joyce8/EMBER2024-capa huggingface dataset:
Function at 0x599e00
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x599e1a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x599f2a
push ebp
jmp 0x599e30
mov eax, ebx
cmp ebx, 0x15b0
jb 0x599e3f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x599eeb
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x599e60
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x599e60
test eax, eax
je 0x599efd
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x599ef0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x599e30
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x10011b17
Capabilities:
Send data
Send data on socket

Disassembly:
push 4
mov eax, 0x10018096
call fcn.100165a4
push 0x10
call fcn.1001557d
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1000f549
mov esi, eax
push 0xa8
mov ecx, esi
call fcn.1000f571
push 1
call fcn.1000f571
call fcn.1000f595
mov ecx, esi
call fcn.10013cc8
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x10020994]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.10015693
push 0x10
push esi
call fcn.100155ad
add esp, 0xc
call fcn.10016572
ret 8

Function at 0x10011b8d
Capabilities:
Send data
Send data on socket

Disassembly:
push 4
mov eax, 0x10018096
call fcn.100165a4
push 0x10
call fcn.1001557d
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1000f549
mov esi, eax
push 0x32
mov ecx, esi
call fcn.1000f571
push 0xc9
call fcn.1000f571
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
mov edx, dword [esi + 4]
mov edi, eax
pop ecx
mov ebx, 0x3bea
lea ecx, [edi + 2]
add ecx, edx
cmp ecx, ebx
jae 0x10011c16
cmp edi, 0x2000
ja 0x10011c16
lea eax, [edx + 2]
cmp eax, ebx
jae 0x10011c00
mov eax, dword [esi + 0xc]
mov word [edx + eax], di
add dword [esi + 4], 2
mov edx, dword [esi + 4]
add dword [esi], 2
mov eax, dword [esi + 0xc]
push dword [ebp + 0xc]
add eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
add dword [esi + 4], edi
add dword [esi], edi
pop ecx
pop ecx
mov ecx, esi
call fcn.1000f595
mov ecx, esi
call fcn.10013cc8
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x10020994]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.10015693
push 0x10
push esi
call fcn.100155ad
add esp, 0xc
call fcn.10016572
ret 8
Function at 0x1001272c
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x10018145
call fcn.100165a4
mov esi, ecx
push 4
xor ebx, ebx
call fcn.1001557d
mov dword [ebp - 0x10], eax
mov dword [eax], 0x1000f6ee
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x100128ec
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x10012775
mov eax, esi
call fcn.10016572
ret 4
push 6
mov dword [edi], ebx
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x100133a3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x40
push dword [ebp + 8]
mov ebx, edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 8], 2
jne 0x100133c9
mov word [esi], bx
jmp 0x100133d1
cmp dword [ebp + 8], 1
jne 0x100133d1
mov byte [esi], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
leave
ret

Function at 0x10013cc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x768c7c]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [0x768c80]
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x768c84]
cmp dword [edi + 8], 2
mov esi, dword [edi]
sete bl
mov dword [ebp - 0x20], eax
mov eax, dword [0x768c88]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], eax
lea ebx, [ebx*4 + 2]
add esi, ebx
mov dword [ebp - 0x14], ebx
mov ecx, esi
mov dword [ebp - 8], esi
and ecx, 0x80000007
jns 0x10013d21
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x10013d2d
push 8
pop eax
sub eax, ecx
add esi, eax
mov dword [ebp - 8], esi
mov ecx, dword [edi + 0xc]
mov eax, esi
cdq
add ecx, ebx
and edx, 3
mov dword [ebp - 0xc], ecx
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
test eax, eax
jle 0x10013dc1
mov edi, dword [ecx + edx*4]
xor esi, esi
mov ebx, dword [ecx + edx*4 + 4]
push 0x20
pop edx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x28]
add eax, esi
sub esi, 0x61c88647
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xd
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x28]
add eax, esi
xor ecx, eax
add ebx, ecx
sub edx, 1
jne 0x10013d58
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx*4], edi
mov dword [ecx + edx*4 + 4], ebx
add edx, 2
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0x10]
jl 0x10013d4c
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + 0xc]
lea ecx, [ebx - 2]
add ecx, esi
mov word [eax], cx
mov dword [edi], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10013dd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x768c7c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x768c80]
mov dword [ebp - 0x18], eax
mov eax, dword [0x768c84]
mov dword [ebp - 0x14], eax
mov eax, dword [0x768c88]
mov dword [ebp - 0x10], eax
mov eax, edx
cdq
and edx, 3
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
test eax, eax
jle 0x10013e8b
push ebx
push edi
mov edi, dword [esi + edx*4 + 2]
mov ebx, dword [esi + edx*4 + 6]
mov esi, 0xc6ef3720
push 0x20
pop edx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xd
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x1c]
add eax, esi
add esi, 0x61c88647
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x1c]
add eax, esi
xor ecx, eax
sub edi, ecx
sub edx, 1
jne 0x10013e28
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [esi + edx*4 + 2], edi
mov dword [esi + edx*4 + 6], ebx
add edx, 2
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0xc]
jl 0x10013e18
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10014b17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10014b3a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10014bf5
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x10014b60
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10014b65
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, ecx
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10014be9
jg 0x10014b7a
test esi, esi
je 0x10014be9
test ecx, ecx
jl 0x10014bcb
jg 0x10014b84
test eax, eax
je 0x10014bcb
cmp edi, ecx
jg 0x10014b96
jl 0x10014b8e
cmp esi, eax
jae 0x10014b96
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10014be9
jg 0x10014bce
test esi, esi
je 0x10014be9
jmp 0x10014bce
mov edx, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x10014be9
push dword [ebx + 0x4c]
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10014bfa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
jg 0x10014c1c
jl 0x10014c13
test edi, edi
jne 0x10014c1c
xor eax, eax
xor edx, edx
jmp 0x10014ceb
cmp dword [ecx + 0x38], 0
je 0x10014c32
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10014ceb
mov eax, dword [ecx + 0x1c]
push esi
mov esi, edi
mov edx, dword [eax]
test edx, edx
je 0x10014c7d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x10014c7d
cmp eax, edi
jb 0x10014c53
mov eax, edi
mov dword [ebp + 0x10], edi
mov esi, dword [ebp + 8]
push eax
push edx
push esi
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 0x10]
add esi, edx
mov dword [ebp + 8], esi
mov esi, edi
sub esi, edx
mov eax, dword [ecx + 0x2c]
sub dword [eax], edx
mov eax, dword [ecx + 0x1c]
add dword [eax], edx
jmp 0x10014c83
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
je 0x10014ce1
call fcn.10015240
mov edx, dword [ebp + 8]
mov eax, esi
cmp esi, 0xfff
jbe 0x10014ccb
push dword [ecx + 0x4c]
push 0xfff
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp + 8]
mov ecx, 0xfff
add edx, eax
add esp, 0x10
sub esi, eax
mov dword [ebp + 8], edx
cmp eax, ecx
jne 0x10014ce1
cmp esi, ecx
mov ecx, dword [ebp - 4]
ja 0x10014c9b
mov eax, esi
test eax, eax
je 0x10014ce1
push dword [ecx + 0x4c]
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sub edi, esi
mov eax, edi
sbb ebx, 0
mov edx, ebx
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x10014f6a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10020040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10014f8d
xor eax, eax
jmp 0x10015056
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10014fb9
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10014fb9
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x1001504e
cmp dword [esi + 0x4c], 0
je 0x10015052
mov ecx, esi
call fcn.10015240
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10014fd6
movsx eax, bl
jmp 0x1001500f
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10015024
sub eax, 1
je 0x10015024
dec eax
sub eax, 1
jne 0x10015052
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x1001504e
or ebx, eax
jmp 0x1001504e
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10015042
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10015052
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10015052
mov eax, ebx
jmp 0x10015055
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001556f
leave
ret 4
Function at 0x10015263
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10020040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x100152bb
cmp byte [esi + 0x3d], bl
je 0x100152bb
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100152f5
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x100152cc
sub eax, 1
je 0x100152cf
dec eax
sub eax, 1
jne 0x100152f5
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001556f
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100152ed
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100152f5
cmp byte [esi + 0x3d], bl
sete al
jmp 0x100152bd
xor al, al
jmp 0x100152bd
Function at 0x44532a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4926c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004421b7
mov dword [ebp - 0x14], eax
cmp dword [0x4d86f0], edi
jne 0x44541b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4453a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4454fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4454fb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4454fb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4d86f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4d86f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4d86f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d8700], eax
test eax, eax
je 0x445418
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4d86fc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x445440
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x445433
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x445455
push 4
pop eax
jmp 0x4454fd
cmp dword [ebp - 0x14], edi
je 0x445455
push dword [0x4d86f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x44543a
mov eax, dword [0x4d86fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4454b3
cmp dword [0x4d8700], esi
je 0x4454b3
push eax
call ebx
push dword [0x4d8700]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4454b3
test eax, eax
je 0x4454b3
call ecx
test eax, eax
je 0x4454a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4454a8
test byte [ebp - 8], 1
jne 0x4454b3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4454e3
mov eax, dword [0x4d86f4]
cmp eax, esi
je 0x4454e0
push eax
call ebx
test eax, eax
je 0x4454e0
call eax
mov edi, eax
test edi, edi
je 0x4454e0
mov eax, dword [0x4d86f8]
cmp eax, esi
je 0x4454e0
push eax
call ebx
test eax, eax
je 0x4454e0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4d86f0]
call ebx
test eax, eax
je 0x4454fb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4454fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f4cb
leave
ret
Function at 0x4068e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4068f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406934
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x406930
lea ebx, [ebx]
cmp esi, eax
jae 0x406934
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406920
cmp esi, eax
jb 0x40693a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x408c10
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ecx
mov ecx, dword [esi]
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x408c59
cmp dword [esp], 0x103
jne 0x408c59
mov edx, dword [esi]
push 0xc8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi]
push 0xd4abf
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret

Function at 0x408eb0
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x579680]
xor eax, esp
mov dword [esp + 0x108], eax
push 0
push 0x1a
lea eax, [esp + 0xc]
push eax
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x5586c4
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x408f0a
push eax
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00406ca0
mov ecx, dword [esp + 0x108]
xor ecx, esp
mov eax, esi
call fcn.00507bff
add esp, 0x10c
ret
Function at 0x408f30
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x579680]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
lea esi, [esp + 0xc]
mov ebx, ecx
call fcn.00408eb0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.005085d6
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408f87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x557f18
lea ecx, [esp + 0x18]
push ecx
call esi
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
push 0
lea edx, [esp + 0x18]
push edx
push 0
call edi
cmp ebx, 0x82
jne 0x408fbc
push 0x5586d8
jmp 0x409099
cmp ebx, 0x86
jne 0x408fd3
push 0x557f24
lea ecx, [esp + 0x18]
push ecx
jmp 0x40909e
cmp ebx, 0x83
jne 0x408fea
push str.androidwinusb86.cat
lea edx, [esp + 0x18]
push edx
jmp 0x40909e
cmp ebx, 0x80
jne 0x408ffc
push str.androidwinusba64.cat
jmp 0x409099
cmp ebx, 0x87
jne 0x409022
push str.i386
lea ecx, [esp + 0x18]
push ecx
call esi
push 0
lea edx, [esp + 0x18]
push edx
push 0
call edi
push str.WdfCoInstaller01009.dll
jmp 0x409099
cmp ebx, 0x88
jne 0x409048
push str.i386
lea ecx, [esp + 0x18]
push ecx
call esi
push 0
lea edx, [esp + 0x18]
push edx
push 0
call edi
push 0x558738
jmp 0x409099
cmp ebx, 0x89
jne 0x409057
push str.i386
jmp 0x409082
cmp ebx, 0x8a
jne 0x409066
push str.amd64
jmp 0x409009
cmp ebx, 0x8b
jne 0x409075
push str.amd64
jmp 0x40902f
cmp ebx, 0x8c
jne 0x4090a0
push str.amd64
lea ecx, [esp + 0x18]
push ecx
call esi
push 0
lea edx, [esp + 0x18]
push edx
push 0
call edi
push 0x558750
lea eax, [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
movzx edx, bx
push 0x558770
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x409104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x409104
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
test esi, esi
jne 0x40911e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00507bff
add esp, 0x110
ret
lea ecx, [esp + 0x14]
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00507bff
add esp, 0x110
ret