joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1f8c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2142
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1d8]
movzx eax, byte [eax + 0x21]
test al, al
je 0x4c2127
cmp al, 1
jne 0x4c2072
mov eax, dword [ebx + 0x284]
call fcn.004046f4
xor eax, eax
mov dword [ebx + 0x284], eax
mov eax, ebx
call fcn.004c1eb4
lea ecx, [ebx + 0x2a8]
mov edx, dword [ebx + 0x12c]
add edx, 2
mov eax, ebx
call fcn.004b7fd0
cmp dword [ebx + 0x2a8], 0
jne 0x4c2018
lea edx, [ebp - 8]
mov eax, 0xbb
call fcn.0040d288
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4b4a68]
call fcn.0041194c
call fcn.00404fa8
inc dword [ebx + 0x12c]
mov eax, dword [ebx + 0x2a8]
call fcn.0040d3dc
test al, al
je 0x4c203e
mov eax, dword [ebx + 0x2a8]
call fcn.00405ad8
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp word [ebx + 0x232], 0
je 0x4c205d
mov ecx, dword [ebx + 0x12c]
inc ecx
mov edx, ebx
mov eax, dword [ebx + 0x234]
call dword [ebx + 0x230]
mov eax, ebx
call fcn.004c1df0
mov dword [ebx + 0x260], eax
mov dword [ebx + 0x264], edx
jmp 0x4c20da
mov eax, dword [ebx + 0x284]
call fcn.004046f4
xor eax, eax
mov dword [ebx + 0x284], eax
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2a8]
call fcn.004056d0
lea eax, [ebx + 0x2a8]
mov edx, dword [ebx + 0x1a8]
call fcn.0040568c
push 1
mov ecx, dword [ebx + 0x12c]
add ecx, 2
lea edx, [ebx + 0x2a8]
mov eax, ebx
call fcn.004b8160
inc dword [ebx + 0x12c]
mov eax, dword [ebx + 0x1d8]
mov edx, dword [eax + 8]
mov dword [ebx + 0x260], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x264], edx
push 0xffff
movzx eax, byte [ebx + 0x105]
push eax
mov eax, dword [ebx + 0x108]
push eax
mov ecx, dword [ebx + 0x2a8]
mov dl, 1
mov eax, dword [0x4a6b5c]
call fcn.004a6cd4
mov dword [ebx + 0x284], eax
mov dword [ebx + 0x258], 0
mov dword [ebx + 0x25c], 0
xor edx, edx
mov eax, dword [ebx + 0x2a0]
call fcn.004aa4a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2149
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040565c
ret
Function at 0x4c3e54
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1e0], 0
je 0x4c3e78
mov eax, dword [ebx + 0x1e0]
call fcn.004a7b54
test al, al
jne 0x4c3e8e
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.004a7edc
jmp 0x4c3e9b
mov eax, esi
mov edx, dword [ebx + 0x1e0]
call fcn.0040568c
add esp, 0x130
pop esi
pop ebx
ret

Function at 0x4c4e44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4c4e4c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c4ff3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
mov dl, 1
mov eax, dword [0x41f898]
call fcn.004046c4
mov dword [ebp - 0x10], eax
movzx edx, byte [esi + 0x40]
mov ecx, dword [ebp - 0x10]
mov eax, esi
call fcn.004c4d84
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4c4f68
inc ebx
mov dword [ebp - 0xc], 0
xor eax, eax
push ebp
push 0x4c4f49
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [esi + 0x10]
add edx, 0x66
call fcn.004058ac
mov eax, dword [ebp - 0x18]
call fcn.0040d424
test al, al
jne 0x4c4ee4
lea eax, [ebp - 0x1c]
mov edx, dword [esi + 0x10]
add edx, 0x66
call fcn.004058ac
mov eax, dword [ebp - 0x1c]
call fcn.0040d448
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040d93c
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
mov edx, dword [esi + 0x10]
add edx, 0x66
call fcn.004058ac
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
pop ecx
call fcn.00405960
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.004c4da0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c4f5e
inc dword [ebp - 0xc]
dec ebx
jne 0x4c4ea6
cmp byte [ebp - 0x11], 0
je 0x4c4fbb
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4c4fb3
inc ebx
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
call fcn.00405ad8
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
inc dword [ebp - 0xc]
dec ebx
jne 0x4c4f85
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 0x10]
call fcn.004046f4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4ffa
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.0040565c
lea eax, [ebp - 4]
call fcn.00405638
ret
Function at 0x4c5004
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4c5082
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4c5064
inc ebx
xor esi, esi
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.00405ad8
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
inc esi
dec ebx
jne 0x4c5039
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5089
lea eax, [ebp - 0xc]
call fcn.00405638
ret

Function at 0x4eae53
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4eaeab
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4eaea1
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4eaeaf
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4075c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4075d3
xor al, al
pop esi
pop ebp
ret 4
push 0
push 0
push 0
push 0
mov byte [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x407680
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
push 0
push 0
mov dword [esi], eax
call fcn.0049b0d3
add esp, 0x18
mov dword [esi + 4], eax
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x407610
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x407649
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x407639
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x407659
mov eax, dword [ecx]
call dword [eax]
mov dword [esi], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40766e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop esi
pop ebp
ret 4

Function at 0x4079f0
Capabilities:
Move file

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x407a00
mov eax, dword [edi]
jmp 0x407a02
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x407a0a
mov ecx, dword [esi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x407a1d
pop edi
mov al, 1
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [edi + 0x14], 8
jb 0x407a2b
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x407a33
mov esi, dword [esi]
push eax
push 3
push edi
push esi
push str.move_file_from____s___to____s___flag___d_failed__error___d.
push 0xbe
push str.utility::ufile::moveFile
call fcn.0040ba80
add esp, 0x1c
xor al, al
pop edi
pop esi
ret
Function at 0x4085d0
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x4085f3
mov eax, dword [edi]
jmp 0x4085f5
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x4085fd
mov ecx, dword [esi]
push 0
push 1
push eax
push ecx
push str.shell_filename____s___param____s___runas___d__show___d
push 0xb
push str.utility::process::shell
call fcn.0040ba80
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004a6740
add esp, 0x28
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40865c
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov eax, str.runas
mov ecx, str.open
cmovb eax, ecx
cmp dword [edi + 0x14], 8
jb 0x408678
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x408680
mov esi, dword [esi]
push 0
push 0
push edi
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
cmp eax, 0x20
jg 0x4086c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.shellEx_failed____lastError___d
push 0x18
push str.utility::process::shell
call fcn.0040ba80
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret
Function at 0x4087e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cef6e
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x40881b
mov eax, dword [esi]
jmp 0x40881d
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x408825
mov ecx, dword [edi]
push 0
push eax
push ecx
push str.createProcess_filename____s___param____s___show___d
push 0xea
push str.utility::process::create
call fcn.0040ba80
push edi
mov edx, 0x4f1e94
lea ecx, [ebp - 0x98]
call fcn.004089b0
push 0x4f1e94
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407f60
add esp, 0x20
mov byte [ebp - 4], 2
cmp dword [ebp - 0x84], 8
jb 0x408882
push dword [ebp - 0x98]
call fcn.0048d9a0
add esp, 4
xor eax, eax
mov dword [ebp - 0x84], 7
mov dword [ebp - 0x88], 0
mov word [ebp - 0x98], ax
cmp dword [esi + 0x10], eax
je 0x4088e4
push esi
mov edx, 0x4f1e98
lea ecx, [ebp - 0xb0]
call fcn.004089b0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00408420
mov byte [ebp - 4], 2
cmp dword [ebp - 0x9c], 8
jb 0x4088e4
push dword [ebp - 0xb0]
call fcn.0048d9a0
add esp, 4
push 0x40
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004a6740
add esp, 0xc
mov dword [ebp - 0x80], 0x44
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x14], 8
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x50], eax
push ecx
push 0
push 0
push 0x10
push 0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x54], 1
movdqu xmmword [ebp - 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x408975
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.createProcess_failed____lastError___d
push 0xfd
push str.utility::process::create
call fcn.0040ba80
add esp, 0x10
xor esi, esi
jmp 0x408981
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x38]
cmp dword [ebp - 0x14], 8
jb 0x408992
push dword [ebp - 0x28]
call fcn.0048d9a0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret

Function at 0x40b470
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004a6740
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40b4cb
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
setae al
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret
Function at 0x40b5f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x38
lea eax, [ebp - 0x3c]
mov esi, ecx
push 0
push eax
call fcn.004a6740
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x3c], 0x440
mov dword [ebp - 0x34], str.open
jb 0x40b632
mov eax, dword [esi]
jmp 0x40b634
mov eax, esi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40b66b
cmp dword [esi + 0x14], 8
jb 0x40b654
mov esi, dword [esi]
push 5
push 0
push esi
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret

Function at 0x40e080
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf560
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x26c], esi
cmp eax, 0x64
jne 0x40e0d6
mov eax, dword [esi + 8]
test eax, eax
je 0x40e0ea
push str._force_:_true_
jmp 0x40e0e6
test eax, eax
jne 0x40e0ea
mov eax, dword [esi + 8]
test eax, eax
je 0x40e0ea
push 0x4f1788
push 9
call eax
push dword [esi + 4]
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4f33c0
lea edx, [esi + 0xc]
mov dword [esi + 0x40], 7
lea ecx, [ebp - 0x284]
call fcn.00407e70
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x40e11f
mov eax, dword [eax]
lea ecx, [ebp - 0x268]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp dword [ebp - 0x270], 8
mov edi, eax
jb 0x40e146
push dword [ebp - 0x284]
call fcn.0048d9a0
add esp, 4
xor eax, eax
mov dword [ebp - 0x270], 7
mov dword [ebp - 0x274], 0
mov word [ebp - 0x284], ax
cmp edi, 0xffffffff
je 0x40e1c8
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, edi
lea eax, [ebp - 0x268]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40e1c8
cmp word [ebp - 0x23c], 0x2e
je 0x40e170
lea eax, [ebp - 0x23c]
push eax
lea edx, [esi + 0xc]
lea ecx, [ebp - 0x29c]
call fcn.00407e70
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x40e1ac
mov eax, dword [eax]
push eax
call ebx
cmp dword [ebp - 0x288], 8
jb 0x40e170
push dword [ebp - 0x29c]
call fcn.0048d9a0
add esp, 4
jmp 0x40e170
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
add esi, 0xc
cmp dword [esi + 0x14], 8
jb 0x40e1da
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
jmp 0x40e204
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret
Function at 0x40e630
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cf658
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5148c8]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5148c8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [esp + 0x30]
push eax
call fcn.0040e8c0
push 0
push 0x4f1788
mov dword [esp + 0x60], 0
push dword [esp + 0x48]
push ecx
lea ecx, [esp + 0x40]
call fcn.004059d0
test eax, eax
je 0x40e7af
push str.DotSetupSDK_
lea edx, [esp + 0x34]
lea ecx, [esp + 0x1c]
call fcn.00407e70
mov esi, eax
lea edi, [ebx + 0xc]
add esp, 4
cmp edi, esi
je 0x40e6e1
cmp dword [edi + 0x14], 8
jb 0x40e6c6
push dword [edi]
call fcn.0048d9a0
add esp, 4
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov ecx, edi
push esi
mov word [edi], ax
call fcn.004065e0
cmp dword [esp + 0x2c], 8
jb 0x40e6f4
push dword [esp + 0x18]
call fcn.0048d9a0
add esp, 4
push str..dll
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.00407e70
lea esi, [ebx + 0x24]
mov dword [esp + 0x18], eax
add esp, 4
cmp esi, eax
je 0x40e741
cmp dword [esi + 0x14], 8
jb 0x40e726
push dword [esi]
call fcn.0048d9a0
mov eax, dword [esp + 0x18]
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], cx
mov ecx, esi
push eax
call fcn.004065e0
cmp dword [esp + 0x2c], 8
jb 0x40e754
push dword [esp + 0x18]
call fcn.0048d9a0
add esp, 4
cmp dword [edi + 0x14], 8
jb 0x40e75c
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x40e76f
mov eax, dword [esi]
jmp 0x40e771
mov eax, esi
push eax
mov ecx, ebx
call fcn.0040e7f0
test al, al
je 0x40e7af
cmp dword [esi + 0x14], 8
jb 0x40e785
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
test eax, eax
je 0x40e7af
push 0x4f3440
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 8], eax
test eax, eax
jne 0x40e7e4
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor bl, bl
cmp dword [esp + 0x44], 8
jb 0x40e7c4
push dword [esp + 0x30]
call fcn.0048d9a0
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x40e7b1
Function at 0x40e7f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4f3448
push 0x8d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40e831
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret 4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e81d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40e86c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e881
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp - 8]
push eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret 4

Function at 0x40ed90
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1c8
mov eax, dword [0x5148c8]
xor eax, esp
mov dword [esp + 0x1c4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x40edea
push 0
push str.CoInitialize_error
push str.Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x38]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 0x18
xor ecx, ecx
mov eax, esp
sub esp, 0x18
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov word [eax], cx
mov ecx, esp
xor eax, eax
push eax
push 0x4f1788
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.004066b0
call fcn.00440ca0
mov dword [0x51d3a0], 0x443030
call fcn.0040bc10
push 0x4f3674
push str.downloader_start._version_is_:__s_
push 0xad
push str.wWinMain
call fcn.0040ba80
add esp, 0x40
push str.commoninit_end
push 0xaf
push str.wWinMain
call fcn.0040ba80
add esp, 8
mov ecx, esi
call fcn.0040ebb0
add esp, 4
push str.duilibInit2_end
push 0xb2
push str.wWinMain
call fcn.0040ba80
add esp, 0xc
call fcn.0040ec60
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
push edi
movdqa xmmword [esp + 0x14], xmm0
lea ecx, [esp + 0x14]
push esi
mov dword [esp + 0x18], vtable.DNDownloaderImpl.0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call fcn.00410100
test al, al
je 0x40eedf
call fcn.00457af0
lea ecx, [esp + 0x10]
call fcn.00410420
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x1cc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40fff0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov dword [0x51d3a8], 0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x4109a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5148c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push 0x118
push 0
push eax
mov dword [ebp - 0x124], 0
call fcn.004a6740
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x410a09
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, esi
push 0xffffffffffffffff
jb 0x410a1d
push str.mainframe.xml
jmp 0x410a22
push str.mainframe_xp.xml
call fcn.0044fe90
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049a4c3
mov esp, ebp
pop ebp
ret 4