joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40800e
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 8], ebx
je 0x408032
xor eax, eax
inc eax
jmp 0x4081a1
xorps xmm0, xmm0
lea edi, [esi + 0x5d120]
push edi
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
push 0x3a
mov word [ebp - 0xc], ax
pop eax
push 0x5c
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
push ebx
mov word [ebp - 6], ax
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40819f
mov ecx, dword [esi + 0x5d100]
mov eax, dword [esi + 0x5d104]
cmp ecx, 0xffffffff
jne 0x40808f
cmp eax, ecx
je 0x4080aa
cmp dword [ebp - 0x1c], eax
ja 0x4080aa
jb 0x40809b
cmp dword [ebp - 0x20], ecx
ja 0x4080aa
mov dword [esi + 0x2470], 2
jmp 0x40819f
push ebx
push 0x20
push 4
push ebx
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x408189
cmp dword [esi + 0x26f0], ebx
je 0x40802a
lea edi, [esi + 0x26e4]
mov ecx, esi
mov eax, dword [edi]
mov dword [edi + 4], eax
call fcn.0040843a
test eax, eax
jne 0x40802a
cmp dword [esi + 0x2468], ebx
ja 0x408102
mov dword [esi + 0x2468], 5
push 0xa
pop eax
cmp dword [esi + 0x2468], eax
jbe 0x408113
mov dword [esi + 0x2468], eax
mov dword [esi + 0x5cfc0], ebx
mov ecx, edi
mov dword [esi + 0x5cfc4], ebx
mov edx, dword [esi + 0x5d100]
mov eax, dword [esi + 0x5d104]
add edx, 0xffffffff
mov dword [esi + 0x5cfc8], edx
adc eax, 0xffffffff
mov dword [esi + 0x5cfcc], eax
lea eax, [esi + 0x5cfb8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040909e
mov eax, dword [esi + 0x5d100]
mov cl, 0x20
mov edx, dword [esi + 0x5d104]
call fcn.00457670
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push ecx
push dword [esi + 0x5d100]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x40802a
mov dword [esi + 0x2470], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2474], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043223c
mov esp, ebp
pop ebp
ret
Function at 0x40825e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x465b08]
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x20c], ax
push 0x206
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x210], ebx
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x214], ebx
call fcn.004352b0
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push 2
push ebx
push 0xffffffffffffff96
push dword [esi + 8]
call edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x210]
push eax
push 0x6a
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 8]
call ebx
cmp dword [ebp - 0x210], 0x6a
jne 0x408357
mov ecx, str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40830c
test dx, dx
je 0x408308
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40830c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4082e6
xor eax, eax
jmp 0x408311
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408357
push 1
push eax
push 0xffffffffffffff92
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x210]
push eax
push 4
lea eax, [ebp - 0x214]
push eax
push dword [esi + 8]
call ebx
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x210]
push 1
push 0
neg eax
push eax
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043223c
mov esp, ebp
pop ebp
ret

Function at 0x408368
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 2
push ebx
push ebx
mov eax, dword [esi + 0x26e8]
sub eax, dword [esi + 0x26e4]
push dword [esi + 8]
sar eax, 2
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 4], ebx
je 0x40842b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push ebx
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call edi
mov eax, dword [esi + 0x26e8]
xor ecx, ecx
sub eax, dword [esi + 0x26e4]
sar eax, 2
mov dword [ebp - 0xc], ecx
push 4
pop ebx
test eax, eax
je 0x408404
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x26e4]
push 0x20
push dword [eax + ecx*4]
push dword [esi + 8]
call edi
mov eax, dword [esi + 0x26e8]
add ebx, 0x20
mov ecx, dword [ebp - 0xc]
sub eax, dword [esi + 0x26e4]
inc ecx
sar eax, 2
mov dword [ebp - 0xc], ecx
cmp ecx, eax
jb 0x4083d1
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 8]
push eax
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call edi
pop edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40843a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x465b08]
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x210], ax
push 0x206
lea eax, [ebp - 0x20e]
mov dword [ebp - 0x214], ebx
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x218], ebx
call fcn.004352b0
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x228], xmm0
push 2
push ebx
push 0xffffffffffffff96
push dword [esi + 8]
call edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x214]
push eax
push 0x6a
lea eax, [ebp - 0x210]
push eax
push dword [esi + 8]
call ebx
cmp dword [ebp - 0x214], 0x6a
jne 0x408638
mov ecx, str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4084fd
test dx, dx
je 0x4084f9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4084fd
add eax, 4
add ecx, 4
test dx, dx
jne 0x4084d7
xor eax, eax
jmp 0x408502
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408638
push 1
push eax
push 0xffffffffffffff92
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x214]
push eax
push 4
lea eax, [ebp - 0x22c]
push eax
push dword [esi + 8]
call ebx
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x214]
push 1
push 0
neg eax
push eax
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x214]
push eax
push 4
lea eax, [ebp - 0x218]
push eax
push dword [esi + 8]
call ebx
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x218], 0
mov ebx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
jbe 0x408603
lea edi, [esi + 0x5cfb8]
mov dword [ebp - 0x21c], eax
push 0
lea eax, [ebp - 0x214]
push eax
push 0x20
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0x18]
xor edx, edx
add dword [edi + 8], eax
mov eax, dword [edi + 0x1c]
adc dword [edi + 0xc], eax
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 8]
mov eax, dword [edi + 0x14]
sbb eax, dword [edi + 0xc]
add ecx, 1
mov dword [edi], edx
adc eax, edx
mov dword [edi + 4], edx
add dword [ebp - 0x21c], ecx
lea ecx, [esi + 0x26e4]
mov dword [edi + 0x18], edx
adc ebx, eax
mov dword [edi + 0x1c], edx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], edi
push eax
call fcn.0040909e
mov eax, dword [ebp - 0x230]
add edi, 0x20
inc eax
mov dword [ebp - 0x230], eax
cmp eax, dword [ebp - 0x218]
jb 0x408586
mov eax, dword [ebp - 0x21c]
mov edx, dword [esi + 0x5d100]
mov ecx, dword [esi + 0x5d104]
sub edx, eax
mov dword [esi + 0x5d118], edx
sbb ecx, ebx
xor eax, eax
mov dword [esi + 0x5d11c], ecx
inc eax
mov ecx, edx
mov dword [esi + 0x5d110], ecx
mov ecx, dword [esi + 0x5d11c]
mov dword [esi + 0x5d114], ecx
jmp 0x40863a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043223c
mov esp, ebp
pop ebp
ret
Function at 0x40864b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi + 0x20]
mov ebx, dword [edi + 0x805c]
cmp dword [eax + 4], 1
jne 0x408669
mov ebx, dword [edi]
xor eax, eax
cmp dword [esi + 0x26f0], eax
je 0x40870e
call fcn.0040825e
mov eax, dword [edi + 0x8040]
mov dword [ebp - 8], eax
push 0
mov edx, dword [eax + 8]
add edx, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 0x1c]
mov eax, ecx
mov dword [ebp - 4], ecx
sar eax, 0x1f
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4086bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408747
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408747
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x408747
mov eax, dword [ebp - 8]
add dword [eax + 0x18], ecx
adc dword [eax + 0x1c], 0
mov ecx, dword [ebp + 8]
add dword [esi + 0x5d110], ecx
push ecx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push edi
call fcn.00408752
mov ecx, esi
call fcn.00408368
xor eax, eax
inc eax
jmp 0x408749
push eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408747
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x408747
add dword [esi + 0x5d110], eax
mov ecx, esi
push eax
adc dword [esi + 0x5d114], 0
push edi
call fcn.00408752
jmp 0x408709
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409bb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409c10
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409c01
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x409bfd
cmp esi, ecx
jae 0x409c01
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x409beb
cmp esi, ecx
jb 0x409c05
xor eax, eax
jmp 0x409c0f
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b8e5
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x467614
mov edi, 0x467218
mov ebx, 0x103
push edi
push ebx
push 0x4d70b0
mov esi, ecx
call fcn.0040b802
call fcn.0040c6aa
push eax
push edi
push ebx
push 0x4d7ae0
call fcn.0040b802
call fcn.0040c6aa
push eax
push edi
push ebx
push 0x4d80f8
call fcn.0040b802
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push edi
push ebx
push 0x4d74c0
call fcn.0040b802
push dword [esi]
push str.0x_08x
push ebx
push 0x4d72b8
call fcn.0040b802
mov ax, word [0x465b08]
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.004352b0
and dword [ebp - 0x440], 0
lea edi, [ebp - 0x43c]
mov ebx, dword [esi + 0xc]
add esp, 0x2c
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x440]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, 0x103
test eax, eax
je 0x40ba27
mov esi, dword [ebp - 0x43c]
test esi, esi
je 0x40ba27
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40ba27
push edi
mov edx, 0x4d7ef0
lea ecx, [ebp - 0x20c]
sub ebx, esi
call fcn.0040c53b
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
lea ecx, [ebp - 0x20c]
cmovne ecx, eax
push ecx
push 0x467218
push edi
push 0x4d76c8
call fcn.0040b802
push ebx
push str.0x_08x
push edi
push 0x4d6ca0
call fcn.0040b802
add esp, 0x20
jmp 0x40ba3a
push 0x467634
push edi
push 0x4d76c8
call fcn.0040b802
add esp, 0xc
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004352b0
push ecx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
lea edx, [ebp - 0x420]
lea ecx, [ebp - 0x418]
call fcn.004209d0
add esp, 0x1c
cmp dword [ebp - 0x418], 0
je 0x40baac
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push dword [ebp - 0x418]
push str._d._d._d__s
push edi
push 0x4d7ce8
call fcn.0040b802
add esp, 0x1c
call fcn.0040c60a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043223c
mov esp, ebp
pop ebp
ret
Function at 0x40bb8c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0x824
mov dword [ebp - 0x82c], eax
mov edi, edx
lea eax, [ebp - 0x828]
mov dword [ebp - 0x830], ebx
push 0
push eax
mov dword [ebp - 0x834], esi
call fcn.004352b0
add esp, 0xc
cmp dword [ebp + 0x10], 0
push esi
je 0x40bcc9
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push 0x823
push eax
call fcn.0040b84a
lea esi, [ebp - 0x828]
add esp, 0x18
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40bc13
push 0x467754
push dword [ebp - 0x834]
sub esi, ecx
call fcn.0043c636
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40bd18
push 2
push 0
push ebx
call fcn.0043ca18
push ebx
call fcn.0043c56a
push 0
push 0
push ebx
mov dword [ebp - 0x82c], eax
call fcn.0043ca18
mov eax, dword [ebp - 0x82c]
add esp, 0x1c
add eax, 2
add eax, esi
mov dword [ebp - 0x834], eax
cmp eax, dword [edi]
jae 0x40bcbd
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push esi
push eax
push ecx
call fcn.00433fd0
mov eax, dword [ebp - 0x830]
push ebx
push 1
push dword [ebp - 0x82c]
add eax, esi
push eax
call fcn.0043cc0d
mov eax, dword [ebp - 0x82c]
add esp, 0x1c
add eax, dword [ebp - 0x830]
mov ecx, 0xa0d
mov word [eax + esi], cx
mov eax, dword [ebp - 0x834]
mov dword [edi], eax
jmp 0x40bcc0
and dword [edi], 0
push ebx
call fcn.0043c6c3
pop ecx
jmp 0x40bd1b
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push 0x823
push eax
call fcn.0040b84a
lea esi, [ebp - 0x828]
add esp, 0x18
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40bcf6
sub esi, ecx
cmp esi, dword [edi]
jae 0x40bd18
push esi
lea eax, [ebp - 0x828]
push eax
push ebx
call fcn.00433fd0
add esp, 0xc
mov dword [edi], esi
jmp 0x40bd1b
and dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043223c
mov esp, ebp
pop ebp
ret
Function at 0x40c2a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea ecx, [ebp - 0x620]
push edi
mov dword [ebp - 0x620], ebx
call fcn.0040bd2c
mov dword [0x4d6888], eax
test eax, eax
je 0x40c3f9
mov si, word [0x465b08]
lea eax, [ebp - 0x412]
mov edi, 0x206
mov word [ebp - 0x414], si
push edi
push ebx
push eax
call fcn.004352b0
push edi
lea eax, [ebp - 0x20a]
mov word [ebp - 0x20c], si
push ebx
push eax
call fcn.004352b0
add esp, 0x18
lea eax, [ebp - 0x20c]
mov ebx, 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x467278
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call fcn.004058d5
push str.http:__doctor.se.360.cn_index.php_doadderrorlog
call fcn.0040b863
lea eax, [ebp - 0x414]
push eax
call fcn.0040b894
mov ax, word [0x465b08]
push edi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push 0
push eax
mov dword [0x475510], 0x2710
call fcn.004352b0
add esp, 0xc
push 0x54
pop eax
call fcn.004329f0
mov ecx, esp
mov edx, str.___________________________7d9114302a0cb6
push 3
push 0x2a
call fcn.0040548a
push eax
push str.multipart_form_data__boundary_s
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.0040b802
mov eax, dword [0x4d6888]
mov esi, 0x4752f0
push 0x208
mov dword [0x4752e8], eax
mov eax, dword [ebp - 0x620]
push 0
push esi
mov dword [0x4752ec], eax
call fcn.004352b0
lea eax, [ebp - 0x61c]
push eax
push 0x467218
push ebx
push esi
call fcn.004093ee
add esp, 0x2c
call fcn.00405822
call fcn.00405aee
lea esp, [ebp - 0x62c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043223c
mov esp, ebp
pop ebp
ret
Function at 0x40c410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.dbghelp.dll
mov dword [ebp - 0x210], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40c52c
push ebx
push str.MiniDumpWriteDump
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40c524
mov cx, word [0x465b08]
lea eax, [ebp - 0x20a]
push edi
push 0x206
push 0
push eax
mov word [ebp - 0x20c], cx
call fcn.004352b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x4d8300
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x467278
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
je 0x40c523
xor eax, eax
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [ebp - 0x214]
xor ecx, ecx
push ecx
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x210]
push ecx
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push ecx
push edi
mov dword [ebp - 0x218], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043223c
mov esp, ebp
pop ebp
ret

Function at 0x40c53b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004330f0
mov eax, dword [0x46f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push esi
push edi
push 0x4000
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.004352b0
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x40c5f7
cmp eax, 0x3fff
ja 0x40c5f7
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40c5f7
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x467610
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40c5f7
mov ecx, dword [ebp - 0x4008]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
push edi
call fcn.0040b802
xor eax, eax
add esp, 0x1c
mov word [edi + ebx*2 - 2], ax
inc eax
jmp 0x40c5f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043223c
mov esp, ebp
pop ebp
ret
Function at 0x40c60a
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ecx, ecx
mov eax, 0x104
mov ebx, 0x4719a0
mov dword [ebp - 4], eax
push esi
push edi
cmp cx, word [0x4719a0]
jne 0x40c653
xor esi, esi
push esi
push 0x26
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x40c63a
mov eax, dword [ebp - 4]
mov esi, str.internet_exploreriexplore.exe
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x4d6890
mov ecx, ebx
push eax
mov edx, edi
call fcn.0040c53b
mov esi, eax
pop ecx
test esi, esi
jne 0x40c6a1
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push edi
lea eax, [ebp - 8]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x40c6a1
xor eax, eax
xor ecx, ecx
inc eax
cmp cx, word [0x4d6890]
cmovne esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
push edi
push 0x467c64
movzx eax, dx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40cdd7
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x40cdd6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40cdd6
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40cdd6
push esi
push ebx
push edi
call fcn.00433fd0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40cdcf
mov ebx, dword [ebp - 4]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x40cd98
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
mov dword [esi], 0x467c2c
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
jmp 0x40cd9a
xor esi, esi
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
je 0x40cdcf
mov eax, dword [esi + 8]
and dword [esi + 8], 0
test eax, eax
jne 0x40cdc7
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x40cdc7
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret