joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e3776
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x670440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x5e37b9
call fcn.005c6a7d
mov dword [eax], 0xf
call fcn.005c6a90
mov dword [eax], 0xd
call fcn.005be8c2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00502d42
leave
ret
test eax, eax
jne 0x5e37c0
inc eax
jmp 0x5e37ad
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x5e37ab
xor eax, eax
cmp ecx, 1
setne al
jmp 0x5e37ad

Function at 0x5e55f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5e561d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5e561d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x46f569e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x243a114a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x6e4ed2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
lea esp, [esp + 2]
mov dword [esp + 0xc], edx
setl ah
rdtsc
jmp 0x6e4e5e
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
nop
mov ecx, 0x23372a00
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x1a2d4b7a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403248
push 0x402260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x404184], 0xffffffff
mov dword [0x404188], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x404180]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40417c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x40418c], ecx
call fcn.00402250
mov eax, dword [0x404138]
test eax, eax
jne 0x4020f1
push 0x402240
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00402220
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x404178]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x404174]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x4021ff
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x402165
cmp al, 0x22
jne 0x402157
cmp byte [esi], 0x22
jne 0x40216e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40217e
cmp al, 0x20
ja 0x40217e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40216e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40219f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x4021a4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x4021e4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40216e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4021ff
Function at 0x435b95
Capabilities:
Create process on windows

Disassembly:
push 0x44
push 0
push 0x4a6d20
call fcn.00414700
push 0x10
push 0
push 0x4a6d0c
call fcn.00414700
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push 0x4a6d0c
push 0x4a6d20
push 0
push 0
push 0x20
push 0
push 0
push 0
push ecx
mov eax, 1
push 0
mov dword [0x4a6d20], 0x44
mov dword [0x4a6d4c], 1
mov word [0x4a6d50], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x435c0a
mov edx, dword [0x4a6d0c]
mov dword [esp + 4], edx
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4
Function at 0x4499ac
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
push 0x4a5e00
call fcn.00435ca3
mov ecx, dword [0x4a5e60]
mov edx, dword [ecx + eax*4]
mov edi, dword [edx]
cmp ebx, esi
jne 0x449a33
cmp dword [edi + 0x194], 0
je 0x449a0f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x194]
push 0
push esi
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
movzx edx, word [esp + 0x28]
movzx eax, word [esp + 0x24]
shl edx, 0x10
or edx, eax
push edx
push ebx
push 0x7b
push esi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
push ebx
push 0x4a5e00
call fcn.00444056
mov ebp, eax
cmp ebp, 0xffffffff
je 0x449a0f
mov ecx, dword [0x4a5e74]
mov edx, dword [ecx + ebp*4]
mov ecx, dword [edx]
mov al, byte [ecx + 0x88]
cmp al, 0xe
je 0x449a0f
cmp al, 0xf
je 0x449a0f
cmp al, 0x13
je 0x449a0f
cmp al, 0x10
je 0x449a0f
cmp dword [ecx + 8], 0
je 0x449a0f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push ecx
mov ecx, dword [0x4a5e74]
push edx
mov edx, dword [ecx + ebp*4]
push eax
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d97504
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x31d81123
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4015f9
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1024
call fcn.00407ab0
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x3c]
mov ecx, ebx
call fcn.0040740b
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0
mov ebp, str.Startup
push str.copy
push ebp
call edi
test eax, eax
setne al
mov ecx, ebx
mov byte [esi + 6], al
call fcn.0040740b
push eax
push 1
push str.engine
push ebp
call edi
neg eax
sbb al, al
and byte [esp + 0x10], 0
inc al
lea edi, [esp + 0x11]
mov byte [esi + 5], al
xor eax, eax
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0040740b
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [esp + 0x14]
push 3
push eax
push 0x40b6a0
push str.EnableLangDlg
push ebp
call edi
cmp eax, 1
jne 0x401692
cmp byte [esp + 0x10], 0x79
je 0x40168e
cmp byte [esp + 0x10], 0x59
jne 0x401692
mov byte [esi + 8], 1
mov ecx, ebx
call fcn.0040740b
push eax
lea eax, [esi + 0x48]
push 0x1f4
push eax
push 0x40b6a0
push str.AppName
push ebp
call edi
mov ecx, ebx
call fcn.0040740b
push eax
push 1
push str.count
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and dword [esp + 0x18], 0
mov dword [esi + 0x244], eax
test eax, eax
jle 0x401741
lea eax, [esi + 0x248]
mov dword [esp + 0x14], eax
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
push str.key_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, ebx
call fcn.0040740b
push eax
lea eax, [esp + 0x20]
push 0xa
push eax
lea eax, [esp + 0x34]
push str.0x0009
push eax
push str.Languages
call edi
lea eax, [esp + 0x1e]
push eax
call fcn.00407938
inc dword [esp + 0x1c]
pop ecx
mov ecx, dword [esp + 0x14]
add dword [esp + 0x14], 2
mov word [ecx], ax
mov eax, dword [esp + 0x18]
cmp eax, dword [esi + 0x244]
jl 0x4016e3
mov ecx, ebx
call fcn.0040740b
push eax
lea eax, [esp + 0x20]
push 0xa
push eax
push str.0x0009
push str.Default
push str.Languages
call edi
lea eax, [esp + 0x1e]
push eax
call fcn.00407938
pop ecx
mov word [esi + 0x240], ax
mov ecx, ebx
call fcn.0040740b
push eax
lea eax, [esp + 0x38]
push 0x1000
push eax
push 0x40b6a0
push str.cmdline
push ebp
call edi
sub esp, 0xc
lea eax, [esp + 0x40]
mov dword [esp + 0x20], esp
push 0xffffffffffffffff
push eax
call fcn.004015ba
pop ecx
pop ecx
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
and dword [ecx + 4], 0
mov ecx, esi
call fcn.00401329
and byte [esi + 0x312], 0
add esi, 0x312
mov ecx, ebx
call fcn.0040740b
push eax
push 0x64
push esi
push 0x40b6a0
push str.ProductGUID
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1024
ret
Function at 0x4018f8
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
and byte [ebp - 0x854], 0
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x853]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x854]
xor esi, esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add ebx, 0x312
lea eax, [ebp - 0x854]
push ebx
push eax
call edi
lea eax, [ebp - 0x854]
push 0x40b128
push eax
call edi
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x854]
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401af4
push 1
lea ecx, [ebp - 0x38]
call fcn.00401b09
mov eax, 0x800
and byte [ebp - 0x10], 0
mov edi, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], esi
call fcn.00401e5c
push eax
push esi
push esi
push str.UninstallString
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
lea ecx, [ebp - 0x14]
neg ebx
sbb bl, bl
inc bl
call fcn.00401c24
test bl, bl
je 0x401aec
cmp word [0x40b110], si
mov ecx, dword [0x409200]
push 2
mov eax, 0x40b112
pop ebx
je 0x4019f7
mov dx, word [eax]
add eax, ebx
test dx, dx
jne 0x4019ed
push ecx
mov ecx, 0x40b110
sub eax, ecx
sar eax, 1
dec eax
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00401de9
mov edx, dword [0x409200]
mov ecx, eax
cmp ecx, edx
jne 0x401a53
cmp word [0x40b108], si
mov eax, 0x40b10a
je 0x401a30
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x401a26
mov ecx, 0x40b108
push edx
sub eax, ecx
sar eax, 1
dec eax
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00401de9
mov ecx, eax
cmp ecx, dword [0x409200]
je 0x401aec
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], si
add ecx, 3
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x30
jne 0x401aec
mov dx, word [eax + ecx*2 + 2]
cmp dx, 0x78
je 0x401a80
cmp dx, 0x58
jne 0x401aec
add ecx, ebx
lea ecx, [eax + ecx*2]
mov ax, word [ecx]
cmp ax, si
je 0x401aa8
lea edx, [ebp - 0x18]
cmp ax, 0x20
je 0x401aa8
mov ax, word [ecx]
add ecx, ebx
mov word [edx], ax
add edx, ebx
mov ax, word [ecx]
cmp ax, si
jne 0x401a90
lea eax, [ebp - 0x18]
push 1
push eax
lea ecx, [ebp - 0x54]
call fcn.00401c4b
mov edi, eax
mov ecx, edi
call fcn.00406fc7
push dword [edi + 4]
call fcn.00407938
pop ecx
mov edi, eax
lea ecx, [ebp - 0x54]
call fcn.00401cb7
lea ecx, [ebp - 0x38]
call fcn.00401b92
cmp dword [ebp - 4], esi
je 0x401ae8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x401b04
lea ecx, [ebp - 0x38]
call fcn.00401b92
cmp dword [ebp - 4], esi
je 0x401b02
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024b5
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x4024d3
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov dword [0x40b6ac], eax
mov al, byte [esi]
cmp al, 0x22
jne 0x402509
push esi
call edi
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0x4024fd
cmp al, bl
jne 0x4024ee
cmp byte [esi], 0x22
jne 0x402517
push esi
call edi
mov esi, eax
jmp 0x402517
cmp al, 0x20
jle 0x402517
push esi
call edi
mov esi, eax
cmp byte [esi], 0x20
jg 0x40250d
mov al, byte [esi]
cmp al, bl
je 0x402521
cmp al, 0x20
jle 0x402502
lea eax, [ebp - 0x44]
mov dword [ebp - 0x18], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
pop edi
je 0x40253b
movzx eax, word [ebp - 0x14]
jmp 0x40253e
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push dword [0x40b6ac]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40263e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x22a], bl
jne 0x402761
cmp byte [esi + 0x539], bl
jne 0x402761
mov ax, word [esi + 0x608]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push 0x6b
push 5
push dword [esi + 0x224]
call edi
cmp eax, ebx
jne 0x4026bb
mov ax, word [esi + 0x608]
and ax, 0x3ff
or ah, 4
push eax
push 0x6b
push 5
push dword [esi + 0x224]
call edi
cmp eax, ebx
jne 0x4026bb
push 5
push 0x6b
push dword [esi + 0x224]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x402761
push eax
push dword [esi + 0x224]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x4025a6
push ebx
push eax
push dword [esi + 0x224]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [esi + 0x5a4], eax
lea eax, [ebp - 0xc]
push eax
push 0x9003
mov ecx, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.004065a1
test al, al
je 0x402741
lea eax, [esi + 0x270]
lea ecx, [ebp - 0xc]
push eax
call fcn.0040740b
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
push 0x9102
push dword [esi + 0x5a4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x14]
call fcn.00401d65
push dword [ebp - 0x18]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
lea ecx, [ebp - 8]
call fcn.00401d65
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a86
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x22f], bl
jne 0x403c1c
cmp byte [esi + 0x22b], bl
jne 0x403c1c
cmp byte [esi + 0x22e], bl
je 0x403c1c
cmp byte [esi + 0x228], bl
jne 0x403c1c
lea eax, [ebp - 0x270]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x403c1c
lea eax, [ebp - 0x16c]
push eax
push ebx
lea eax, [ebp - 0x270]
push str.Setup
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x403c1c
lea eax, [ebp - 0x16c]
push ebx
push eax
lea ecx, [esi + 0x240]
call fcn.0040740b
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403c1c
push edi
push ebx
push 0x4000000
push 3
push ebx
push 1
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x10
mov dword [ebp - 8], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
push str.__clone_of_
rep stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24c]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 4], eax
call edi
push eax
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.0040202e
push 0x40b360
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push eax
mov dword [ebp - 4], eax
call edi
push eax
lea ecx, [ebp - 0x14]
push dword [ebp - 4]
call fcn.0040202e
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [esi + 0x234]
push esi
call edi
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.0040202e
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
call fcn.0040740b
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
call fcn.00401d65
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x24]
call fcn.00403c22
cmp dword [ebp - 8], 0xffffffff
pop edi
je 0x403c18
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x403c1e
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4045df
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
and byte [ebp - 0x140], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x13f]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x140]
mov dword [ebp - 4], esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x140], 0
je 0x40465e
lea eax, [ebp - 0x140]
mov edi, 0x409278
push esi
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], 0x409280
mov dword [ebp - 0xc], edi
call fcn.00406a5b
mov esi, 0x409274
push 0x40b3ec
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
call fcn.00404cdd
jmp 0x40468f
lea eax, [ebp - 0x140]
mov edi, 0x409278
push esi
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], 0x409280
mov dword [ebp - 0x28], edi
call fcn.00406a5b
mov esi, 0x409274
mov dword [ebp - 4], 2
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], 0x409280
mov dword [ecx + 0x14], edi
call fcn.00406aca
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x4046bb
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x3c]
call fcn.00401b92
test byte [ebp - 4], 1
je 0x4046c9
lea ecx, [ebp - 0x20]
call fcn.00401b92
mov eax, edi
pop edi
pop esi
leave
ret