joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4020bb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4020f2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4020ee
jmp 0x4020e0
cmp esi, eax
jae 0x4020f2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4020e0
cmp esi, eax
jb 0x4020f9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_Acrobat11.0Security
push 0x80000002
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403dea
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4068dc
push ecx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403de0
cmp dword [ebp - 4], eax
jne 0x403de0
xor esi, esi
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401de0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x401e2b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x401e1b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x401e01
jmp 0x401e20
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x401e7b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401e40
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401e40
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x401e5c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004031c0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x401e9d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401f10
mov esi, dword [ebx]
cmp esi, ebx
je 0x401f10
test esi, esi
je 0x401f10
cmp word [esi + 0x24], 2
jbe 0x401f0a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401f0a
cmp dword [esi + 0x18], 0
je 0x401f0a
test ebp, ebp
je 0x401ec5
cmp ebp, eax
jne 0x401f0a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004031c0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401eea
cmp eax, dword [esi + 0x18]
jne 0x401f0a
cmp dword [esp + 0x10], 0
je 0x401f1d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402cd0
add esp, 8
test eax, eax
je 0x401f1d
mov esi, dword [esi]
cmp esi, ebx
jne 0x401ea3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x401f30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7f7a08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4020dd
cmp dword [0x7f7a0c], 0
jne 0x4020c9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004023f0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401f80
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401f90
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401fc5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004023f0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402024
sub edx, esi
sar edx, 1
je 0x4020dd
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402040
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4020dd
xor eax, eax
push ebx
test edx, edx
je 0x402078
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402078
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402061
xor eax, eax
test edx, edx
je 0x402092
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x402092
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402080
xor eax, eax
test edx, edx
je 0x4020af
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4020af
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4020a0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7f7a08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x4027d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40282b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4027f0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40280c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004031c0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40284d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4028bf
mov esi, dword [ebx]
cmp esi, ebx
je 0x4028bf
test esi, esi
je 0x4028bf
cmp word [esi + 0x24], 2
jbe 0x4028b9
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4028b9
cmp dword [esi + 0x18], 0
je 0x4028b9
test ebp, ebp
je 0x402875
cmp ebp, eax
jne 0x4028b9
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004031c0
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40289a
cmp edx, dword [esi + 0x18]
jne 0x4028b9
cmp dword [esp + 0x14], eax
je 0x4028cc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402cd0
add esp, 8
test eax, eax
je 0x4028cc
mov esi, dword [esi]
cmp esi, ebx
jne 0x402853
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x4028e0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7f7b48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402a09
cmp dword fs:[0xc0], eax
je 0x40290b
mov dword [0x7f7b44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7f7a2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7f7a30], eax
movzx edx, word [esi + 0xac]
mov dword [0x7f7a34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7f7a38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40296b
push 0x7f
push eax
push 0x7f7a3c
call fcn.004031c0
mov edx, dword [0x7f7a34]
add esp, 0xc
jmp 0x402973
xor eax, eax
mov word [0x7f7a3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7f7b3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7f7b3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7f7b40], ax
mov ecx, eax
mov byte [0x7f7b42], 0
cmp byte [0x7ffe0268], 0
je 0x4029ba
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7f7b42], bl
cmp ebx, 1
pop ebx
jne 0x4029d4
and ecx, 0xffef
mov word [0x7f7b40], cx
test edx, edx
jne 0x402a09
call fcn.004028e0
cmp dword [0x7f7a2c], 6
ja 0x402a09
jb 0x4029f1
cmp dword [0x7f7a30], 4
jae 0x402a09
call fcn.004028e0
cmp dword [0x7f7a2c], 0xa
jae 0x402a09
mov dword [0x7f7a34], 1
ret
Function at 0x402a10
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402a38
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x402a46
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x402a5f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x402a6d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x402a86
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x402a94
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x402aad
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x402abb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x402b02
add dword [esp], 5
retf

Function at 0x402b90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7f8588]
sub esp, 0x11c
test eax, eax
jne 0x402c8e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004023f0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402be0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402bf0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402c25
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.004027d0
pop edi
pop esi
pop ebx
test eax, eax
je 0x402c89
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402c89
mov dword [0x7f8588], eax
add esp, 0x11c
ret
mov eax, dword [0x7f8588]
add esp, 0x11c
ret
Function at 0x41aca2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x40d42c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40d2a4
mov eax, dword [0x634ef4]
cmp byte [eax], 0
je 0x40d4a8
mov eax, dword [0x634b48]
call fcn.00403850
call fcn.00403024
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a3a0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40d4f0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40d4de
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x634abc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x6387f8]
call fcn.004069b0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40ddb0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40de86
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405460
lea eax, [ebp - 4]
call fcn.004058b0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40de70
mov eax, ebx
call fcn.00402ec8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40de69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40de53
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40de98
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40de53
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de70
mov eax, dword [ebp - 0x10]
call fcn.00402ee4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de8d
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x41fd30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x63a9ec
cmp dword [edi], 0
jne 0x41fdac
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x63a9e8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48db0c
mov ecx, 2
call fcn.00403168
mov edx, 0x41fd08
lea eax, [esi + 5]
call fcn.0041fd28
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041fd28
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41fd81
mov dword [0x63a9e8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41ff88
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4201b9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
cmp byte [ebp + eax - 0x109], 0x5c
je 0x41ffe2
mov byte [ebp + eax - 0x108], 0x5c
mov byte [ebp + eax - 0x107], 0
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 4]
mov ecx, 0x4201d0
call fcn.004056e0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov ebx, eax
test ebx, ebx
je 0x420033
push 0x4201e0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63a9f0], eax
push 0
push 0
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
lea eax, [ebp - 0x110]
mov edx, 0x420204
call fcn.00405694
mov eax, dword [ebp - 0x110]
call fcn.00405858
push eax
call sub.kernel32.dll_LoadLibraryExA_1
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x420218
call fcn.004056e0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov ebx, eax
test ebx, ebx
je 0x420193
push 0x420224
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63a9f4], eax
push 0x420238
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63a9f8], eax
push 0x420248
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa24], eax
push 0x420258
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa28], eax
push 0x42026c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63a9fc], eax
push 0x420280
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa00], eax
push 0x420294
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa04], eax
push 0x4202a4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa08], eax
push 0x4202b8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa0c], eax
push 0x4202cc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa10], eax
push 0x4202e0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa14], eax
push 0x4202f4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa18], eax
push 0x42030c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa1c], eax
push 0x420328
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aa20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4201c0
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x42052c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x37], 0
jne 0x42053f
cmp dword [esi + 0x2b], 0
je 0x42054d
mov dword [esi + 8], 0x1002
xor esi, esi
jmp 0x4205d3
mov dword [esi + 8], 0
push 0xa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x420570
mov dword [esi + 8], 0x3001
xor esi, esi
jmp 0x4205d3
push eax
push eax
push dword [ebp + 0xc]
call sub.kernel32.dll_LoadResource
pop ecx
or eax, eax
jne 0x42058a
mov dword [esi + 8], 0x3002
xor esi, esi
jmp 0x4205d3
mov dword [esi + 0x13], eax
mov dword [esi + 0x1b], eax
push ecx
push dword [ebp + 0xc]
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4205a8
mov dword [esi + 8], 0x3002
xor esi, esi
jmp 0x4205d3
mov dword [esi + 0x17], eax
mov dword [esi + 0x2b], 2
push esi
call fcn.00421e1c
or eax, eax
jne 0x4205c7
mov dword [esi + 0x2b], 0
xor esi, esi
jmp 0x4205d3
mov dword [esi + 0x37], 1
mov esi, 1
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x423054
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x423063
test al, 0x10
jne 0x423066
xor eax, eax
ret
mov al, 1
ret

Function at 0x423088
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x423097
test al, 0x10
je 0x42309a
xor eax, eax
ret
mov al, 1
ret

Function at 0x4231a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
push 0x40
push 0x12
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], 0x5024048b
mov byte [ebx + 4], 0xb8
lea eax, [ebx + 9]
mov dword [eax], 0x4244489
mov byte [ebx + 0xd], 0xe9
lea eax, [ebx + 5]
mov dword [eax], esi
sub edi, ebx
sub edi, 0x12
lea eax, [ebx + 0xe]
mov dword [eax], edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42359c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x423606
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004055c0
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00423588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42360d
lea eax, [ebp - 0x10c]
call fcn.004053c8
ret
Function at 0x423614
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42367e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004055c0
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00423588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423685
lea eax, [ebp - 0x10c]
call fcn.004053c8
ret

Function at 0x42368c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4236bc
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x42369a
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x4236d8
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4237b6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042583c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x423799
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00423088
test al, al
je 0x42372d
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
push eax
mov ecx, edi
mov edx, dword [0x6387f8]
mov eax, dword [ebp - 8]
call fcn.00425934
mov eax, dword [ebp - 8]
call fcn.004254a4
test eax, eax
jbe 0x42376d
mov eax, dword [ebp - 8]
call fcn.004254a4
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.004055c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.004254c8
test esi, esi
je 0x423783
mov eax, ebx
call fcn.00423088
test al, al
je 0x423783
push esi
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4237a0
mov eax, dword [ebp - 8]
call fcn.00423fcc
ret