joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b9f0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0x20
mov dword [0x101f8958], 0x1368
mov dword [0x101f8954], 0xc38
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
call fcn.1000b520
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1000b840
mov dword [0x101f8958], 0x107
cmp eax, 0
mov dword [ebp - 0x34], eax
je 0x1000bb33
mov eax, dword [ebp - 0x34]
mov dword [0x101f8954], 0x193b
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101f8954], 0xd99
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.1000af60
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x101f8958], 0x18f5
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x38], ecx
mov dword [0x101f8954], 0xfffff5d7
add ecx, 0x1863
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x1000bb2a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x1000bf30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov eax, dword [0x101f8958]
lea ecx, [esi + 0x28]
mov edx, 0x10
mov dword [esi + 0x24], eax
mov eax, edx
mov dword [esi + 0x20], ecx
call fcn.1000a1e0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, dword [esi + 0x24]
add ecx, 0x1e5a
mov dword [0x101f8954], ecx
sub esp, 4
mov dword [esp], eax
mov dword [esi + 0x1c], eax
call fcn.1000bb70
add esp, 4
lea ecx, [0x1000acd0]
mov edx, dword [esi + 0x1c]
mov edi, dword [edx]
mov dword [esi + 0x58], edi
mov dword [esi + 0x38], 0x146200
mov edi, dword [0x101f8940]
mov dword [esi + 0x30], edi
mov edi, dword [0x101f8944]
mov dword [esi + 0x74], edi
mov dword [0x101f8954], 0xfffffbfd
mov edi, dword [0x101f8948]
mov dword [esi + 0x5c], edi
mov edi, dword [0x101f894c]
mov dword [esi + 0x78], edi
mov edi, dword [0x101f8950]
mov dword [esi + 0x3c], edi
mov dword [0x101f8958], 0x2687
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ecx
mov eax, dword [esi + 0x14]
cmp word [eax], 0x5a4d
mov dword [esi + 0x10], eax
jne 0x1000bfff
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esi + 0xc], eax
mov dword [esi + 8], ecx
je 0x1000c017
mov eax, dword [esi + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x14], eax
jmp 0x1000bfdd
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov dword [esi + 0x54], eax
mov dword [0x101f8958], 0x159f
mov eax, dword [eax + ecx + 0x50]
mov dword [esi + 0x44], eax
mov dword [0x101f8954], 0x983
call fcn.1000a5c0
xor ecx, ecx
cmp eax, 0
mov dword [esi], ecx
jne 0x1000c09f
lea eax, [esi + 0x28]
mov ecx, dword [0x101f8954]
add ecx, 0x159
mov dword [0x101f8954], ecx
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx + 8]
push edx
push eax
call fcn.1000b9f0
add esp, 8
mov dword [0x101f8954], 0x1656
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x28]
mov dword [ecx], edx
call eax
mov eax, 2
mov ecx, dword [0x101f8954]
add ecx, 0xfffff4f5
mov dword [0x101f8954], ecx
mov dword [esi], eax
mov eax, dword [esi]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x663200], al
mov byte [0xa656e4], al
mov eax, 0xd7b0
push esi
mov dword [0x663218], ecx
mov word [0xa6573c], ax
mov word [0xa6573e], ax
mov word [0x663614], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x663248], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b665
call esi
cmp al, 4
ja 0x44b66b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x663244], eax
pop esi
ret

Function at 0x64a84c
Capabilities:
Encode data using xor

Disassembly:
fst st(5)
and edx, ebx
cmc
mov dl, 0
xchg ebx, eax
xchg ebx, eax
shr esp, 1
cld
repe cmpsd dword [esi], dword es:[edi]
mov byte [0x4331d359], al
div dword [ebx]
jbe 0x64a7db
add al, 0x53
or dword [ebx], esi
rcl byte [esi - 0x3e], cl
dec esp
lodsd eax, dword [esi]
neg dword [eax]
mov byte [edi], 0xa1
test ebx, esp
xchg ebp, eax
xchg edx, eax
test dword [ecx - 0x4d1e4067], esp
mov eax, dword [0xb2e1bf99]
xchg ebp, eax
sub ecx, eax
sbb esi, dword [edx + 0x46]
jge 0x64a7b1
rcl dword [ebx], 3
push ebx
in eax, 0x5e
xor edx, 0x55
mov dl, 5
xor dh, byte [esi - 0x2d931b5c]
cld
in al, dx
loopne 0x64a7f1
mov bl, 0x94
xchg ebx, eax
bound ebp, qword [edx + 0x7c]
and byte [ebp + 0x45], dh
jne 0x64a84b
push es
pop edi
inc esi
invalid
xor dword [ecx + 0x52], ebx
wait
fild word [edx]
retf 0x271d
add esi, dword [ebx]
push 0xc9b1b4e5
xor ebp, dword [eax - 0x1b]
mov ah, 0xb1
leave
mov bl, 0x2b
sbb dh, byte [ecx + 0x3b]
les edx, [ebp + 0x39]
mov bh, 0xb4
aaa
jne 0x64a804
jne 0x64a7e6
inc esp
inc edx
mov ch, 0x74
das
dec ecx
rol ah, cl
pop edi
cmc
push ebp
xor eax, 0x150ad1d0
inc ebp
js 0x64a80b
pop eax
int 0x96
mov ebx, 0xb5a501de
inc ebx
invalid
Function at 0x410000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x461e05]
shl eax, 2
mov dword [0x461e09], eax
push edi
push ecx
xor eax, eax
mov edi, section.TLSCBA_1
mov ecx, 0x461dac
cmp ecx, edi
jbe 0x410024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov eax, dword [edx - 8]
mov dword [0x461e0d], eax
mov eax, dword [edx - 4]
mov dword [0x461e11], eax
sub edx, 4
mov dword [0x461910], edx
sub edx, 4
cmp edx, esp
jae 0x41004e
mov esp, edx
push 0
call fcn.004262a7
pop ecx
push 0x461dd8
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x461e16], eax
push 0
jmp fcn.0042bc94

Function at 0x415ee1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp word [ebx + 0x14], 0xffff
je 0x415f4e
mov eax, dword [ebx + 0x14]
shr eax, 0x10
test ax, 0xffff
je 0x415f07
push dword [ebx + 0x14]
call fcn.0042af04
pop ecx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
test esi, esi
jge 0x415f29
push 0
push 0x4687ea
call fcn.00423e4b
add esp, 8
mov dword [ebx + 0x14], eax
jmp 0x415f4e
lea eax, [esi + 1]
push eax
call fcn.0042b054
pop ecx
mov edi, eax
mov dword [ebx + 0x14], edi
mov byte [edi], 0
mov byte [edi + esi], 0
lea eax, [esi + 1]
mov edx, edi
push eax
push edx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextA
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x418f63
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, 0x469605
call fcn.00426190
cmp esi, dword [0x468a80]
jne 0x418f95
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41911a
push 0
push edi
call fcn.00414cfb
add esp, 8
mov dword [ebp - 0x28], eax
push 0
push 0x4196b5
push 0x4236fd
cmp dword [ebp - 0x28], 0
je 0x418fbd
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
jmp 0x418fbf
xor eax, eax
push eax
push dword [ebp - 0x28]
call fcn.00426034
add esp, 0x14
mov ebx, eax
mov eax, dword [0x4694d0]
test eax, eax
je 0x418ffd
test ebx, ebx
jne 0x418ffd
cmp esi, 0x1f
je 0x418ffd
cmp esi, 0xa
je 0x418ffd
mov edx, dword [eax]
mov dword [edx + 0x10], edi
push edx
call fcn.0041404e
pop ecx
mov ebx, dword [0x4694d0]
xor eax, eax
mov dword [0x4694d0], eax
test ebx, ebx
jne 0x419012
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41911a
cmp byte [0x469580], 0
jne 0x41904a
inc byte [0x469580]
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x419040
call sub.KERNEL32.dll_GetVersion
and eax, 0xff
cmp eax, 4
jae 0x419040
xor eax, eax
jmp 0x419045
mov eax, 1
mov dword [0x46957c], eax
cmp dword [0x46957c], 0
je 0x419073
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
mov eax, dword [ebx + 0xc]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41911a
mov word [ebp - 0x14], 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
mov eax, dword [ebx + 0xc]
call dword [eax + 4]
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x41911a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4193f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push dword [ebx + 0x10]
mov eax, dword [ebx]
push dword [eax + 0x10]
push 0x7ff8
push eax
call fcn.00415d04
add esp, 0x10
test eax, eax
je 0x419423
test eax, eax
setg al
and eax, 1
jmp 0x4194dc
mov esi, 1
cmp dword [ebx + 0x10], 0
je 0x4194da
mov edi, dword [ebx + 0x10]
mov dword [ebp - 4], edi
push 0xf0
push dword [ebp - 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x6c]
push dword [eax + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x4194da
mov dword [ebp - 8], edi
push dword [ebp - 8]
mov eax, dword [ebx]
mov eax, dword [eax + 0x6c]
push dword [eax + 0xc]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x4194da
push eax
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x4194cf
jmp 0x4194c6
mov ax, word [edi]
add edi, 2
mov word [ebp - 0xa], ax
mov ax, word [edi]
add edi, 2
mov word [ebp - 0xc], ax
mov eax, dword [edi]
add edi, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x18], eax
movzx eax, word [ebp - 0xa]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov eax, dword [ebx]
push dword [eax + 0x10]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
jne 0x4194c3
xor esi, esi
add edi, dword [ebp - 0x10]
test esi, esi
je 0x4194cf
cmp byte [edi], 0
jne 0x41947c
mov eax, dword [ebx]
push dword [eax + 0x68]
call fcn.00417597
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4198ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, 0x469804
call fcn.00426190
cmp dword [ebx + 8], 0
jne 0x4198e8
mov al, byte [ebx + 0x1e]
shl eax, 0x1e
sar eax, 0x1f
je 0x4198de
push dword [ebx]
call sub.KERNEL32.dll_LockResource
mov dword [ebx + 8], eax
jmp 0x4198e8
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
cmp dword [eax], 0xc
jne 0x4198f6
or byte [ebx + 0x1e], 1
jmp 0x419944
mov eax, dword [ebx + 8]
cmp dword [eax], 0x28
jne 0x419904
and byte [ebx + 0x1e], 0xfe
jmp 0x419944
push dword [ebx]
call sub.KERNEL32.dll_GlobalUnlock
push 0
push 0
push 0
push 1
push 0x41a30c
push 0
mov word [ebp - 0x1c], 8
push 0
push 0x7fdc
lea eax, [ebp - 0xc]
push eax
call fcn.004120b5
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x41a2b4
call fcn.00424f60
add esp, 0x20
mov al, byte [ebx + 0x1e]
shl eax, 0x1f
sar eax, 0x1f
je 0x41997b
mov eax, dword [ebx + 8]
mov ax, word [eax + 0xa]
push eax
call fcn.00410878
pop ecx
mov esi, eax
mov dword [ebx + 0x10], esi
lea eax, [esi + esi*2]
mov edx, dword [ebx + 8]
movzx edx, word [edx + 4]
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 8]
movzx edx, word [edx + 6]
mov dword [ebx + 0x18], edx
jmp 0x4199a5
mov eax, dword [ebx + 8]
mov ax, word [eax + 0xe]
push eax
call fcn.00410878
pop ecx
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, esi
shl eax, 2
mov edx, dword [ebx + 8]
mov edx, dword [edx + 4]
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 8]
mov edx, dword [edx + 8]
mov dword [ebx + 0x18], edx
mov edx, dword [ebx + 8]
add eax, dword [edx]
add eax, edx
mov dword [ebx + 0xc], eax
mov word [ebx + 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a135
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x469870
call fcn.00426190
push 2
push dword [ebp + 0x10]
push edi
call sub.KERNEL32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x41a16a
push esi
push edi
call sub.KERNEL32.dll_LoadResource
mov dword [ebx], eax
jmp 0x41a16e
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x41a184
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x41a214
or byte [ebx + 0x1e], 2
push ebx
call fcn.004198ac
pop ecx
push esi
push edi
call sub.KERNEL32.dll_SizeofResource
mov edi, eax
push edi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
test esi, esi
jne 0x41a1d6
push 0
push 0
push 0
push 1
push 0x41a273
push 0
mov word [ebp - 0x1c], 8
lea eax, [ebp - 0xc]
push eax
call fcn.00411bcd
pop ecx
lea eax, [ebp - 0xc]
push eax
push 0x41a21b
call fcn.00424f60
add esp, 0x20
push esi
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0x30], eax
mov eax, edi
mov edx, dword [ebx + 8]
mov edi, dword [ebp - 0x30]
push eax
push edx
push edi
call fcn.00424230
add esp, 0xc
mov dword [ebx], esi
mov eax, dword [ebp - 0x30]
mov dword [ebx + 8], eax
and byte [ebx + 0x1e], 0xfd
push ebx
call fcn.004198ac
pop ecx
mov eax, 1
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ac2a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff0
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowLongA
test al, 4
je 0x41ac50
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
je 0x41ac7a
test esi, esi
jne 0x41ac5f
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
inc esi
push esi
call fcn.0042b054
pop ecx
mov edi, eax
mov eax, esi
mov edx, edi
push eax
push edx
push dword [ebx + 0x10]
call sub.USER32.dll_GetWindowTextA
mov eax, edi
jmp 0x41aca7
push 0
push 0
push 0xbd
push ebx
call fcn.00414b38
add esp, 0x10
test esi, esi
je 0x41aca1
push 0x42
push esi
push eax
call sub.KERNEL32.dll_LocalReAlloc
test eax, eax
jne 0x41aca1
xor eax, eax
jmp 0x41aca7
push eax
call sub.KERNEL32.dll_LocalLock
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4220b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
shr eax, 4
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 6
push dword [ebp - 0xc]
push dword [esi + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x422165
mov dword [ebp - 0x10], edi
push dword [ebp - 0x10]
push dword [esi + 0xc]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 4], eax
test eax, eax
je 0x422165
push dword [ebp - 4]
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x422155
mov eax, dword [ebp + 0xc]
and eax, 0xf
jmp 0x422116
add ebx, ebx
add edi, ebx
mov bx, word [edi]
add edi, 2
movzx ebx, bx
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x422112
test ebx, ebx
je 0x422155
cmp ebx, dword [ebp + 0x14]
jb 0x422135
mov ebx, dword [ebp + 0x14]
dec ebx
mov eax, ebx
jmp 0x422146
mov dl, byte [edi]
add edi, 2
mov ecx, dword [ebp + 0x10]
inc dword [ebp + 0x10]
mov byte [ecx], dl
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x422139
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push dword [ebp - 4]
call sub.KERNEL32.dll_FreeResource
test ebx, ebx
je 0x422165
mov eax, ebx
jmp 0x422190
mov eax, dword [0x46ae00]
cmp esi, eax
je 0x422182
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.004220b6
add esp, 0x10
jmp 0x422190
cmp dword [ebp + 0x14], 0
je 0x42218e
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422197
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, 0x46aa31
call fcn.00426190
xor ebx, ebx
mov word [ebp - 0x14], 8
lea eax, [ebp - 4]
push eax
call fcn.0042c1a4
pop ecx
mov eax, dword [ebp + 0x10]
shr eax, 4
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 6
push dword [ebp - 0x30]
push dword [esi + 0xc]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x4222bb
mov dword [ebp - 0x34], edi
push dword [ebp - 0x34]
push dword [esi + 0xc]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4222bb
push dword [ebp - 0x28]
call sub.KERNEL32.dll_LockResource
mov edi, eax
test edi, edi
je 0x422275
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x38], eax
jmp 0x42221c
add ebx, ebx
add edi, ebx
mov bx, word [edi]
add edi, 2
movzx ebx, bx
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x38], 0xffffffff
test eax, eax
jne 0x422218
test ebx, ebx
je 0x422275
push ebx
lea eax, [ebp - 4]
push eax
call fcn.0042c428
add esp, 8
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
jmp 0x42226a
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
lea eax, [ebp - 4]
push eax
call fcn.0042c3e0
add esp, 8
mov dl, byte [edi]
add edi, 2
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x38], 0xffffffff
test eax, eax
jne 0x42224b
push dword [ebp - 0x28]
call sub.KERNEL32.dll_FreeResource
test ebx, ebx
je 0x4222bb
mov word [ebp - 0x14], 0x14
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0042c218
add esp, 8
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], 0x20
push eax
push 2
lea eax, [ebp - 4]
push eax
call fcn.0042c478
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x422337
mov ebx, dword [0x46ae00]
cmp esi, ebx
je 0x4222ff
mov word [ebp - 0x14], 0x2c
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.00422197
add esp, 0xc
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], 0x38
push eax
push 2
lea eax, [ebp - 4]
push eax
call fcn.0042c478
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x422337
mov word [ebp - 0x14], 0x44
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0042c218
add esp, 8
mov eax, dword [ebp + 8]
mov word [ebp - 0x14], 0x50
push eax
push 2
lea eax, [ebp - 4]
push eax
call fcn.0042c478
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4286c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4286dc
call fcn.00428e58
jmp 0x4286fd
test byte [ebp + 0xc], 0x80
jne 0x4286e7
or ebx, 1
jmp 0x4286ea
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.dll_SetFileAttributesA
dec eax
je 0x4286fb
call fcn.00428e58
jmp 0x4286fd
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x428798
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
cmp dword [ebx + 4], 0xffffffff
jne 0x4287cf
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x4287df
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4287ed
call fcn.00428e38
jmp 0x42886d
test byte [ebx + 8], 8
je 0x4287fc
test byte [ebp - 0x148], 8
jne 0x428810
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x428810
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x4287a9
mov eax, dword [ebp - 0x148]
mov dword [esi + 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x134]
push eax
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0xe]
push eax
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov eax, dword [ebp - 0x128]
mov dword [esi + 4], eax
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428874
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x4288a3
movsx eax, byte [ebp - 0x104]
add eax, 0xffffffa0
jmp 0x4288ad
movsx eax, byte [ebp - 0x104]
add eax, 0xffffffc0
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret

Function at 0x4288b8
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov al, byte [ebp + 8]
add al, 0x40
mov byte [ebp - 3], al
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x42891d
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x42891d
call fcn.00428e58
jmp 0x428958
push edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x42892d
call fcn.00428e58
jmp 0x428958
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x428953
push edi
call sub.KERNEL32.dll_GetDriveTypeA
mov ebx, eax
test ebx, ebx
je 0x428951
cmp ebx, 1
je 0x428951
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x42893e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret