joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62722f
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x627250
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x627252
xor eax, eax
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edx + 4], eax
movzx eax, word [ecx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 6]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 0xa]
mov dword [edx + 0x24], eax
mov eax, dword [edx + 0x20]
imul eax, dword [edx + 0x18]
imul eax, dword [edx + 0x1c]
shl eax, 2
mov dword [edx + 0x28], eax
mov esi, dword [ecx + 0x14]
test esi, esi
je 0x6272c5
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x6272c7
xor eax, eax
pop edi
mov dword [edx + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x648010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
imul esi, esi, 0x64
mov edi, dword [ebp + 8]
imul edi, edi, 0x64
add edi, dword [ecx + 0x2c]
mov dword [ebp - 4], ecx
add esi, dword [edi + 4]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [ebx + 0xc]
add eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x118], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], ecx
jne 0x648086
push ecx
push ecx
call sub.MSVCR71.dll__controlfp
mov ecx, dword [ebp - 4]
push 0x30000
push 0
mov dword [ecx + 0x114], eax
call sub.MSVCR71.dll__controlfp
mov eax, dword [ebp - 4]
add esp, 0x10
or dword [eax + 0x118], 1
xor edx, edx
cmp dword [esi + 0x3c], edx
je 0x648161
mov ecx, dword [edi]
mov eax, dword [ebx + 0x10]
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x14]
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
add eax, ecx
cmp word [esi + 0x4e], dx
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], edx
jbe 0x648153
movzx ecx, word [ebp + 8]
shl ecx, 5
add ecx, dword [esi + 0x34]
cmp dword [ecx], edx
je 0x648140
mov eax, dword [ecx + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0x10]
movzx edx, word [eax + 4]
sub edx, 0
je 0x64811b
dec edx
je 0x6480f4
dec edx
jne 0x648140
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x10]
jmp 0x648109
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x14]
push dword [esi + 0x3c]
push edx
push eax
push dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
call fcn.006474aa
jmp 0x648140
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
push dword [esi + 0x3c]
movzx eax, word [eax + 6]
push edx
mov edx, dword [ebp - 0x18]
lea eax, [edx + eax*8]
push eax
push dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
call fcn.00647843
inc dword [ebp + 8]
mov ax, word [ebp + 8]
xor edx, edx
cmp ax, word [esi + 0x4e]
jb 0x6480b8
mov edi, dword [edi]
add edi, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push edx
push dword [ebp + 8]
push edx
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 8]
push edx
push dword [ebp - 0xc]
push edx
push dword [esi + 0x44]
push dword [esi + 0x40]
call fcn.0060c9e2
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x655ee0
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x655f03
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x655f29
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x655f10
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x655fe0
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x656017
push esi
call fcn.00692aa0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x656010
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x656096
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x656080
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x65603a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x656079
cmp eax, 2
je 0x656080
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x656030
cmp eax, 3
je 0x65605d
cmp eax, 1
jne 0x656030
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x656030
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x656030
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.00655ee0
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x6560ad
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.00655ee0
pop esi
pop ebp
ret 4

Function at 0x65c3c2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov dword [esi + 4], ecx
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
jne 0x65c407
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x693f26
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x693f35
xor eax, eax
jmp 0x694018
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x693ff8
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
inc edx
dec edi
jne 0x693f55
pop edi
test eax, eax
je 0x694012
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6f2c88]
inc edx
dec eax
jne 0x693ffc
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x6941b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x6941e5
test ecx, ecx
jne 0x6941ef
test esi, esi
jne 0x6941ef
mov eax, edx
jmp 0x694260
cmp eax, 0xffffffff
jne 0x6941ef
push 0xfffffffffffffffe
pop eax
jmp 0x694260
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x694260
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x694225
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x694244
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x69430d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x694285
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x69428f
xor ecx, ecx
jmp 0x6942ce
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x6942b1
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.006afdb8
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x6942f9
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x69430d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x6941c7
pop edi
pop esi
leave
ret
Function at 0x49af9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040482c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x49e4fc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x49e52a
mov eax, ebx
call fcn.0049efb4
cmp dword [ebx + 0x3c], 0
je 0x49e523
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x49e59b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x49e58d
cmp dword [ebx + 8], 0
je 0x49e54c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x49e55e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49e58d
cmp dword [ebx + 8], 0
je 0x49e53f
cmp eax, 3
je 0x49e571
dec eax
jne 0x49e53f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49e53f
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x49e53f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x49e5b9
cmp dword [ebx + 0x10], 0xcc
je 0x49e5b9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049e5c4
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4010d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.0040996f

Function at 0x402010
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
call fcn.004093e0
push 0
push SysReAllocString
push 0xc40080
mov ecx, esi
call fcn.004104bd
push 0
push 0x80000
push 0x40001
mov ecx, esi
call fcn.004104e9
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x20]
push 1
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push str.UpdateLogin
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402078
mov edx, dword [esi]
mov eax, dword [edx + 0x158]
mov ecx, esi
call eax
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x20]
push ecx
push 1
push 0x80
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.GXDCompress.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4020be
push str.uncompress
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x58538c], eax
test eax, eax
je 0x4020be
mov dword [0x585380], 0xffffffff
call fcn.00402100
call fcn.00402100
push 0
lea ecx, [esi + 0x8c]
call fcn.004105e0
push 0
push 0
push 0
push 0
push esi
push 0x402800
call fcn.00417bd6
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.00402350
mov eax, 1
pop esi
ret
Function at 0x402dc0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x5853d8]
push esi
push 0
push eax
mov esi, ecx
mov dword [0x5853bc], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x78]
test eax, eax
je 0x402deb
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x585390]
test eax, eax
je 0x402dfb
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0040c804
test eax, eax
je 0x402e1f
mov edx, dword [eax + 0x20]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
pop esi
jmp fcn.004090bb

Function at 0x4033a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x6c
mov eax, dword [0x57c6c0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push str.G02_GINFO014.BIN
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403406
push 0
lea eax, [esp + 8]
push eax
push 8
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4033ff
cmp dword [esp + 4], 8
jne 0x4033ff
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [edi], edx
mov dword [ebx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.00508869
add esp, 0x6c
ret

Function at 0x403c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403ca9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403ce4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403ce0
lea ebx, [ebx]
cmp esi, eax
jae 0x403ce4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403cd0
cmp esi, eax
jb 0x403cea
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404bc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x6c
mov eax, dword [0x57c6c0]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
mov edx, dword [eax]
push esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push str.G02_GINFO014.BIN
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c21
push 0
lea eax, [esp + 8]
push eax
push 8
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
call fcn.00508869
add esp, 0x6c
ret 8
Function at 0x406170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52ff4b
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x57c6c0]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push edi
mov eax, dword [0x57c6c0]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push str.PRESENTVERSION.DAT
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406232
push 0x1001
push str.PRESENTVERSION.DAT
lea ecx, [esp + 0x1c]
mov dword [0x585374], 1
call fcn.00420aa7
push 6
push str.00001
lea ecx, [esp + 0x1c]
mov dword [esp + 0x428], 0
call fcn.004201d1
lea ecx, [esp + 0x14]
call fcn.00420435
mov ecx, edi
call fcn.00406170
lea ecx, [esp + 0x14]
mov dword [esp + 0x420], esi
call fcn.0042059d
jmp 0x4062bd
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
push 5
lea ecx, [esp + 0x30]
push ecx
push esi
call edi
test eax, eax
jne 0x406259
mov dword [0x585374], 1
jmp 0x4062b6
cmp dword [esp + 0x10], 5
jne 0x40624d
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x2d], 0
call fcn.0050933f
mov dword [0x585378], eax
lea eax, [esp + 0x28]
push eax
call fcn.0050933f
add esp, 8
cmp eax, 1
mov dword [0x585374], eax
jge 0x406295
mov dword [0x585374], 1
push 0
lea ecx, [esp + 0x14]
push ecx
push 6
lea edx, [esp + 0x30]
push edx
push esi
call edi
test eax, eax
je 0x4062b6
cmp dword [esp + 0x10], 6
jne 0x4062b6
mov byte [esp + 0x2a], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.00508869
mov esp, ebp
pop ebp
ret
Function at 0x4079b0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4079e9
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call dword [0x58538c]
add esp, 0x10
test eax, eax
je 0x4079f0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop esi
pop ecx
ret 0xc
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x407a37
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x407a46
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x1c]
jne 0x407a2a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x407a30
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc

Function at 0x4098d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00411923
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x409911
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00409529
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x40fbe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40fc27
call fcn.00411923
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40fc27
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40fc43
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f75a
mov esi, eax
test edi, edi
je 0x40fc41
test ebx, ebx
je 0x40fc41
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x410b4a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x529c07
call fcn.0050a140
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x410b6f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x410bb5
lea ecx, [ebp - 0x10]
call fcn.00404360
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410366
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404340
mov eax, esi
call fcn.0050a218
ret 8

Function at 0x41d200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41d248
call fcn.00411923
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41d248
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41d28b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41d274
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41d274
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41d288
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41eeb0
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x41eedb
call fcn.00411923
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x41eefe
push eax
push dword [esi + 4]
call fcn.0041ee36
push esi
push eax
mov ecx, 0x58139c
call fcn.0041eaea
mov eax, esi
pop esi
pop ebp
ret 0x18