joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40626c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x4062da
push 0x11
call esi
test al, al
js 0x4062da
push 0x10
call esi
test al, al
js 0x4062da
push 0x12
call esi
test al, al
js 0x4062da
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4062da
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x4062fe
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x4062fe
dec eax
push eax
push dword [0x40b4cc]
call fcn.00406bc0
mov eax, dword [eax + 8]
jmp 0x406300
xor eax, eax
pop esi
leave
ret 4

Function at 0x406443
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x4064b6
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406498
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406496
cmp dl, 0x5c
je 0x406496
cmp dl, 0x2f
jne 0x4064a2
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406482
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
jmp 0x4064b8
xor eax, eax
leave
ret 4

Function at 0x4064c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4064f5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406780
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x4067c9
cmp byte [esi], al
je 0x4067c9
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b4dc]
push eax
push ecx
call fcn.00406bc0
test eax, eax
je 0x4067f7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x4067d0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4067b5
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406860
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4067d0
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x406800
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406859
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406858
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b4dc]
push eax
push ecx
call fcn.00406bc0
test eax, eax
je 0x406854
cmp dword [eax + 4], 0
je 0x406842
push esi
push edi
push eax
call fcn.00406860
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x406860
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406895
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40690e
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x4068fb
sub ecx, 1
je 0x4068e6
sub ecx, 2
je 0x4068d3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.004064c0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40693b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x406e90
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x407045
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x407044
mov eax, dword [0x40b18c]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x40703c
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x406ffe
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x406f20
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x40701f
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4090f0]
add eax, 1
sub edi, 1
jne 0x407002
cmp edx, 0x1000
je 0x406ef0
mov edx, dword [0x40b18c]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x407050
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x427460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x108]
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
xor eax, eax
push fcn.00427450
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 1
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
xor cx, cx
mov edx, 0xff
call fcn.004095a0
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 4]
call fcn.00449220
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00427450
mov esp, ebp
pop ebp
ret

Function at 0x427510
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
mov edx, 0x59ac28
lea eax, [ebp - 0x18]
call fcn.0040e7c0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004274f0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, str.KABx64
call fcn.00408bb0
push 0
lea eax, [ebp - 0x1c]
call fcn.00427460
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, str.KABx64Direct1Direct1_adobeapp.exe
call fcn.00408cb0
lea eax, [ebp - 0x10]
mov edx, str.Adobe_Cabinet
call fcn.00408bb0
push 0
lea eax, [ebp - 0x1c]
call fcn.00427460
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, str.AdobeCDirect1Direct1_adobeapp.exe
call fcn.00408cb0
mov byte [ebp - 8], 0
add byte [ebp - 8], 1
mov edx, 1
mov eax, 0x5e89e8
call fcn.0056e8d0
mov dword [ebp - 4], eax
xor eax, eax
push fcn.004274e0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x80000001
call fcn.0056e890
mov al, byte [ebp - 8]
cmp al, 1
jl 0x4275fc
sub al, 1
je 0x4275d8
sub al, 1
je 0x4275ec
jmp 0x4275fc
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0056eb00
jmp 0x4275fc
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.0056eb00
nop
movzx eax, byte [ebp - 8]
mov edx, dword [ebp + eax*8 - 0x20]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.0056ece0
mov eax, dword [ebp - 0x1c]
movzx edx, byte [ebp - 8]
mov edx, dword [ebp + edx*8 - 0x1c]
call fcn.00409770
test eax, eax
je 0x42763c
movzx eax, byte [ebp - 8]
mov ecx, dword [ebp + eax*8 - 0x1c]
movzx eax, byte [ebp - 8]
mov edx, dword [ebp + eax*8 - 0x20]
mov eax, dword [ebp - 4]
call fcn.0056eea0
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004274e0
cmp byte [ebp - 8], 2
jl 0x427590
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004274f0
mov esp, ebp
pop ebp
ret
Function at 0x428850
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x140]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00428830
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5f3260], 0
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00408bb0
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 8], eax
jmp 0x428ab3
add byte [ebp - 0xc], 1
mov eax, dword [ebp - 8]
and eax, 1
test al, al
je 0x428ab0
add byte [0x5f3260], 1
push 0
movsx eax, byte [ebp - 0xc]
add eax, 0x40
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.004094a0
mov edx, dword [ebp - 0x10]
movzx eax, byte [0x5f3260]
lea eax, [eax*4 + 0x5f2e5c]
mov ecx, 0x599558
call fcn.00408cb0
mov al, byte [ebp - 0xc]
call fcn.004545c0
movzx ecx, byte [0x5f3260]
mov dword [ecx*8 + 0x5f2f58], eax
mov dword [ecx*8 + 0x5f2f5c], edx
lea eax, [ebp - 0x10]
call fcn.00403ce0
push 0
movsx eax, byte [ebp - 0xc]
add eax, 0x40
lea ecx, [ebp - 0x14]
xor dx, dx
call fcn.004094a0
mov edx, dword [ebp - 0x14]
mov ecx, 0x599558
lea eax, [ebp - 0x10]
call fcn.00408cb0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x428945
mov eax, 0x5ef2f0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jb 0x428a04
sub eax, 2
je 0x428978
sub eax, 1
je 0x428998
sub eax, 1
je 0x4289b4
sub eax, 1
je 0x4289d0
sub eax, 1
je 0x4289ec
jmp 0x428a04
movzx eax, byte [0x5f3260]
lea eax, [eax*4 + 0x5f315c]
mov edx, str._REMOVABLE_
call fcn.00408bb0
jmp 0x428a04
movzx eax, byte [0x5f3260]
lea eax, [eax*4 + 0x5f315c]
mov edx, str._HDD_
call fcn.00408bb0
jmp 0x428a04
movzx eax, byte [0x5f3260]
lea eax, [eax*4 + 0x5f315c]
mov edx, str._NETWORK_
call fcn.00408bb0
jmp 0x428a04
movzx eax, byte [0x5f3260]
lea eax, [eax*4 + 0x5f315c]
mov edx, str._CDROM_
call fcn.00408bb0
jmp 0x428a04
movzx eax, byte [0x5f3260]
lea eax, [eax*4 + 0x5f315c]
mov edx, str._RAMDISK_
call fcn.00408bb0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
movzx eax, byte [0x5f3260]
mov eax, dword [eax*4 + 0x5f2e5c]
mov dword [ebp - 0x2c], eax
mov eax, str.__size:
mov dword [ebp - 0x28], eax
movzx eax, byte [0x5f3260]
lea ebx, [eax*8 + 0x5f2f58]
mov eax, dword [ebx]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0xff
lea edx, [ebp - 0x140]
mov eax, 0xffffffff
call fcn.00405130
lea ecx, [ebp - 0x34]
xor dx, dx
lea eax, [ebp - 0x140]
call fcn.00409430
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x34]
call fcn.0040a200
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, str.bytes_
mov dword [ebp - 0x20], eax
movzx eax, byte [0x5f3260]
mov eax, dword [eax*4 + 0x5f315c]
mov dword [ebp - 0x1c], eax
mov eax, 0x5993a8
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
mov ecx, 6
call fcn.00408f40
shr dword [ebp - 8], 1
cmp dword [ebp - 8], 0
ja 0x4288a8
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00428830
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428b00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x258]
mov dword [ebp - 4], eax
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x138], 0
xor eax, eax
push fcn.00428ae0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00408bb0
mov dword [ebp - 0x130], 0x128
push 0
push 2
call fcn.0056e420
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 8]
call fcn.0056e430
test eax, eax
je 0x428c9c
jmp 0x428c83
push 1
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x10c]
xor cx, cx
mov edx, 0x103
call fcn.004095a0
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
lea eax, [eax*4 + 0x5f0e3c]
call fcn.00408bb0
mov edx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x128]
mov dword [edx*4 + 0x5f1e3c], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax*4 + 0x5f0e3c]
mov dword [ebp - 0x148], eax
mov eax, 0x599600
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax*4 + 0x5f1e3c]
xor edx, edx
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], edx
push dword [ebp - 0x154]
push dword [ebp - 0x158]
mov ecx, 0xff
lea edx, [ebp - 0x258]
mov eax, 0xffffffff
call fcn.004050a0
lea ecx, [ebp - 0x150]
xor dx, dx
lea eax, [ebp - 0x258]
call fcn.00409430
xor cl, cl
xor dx, dx
lea eax, [ebp - 0x150]
call fcn.0040a200
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x140], eax
mov eax, 0x5993a8
mov dword [ebp - 0x13c], eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
mov ecx, 4
call fcn.00408f40
add dword [ebp - 0x134], 1
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 8]
call fcn.0056e440
test eax, eax
jne 0x428b80
mov esi, esi
mov eax, dword [ebp - 0x134]
mov dword [0x5f2e40], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00428ae0
mov esp, ebp
pop ebp
ret
Function at 0x42b3a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x42b44a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x42b466
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x42b466
sub dx, 0x20
je 0x42b440
sub dx, 0x80
je 0x42b440
sub dx, 0x1f62
jb 0x42b466
sub dx, 1
jbe 0x42b440
sub dx, 6
je 0x42b440
sub dx, 0x26
jne 0x42b466
nop
jmp 0x42b440
cmp eax, dword [ebp - 0x20]
jg 0x42b3e8
lea esi, [esi]
jmp 0x42b466
cmp dword [ebp - 0x1c], 2
jne 0x42b45a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x42b466
mov al, byte [ebp - 0xc]
call fcn.0040b400
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x42b4e4
sub ax, 0x21
je 0x42b4f8
sub ax, 0x17
je 0x42b504
sub ax, 0x222
je 0x42b510
sub ax, 0x392
je 0x42b518
sub ax, 1
je 0x42b520
sub ax, 0x1996
je 0x42b528
sub ax, 1
je 0x42b530
sub ax, 6
je 0x42b538
sub ax, 0xb
je 0x42b548
sub ax, 0x1b
je 0x42b540
sub ax, 0x367
je 0x42b550
jmp 0x42b558
mov ax, word [ebp - 0x24]
call fcn.0040b4a0
mov byte [ebp - 0x10], al
jmp 0x42b560
mov byte [ebp - 0x10], 0x20
jmp 0x42b560
mov byte [ebp - 0x10], 0x2e
jmp 0x42b560
mov byte [ebp - 0x10], 0x27
jmp 0x42b560
mov byte [ebp - 0x10], 0x2c
jmp 0x42b560
mov byte [ebp - 0x10], 0x27
jmp 0x42b560
mov byte [ebp - 0x10], 0x20
jmp 0x42b560
mov byte [ebp - 0x10], 0x20
jmp 0x42b560
mov byte [ebp - 0x10], 0x20
jmp 0x42b560
mov byte [ebp - 0x10], 0x20
jmp 0x42b560
mov byte [ebp - 0x10], 0x2d
jmp 0x42b560
mov byte [ebp - 0x10], 0x27
jmp 0x42b560
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x438bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00438bc0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x438ce0
mov al, byte [ebp - 0x110]
test al, al
je 0x438ca9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fc0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409430
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a200
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59d030
call fcn.00452b30
mov edx, 0x438c3a
mov ecx, ebp
call fcn.004141c0
jmp 0x438ce0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59d030
call fcn.00452b30
mov edx, 0x438ca9
mov ecx, ebp
call fcn.004141c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x438da4
mov al, byte [ebp - 0x110]
test al, al
je 0x438d6d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fc0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409430
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a200
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59d030
call fcn.00452b30
mov edx, 0x438cfe
mov ecx, ebp
call fcn.004141c0
jmp 0x438da4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59d030
call fcn.00452b30
mov edx, 0x438d6d
mov ecx, ebp
call fcn.004141c0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00438260
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00438bc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43be60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x59dcbc
call fcn.0040cfd0
test al, al
je 0x43bf46
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0043bf60
xor eax, eax
push fcn.0043be50
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408bb0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0043b070
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0043abc0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0043be50
jmp 0x43bf51
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043e3f0
mov esp, ebp
pop ebp
ret
Function at 0x4483a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.00448390
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408bb0
lea eax, [ebp - 0xc10]
call fcn.00403d20
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x448400
mov eax, 0x5ef2f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4484aa
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040fa10
xor eax, eax
push fcn.00448380
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x44845c
mov eax, 0x5ef2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x448498
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x5a28bc
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x448498
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448380
jmp 0x448508
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4484cc
mov eax, 0x5ef2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x448508
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x5a28bc
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x448508
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448390
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret