joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f813957
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x5f8138ea
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x5f813908
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x5f813966
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and byte [ecx + 0x1065], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x5f81394d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x5f813956
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x5f813960
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x5f813942
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x5f8138cc
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x5f8139b3
dec eax
je 0x5f8139aa
sub eax, 3
je 0x5f8139a1
mov dword [ebp - 4], 0x40
jmp 0x5f8139d0
mov dword [ebp - 4], 4
jmp 0x5f8139b6
mov dword [ebp - 4], 0x20
jmp 0x5f8139b6
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x5f813a02
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x5f813982
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.5f813213
dec edx
sbb byte [ebx], al
into
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x5f813a0e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5f8153c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x5f8153d7
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.5f813213
xchg bl, dh
jp 0x5f8153f0
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
dec edx
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.5f813213
in eax, dx
lodsb al, byte [esi]
or eax, 0x348b497b
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x5f815400
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x5f815400
call fcn.5f813213
pop es
push ss
ljmp 0xdf03
Function at 0x5f815d02
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ecx], edi
mov ecx, dword [ebp + 0x10]
push ebx
push eax
mov dword [ecx], edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x5f815d5f
call fcn.5f814d33
mov esi, eax
mov ecx, dword [0x5f831160]
cmp ecx, 0x5f831160
je 0x5f815d58
test byte [ecx + 0x1c], 1
je 0x5f815d58
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x11
mov edx, 0x5f80885c
pop ecx
call fcn.5f80a336
mov eax, esi
jmp 0x5f815e73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x5f815d92
call fcn.5f814d33
mov esi, eax
mov ecx, dword [0x5f831160]
cmp ecx, 0x5f831160
je 0x5f815d58
test byte [ecx + 0x1c], 1
je 0x5f815d58
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x12
jmp 0x5f815d4d
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x5f815dc6
call fcn.5f814d33
mov esi, eax
mov ecx, dword [0x5f831160]
cmp ecx, 0x5f831160
je 0x5f815d58
test byte [ecx + 0x1c], 1
je 0x5f815d58
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x13
jmp 0x5f815d4d
lea ecx, [eax + esi]
cmp esi, ecx
jbe 0x5f815df0
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f815e5d
test byte [eax + 0x1c], 1
je 0x5f815e5d
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
jmp 0x5f815e52
mov edx, dword [ebp + 8]
and edx, 0xf
jbe 0x5f815e0a
cmp esi, ecx
jae 0x5f815e0e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
inc edi
cmp edi, edx
jb 0x5f815df8
cmp esi, ecx
jb 0x5f815e2d
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f815e5d
test byte [eax + 0x1c], 1
je 0x5f815e5d
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
jmp 0x5f815e52
movzx eax, word [esi]
test ax, ax
jne 0x5f815e64
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f815e5d
test byte [eax + 0x1c], 2
je 0x5f815e5d
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
mov edx, 0x5f80885c
pop ecx
call fcn.5f80a336
mov eax, 0x80070714
jmp 0x5f815e73
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
lea eax, [esi + 2]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x5f8231ab
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x5f8231e8
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x5f8231e1
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x5f8231ed
add edx, 0x28
cmp edx, esi
jne 0x5f8231d2
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x5f8231ea
Function at 0x5f826105
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5f8069d4
push 0x5f8069cc
push 0x5f805580
push 0
call fcn.5f826083
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5f82613a
push dword [ebp + 8]
mov ecx, esi
call dword [0x5f833194]
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x5f82617f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5f8069e4
push 0x5f8069dc
push 0x5f8055a4
push 2
call fcn.5f826083
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x5f8261b3
mov ecx, esi
call dword [0x5f833194]
call esi
jmp 0x5f8261b9
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x5f8261bc
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5f8069ec
push 0x5f8069e4
push 0x5f8055b8
push 3
call fcn.5f826083
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x5f8261f3
mov ecx, esi
call dword [0x5f833194]
call esi
jmp 0x5f8261f9
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x5f82e320
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5f82e35e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5f82e356
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5f82e360
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5f82e346
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5f82e430
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5f82e461
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5f82e461
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5f82e461
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405b70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4e8ff8], 0
push ebx
push esi
push edi
jne 0x405bdd
push 0x10
call fcn.00493133
mov esi, eax
add esp, 4
mov dword [ebp - 8], esi
mov dword [0x4e8ff8], esi
push 0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [esi + 4], 0
jne 0x405bdd
push 0
mov dword [esi + 8], fcn.004199b0
mov dword [esi + 0xc], 0x419a00
call fcn.004199b0
add esp, 4
mov dword [esi + 4], eax
mov dword [ebp - 4], 0x4e9000
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [0x4e9000]
mov ebx, esi
mov edi, dword [0x4e9004]
add ebx, 1
mov ecx, edi
mov dword [ebp - 8], edi
adc ecx, 0
mov eax, esi
mov edx, edi
mov edi, dword [ebp - 4]
lock cmpxchg8b qword [edi]
mov edi, dword [ebp - 8]
cmp eax, esi
jne 0x405bf0
cmp edx, edi
jne 0x405bf0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406c90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406d0f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret
Function at 0x406e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3d08
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00410ac0
cmp dword [eax + 0x14], 8
jb 0x406e97
mov eax, dword [eax]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [ebp - 0x14]
mov edi, eax
cmp ecx, 8
jb 0x406ebc
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00404770
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test edi, edi
jne 0x406ed8
xor bl, bl
jmp 0x406f38
push 0
push 0
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x406f31
mov esi, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test esi, esi
je 0x406f31
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406f31
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x406f28
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x406f4d
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00403e20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret
Function at 0x406f70
Capabilities:
Hide graphical window
Log keystrokes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3d38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00410ac0
cmp dword [eax + 0x14], 8
jb 0x406fb5
mov eax, dword [eax]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, 8
jb 0x406fda
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00404770
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test esi, esi
je 0x407100
push eax
push eax
push eax
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4070f9
mov ecx, dword [eax + 4]
mov ebx, dword [eax + 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x4070b0
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4070b0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push esi
push ebx
call edi
mov esi, dword [ebp - 0x2c]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
call esi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebp - 0x2c]
call esi
mov esi, dword [ebp - 0x2c]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp - 0x30]
push ebx
call edi
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov bl, 1
jmp 0x407102
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x4070c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebx + 3]
cmp ecx, eax
jb 0x4070c8
mov bl, 1
jmp 0x407102
test edi, edi
je 0x4070f9
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x407100
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4070f9
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x407117
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00403e20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret
Function at 0x4071a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3dae
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
mov dword [ebp - 4], 1
call fcn.00493133
mov edi, eax
lea eax, [ebp - 0x84]
push 0x40
push 0
push eax
mov dword [edi + 8], 1
mov dword [edi + 4], 0
mov dword [edi], 0xc
mov dword [ebp - 0x88], 0x44
call fcn.00498020
mov eax, 1
mov dword [ebp - 0x5c], 1
push 0x4c95c8
lea edx, [ebp + 8]
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x40]
call fcn.0040a8a0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.0040a9b0
add esp, 0x18
mov esi, eax
lea eax, [ebp + 0x20]
cmp eax, esi
je 0x407279
mov eax, dword [ebp + 0x34]
cmp eax, 0x10
jb 0x40725e
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00403e20
push esi
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x34], 0xf
mov dword [ebp + 0x30], 0
mov byte [ebp + 0x20], 0
call fcn.00403cc0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x40728e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403e20
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x4072b5
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403e20
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
push 0x20
push 0
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xc
push edi
mov esi, eax
call fcn.004933d3
mov ecx, dword [ebp + 0x1c]
add esp, 8
cmp ecx, 0x10
jb 0x407304
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00403e20
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
cmp eax, 0x10
jb 0x40732b
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00403e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret
Function at 0x407e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, dword [0x4e8ff4]
cmp dword [esi + 0x5c], 0
je 0x407f01
add esi, 0x4c
cmp dword [esi + 0x14], 0x10
jb 0x407ea0
mov eax, dword [esi]
jmp 0x407ea2
mov eax, esi
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x407f01
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x400
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], str.Open
mov dword [ebp - 0x30], str.iexplore.exe
jb 0x407ee6
mov esi, dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b0a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40b0b9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40b0f6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40b0f2
nop word [eax + eax]
cmp esi, edx
jae 0x40b0f6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40b0e0
cmp esi, edx
jb 0x40b0fd
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40b470
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b43f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp edx, 0x7e9
jne 0x40b571
cmp eax, 3
jne 0x40b534
mov ecx, dword [esi + 0x850]
test ecx, ecx
je 0x40b4e3
cmp edi, dword [ecx + 0xc5c]
je 0x40b4e3
cmp edi, dword [ecx + 0xc58]
jl 0x40b4e3
cmp edi, dword [ecx + 0xc54]
jg 0x40b4e3
mov dword [ecx + 0xc5c], edi
call fcn.00441240
cmp dword [esi + 0x838], 0
je 0x40b5a5
lea ecx, [ebp - 0x30]
call fcn.0040c5d0
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push str._d__
push eax
call fcn.0040ca40
mov ecx, dword [esi + 0x838]
add esp, 0xc
mov eax, dword [ecx]
push 0
push 0
push dword [ebp - 0x30]
call dword [eax + 0x34]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c4e0
jmp 0x40b5a5
cmp eax, 1
jne 0x40b5a5
cmp edi, eax
je 0x40b55b
push 0
push 0x4c9b64
push 0x4c9b6c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
jmp 0x40b5a5
mov ecx, dword [esi + 0x86c]
test ecx, ecx
je 0x40b5a5
mov eax, dword [ecx]
push 2
call dword [eax + 0x250]
jmp 0x40b5a5
cmp edx, 0x112
jne 0x40b5a5
push eax
xorps xmm0, xmm0
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
movq qword [ebp - 0x1b], xmm0
push 0x4c9b90
push eax
movups xmmword [ebp - 0x2b], xmm0
call fcn.0040ca60
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0041b010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40cca0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x14], ecx
mov eax, edx
xor bl, bl
push edi
mov dword [ebp - 0xc], eax
cmp dword [ecx + 0x10], esi
je 0x40cdce
cmp dword [eax + 0x10], esi
je 0x40cdce
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.00403500
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 4], eax
test eax, eax
je 0x40cdce
push 0x4e8100
push eax
call fcn.0049364a
mov edi, eax
add esp, 8
test edi, edi
je 0x40cdce
mov ecx, dword [ebp - 0xc]
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00403500
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x40cdb8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x40cdb8
mov eax, dword [ebp - 0x10]
push 0x4e8100
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0xc], ecx
call fcn.0049364a
mov esi, eax
add esp, 8
test esi, esi
je 0x40cdb8
mov ecx, dword [ebp - 0x14]
call fcn.00403500
push eax
push dword [ebp - 0xc]
push str.StringFileInfo_08lx_s
push 0x80
push esi
call fcn.004064d0
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x40cdb6
mov edx, dword [ebp - 0x1c]
cmp byte [edx], bl
jne 0x40cd9e
xor ecx, ecx
jmp 0x40cdac
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cda3
sub ecx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00403a90
mov bl, 1
push edi
call fcn.00493645
add esp, 4
test esi, esi
je 0x40cdce
push esi
call fcn.00493645
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret