0xe
jbe 0x4069f2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408ea2
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00408d19

Function at 0x4150b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4150dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4150dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x29807350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29877b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807376
xor eax, eax
jmp 0x29807433
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807398
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807398
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x29807433
cmp dword [esi + 0x4c], 0
je 0x29807431
call fcn.29806b4d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x298073c2
push dword [esi + 0x4c]
push eax
call fcn.2984e4e8
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x29807431
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x298073ff
sub eax, 1
je 0x298073ff
dec eax
sub eax, 1
jne 0x29807431
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x298073b4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x29807423
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x29807431
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x29807433
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801ca0
leave
ret 4
Function at 0x29827184
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29855122
call fcn.298516be
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x298273a5
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2984e4e8
add esp, 0x10
test eax, eax
js 0x2982739f
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29827228
push edi
call fcn.298281ed
pop ecx
test al, al
je 0x29827228
mov eax, edi
call fcn.29851dd0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2982723a
push edi
lea ecx, [ebp - 0x424]
call fcn.2984e4e8
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2984e4e8
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2982739f
push 0x60
push ebx
push eax
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29827292
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29827292
call fcn.29825408
mov ebx, eax
jmp 0x2982736e
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x298272b9
call fcn.29825408
jmp 0x29827361
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x298272af
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x298272ec
mov ebx, 0x8007000e
jmp 0x29827363
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2984e4e8
jmp 0x29827312
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x298272e5
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2984e4e8
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2984e4e8
mov ebx, eax
test edi, edi
je 0x2982736e
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29827387
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x29827397
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2982738d
mov eax, ebx
jmp 0x298273d3
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x298273ba
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x298273ca
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x298273c0
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851676
ret 0x10
Function at 0x40e447
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40e456
pop dword [ebp - 0x44]
mov eax, 0x40e456
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x39b3e
push 0
mov eax, 0xcb11f7c7
sub eax, 0xcacfa5af
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xe893b1e5
sub ecx, 0xe8937a3e
xor ebx, ebx
add ebx, eax
mov edi, 0xade54665
add edi, 0x525e0d9b
add edi, dword [ebp - 0x44]
mov edx, 0x58d820d4
sub edx, 0x82b1e5a4
mov esi, dword [edi]
xor dword [ebp - 0x34], edx
add esi, edx
add dword [ebp - 0xc], 0x2d754bdb
mov dword [ebx], esi
mov dword [ebp - 0x10], 0xcb6c1bf0
add ebx, 0x6c542c7b
sub ebx, 0x6c542c77
add edi, 4
loop 0x40e4b2
add eax, 0x130fb055
sub eax, 0x130edee6
mov ebx, eax
add eax, 0xc0002e6f
add eax, 0x3fffd196
mov ecx, 0xdb3c0b2d
add ecx, 0x2503f4d3
add ecx, dword [ebp - 0x44]
call ebx
leave
ret