joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4223e9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov word [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x108], 0
cmp dword [0x4940dc], 0
je 0x422428
sub ax, ax
jmp 0x422642
cmp dword [0x48fc30], 0
je 0x422444
mov eax, dword [str.WIN95]
mov dword [0x494100], eax
jmp 0x42244e
mov eax, dword [0x49410c]
mov dword [0x494100], eax
cmp dword [ebp - 4], 0
jne 0x4224d3
cmp dword [0x494888], 0
je 0x4224d3
mov eax, dword [0x494888]
mov dword [ebp - 4], eax
push 0
push dword [0x494128]
push dword [ebp - 4]
call fcn.00472d10
add esp, 0xc
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x42249e
mov word [ebp - 8], 1
jmp 0x42261e
push dword [ebp - 0x10c]
call fcn.00473710
add esp, 4
or eax, eax
jne 0x4224d3
push dword [ebp - 0x10c]
call fcn.00472a0c
add esp, 4
mov dword [ebp - 0x10c], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x422558
cmp dword [0x49488c], 0
je 0x422558
mov eax, dword [0x49488c]
mov dword [ebp - 4], eax
push 0
push dword [0x494128]
push dword [ebp - 4]
call fcn.00472d10
add esp, 0xc
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x422523
mov word [ebp - 8], 1
jmp 0x42261e
push dword [ebp - 0x10c]
call fcn.00473710
add esp, 4
or eax, eax
jne 0x422558
push dword [ebp - 0x10c]
call fcn.00472a0c
add esp, 4
mov dword [ebp - 0x10c], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10c], 0
jne 0x42257e
push 0
push dword [0x494128]
push dword [ebp - 4]
call fcn.00472d10
add esp, 0xc
mov dword [ebp - 0x10c], eax
push dword [ebp - 0x10c]
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x4940fc], eax
cmp dword [0x4940fc], 0
jne 0x4225a6
mov word [ebp - 8], 2
jmp 0x42261e
push dword [0x494138]
push dword [0x4940fc]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x494184], eax
push dword [0x494148]
push dword [0x4940fc]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x494188], eax
push dword [0x494158]
push dword [0x4940fc]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x49418c], eax
push dword [0x494170]
push dword [0x4940fc]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x494190], eax
push dword [0x494180]
push dword [0x4940fc]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x494194], eax
mov dword [0x4940dc], 1
cmp dword [ebp - 0x10c], 0
je 0x422639
push dword [ebp - 0x10c]
call fcn.00472a0c
add esp, 4
mov ax, word [ebp - 8]
jmp 0x422642
pop edi
pop esi
pop ebx
leave
ret

Function at 0x439316
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.0047ee00
add esp, 4
inc eax
push eax
call fcn.0047fd30
add esp, 4
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0047e484
add esp, 8
mov eax, dword [ebp - 8]
jmp 0x439355
pop edi
pop esi
pop ebx
leave
ret
Function at 0x485d90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
sub esi, esi
lea eax, [esp + 4]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp eax, esi
je 0x485dc5
cmp byte [esp + 5], 0x3a
jne 0x485dc5
xor eax, eax
mov al, byte [esp + 4]
push eax
call fcn.00486190
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004018d4
push 0x404004
push section..data
call fcn.004018ba
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401123
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401010
Capabilities:
Check if file exists
Delete file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42da08
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x43b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x401194
cmp word [eax], bx
je 0x401194
cmp edi, ebx
je 0x401194
cmp word [edi], bx
je 0x401194
push 0x2000
mov dword [ebp - 0x20], ebx
call fcn.0041b26c
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x401194
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
mov dword [ebp - 0x38], vtable.CWininetFile.0
call edx
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010d8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4010d8
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x20
push 2
push ebx
push 2
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40116e
mov eax, dword [ebp + 8]
push ebx
push eax
lea ecx, [ebp - 0x38]
call fcn.00401230
test eax, eax
je 0x401167
lea ecx, [ebp - 0x14]
push ecx
push 0x2000
push esi
lea ecx, [ebp - 0x38]
call fcn.00401420
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x401159
lea ecx, [ecx]
add dword [ebp - 0x18], eax
push ebx
lea edx, [ebp - 0x1c]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jne 0x401167
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x14]
push ecx
push 0x2000
push esi
lea ecx, [ebp - 0x38]
call fcn.00401420
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x401120
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, dword [ebp - 0x28]
sete dl
mov dword [ebp - 0x20], edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0041b300
add esp, 4
lea ecx, [ebp - 0x38]
call fcn.00401200
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401230
Capabilities:
Check http status code
Check internet connectivity via wininet
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x437db8
push 0x41df10
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x43b050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edx, ecx
mov dword [ebp - 0x54], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ecx
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov ecx, 8
mov esi, 0x432414
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [ebp - 0x60], ecx
xor esi, esi
xor edi, edi
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], 4
cmp eax, ecx
jne 0x4012b2
xor eax, eax
jmp 0x401402
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 4], ebx
push 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [ebp - 0x60], 0x20
je 0x4012dc
mov dword [ebp - 4], 0xfffffffe
jmp 0x4013f3
mov edx, dword [ebp - 0x4c]
test edx, edx
je 0x401308
mov eax, edx
lea ebx, [eax + 2]
jmp 0x4012f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4012f0
sub eax, ebx
sar eax, 1
je 0x401308
mov esi, 3
mov edi, edx
push 0
push 0
push edi
push esi
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__QQPCMgr7.0_
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
je 0x4012d0
push 0
push 0x84000100
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x64]
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x4013d0
xor eax, eax
mov word [ebp - 0x274], ax
push 0x208
push eax
lea ecx, [ebp - 0x272]
push ecx
call fcn.0041d2e0
add esp, 0xc
mov dword [ebp - 0x68], 0x208
push 0
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x274]
push eax
push 0x2f
push esi
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
call edi
mov dword [ebp - 0x5c], 0
push 0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x20000013
push esi
call edi
test eax, eax
je 0x4013d0
cmp dword [ebp - 0x5c], 0xc8
jne 0x4013d0
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0x20000005
push esi
call edi
test eax, eax
je 0x4013c9
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov dword [eax + 0x10], edx
mov dword [ebp - 0x44], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x4013f6
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x54]
mov dword [eax + 4], ebx
mov dword [eax + 8], esi
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041b25d
mov esp, ebp
pop ebp
ret 8
Function at 0x4015d0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f168
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x43b050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004019d0
test eax, eax
je 0x40173a
push 0x4324d0
call fcn.004074b0
add esp, 4
test eax, eax
jne 0x401657
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx esi, word [ebp - 0x20]
movzx ecx, word [ebp - 0x1e]
imul esi, esi, 0x64
movzx edx, word [ebp - 0x1a]
add esi, ecx
imul esi, esi, 0x64
push str.Udte
add esi, edx
call fcn.004074b0
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
xor esi, esi
mov eax, ecx
cmp eax, esi
je 0x40167e
jmp 0x401659
xor esi, esi
cmp dword [0x43e540], esi
ja 0x40167e
push 0x43e540
push esi
push 0x2710
push 0x417380
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x43e53c], eax
push esi
push 0x2710
push 1
push esi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
lea edx, [ebp - 0x24]
push edx
mov ecx, str.SpesmarlIlnclzs
mov dword [ebp - 4], esi
call fcn.0040a050
mov ebx, dword [eax]
add esp, 4
push 0x80000001
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x20019
call fcn.004043f0
test eax, eax
mov eax, dword [ebp - 0x24]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4016e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
test bl, bl
je 0x40172e
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
push str.DelayMinutes
push esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x401721
push esi
call edi
xor esi, esi
mov eax, dword [ebp - 0x24]
cmp eax, 3
jbe 0x40172e
mov dword [0x43e5d4], eax
test esi, esi
je 0x401735
push esi
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b25d
mov esp, ebp
pop ebp
ret

Function at 0x401940
Capabilities:
Terminate thread

Disassembly:
push 1
push 0
mov dword [0x43e538], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x43e578]
test ecx, ecx
je 0x40197c
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ecx, dword [0x43e578]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov dword [0x43e578], 0
mov eax, dword [0x43e53c]
test eax, eax
je 0x4019b8
cmp dword [0x43e540], 0
jbe 0x4019b8
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x43e53c]
test eax, eax
je 0x4019b8
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x43e53c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x43e53c], 0
mov dword [0x43e540], 0
xor eax, eax
ret
Function at 0x402050
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e378
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x43b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403220
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x4020ad
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.00403e20
mov edx, dword [ebp - 0x10]
mov eax, edx
cmp dword [edx - 8], esi
jge 0x4020be
push 0x80070057
call fcn.00401540
mov dword [edx - 0xc], esi
mov edx, dword [ebp - 0x10]
xor ecx, ecx
push 0x5c
push eax
mov word [edx + 0x208], cx
call fcn.0041b528
mov esi, eax
add esp, 8
test esi, esi
jne 0x402117
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402104
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x43e568]
lea edi, [ebp - 0x14]
call fcn.00411ff0
mov ecx, dword [eax]
lea edx, [esi + 2]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x402130
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402160
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0041b8e7
add esp, 8
test eax, eax
js 0x4020b4
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx - 8]
jg 0x4020b4
mov dword [ecx - 0xc], eax
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4021c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x43d6ac
call fcn.0041b1b5
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x404224
test esi, esi
jne 0x404224
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x404208
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404202
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404202
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x4041f1
cmp esi, eax
jae 0x4041f5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4041e3
cmp esi, eax
jb 0x4041f9
xor eax, eax
jmp 0x404202
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x40422d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x43d6ac
call fcn.0041b1b5
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x404195
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404328
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40435a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x404356
cmp esi, eax
jae 0x40435a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404348
cmp esi, eax
jb 0x404360
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x404370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4043de
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4043ad
cmp eax, 2
jne 0x4043c8
mov eax, dword [ebp - 4]
test esi, esi
je 0x4043d8
test eax, eax
je 0x4043d3
test al, 1
jne 0x4043c8
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4043d8
mov eax, 0xd
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x404770
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e2c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x43b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0
test eax, eax
jne 0x4047ba
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4047a6
lea esi, [edi + 8]
push esi
call fcn.0041bb83
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4047a6
push esi
push 0
push ebx
call fcn.0041d2e0
mov eax, dword [ebp + 8]
add esp, 0xc
push ebx
push edi
xor esi, esi
push esi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4048ab
mov ecx, str.762A792A5E2A582A432A442A4D2A6C2A432A462A4F2A632A442A4C2A452A762A1A2A122A1A2A1E2A1A2A1E2A482A1A2A762A792A5A2A4F2A492A432A4B2A462A682A5F2A432A462A4E2A2A2A
lea edi, [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00411ff0
mov edi, eax
mov dword [ebp - 4], esi
mov eax, dword [edi]
cmp dword [eax - 4], 1
jle 0x404828
mov ecx, dword [eax - 0xc]
push ecx
push edi
call fcn.00403a50
mov edi, dword [edi]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404860
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x4048ab
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041bb83
mov ecx, dword [ebp - 0x14]
mov esi, eax
mov eax, dword [ebp - 0x10]
push eax
push ecx
inc eax
push eax
push esi
call fcn.0041bb8e
mov eax, dword [ebp - 0x10]
xor edx, edx
push esi
mov word [esi + eax*2], dx
call fcn.0041bc5b
push esi
mov dword [ebp - 0x18], eax
call fcn.0041bc7c
add esp, 0x1c
push ebx
call fcn.0041bc7c
mov eax, dword [ebp - 0x18]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
jne 0x4048ed
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
cmp ebx, esi
je 0x4048e2
lea edi, [ebx + 8]
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.0041bb83
mov esi, eax
add esp, 4
test esi, esi
je 0x4048e2
push edi
push 0
push esi
call fcn.0041d2e0
mov eax, dword [ebp + 8]
add esp, 0xc
push esi
push ebx
xor edi, edi
push edi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4049a4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x4329f8
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4049a4
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x4049a4
movzx eax, word [ecx + 0xa]
cdq
shld edx, eax, 0x10
shl eax, 0x10
mov edi, eax
movzx eax, word [ecx + 8]
mov ebx, edx
cdq
or edi, eax
movzx eax, word [ecx + 0xe]
or ebx, edx
shld ebx, edi, 0x10
cdq
shl edi, 0x10
or edi, eax
movzx eax, word [ecx + 0xc]
or ebx, edx
shld ebx, edi, 0x10
cdq
shl edi, 0x10
push esi
or edi, eax
or ebx, edx
call fcn.0041bc7c
add esp, 4
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
push esi
call fcn.0041bc7c
add esp, 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404a60
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e270
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43b050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404b35
mov ecx, dword [ebp + 8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404b35
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0xa
div ecx
lea edi, [ebp - 0x10]
push edx
push esi
push str._s._d
call fcn.004040d0
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
push 1
push esi
push edx
call edi
test eax, eax
je 0x404b15
push 4
push 0
push esi
call edi
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret