joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583edc
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x4e3219
push 0x10
lea eax, [ebp - 0x230]
push eax
call fcn.004e3340
mov edi, eax
cmp esi, edi
je 0x4e31f4
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4e31cd
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.0041ecb0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4e31e5
mov eax, dword [esi]
jmp 0x4e31e7
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.0043e650
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4e3219
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.0041ecb0
cmp dword [esi + 0x28], 0
jne 0x4e3295
push 2
lea eax, [ebp - 0x230]
push eax
call fcn.004e3340
mov ebx, eax
lea edi, [esi + 0x18]
cmp edi, ebx
je 0x4e3270
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x4e3249
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.0041ecb0
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x4e3261
mov eax, dword [edi]
jmp 0x4e3263
mov eax, edi
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
push ebx
call fcn.0043e650
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4e3295
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.0041ecb0
cmp dword [esi + 0x40], 0
jne 0x4e330f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0051f290
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x218], 0
jne 0x4e32e4
xor ecx, ecx
jmp 0x4e32ff
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e32f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x30]
call fcn.0041c830
cmp dword [esi + 0x28], 0
je 0x4e331f
cmp dword [esi + 0x10], 0
je 0x4e331f
xor eax, eax
jmp 0x4e3324
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret
Function at 0x4e4420
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
jne 0x4e444f
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0xa
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4e446e
mov dword [edi], 4
jmp 0x4e44fa
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4e4485
mov dword [edi], 5
jmp 0x4e44fa
push ebx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, dword [ebp - 0xc]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e44f4
test esi, esi
je 0x4e44f4
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.004e4540
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret 0x10
mov dword [edi], 6
mov ecx, dword [ebp - 4]
mov eax, 0x80004005
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b15a
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4eba10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584a33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5c9f2c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x5c9f2c
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x59de2c
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004e9390
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f83e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585024
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1b0], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0xa
jne 0x4f84da
push 0x3e9
push dword [esi + 0x16c]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x1b8]
test ecx, ecx
je 0x4f8442
push ecx
mov dword [esp], 0x3f800000
call fcn.00495bf0
mov eax, dword [0x5c778c]
test eax, eax
jne 0x4f847d
push 0x174
call fcn.0051aa14
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4f846f
mov ecx, eax
call fcn.004d57f0
jmp 0x4f8471
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5c778c], eax
mov ecx, eax
call fcn.004d62c0
mov eax, dword [0x5c7790]
test eax, eax
jne 0x4f84bf
push 0x120
call fcn.0051aa14
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4f84b1
mov ecx, eax
call fcn.004f95b0
jmp 0x4f84b3
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5c7790], eax
mov ecx, eax
call fcn.004f9b50
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 9
jne 0x4f84f0
mov eax, dword [esi]
push 0
call dword [eax + 0xd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f9b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5852d4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x5c7790]
test esi, esi
jne 0x4f9bf5
push 0x120
call fcn.0051aa14
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4f9be6
mov ecx, eax
call fcn.004f95b0
mov esi, eax
jmp 0x4f9be8
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x5c7790], esi
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4f9cb2
push 1
mov ecx, esi
call fcn.004a2900
push 0xe8
call fcn.0051aa14
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4f9c35
mov ecx, eax
call fcn.00497e00
mov edi, eax
jmp 0x4f9c37
xor edi, edi
push 3
push 0x83
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00497a90
push 2
mov ecx, edi
call fcn.00499280
movaps xmm0, xmmword [0x589cf0]
sub esp, 0x10
mov eax, esp
mov ecx, edi
movups xmmword [eax], xmm0
call fcn.004993d0
push edi
mov ecx, esi
call fcn.004a2920
push 0
mov ecx, esi
call fcn.004a10d0
movaps xmm0, xmmword [0x589d00]
push 0
push ecx
mov eax, esp
push 0x40000
push SysReAllocStringLen
push 0x5a4604
push ecx
mov dword [eax], 0
lea ecx, [ebp - 0x20]
mov eax, esp
movups xmmword [ebp - 0x20], xmm0
push 0
mov dword [eax], ecx
mov ecx, esi
call fcn.0049f9d0
push 1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004a2bb0
push eax
call fcn.00416a10
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret
Function at 0x4fa8a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585456
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov dword [ebp - 0x248], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x244], 0
push eax
push 0x11
movups xmmword [ebp - 0x240], xmm0
push 0
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x238], 0x51
mov dword [ebp - 0x23c], 0x589fdc
mov dword [ebp - 0x21c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebp - 0x244]
test eax, eax
lea eax, [ebp - 0x248]
cmovns ecx, dword [ebp - 0x21c]
push eax
mov dword [ebp - 0x244], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x4faa0f
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4faa0f
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00404e80
mov eax, dword [ebp - 0x220]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x24c], esp
mov esi, esp
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x228], esi
call fcn.00405650
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.004fa800
mov byte [ebp - 4], 0
lea ecx, [eax + 4]
call fcn.004dc1f0
push ecx
push esp
call fcn.004fa800
lea ecx, [eax + 4]
call fcn.004dc080
mov ecx, dword [ebp - 0x224]
mov ecx, dword [ecx + 0x194]
call fcn.00492d70
mov edx, dword [ebp - 0x220]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4faa0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4faa20
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret 4
Function at 0x4fde50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5859c6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4fdefc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4fdefc
call fcn.00480590
mov esi, eax
jmp 0x4fdfec
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4fdf1f
call fcn.00480590
jmp 0x4fdfdf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4fdf3d
call fcn.00480590
jmp 0x4fdfdf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4fdf5e
mov esi, 0x8007000e
jmp 0x4fdfe1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004fcd20
jmp 0x4fdf88
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4fdf9f
mov esi, 0x8007000e
jmp 0x4fdfe1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4fdfbf
call fcn.00480590
jmp 0x4fdfdf
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004fdcf0
mov esi, eax
test edi, edi
je 0x4fdfec
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4fe010
lea ecx, [ebp - 0x418]
call fcn.004fd2a0
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ff2c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4ff2d9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ff2e5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4ff2e0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5631e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00562de5

Function at 0x5631eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00562f66

Function at 0x56967e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00568e58

Function at 0x569689
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00569093

Function at 0x569af5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056987c
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00404d7f
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404de0
add esp, 0x104
pop ebx
ret
Function at 0x408df4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push edi
mov dword [esp + 4], esi
lea edx, [esp + 4]
xor ecx, ecx
mov eax, ebx
call fcn.00408da8
mov eax, dword [esp]
sub esp, 0xfffffffc
pop edi
mov esi, 0x32051f9a
lcall 0x81f7, 0x3132051f
test dword [edx + 0x5b15ea68], 0x8b04ec83
aam 0x89
sbb al, byte [ebx - 0x2b74fb14]

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x68
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret
Function at 0x406259
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4062af
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4062af
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4062a1
cmp esi, ecx
jae 0x4062af
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40628f
cmp esi, ecx
jae 0x4062af
cmp word [esi], 0
je 0x4062af
mov eax, esi
jmp 0x4062b1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4065c1
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call fcn.0040637a
test eax, eax
je 0x406752
mov edx, dword [eax]
mov ecx, eax
push ebx
push esi
push edi
call dword [edx + 0xc]
add eax, 0x10
mov ebx, 0x104
mov dword [ebp - 4], eax
or edi, 0xffffffff
lea eax, [ebp - 4]
mov dword [ebp - 0x14], edi
push ebx
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.00406b58
push ebx
push eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00406b32
test esi, esi
je 0x406743
cmp esi, 0x104
ja 0x406743
mov esi, dword [ebp - 4]
call fcn.0040637a
push eax
lea ecx, [ebp - 8]
call fcn.00406cd7
test esi, esi
je 0x406654
test esi, 0xffff0000
jne 0x406654
movzx eax, si
lea ecx, [ebp - 8]
push eax
call fcn.00406d00
jmp 0x40665d
push esi
lea ecx, [ebp - 8]
call fcn.00406aa6
mov eax, dword [ebp - 8]
lea ecx, [ebp - 8]
push dword [eax - 0xc]
call fcn.00406b58
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [ebp - 8]
test esi, esi
jne 0x40667d
mov eax, ebx
jmp 0x406688
push dword [esi - 8]
push esi
call fcn.0040b9d6
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.00406bda
lea ecx, [esi - 0x10]
call fcn.00406d7f
add eax, 0x10
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406ad1
lea ecx, [ebp - 0x10]
call fcn.00406cbc
call fcn.0040637a
test eax, eax
je 0x406752
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push 0x104
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.00406b58
push eax
push ebx
push ebx
push 0x26
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00406b32
test esi, esi
js 0x406733
lea ecx, [ebp - 0xc]
call fcn.00406a6c
lea ecx, [ebp - 4]
call fcn.00406a6c
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x40672e
mov ecx, dword [ebp - 4]
cmp dword [ecx - 0xc], ebx
jl 0x40672e
call fcn.00406fc9
test eax, eax
je 0x40672e
mov edi, eax
sub edi, dword [ebp - 4]
sar edi, 1
test edi, edi
sete bl
lea ecx, [ebp - 0xc]
call fcn.00406cbc
lea ecx, [ebp - 8]
call fcn.00406cbc
lea ecx, [ebp - 4]
call fcn.00406cbc
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
push 0x80004005
call fcn.004061d5
int3