joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4023c8
cmp byte [esi + ebx - 1], 0xa
je 0x40239c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405120], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402830
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x108]
sub esp, 0x114
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
sub esp, 8
test eax, eax
jne 0x402860
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x406000
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x402858
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ebx, dword [ebp - 4]
mov eax, 1
sub esp, 4
leave
ret

Function at 0x4029e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, dword [ebp - 4]
test edx, edx
je 0x402a20
leave
ret
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, 0xffffffff
leave
ret

Function at 0x402a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, eax
sub esp, 0x14
mov eax, dword [ebp - 4]
test edx, edx
je 0x402a90
leave
ret
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov eax, 0xffffffff
leave
ret

Function at 0x402b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
mov eax, 0xffffffff
cmovne eax, dword [ebp - 4]
leave
ret
Function at 0x402b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
mov eax, 0xffffffff
cmovne eax, dword [ebp - 4]
leave
ret
Function at 0x404280
Capabilities:
Access peb ldr_data
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x405e04
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405e6a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404450
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ea4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405e54
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e71
lea eax, [ebp - 0x10]
call fcn.004041e0
ret

Function at 0x40ae40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ae79
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042d0
jmp 0x40ae82
mov eax, ebx
mov edx, esi
call fcn.00404234
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ae8c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aead
mov al, byte [esp]
jmp 0x40aeaf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b544
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b3ac
mov eax, dword [0x451fe8]
cmp byte [eax], 0
je 0x40b5c0
mov eax, dword [0x451e1c]
call fcn.00402d10
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408630
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b608
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b5f6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x451dd0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x453664]
call fcn.00405270
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x43bd4d1d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3161f95
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
mov ecx, 0x225c2fe0
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x64143b55
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4cc4e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
add edx, edi
mov ebx, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0x24]
add edx, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x4cc54c
mov eax, dword [ecx + esi*4]
xor edx, edx
mov cl, byte [eax + edi]
add eax, edi
test cl, cl
je 0x4cc53f
movzx ecx, cl
lea eax, [eax + 1]
or ecx, 0x60
add edx, ecx
mov cl, byte [eax]
add edx, edx
test cl, cl
jne 0x4cc52c
cmp edx, dword [ebp - 4]
je 0x4cc555
mov ecx, dword [ebp - 8]
inc esi
cmp esi, ebx
jb 0x4cc51e
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e4567
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e4218

Function at 0x4e4572
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e43a2

Function at 0x4ed725
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ed3a2
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x402c00
pop dword [ebp - 0x34]
mov eax, 0x68d641b3
add eax, 0x9769ea4d
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x43f043f4
sub dword [ebp - 0x44], 0xf59dfea9
mov dword [ebp - 0x40], 0x5325915
add dword [ebp - 0x40], 0x2d00f330
mov dword [ebp - 0x3c], 0x5dc84523
sub dword [ebp - 0x3c], 0x117c00f5
mov dword [ebp - 0x38], 0xf2c8c625
sub dword [ebp - 0x38], 0xf2c8c625
lea eax, [ebp - 0x44]
push eax
mov eax, 0x5e076f2c
sub eax, 0x5dc6eea0
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe4f6a88c
sub dword [ebp - 0x44], 0x70843f36
mov dword [ebp - 0x40], 0xfd535e46
sub dword [ebp - 0x40], 0xbbe6fcd1
mov dword [ebp - 0x3c], 0x5edc0a9
sub dword [ebp - 0x3c], 0xa27e543d
mov dword [ebp - 0x38], 0xdc17d182
sub dword [ebp - 0x38], 0xdc17d182
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x34652
push 0
call eax
mov ecx, 0x42663e95
add ecx, 0xbd9a003e
xor edx, edx
add edx, eax
mov edi, 0x49fa2135
add edi, 0xb646eecb
add edi, dword [ebp - 0x34]
mov esi, 0x4d664471
add esi, 0x61bc0f05
mov ebx, dword [edi]
add dword [ebp - 0x28], 0x8ebb1f39
add ebx, esi
xor dword [ebp - 0x1c], 0x81aa2d74
mov dword [edx], ebx
sub dword [ebp - 0x28], ebx
add edx, 4
add edi, 0x746b0651
add edi, 0x8b94f9b3
loop 0x402d1f
add eax, 0xee1f
mov ebx, eax
add eax, 0x162af51b
add eax, 0xe9d50aea
mov ecx, 0x4c87d6dc
sub ecx, 0x4c47d6dc
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401059
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401070
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4010a5
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4010a1
cmp edi, eax
jae 0x4010a5
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x401093
cmp edi, eax
jb 0x4010a9
xor eax, eax
jmp 0x4010b2
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4011b9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4109f8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00408d60
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x401200
xor al, al
jmp 0x401220
cmp dword [ebp - 0x7c], 5
jb 0x4011fc
jbe 0x40120c
mov al, 1
jmp 0x401220
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
jae 0x401220
cmp word [ebp + 0x94], 4
sbb al, al
inc al
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.00408ace
add ebp, 0xa0
leave
ret

Function at 0x401709
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov edi, eax
mov eax, dword [edi]
push 0
push eax
call ebx
test eax, eax
jne 0x401738
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401738
xor al, al
jmp 0x4017c8
mov eax, dword [0x41174c]
push esi
mov ecx, 0x41174c
call dword [eax + 0xc]
or dword [ebp - 8], 0xffffffff
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x104
mov esi, eax
mov dword [ebp - 0x10], eax
call fcn.00402751
mov edi, dword [edi]
push eax
push 0
push 0x40ec30
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004024ef
test esi, esi
je 0x4017ba
cmp esi, 0x6f
je 0x4017ba
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4017ba
mov edi, dword [ebp + 8]
add edi, 0x1c
lea eax, [ebp - 4]
call fcn.0040234a
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
mov al, 1
jmp 0x4017c7
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
xor al, al
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x4017ce
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x41174c]
mov ecx, 0x41174c
call dword [eax + 0xc]
or dword [ebp - 0xc], 0xffffffff
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x104
mov esi, eax
mov dword [ebp - 0x14], eax
call fcn.00402751
push eax
xor ebx, ebx
push ebx
push ebx
push 0x8026
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.004024ef
cmp esi, ebx
jge 0x401836
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
xor al, al
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
lea eax, [ebp - 8]
call fcn.004022f4
push 0x40eba0
lea eax, [ebp - 8]
call fcn.00402514
mov esi, dword [ebp - 8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401874
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401874
lea eax, [esi - 0x10]
call fcn.004010b5
jmp 0x401824
push str.Temp
lea eax, [ebp - 8]
call fcn.00402514
push edi
lea eax, [ebp - 8]
call fcn.00401709
test al, al
jne 0x4018a8
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004010b5
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
mov al, bl
jmp 0x401831
add edi, 0x20
lea eax, [ebp - 8]
call fcn.0040234a
mov bl, 1
jmp 0x40188e

Function at 0x4018b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41174c]
push esi
push edi
mov ecx, 0x41174c
call dword [eax + 0xc]
or dword [ebp - 8], 0xffffffff
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
mov edi, 0x104
push edi
mov esi, eax
mov dword [ebp - 0x10], eax
call fcn.00402751
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004024ef
test esi, esi
je 0x40192d
cmp esi, edi
jae 0x40192d
push ebx
lea eax, [ebp - 4]
call fcn.00401709
test al, al
je 0x40192d
lea edi, [ebx + 0x20]
lea eax, [ebp - 4]
call fcn.0040234a
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
mov al, 1
jmp 0x40193a
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
xor al, al
pop edi
pop esi
leave
ret
Function at 0x40193e
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4109f8]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x218], 0xffffffff
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x21c], bl
call fcn.00408d60
mov eax, dword [esi + 0x20]
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push ebx
push 0x40ec44
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401ab4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
call fcn.004022f4
add esi, 0x10
lea ebx, [ebp - 0x214]
call fcn.00402444
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
call fcn.004010b5
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, 0x40ebb0
push edi
push 0x67
xor ebx, ebx
push ebx
call esi
mov dword [ebp - 0x214], eax
cmp eax, ebx
jne 0x401a08
push edi
push 0x66
push ebx
mov byte [ebp - 0x21c], 1
call esi
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x401ab4
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401ab4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebx
je 0x401ab4
push ebx
push ebx
push 4
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x218], eax
cmp eax, 0xffffffff
je 0x401ab4
push dword [ebp - 0x21c]
xor eax, eax
push dword [ebp - 0x218]
lea edi, [ebp - 0x228]
push dword [ebp - 0x214]
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov ecx, esi
call fcn.00401ce4
add esp, 0xc
test eax, eax
jne 0x401aa1
push ebx
push ebx
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x401ab4
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x218], 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ace
leave
ret
Function at 0x401ce4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4109f8]
xor eax, ebp
mov dword [ebp - 8], eax
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xa0], eax
jne 0x401d35
push 0
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401ee1
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x80], eax
jne 0x401ee1
jmp 0x401ec5
cmp dword [ebp + 8], 0xd
jb 0x401ee1
xor ebx, ebx
lea eax, [ebp - 0x90]
mov edx, edi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x90], 0x401cce
mov dword [ebp - 0x8c], 0x401cd9
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
call fcn.00404801
sub dword [ebp + 8], 0xd
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
add edi, 5
mov eax, dword [edi]
push eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x84], eax
call fcn.0040c827
mov esi, eax
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 8]
push eax
add edi, 8
push edi
lea eax, [ebp - 0x84]
push eax
push esi
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x80], ebx
call fcn.004046b7
add esp, 0x14
push dword [ebp - 0x6c]
mov edi, eax
lea eax, [ebp - 0x90]
push eax
call dword [ebp - 0x8c]
push dword [ebp - 0x68]
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x6c], ebx
call dword [ebp - 0x8c]
add esp, 0x10
mov dword [ebp - 0x68], ebx
cmp edi, ebx
je 0x401e03
or edi, 0xffffffff
push esi
call fcn.0040c86b
pop ecx
mov eax, edi
jmp 0x401ee4
mov ecx, dword [esi]
add esi, 4
mov edi, dword [esi]
push 4
pop eax
add esi, eax
mov ebx, dword [esi]
add esi, eax
mov edx, dword [esi]
add esi, eax
mov dword [ebp - 0x94], edx
mov edx, dword [esi]
push ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x98], edx
add esi, eax
call fcn.0040c827
pop ecx
push dword [ebp - 0x80]
mov dword [ebp - 0x84], eax
push eax
push dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
push eax
lea edx, [eax + ebx]
lea eax, [ebx + edi]
add eax, esi
push eax
push ebx
lea eax, [edi + esi]
push eax
add edx, edi
push edi
add edx, esi
push esi
call fcn.0040486e
add esp, 0x24
test eax, eax
je 0x401e82
push dword [ebp - 0x84]
call fcn.0040c86b
mov esi, dword [ebp - 0x88]
xor edi, edi
pop ecx
inc edi
jmp 0x401df5
mov esi, dword [ebp - 0x80]
push 0
lea eax, [ebp - 0x9c]
push eax
push esi
push dword [ebp - 0x84]
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401ec9
cmp dword [ebp - 0x9c], esi
jne 0x401ec9
push dword [ebp - 0x84]
call fcn.0040c86b
pop ecx
push dword [ebp - 0x88]
call fcn.0040c86b
pop ecx
xor eax, eax
jmp 0x401ee4
push dword [ebp - 0x84]
call fcn.0040c86b
pop ecx
push dword [ebp - 0x88]
call fcn.0040c86b
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408ace
leave
ret