joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a61a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014704]
jne 0x1000a624
repz ret
jmp fcn.1000ae86

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x402c00
pop dword [ebp - 0x24]
mov eax, 0xe8394c23
add eax, 0x1806dfdd
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xffc32406
add dword [ebp - 0x34], 0x4e8f2145
mov dword [ebp - 0x30], 0xfafbda80
sub dword [ebp - 0x30], 0xc8c88e3b
mov dword [ebp - 0x2c], 0xcdae3c9e
add dword [ebp - 0x2c], 0x7e9e0790
mov dword [ebp - 0x28], 0xe7a3a213
add dword [ebp - 0x28], 0x185c5ded
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x6fbd249f
sub dword [ebp - 0x34], 0xfb4abb49
mov dword [ebp - 0x30], 0x6bd73e27
sub dword [ebp - 0x30], 0x2a6adcb2
mov dword [ebp - 0x2c], 0x542dbfa4
sub dword [ebp - 0x2c], 0xf0be5338
mov dword [ebp - 0x28], 0x177f0907
add dword [ebp - 0x28], 0xe880f6f9
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x37632
push 0
call eax
mov ecx, 0xe89c4b
add ecx, 0xff17ae80
xor ebx, ebx
add ebx, eax
mov edi, str._r57
add edi, dword [ebp - 0x24]
mov edx, 0x7bb7211a
add edx, 0x1b9cbe9c
xor dword [ebp - 0x14], eax
mov esi, dword [edi]
xor dword [ebp - 0xc], ebx
sub esi, edx
mov dword [ebp - 0x14], 0xeee7c1f0
mov dword [ebx], esi
add ebx, 0xedec8020
sub ebx, 0xedec801c
add edi, 0xe8c9e9b2
sub edi, 0xe8c9e9ae
loop 0x402d14
add eax, 0x27a81d32
sub eax, 0x27a6ff33
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa0e970f5
add ecx, 0x5f568f0b
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40238f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x208
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x20c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x220]
mov ebp, 0x100
push edi
xor edi, edi
mov dword [esp + 0x10], eax
mov ecx, edi
mov eax, ecx
mov byte [esp + ecx + 0x14], cl
cdq
idiv dword [esp + 0x228]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x114], al
inc ecx
cmp ecx, ebp
jl 0x4023c2
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x14]
movzx eax, byte [esp + esi + 0x114]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x402408
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x14]
mov byte [esp + esi + 0x14], al
inc esi
mov byte [esp + ebx + 0x14], dl
cmp esi, ebp
jl 0x4023e3
mov ebx, edi
mov ebp, edi
cmp dword [esp + 0x220], ebx
jle 0x402494
inc edi
and edi, 0x800000ff
jns 0x402437
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x14]
movzx esi, cl
add ebx, esi
and ebx, 0x800000ff
jns 0x402450
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x14]
mov byte [esp + edi + 0x14], al
push ecx
mov byte [esp + ebx + 0x18], cl
mov ecx, 0x42e098
mov dword [esp], 0x40495270
call fcn.00402081
push eax
call fcn.004019ae
movzx eax, byte [esp + edi + 0x18]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x10]
movzx eax, al
mov al, byte [esp + eax + 0x14]
xor byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x220]
jl 0x402426
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405eff
add esp, 0x208
ret

Function at 0x403062
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [esp + 0x10], esi
jbe 0x40309f
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x15
push 0
mov byte [edi + esi], al
call dword [sym.imp.USER32.dll_OpenIcon]
mov al, byte [edi + esi]
sub al, 0x57
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edi + esi], al
inc esi
cmp esi, dword [esp + 0x10]
jb 0x403070
pop edi
pop esi
ret

Function at 0x403d0a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
mov edi, 0x4ac
mov esi, 0x47b618
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push edi
push esi
call fcn.00403062
pop ecx
pop ecx
call fcn.00403048
mov edx, 0x47b618
add edx, 0x188
mov esi, 0x42f018
push esi
call edx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x406b09
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406b48
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406b48
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406b48
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406b48
cmp dword [ecx + 0x74], 0xe
jbe 0x406b48
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5e872b
Capabilities:
Encode data using xor

Disassembly:
daa
pop ds
fild qword [ecx + 0xb]
and dword [esi + 0x2d], edi
inc ebx
hlt
cmp eax, 0x94821eb4
sbb dword [ebx + 0x7a71f106], ebx
jnp 0x5e865f
and al, 0xf5
sub dword [ebx - 0x264548e3], eax
xor ebx, ecx
xchg edi, eax
inc edi
add eax, 0x156ff181
dec dword [edx + 0x26]
push ss
mov esp, dword [ecx]
xor bl, 0xe5
dec ecx
aad 0x1c
mov edx, 0x19534269
mov ah, 0xb
adc eax, 0xce335bc7
js 0x5e871b
and ebx, dword [eax - 0x68de5828]
salc
and dword [ebp - 0x694967c1], esp
mov edi, 0x5b32e306
and dh, dh
push 0xccc93da2
or dh, byte [ecx + 0x327d8c18]
pushfd
stosd dword es:[edi], eax
popfd
cmp eax, 0xb10accc9
sbb byte [ebp + edi*2 - 0x625463ce], cl
mov cl, 0x79
push 0xffffffffffffffb8
and ecx, dword [ebp + 0x755bbe09]
lcall 0x984c, 0xf74d3aa5
jge 0x5e86cd
jno 0x5e87b0
mov esp, 0x2420875b
cmp eax, 0x9a80b1f6
xor eax, 0x78f0c78c
invalid
aaa
jecxz 0x5e87ca
push ds
bound eax, qword [eax - 0x31915082]
dec edi
xor dword [ebx], eax
into
inc ebp
cmp ch, 0x5d
jmp dword [edx]
mov ebp, 0x57df0fb
mov dword [0x3e81cdad], eax
pushal
sahf
and byte [edx], ch
pop eax
xchg esp, eax
bound ebx, qword [eax - 0x6c]
nop
nop
xchg dword [edx + 0x5e], esi
dec edx
add al, 0xc8
xchg edi, eax
add byte [eax], al
test dword [edi], ecx
fstp xword [di - 0x49]
dec ebx
dec ebx
fucompi st(5)
cmp bl, byte [esi + 0x5c]
push dword [edx + 0x1d186185]
inc ebp
sahf
rcl byte [esi]
imul esp, dword [eax], 0x2b
dec ebx
xchg esp, eax
movsd dword es:[edi], dword [esi]
sub dword [ebx], ebp
dec esi
jnp 0x5e87d8
push edi
sti
or byte [ecx], bh
mov ebp, 0xaa4992
das
mov dl, byte [ebx + 0x42c03dae]
mov bl, 0x26
jae 0x5e8813
mov dword [0xb623f1fc], edi
mov esi, 0x49367326
xchg ebp, eax
mov ebx, 0x3d6ea398
out dx, eax
sub byte [esi + 0x6f], dl
cwde
mov dword [0x28ef3d6e], eax
push esi
outsd dx, dword [esi]
xchg edx, eax
xor ah, byte [edx - 0x19]
sbb al, 0x10
pop esi
jle 0x5e88ac
arpl word [edx - 0x30fb4a56], bp
in eax, dx
lodsb al, byte [esi]
sub bl, bh
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
mov al, byte [0xafadf085]
pop esi
movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi + 0x74], esi
lea esp, [0x41ac13cd]
and eax, 0x41ac13cd
push esi
cmp byte [ebx - 0x52], ah
add cl, dl
cmp eax, 0x8ff73a9e
adc ebp, dword [edi + 0x26]
mov esp, ds
sub dword [0x85dcb73a], eax
add eax, 0xafa996ba
sti
out dx, al
jns 0x5e882a
mov esp, 0x96cc2b37
std
fistp qword [ebx + 0x912ef2d]
leave
xor eax, 0x77cb35c4
bound ebp, qword [ebp + 0x63]
xchg edi, eax
cli
cmc
arpl word [ecx + ebp*8 + 0x7be0f0a6], bp
cmp edx, dword [edx - 0x4a2a4f68]
xchg ebx, eax
or byte [edi + eax*4 + 0x3e], cl
jns 0x5e8854
imul esi, dword [ecx - 0x47], 0xffffffb8
aam 0x28
and eax, 0xa9ade62e
and al, 0xa6
fstp qword [ebp - 0x26]
and ecx, dword [edx + 0x6f]
out 0xad, al
test eax, 0x5ddda624
fisub dword [ebx]
dec edx
outsd dx, dword [esi]
invalid
Function at 0x4027a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430fb9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x443740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
push 0
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
push 0x43b8bc
mov byte [ebx], 0
call fcn.00406550
push 0
mov dword [ebp - 0x30], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [ebp + 0x1c], 8
mov edi, eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x70
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402848
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
jmp 0x40284a
xor edx, edx
cmp byte [edx], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x402865
xor ecx, ecx
jmp 0x402879
mov ecx, edx
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402870
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00406550
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push 0
push eax
mov ecx, ebx
call fcn.004061e0
cmp dword [ebp - 0x14], 0x10
jb 0x4028a8
push dword [ebp - 0x28]
call fcn.0041bbd5
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp + 0x1c], 8
jb 0x4028c0
push dword [ebp + 8]
call fcn.0041bbd5
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bbda
mov esp, ebp
pop ebp
ret
Function at 0x4028e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431011
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x443740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x44], 0
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push 0x43b8e8
mov dword [ebp - 0x54], esi
mov word [esi], ax
call fcn.00406bf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0x18
xor eax, eax
mov dword [ebp - 0x44], 1
push str.D:languageConfigure.ini
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00406bf0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 8
jb 0x4029d8
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4029db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x2b3
push str.FileSystem.cpp
push eax
push str.pszPath__pszPath_0_
push str.ASSERT__s__LastError0X_X____S__d_
push str.assert
push 0x40
call fcn.00411010
add esp, 0x1c
cmp dword [ebp - 0x14], 8
jb 0x4029bb
push dword [ebp - 0x28]
call fcn.0041bbd5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bbda
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
cmp word [eax], 0
je 0x402980
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x4029aa
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 3
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x43b2d8
mov word [ecx], ax
call fcn.00406bf0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x48], esp
xor eax, eax
push 0xb
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.BaseSetting
mov word [ecx], ax
call fcn.00406bf0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00406870
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004109b0
mov edi, eax
add esp, 0x48
cmp esi, edi
je 0x402aab
cmp dword [esi + 0x14], 8
jb 0x402a90
push dword [esi]
call fcn.0041bbd5
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.004066b0
cmp dword [ebp - 0x2c], 8
jb 0x4029aa
push dword [ebp - 0x40]
call fcn.0041bbd5
add esp, 4
jmp 0x4029aa
Function at 0x402ff0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431090
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x443740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 6
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.PROMPT
mov word [ecx], ax
call fcn.00406bf0
xor edx, edx
lea ecx, [ebp - 0x40]
call fcn.00407220
add esp, 0x18
push 0
push 0x43b8e8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
push 0
call fcn.004053b0
test eax, eax
jne 0x40307e
push 0x3e
push str.MoboPlay_setup_wizard_is_still_running._Please_quit_and_retry.
lea ecx, [ebp - 0x40]
call fcn.00406bf0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 5
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.TITLE
mov word [ecx], ax
call fcn.00406bf0
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.00407220
add esp, 0x18
push 0
push 0x43b8e8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
push 0
call fcn.004053b0
test eax, eax
jne 0x4030da
push 8
push str.MoboPlay
lea ecx, [ebp - 0x28]
call fcn.00406bf0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0x30
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.Setup.exe_CheckMutex
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
call fcn.0041c8b6
int3
Function at 0x403110
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431103
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x443740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x27c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
lea ecx, [ebp - 0x260]
call fcn.004118f0
xor eax, eax
mov dword [ebp - 4], 1
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0041dfb0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x218], ax
jne 0x4031c0
xor ecx, ecx
jmp 0x4031df
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4031d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00406bf0
push str.Setup_
mov edx, esi
mov dword [ebp - 0x27c], 1
lea ecx, [ebp - 0x278]
call fcn.00404ee0
add esp, 4
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x248]
call fcn.00404fd0
add esp, 4
push 0x43b8b8
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x230]
call fcn.00405050
mov edi, eax
add esp, 4
cmp esi, edi
je 0x403272
cmp dword [esi + 0x14], 8
jb 0x403257
push dword [esi]
call fcn.0041bbd5
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.004066b0
cmp dword [ebp - 0x21c], 8
jb 0x403289
push dword [ebp - 0x230]
call fcn.0041bbd5
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x234], 8
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x4032bd
push dword [ebp - 0x248]
call fcn.0041bbd5
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x264], 8
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x4032f5
push dword [ebp - 0x278]
call fcn.0041bbd5
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x4032ff
mov eax, dword [esi]
jmp 0x403301
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40333a
test al, 0x10
je 0x40333a
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push esi
mov word [ecx], ax
call fcn.00406870
call fcn.004101e0
add esp, 0x18
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push esi
mov word [ecx], ax
call fcn.00406870
call fcn.00410020
add esp, 0x18
cmp dword [ebp - 0x24c], 8
jb 0x40337a
push dword [ebp - 0x260]
call fcn.0041bbd5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bbda
mov esp, ebp
pop ebp
ret
Function at 0x4033a0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431148
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x443740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 1
lea edx, [ebp + 8]
xor bl, bl
lea ecx, [ebp - 0x28]
cmp dword [ebp + 0x1c], 8
cmovae edx, dword [ebp + 8]
call fcn.00410550
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403408
test al, 0x10
jne 0x403434
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00406870
call fcn.00410020
add esp, 0x18
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push 0
push 2
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [ebp + 0x34], 8
mov edi, eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
movzx eax, si
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40349e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4034a0
xor eax, eax
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push 0
push ecx
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x4034cf
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 8
jb 0x4034e0
push dword [ebp - 0x28]
call fcn.0041bbd5
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x403505
push dword [ebp + 8]
call fcn.0041bbd5
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x40352a
push dword [ebp + 0x20]
call fcn.0041bbd5
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bbda
mov esp, ebp
pop ebp
ret