joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416a70
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x43dc58
call fcn.004399e8
mov eax, dword [ebp + 8]
mov esi, ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040423d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
lea edi, [ebp - 0x44]
call fcn.00415fe7
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
lea ecx, [ebp - 0x30]
call fcn.00414523
test al, al
jne 0x416ade
mov byte [ebp - 4], al
lea eax, [ebp - 0x40]
mov byte [0x44e24b], 2
mov dword [ebp - 0x44], vtable.CConfigRead.0
call fcn.00418a36
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00404ce5
xor eax, eax
call fcn.00439a6b
ret 4
mov ebx, dword [esi + 0x4c]
lea edi, [esi + 0x34]
lea eax, [ebx + 0x4c]
call fcn.004013c0
lea eax, [ebx + 0x50]
lea edi, [esi + 0x38]
call fcn.004013c0
mov ecx, dword [esi + 0x50]
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x48]
push eax
lea eax, [esi + 0x44]
push eax
lea eax, [esi + 0x40]
push eax
lea edi, [esi + 8]
push edi
call fcn.004108d3
test eax, eax
jne 0x416b34
xor ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x40]
mov byte [0x44e249], bl
mov dword [ebp - 0x44], vtable.CConfigRead.0
call fcn.00418a36
push ebx
jmp 0x416aca
mov al, byte [edi]
mov byte [0x44e249], al
mov eax, dword [esi + 0x34]
cmp dword [eax - 0xc], 0
jne 0x416b6c
xor esi, esi
mov byte [ebp - 4], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], vtable.CConfigRead.0
call fcn.00418a36
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00404ce5
mov eax, esi
jmp 0x416ad6
lea ebx, [ebp - 0x34]
call fcn.0040a7fc
add esi, 0x3c
mov edi, esi
mov byte [ebp - 4], 2
call fcn.004013c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
call fcn.004019a0
call fcn.00401000
mov eax, 0x443768
mov ecx, esi
call fcn.00401a10
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, str.QQPCDownload.exe
mov ecx, esi
call fcn.00401a10
xor esi, esi
inc esi
jmp 0x416b46
Function at 0x416e5d
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x20fc]
mov eax, 0x217c
call fcn.00433460
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp + 0x20f8], eax
mov eax, dword [ebp + 0x2104]
push ebx
push 3
push 1
push closesocket
push eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ebx
call fcn.0040a987
test eax, eax
jge 0x416eb7
cmp dword [ebp - 0x1c], ebx
je 0x416eb0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x416f9c
push esi
push edi
xor eax, eax
mov byte [ebp + 0x20e8], bl
lea edi, [ebp + 0x20e9]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea esi, [ebp - 0x80]
stosb byte es:[edi], al
call fcn.004067ab
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x2000
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416ef8
call fcn.0040bbe9
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x416f0c
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x80]
call fcn.00406ef5
jmp 0x416ed5
cmp dword [ebp - 0x1c], ebx
je 0x416f1d
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp + 0x20e8]
push eax
lea esi, [ebp - 0x80]
call fcn.00407100
push 0xfe
lea eax, [ebp + 0x1fea]
push ebx
push eax
mov word [ebp + 0x1fe8], bx
call fcn.0041e7c0
add esp, 0x10
lea edi, [ebp + 0x1fe8]
xor esi, esi
movzx eax, byte [ebp + esi + 0x20e8]
push eax
push str._.2x
push 3
push edi
call fcn.0041f58d
add esp, 0x10
add edi, 4
inc esi
cmp esi, 0x10
jb 0x416f50
push dword [ebp - 0x24]
lea eax, [ebp + 0x1fe8]
push eax
call fcn.004238ed
mov esi, eax
neg esi
sbb esi, esi
pop ecx
inc esi
cmp dword [ebp - 0x1c], ebx
pop ecx
je 0x416f98
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp + 0x20f8]
xor ecx, ebp
pop ebx
call fcn.0041e8c8
add ebp, 0x20fc
leave
ret 4

Function at 0x41717e
Capabilities:
Create directory

Disassembly:
push 4
mov eax, 0x43b736
call fcn.0043997f
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [eax]
sub eax, 0x10
call fcn.00401671
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 1
call fcn.00401000
mov eax, 0x443768
mov ecx, esi
call fcn.00401a10
mov eax, dword [esi]
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, str.QQPCDownloadModule.xml
mov ecx, esi
call fcn.00401a10
mov edi, dword [ebp + 8]
add edi, 0x20
mov eax, esi
call fcn.004013c0
mov eax, esi
call fcn.00439a57
ret 0xc
Function at 0x4171f0
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x43c778
call fcn.0043997f
lea ecx, [ebp - 0x14]
call fcn.0041594d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push str.dr.dll
push ecx
mov ecx, eax
call fcn.004038bf
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004019a0
push dword [ebp - 0x10]
call fcn.00415897
test eax, eax
pop ecx
jne 0x417252
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417252
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004019a0
xor al, al
jmp 0x41728f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.0040944c
mov byte [ebp - 4], 3
call fcn.0043aab0
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.0043acc0
push 0
push 1
lea esi, [ebp - 0x30]
mov edi, eax
call fcn.004097e6
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004019a0
cmp edi, 1
sete al
call fcn.00439a57
ret

Function at 0x417295
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43dda0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x44b074]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
call fcn.0041594d
and dword [esp + 0x20], 0
lea ecx, [esp + 0xc]
push str.dr.dll
push ecx
mov ecx, eax
call fcn.004038bf
pop ecx
pop ecx
mov byte [esp + 0x20], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.004019a0
mov esi, dword [0x44e24c]
call fcn.0043aab0
and dword [eax + 4], 0
push 0x44e248
mov dword [eax], 0x3f6
mov dword [eax + 0x10], esi
call fcn.0043aab0
mov edi, eax
call fcn.0041946f
call fcn.0043aab0
mov edi, eax
call fcn.0043ac50
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.004019a0
xor eax, eax
inc eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41cb25
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x443950
xor esi, esi
push 0x8d
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x41cb5d
xor eax, eax
jmp 0x41cba9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x41cb59
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x41cb59
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x41cba6
push esi
push 0x80
push 2
push esi
push 1
push 0x10000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41cbb7
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e8c8
leave
ret
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cbd6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x41cba8
xor esi, esi
inc esi
jmp 0x41cbcb

Function at 0x41d690
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x44b074]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
xor edx, edx
cmp ecx, edx
push esi
je 0x41d703
cmp eax, edx
jle 0x41d703
cmp edi, edx
je 0x41d703
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0041d800
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0041d8c0
mov al, 1
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0041e8c8
add esp, 0x64
ret
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
xor al, al
call fcn.0041e8c8
add esp, 0x64
ret

Function at 0x41e4ae
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44b074]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041e3ed
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041e7c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41e4fd
cmp dword [ebp - 0x1c], 5
jb 0x41e515
jmp 0x41e511
cmp dword [ebp - 0x10], 1
jne 0x41e515
cmp dword [ebp - 0x1c], 4
ja 0x41e511
jne 0x41e515
cmp dword [ebp - 0x18], 0
jbe 0x41e515
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43f448
call fcn.0041e29a
test eax, eax
jge 0x41e536
mov byte [0x44e1d8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e8c8
add ebp, 0x78
leave
ret
Function at 0x41e7b5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x44d3b0], 0
push esi
jne 0x41e728
call fcn.0041e653
test eax, eax
je 0x41e76b
mov eax, dword [0x44d3b0]
cmp eax, 1
jne 0x41e749
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41e76b
pop esi
ret
push eax
call dword [0x44d3b8]
test eax, eax
jne 0x41e7b3
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41e76f
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x44d3b0]
call dword [0x44d3b8]
mov edi, eax
test edi, edi
je 0x41e796
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x41e7b2
lea edi, [esi + 0xff0]
push esi
push dword [0x44d3b0]
call dword [0x44d3b4]
add esi, 0x10
cmp esi, edi
jb 0x41e79c
mov eax, esi
pop edi
pop esi
ret
jmp 0x41e715

Function at 0x41e8c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b074]
jne 0x41e8d2
repz ret
jmp fcn.00424bf0
Function at 0x42bf88
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x44bad0]
je 0x42bfa3
inc edi
cmp edi, 0x17
jb 0x42bf94
cmp edi, 0x17
jae 0x42c123
push ebp
push 3
call fcn.00434072
cmp eax, 1
pop ecx
je 0x42c0ef
push 3
call fcn.00434072
test eax, eax
pop ecx
jne 0x42bfd7
cmp dword [0x44b070], 1
je 0x42c0ef
cmp ebx, 0xfc
je 0x42c122
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x44d9c8
push ebp
call fcn.00423b32
add esp, 0xc
test eax, eax
je 0x42c00d
push esi
push esi
push esi
push esi
push esi
call fcn.0041f89c
add esp, 0x14
push 0x104
mov esi, 0x44d9e1
push esi
push 0
mov byte [0x44dae5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42c051
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00423b32
add esp, 0xc
test eax, eax
je 0x42c051
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041f89c
add esp, 0x14
push esi
call fcn.00421280
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42c096
push esi
call fcn.00421280
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x44dcdc
push 0x43fe64
sub ecx, eax
push ecx
push eax
call fcn.00431804
add esp, 0x14
test eax, eax
je 0x42c096
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041f89c
add esp, 0x14
jmp 0x42c098
xor esi, esi
push 0x43fe60
push ebx
push ebp
call fcn.00432aea
add esp, 0xc
test eax, eax
je 0x42c0b8
push esi
push esi
push esi
push esi
push esi
call fcn.0041f89c
add esp, 0x14
push dword [edi*8 + 0x44bad4]
push ebx
push ebp
call fcn.00432aea
add esp, 0xc
test eax, eax
je 0x42c0da
push esi
push esi
push esi
push esi
push esi
call fcn.0041f89c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00433eb5
add esp, 0xc
jmp 0x42c122
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42c122
cmp ebp, 0xffffffff
je 0x42c122
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44bad4]
push dword [esi]
call fcn.00421280
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x433eb5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004259e2
xor ebx, ebx
cmp dword [0x44df80], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x433f8b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43406b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43406b
push eax
call fcn.00425974
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44df80], eax
call esi
push eax
call fcn.00425974
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44df84], eax
call esi
push eax
call fcn.00425974
mov dword [0x44df88], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00426133
test eax, eax
pop ecx
pop ecx
je 0x433f59
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041f89c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x433f8b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00425974
cmp eax, ebx
pop ecx
mov dword [0x44df90], eax
je 0x433f8b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00425974
pop ecx
mov dword [0x44df8c], eax
mov eax, dword [0x44df8c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x434010
cmp dword [0x44df90], ecx
je 0x434010
push eax
call fcn.004259eb
push dword [0x44df90]
mov esi, eax
call fcn.004259eb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x434010
cmp edi, ebx
je 0x434010
call esi
cmp eax, ebx
je 0x433fdd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x433fdd
test byte [ebp - 0x18], 1
jne 0x434010
lea eax, [ebp - 0x10]
push eax
call fcn.0042616a
test eax, eax
pop ecx
je 0x433ff8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041f89c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x434007
or dword [ebp + 0x10], 0x200000
jmp 0x43404b
or dword [ebp + 0x10], 0x40000
jmp 0x43404b
mov eax, dword [0x44df84]
cmp eax, dword [ebp - 8]
je 0x43404b
push eax
call fcn.004259eb
cmp eax, ebx
pop ecx
je 0x43404b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43404b
mov eax, dword [0x44df88]
cmp eax, dword [ebp - 8]
je 0x43404b
push eax
call fcn.004259eb
cmp eax, ebx
pop ecx
je 0x43404b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44df80]
call fcn.004259eb
cmp eax, ebx
pop ecx
je 0x43406b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43406d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4033b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e597c
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x523228]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x220], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x40359f
cmp word [edi], 0
je 0x40359f
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x40340b
or eax, 0xffffffff
jmp 0x4035a1
call fcn.00402e90
mov ecx, eax
test ecx, ecx
je 0x4035bf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push edi
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0
call fcn.00402570
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00402f40
mov edx, dword [ebp - 0x228]
add esp, 8
test al, al
mov byte [ebp - 4], 0
sete byte [ebp - 0x219]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403482
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x219], 0
mov esi, dword [ebp - 0x22c]
je 0x403499
or edi, 0xffffffff
jmp 0x40357f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00488730
mov eax, dword [ebp - 0x220]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x218]
jne 0x4034e6
xor edi, edi
jmp 0x40357f
mov eax, dword [ebp - 0x220]
mov eax, dword [eax + 4]
sub eax, 0x10
push eax
call fcn.00402c20
add eax, 0x10
add esp, 4
mov dword [ebp - 0x224], eax
push dword [esi - 0xc]
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
push esi
call fcn.00402b20
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00402570
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004415f0
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.00402970
push 0xa
push 0
push dword [ebp - 0x230]
call fcn.0049557d
add esp, 0xc
lea ecx, [ebp - 0x230]
mov edi, eax
call fcn.00402970
lea ecx, [ebp - 0x224]
call fcn.00402970
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40359b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
jmp 0x4035a1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f043
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402bd0
int3
Function at 0x403ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403f49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403f49
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403f3a
cmp esi, edx
jae 0x403f49
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403f28
cmp esi, edx
jae 0x403f49
cmp word [esi], 0
je 0x403f49
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40b2c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e61e6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x523228]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x40b36c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x40b36c
call fcn.0040a4b0
mov edi, eax
jmp 0x40b48b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40b38f
call fcn.0040a4b0
jmp 0x40b47e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x40b3ad
call fcn.0040a4b0
jmp 0x40b47e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40b3ce
mov edi, 0x8007000e
jmp 0x40b480
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x40b4c4
jb 0x40b3ec
cmp eax, 0xffffffff
ja 0x40b4c4
cmp eax, 0x400
jbe 0x40b401
push eax
lea ecx, [ebp - 0x418]
call fcn.0040a3d0
jmp 0x40b427
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x40b427
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x40b43e
mov edi, 0x8007000e
jmp 0x40b480
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40b45e
call fcn.0040a4b0
jmp 0x40b47e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040b120
mov edi, eax
test esi, esi
je 0x40b48b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40b4a4
lea ecx, [ebp - 0x418]
call fcn.0040a7d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044f043
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00402bd0
int3
Function at 0x40d840
Capabilities:
Check os version
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e63ae
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x523228]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x338], esi
call fcn.00402e90
mov ecx, eax
test ecx, ecx
je 0x40d97e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
push 0x20a
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00488730
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.LdsDumpUper
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d900
sub eax, edx
lea ecx, [esi + 4]
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00403db0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x330]
mov byte [esi], 0
push eax
mov dword [ebp - 0x330], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d961
cmp dword [ebp - 0x320], 2
jne 0x40d961
cmp dword [ebp - 0x32c], 6
jb 0x40d961
mov byte [esi], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f043
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402bd0
int3