joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403249
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x4070c8], ebx
je 0x4032ac
push ebx
push ebx
push 0x12
push dword [0x407168]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x7530
push dword [0x4070c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4070c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
push eax
push ebx
push 0x1e
mov dword [0x4070c8], ebx
call fcn.004040fb
mov al, byte [eax]
cmp byte [0x4070d8], bl
je 0x4032ac
test al, 4
je 0x4032ac
xor eax, eax
jmp 0x403331
push esi
cmp byte [0x4070a8], bl
jne 0x4032ec
push dword [0x4070c0]
mov esi, 0x407038
push esi
call fcn.00403b07
cmp byte [0x40707f], bl
jne 0x4032d4
mov byte [0x4070d8], bl
cmp byte [0x4070d8], bl
jne 0x403311
inc dword [0x407030]
mov eax, dword [0x407030]
cmp eax, dword [ebp + 8]
jb 0x4032f0
xor eax, eax
jmp 0x403330
mov eax, dword [0x4070c0]
mov byte [eax], bl
push dword [0x4070c0]
push esi
call fcn.00403b07
mov byte [0x40707f], 1
mov byte [0x4070d8], 1
push 0x407168
push ebx
push ebx
push 0x4034c8
push ebx
push ebx
mov dword [0x40702c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4070c8], eax
pop esi
pop ebx
leave
ret 4

Function at 0x403399
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
push edi
mov ebx, 0x94
push ebx
xor edi, edi
push edi
lea eax, [ebp - 0xbc]
push eax
call fcn.00405205
mov dword [ebp - 4], 3
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], edi
je 0x40341f
dec eax
jne 0x4034a0
cmp byte [0x4070e9], 0x40
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
lea edx, [eax + 6]
jne 0x4033e9
xor ecx, ecx
jmp 0x4033ec
mov ecx, dword [ecx + 4]
push ecx
add eax, 2
push eax
push edx
lea eax, [ebp - 0xbc]
push eax
call fcn.00402f7d
test eax, eax
jle 0x4034a0
push edi
push 0x12
push 0x12
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4033c1
jmp 0x4034a0
push 0x4464
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
je 0x40348e
or dword [esi + 0x70], 0xffffffff
or byte [esi + 0x5c], 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3ba8], eax
push ebx
lea eax, [ebp - 0xbc]
push eax
lea eax, [esi + 0x3c58]
push eax
call fcn.004051ec
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x401dd0
push edi
push edi
mov dword [esi + 0x6c], 3
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x3ba4], eax
cmp eax, edi
je 0x40348e
push 0xfffffffffffffff1
push eax
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 8]
push esi
call fcn.004020f3
cmp dword [ebp - 8], edi
jne 0x4033c1
lea eax, [ebp - 0xbc]
push eax
call fcn.00402f46
push 2
push 1
push 0x400
push dword [0x40700c]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4039be
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x4070e4
xor eax, eax
cmp dword [esi], eax
jne 0x4039fa
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp + 8]
jecxz 0x403a09
cmp eax, ecx
je 0x403a09
mov dword [esi], ecx
push eax
push dword [0x401258]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, sym.rpcnetp.exe_rpcnetp
pop eax
jne 0x403a09
call fcn.00404203
mov eax, 1
mov dword [0x4070ac], eax
pop esi
leave
ret 0xc
mov dword [esi], eax
pop esi
leave
jmp fcn.00403674
Function at 0x403b07
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4070ea]
sub esp, 0x10
push ebx
push esi
push edi
test eax, eax
je 0x403c10
mov esi, dword [ebp + 0xc]
mov cl, byte [0x4070e9]
cmp cl, 0x40
jne 0x403cb4
mov cl, byte [0x4070ec]
mov dl, byte [0x4070ed]
movzx edi, al
mov byte [ebp - 1], ah
movzx eax, ah
movzx ebx, cl
push 0x46
lea edi, [edi*4 + 0x4070ee]
mov dword [ebp - 0xc], eax
lea eax, [edi + eax*4]
mov dword [ebp - 8], ebx
push 0
push dword [ebp + 8]
shl ebx, 4
mov byte [ebp - 2], cl
mov byte [ebp - 3], dl
mov dword [ebp - 0x10], eax
add ebx, eax
call fcn.00405de2
mov al, byte [esi]
add esp, 0xc
cmp al, byte [ebp - 1]
movzx eax, al
jae 0x403bab
push dword [edi + eax*4]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
movzx ecx, byte [esi]
mov edx, dword [edi + ecx*4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 2], edx
test eax, eax
je 0x403c01
push 0x10
push eax
add ecx, 6
push ecx
call fcn.00405e18
add esp, 0xc
jmp 0x403c8b
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
add ecx, edi
cmp eax, ecx
jge 0x403c29
push 0x4016e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x403bd6
push 0x4016d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x403be0
mov al, byte [ebp - 2]
add al, byte [ebp - 1]
mov byte [esi], al
jmp 0x403c03
mov ecx, dword [ebp + 8]
add ecx, 6
push 0x40
push ecx
movzx ecx, byte [esi]
sub ecx, edi
shl ecx, 4
add ecx, dword [ebp - 0x10]
push ecx
push 0x17
call eax
test eax, eax
jne 0x403c8b
inc byte [esi]
mov eax, dword [0x4070ea]
test eax, eax
jne 0x403b20
push eax
mov eax, esp
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push pe_nt_image_headers32
call fcn.00403cea
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
movzx edi, byte [ebp - 2]
movzx edx, byte [ebp - 3]
movzx ecx, byte [ebp - 1]
movzx eax, byte [esi]
add edx, edi
add edx, ecx
cmp eax, edx
jge 0x403c8b
sub eax, edi
sub eax, ecx
mov ecx, dword [ebp + 8]
lea edx, [ecx + 6]
lea edi, [ecx + 0x46]
mov ecx, 0x407168
je 0x403c64
jmp 0x403c5c
cmp byte [ebx], 0
je 0x403c60
inc ebx
cmp ebx, ecx
jb 0x403c56
inc ebx
dec eax
jne 0x403c5c
cmp ebx, ecx
jb 0x403c75
mov al, byte [ebp - 3]
add al, byte [ebp - 2]
add al, byte [ebp - 1]
mov byte [esi], al
jmp 0x403c8b
mov al, byte [ebx]
test al, al
je 0x403c8b
sub ebx, edx
cmp edx, edi
jae 0x403c8b
mov byte [edx], al
inc edx
mov al, byte [ebx + edx]
test al, al
jne 0x403c7d
movzx edx, byte [ebp - 2]
movzx ecx, byte [ebp - 3]
inc byte [esi]
movzx eax, byte [esi]
add ecx, edx
movzx edx, byte [ebp - 1]
add ecx, edx
cmp eax, ecx
jle 0x403c22
mov byte [0x40707f], 0
jmp 0x403c22
test cl, cl
je 0x403ccb
push 0x4070ea
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edi, dword [ebp + 8]
mov dword [edi + 2], eax
jmp 0x403cd3
mov ecx, dword [ebp + 8]
mov dword [ecx + 2], eax
mov edi, ecx
push dword [edi + 2]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
add edi, 6
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x403c22
Function at 0x403cea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040406a
mov ebx, eax
mov dh, byte [ebx]
mov dl, 1
mov ecx, dword [edi]
or dh, dh
jne 0x403d1d
inc ebx
push ecx
mov eax, esp
push eax
push 0
push dword [ebx]
call fcn.004040fb
pop ecx
jecxz 0x403d2b
push eax
mov al, byte [eax]
xor al, 0xb5
mov byte [esi], al
pop eax
inc esi
inc eax
loop 0x403d1f
or dh, dh
jne 0x403d37
inc dl
mov cl, dl
cmp ecx, dword [edi]
jl 0x403d0a
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [edi], esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x403ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 5], 0
push ebx
mov bl, byte [ebp - 5]
mov byte [ebp - 1], bl
test bl, bl
je 0x403f15
mov byte [ebp - 9], 0
push dword [ebp - 9]
push dword [ebp - 5]
call fcn.00403e23
cmp al, 1
je 0x403f0f
inc byte [ebp - 9]
jne 0x403ef9
jmp 0x403f15
mov bl, byte [ebp - 9]
mov byte [ebp - 1], bl
push 4
pop eax
rol byte [ebp - 1], 1
xor bl, byte [ebp - 1]
dec eax
jne 0x403f18
movzx eax, byte [ebp - 5]
mov ecx, dword [0x40716c]
xor bl, 0x63
inc byte [ebp - 5]
mov byte [eax + ecx + 0x5c4], bl
jne 0x403eeb
pop ebx
leave
ret
Function at 0x40430e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1c]
sub esp, 0x2c
test ecx, ecx
jne 0x404325
mov eax, dword [ebp + 0x10]
and dword [eax], ecx
jmp 0x404411
and dword [ebp + 0x1c], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
lea eax, [ecx + 0x7f]
cdq
movsd dword es:[edi], dword [esi]
and edx, 0x7f
lea ebx, [edx + eax]
mov edx, dword [ebp + 0x18]
movsd dword es:[edi], dword [esi]
sar ebx, 7
mov eax, ebx
shl eax, 7
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp + 0x10], edx
bswap edi
test ebx, ebx
jle 0x404404
lea eax, [ebp - 0x2c]
mov esi, edx
sub esi, eax
mov eax, dword [ebp + 0xc]
sub eax, edx
mov dword [ebp + 0x18], ecx
mov dword [ebp - 4], eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x1c]
push 0x80
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.004044b2
lea eax, [ebx - 1]
cmp dword [ebp + 0x1c], eax
jne 0x4043d2
xor ecx, ecx
cmp dword [ebp - 8], ecx
je 0x4043d2
mov eax, dword [ebp + 0x18]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x4043e5
mov edx, dword [ebp - 4]
lea eax, [ebp + ecx - 0x2c]
mov cl, byte [esi + eax]
xor cl, byte [eax]
add edx, esi
mov byte [edx + eax], cl
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp - 0xc]
jl 0x4043b3
jmp 0x4043e5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
push 4
push eax
add ecx, eax
lea edx, [ebp - 0x2c]
call fcn.004051c6
add dword [ebp + 0x10], 0x10
add dword [ebp + 0x18], 0xffffff80
inc edi
add esi, 0x10
inc dword [ebp + 0x1c]
mov eax, edi
bswap eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x1c], ebx
jl 0x404372
mov edi, dword [ebp + 0x14]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x40517d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
bswap eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax]
lea edx, [ecx + 1]
mov byte [eax], dl
lea edx, [ebp + 0xc]
push ecx
mov ecx, edx
call fcn.00403e48
mov ecx, dword [ebp + 8]
mov edx, esi
push 4
sub edx, ecx
pop esi
mov eax, dword [ebp + 0xc]
bswap eax
xor eax, dword [edx + ecx]
mov dword [ecx], eax
bswap eax
add ecx, 4
dec esi
mov dword [ebp + 0xc], eax
jne 0x4051ac
pop esi
pop ebp
ret 0xc

Function at 0x4051c6
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
sub edx, eax
push edi
sub ecx, eax
mov edi, dword [edx + eax]
xor edi, dword [eax]
inc esi
mov dword [ecx + eax], edi
add eax, 4
cmp esi, dword [esp + 0x10]
jl 0x4051d2
pop edi
pop esi
ret 8
Function at 0x405499
Capabilities:
Resume thread

Disassembly:
push 0x6b8
push 0x406450
call fcn.00404f6c
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], eax
mov esi, 0x32e
push esi
push edi
lea eax, [ebp - 0x398]
push eax
call fcn.00405205
lea eax, [esi - 4]
mov word [ebp - 0x390], ax
push esi
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x6c8]
push eax
call fcn.004051ec
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040521c
mov dword [ebp - 0x34], 0x4060f3
mov dword [ebp - 0x30], 0x40618f
mov dword [ebp - 0x2c], 0x402305
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
mov dword [esi], 0x237
mov dword [esi + 4], 6
mov dword [ebp + 8], 0x4019cd
cmp dword [esi + 0x6c], 4
jne 0x405547
mov dword [ebp + 8], edi
lea ebx, [esi + 0x1bc8]
push 2
push edi
push ebx
push esi
call fcn.00401919
test eax, eax
je 0x4055ba
push 1
push dword [ebp + 8]
lea eax, [esi + 0x78]
push eax
push esi
call fcn.00401919
test eax, eax
je 0x4055ba
mov dword [ebp - 4], edi
push edi
push ebx
call fcn.00402531
cmp dword [ebp - 0x1c], edi
je 0x4055a0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x20]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4055b6
lea eax, [ebp - 0x68]
push eax
call fcn.00401eea
test eax, eax
jne 0x4055a0
jmp 0x4055b6
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.0040529e
call fcn.00401740
ret 4
Function at 0x405855
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4064d0
push 0x404fa7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
mov eax, 0x3034
call fcn.004063e0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor eax, eax
mov word [ebp - 0x304c], ax
push 0x1ffe
push ebx
lea eax, [ebp - 0x304a]
push eax
call fcn.00405de2
mov byte [ebp - 0x104c], bl
push 0xfff
push ebx
lea eax, [ebp - 0x104b]
push eax
call fcn.00405de2
add esp, 0x18
mov dword [ebp - 0x1c], ebx
xor esi, esi
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], ebx
push ebx
push ebx
push ebx
push ebx
push 0x401630
mov eax, dword [ebp + 8]
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x405a07
mov dword [ebp - 0x4c], ebx
xor eax, eax
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ebx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], esi
push dword [ebp + 0xc]
push 0x40161c
push 0x401610
lea eax, [ebp - 0x304c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push ebx
push ebx
mov esi, 0x1000
push esi
lea eax, [ebp - 0x104c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x304c]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x28], ebx
je 0x405961
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], ebx
jmp 0x405974
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x304c]
push eax
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call dword [eax + 0x24]
lea edi, [eax - 1]
neg edi
sbb edi, edi
inc edi
jne 0x40599c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], ebx
jne 0x4059cf
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x4059ad
cmp word [eax], bx
jne 0x4059c6
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x4059c6
cmp word [eax], bx
je 0x4059c6
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x20], ebx
jne 0x405949
push dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call dword [eax + 0x44]
cmp edi, ebx
je 0x405a29
cmp dword [ebp - 0x30], ebx
je 0x4059ed
push dword [ebp - 0x30]
push esi
push dword [ebp + 0x14]
call fcn.0040570c
cmp dword [ebp - 0x2c], ebx
je 0x4059fe
push dword [ebp - 0x2c]
push esi
push dword [ebp + 0x18]
call fcn.0040570c
mov dword [ebp - 0x24], 1
jmp 0x405a29
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405a29
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4061d4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x406241
push ebx
push edi
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, esi
je 0x40623a
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
je 0x406237
mov ecx, dword [eax + 0x3c]
mov ecx, dword [ecx + eax + 8]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call ebx
push dword [ebp + 8]
call ebx
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x405311
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4d11fe
call fcn.004cdff0
push ebx
push esi
mov esi, dword [ebp + 8]
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
and dword [esi + 0xc], 0
push edi
and dword [ebp - 4], 0
lea edi, [esi + 0x14]
mov ecx, edi
mov dword [esi], vtable.TiXmlAttribute.0
call fcn.0040540e
lea ebx, [esi + 0x30]
mov ecx, ebx
call fcn.0040540e
push dword [ebp + 0xc]
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00405394
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00405394
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x408365
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x40837c
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
je 0x4083b1
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4083ad
cmp edi, eax
jae 0x4083b1
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40839f
cmp edi, eax
jb 0x4083b5
xor eax, eax
jmp 0x4083bf
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x408525
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x4085b3
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x40855c
cmp dword [ebp - 8], 2
jne 0x4085b2
push esi
mov esi, dword [ebp + 0xc]
call fcn.0040822f
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00408130
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x40859a
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4085aa
push eax
call fcn.0048a91e
pop ecx
mov edx, esi
call fcn.004080e0
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x4088b3
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4d27dc
call fcn.004cdff0
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0040826f
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4088fe
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407fe5
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4088df
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x4088df
lea ecx, [ebp - 0x10]
call fcn.00408861
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x408935
xor esi, esi
jmp 0x4088e2
push eax
call fcn.004088b3
test eax, eax
pop ecx
je 0x408931
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4088df
call edi
cmp eax, ebx
jne 0x408931
jmp 0x4088df

Function at 0x40a9a6
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x40a9d4
push dword [esp + 0xc]
call fcn.0048a91e
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a9d4
inc edi
mov eax, edi
pop edi
ret 8

Function at 0x40aa6e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x40aaf7
push ebx
call fcn.00486b44
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40aae8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4e6a40
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40aae8
cmp dword [ebp - 0xc], ebx
je 0x40aae8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x40aaf7
push dword [ebp - 4]
call fcn.00489f07
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret
Function at 0x40abc7
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4d1892
call fcn.004cdff0
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x50c868
mov dword [ebp - 0x10], edi
call fcn.004082b2
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00489f10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.0040849e
push esi
call fcn.0040ab33
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40ad15
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00489f10
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x40ad6e
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x40ae24
mov eax, dword [ebp - 0x94]
dec eax
je 0x40ae10
dec eax
jne 0x40ae24
mov eax, dword [ebp - 0xa0]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x40adbd
cmp dword [ebp - 0x9c], edx
jne 0x40ada7
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x40ae0c
cmp dword [ebp - 0x9c], edi
jne 0x40adf5
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x40ae0c
cmp eax, 5
jne 0x40ade7
cmp dword [ebp - 0x9c], 2
jne 0x40adce
push eax
jmp 0x40adee
cmp dword [ebp - 0x9c], 1
jne 0x40addb
mov edi, ecx
jmp 0x40ae24
cmp dword [ebp - 0x9c], edi
jne 0x40ae24
push 3
jmp 0x40adee
cmp eax, 4
ja 0x40adf1
push 4
pop edi
jmp 0x40ae24
cmp eax, ecx
jb 0x40ae24
cmp dword [ebp - 0x9c], 2
jae 0x40ae02
cmp eax, ecx
jbe 0x40ae24
cmp byte [ebp + 0x76], dl
jne 0x40ae24
call fcn.0040ac4a
mov edi, eax
jmp 0x40ae24
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret