joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bf4c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
add esp, 1
sub esp, 0x14
jmp 0x6bf554
sub bl, ah
push edx
sete dh
neg bh
bsr bp, bp
cpuid
jmp 0x6bf53c
sub esp, 2
mov cx, word [esp]
cpuid
mov dword [esp], eax
pop bp
jmp 0x6bf5c9
push word [esp + 7]
lea esp, [esp + 1]
lea esp, [esp + 0x18]
pushal
xchg dx, si
inc bp
jmp 0x6bf528
btc ebx, edi
pop word [esp]
setne ah
xchg word [esp], dx
lea edx, [edx + ebp]
pop ax
jmp 0x6bf5b1
push word [esp + 1]
rdtsc
cld
mov edi, esi
mov byte [esp + 1], dh
cpuid
jmp 0x6bf569
ror dh, 7
cpuid
bswap edx
rdtsc
cpuid
lea ebp, [edx + esi]
jmp 0x6bf654
mov edi, 0x4bcbd8de
bsf bx, ax
add esp, 0
mov dx, 0x7f9
cmc
jmp 0x6bf59b
lea ebp, [ebp + 0x8f]
bswap esi
lea esp, [esp + 1]
mov edi, dword [esp]
xchg bh, cl
jmp 0x6bf589
add esp, 0
btr edi, esp
mov byte [esp], dh
rcl ax, cl
shl di, cl
rdtsc
jmp 0x6bf60a
mov di, word [esp]
rcr edi, 7
xchg byte [esp], dl
xchg ecx, eax
mov ebp, 0xdbc571a4
ror ebx, 0xb
jmp 0x6bf620
rdtsc
xchg byte [esp], al
lea edx, [ebx*4]
mov edx, 0xe468e3a
shl si, cl
jmp 0x6bf637

Function at 0x6bfaf7
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
bsf di, si
lea esp, [esp + 1]
jmp 0x6bfb66
mov bh, byte [esp + 8]
mov bx, di
xchg si, dx
sub esp, 4
lea edx, [eax + 9]
pop ebx
jmp 0x6bfb4b
Function at 0x6c01c2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
mov edi, 0x9ac2890e
xchg ch, dl
mov ah, byte [esp + 1]
mov byte [esp], bh
jmp 0x6c01e9
rdtsc
lea esp, [esp + 3]
rcr eax, 0x17
mov bl, bh
mov byte [esp + 2], ch
jmp 0x6c01ab
pop si
add esp, 1
lea esp, [esp + 1]
mov ebx, esi
cmc
mov di, word [esp]
jmp 0x6c020c
cpuid
mov cl, ch
neg ecx
lea ebp, [edx + edx]
push esp
mov bx, 0xa2a1
jmp 0x6c01d3
Function at 0x6c029e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
mov bp, di
call fcn.006c0270
xchg dword [esp + 0xc], ecx
jmp 0x6c02f4
rdtsc
add esp, 5
bsf bx, si
lea ecx, [eax*4]
rdtsc
jmp 0x6c02ce
not cx
rdtsc
pop ecx
xchg byte [esp + 2], bl
lea esi, [esp + eax]
setne ah
jmp 0x6c0292
pop edx
cpuid
mov edx, ebp
lea ecx, [ecx + 0xb3]
rdtsc
lea esi, [edi*4]
jmp 0x6c0321
neg di
mov dh, byte [esp + 9]
cpuid
xchg word [esp + 9], bp
pop word [esp + 0xd]
neg ch
jmp 0x6c02a4
bswap eax
rcl di, cl
setae dh
btc ecx, edi
sub esp, 0x10
jmp 0x6c0354
push esp
xchg edi, ebp
mov bp, word [esp + 5]
lea esp, [esp + 9]
add esp, 1
inc cl
jmp 0x6c030b
bswap esi
lea ebx, [ebp*4]
btr ebp, edx
popal
push dword [esp + 3]
mov dx, word [esp + 2]
jmp 0x6c02bc
sub esp, 0xa
sub esp, 0x18
mov ah, byte [esp + 0x22]
inc cx
bswap ebx
mov byte [esp + 0xf], ah
jmp 0x6c0436
add al, 0x60
lea edx, [ebp - 0x47]
mov bl, bh
jmp 0x6c0339
bswap esi
sub esp, 0x1e
pushal
xchg word [esp + 0xb], bp
bsf di, si
cpuid
jmp 0x6c03e0
mov ecx, dword [esp]
mov al, ah
btc edi, edi
not di
lea edx, [esi - 0xcd]
cpuid
jmp 0x6c03ab
sub esp, 0x18
lea esp, [esp + 0x56]
call fcn.006c040f
rcl dword [ebp - 0x3b], 0xac
pop edi
call 0x33c0ca47
into
loope 0x6c0475
jmp 0x6c038a
rdtsc
rdtsc
inc bl
mov dl, dh
btr esi, edx
rdtsc
jmp 0x6c03cb
mov edx, esi
push edx
pushal
lea esp, [esp + 0x57]
xchg ah, bl
not edx
jmp 0x6c0400
cmp esp, dword [esi - 0x79]
je 0x6c049e
add esp, dword [esi - 1]
je 0x6c04a3
adc ch, bl
ret 0x5c87
xchg dword [esp + 2], ebx
inc ax
neg bx
mov dl, 0xa4
mov edi, dword [esp + 3]
cmc
jmp 0x6c04ec
je 0x6c04c4
add eax, 0x13882d66
mov byte [ebx], dl
lea edx, [ebp + 0x5f]
jmp 0x6c0482
rcl ax, cl
rcl eax, cl
mov byte [esp + 9], bh
cld
pop word [esp + 1]
add esp, 7
cpuid
jmp 0x6c04ff
mov dl, 0xec
mov dl, 0x34
xchg bp, bx
mov si, dx
neg si
push dword [esp + 8]
jmp 0x6c04c3
setbe ah
mov word [esp + 1], bx
call 0x6c050d
jecxz 0x6c0491
les ecx, [eax]
lea edx, [esp + edi]
push edx
lea esp, [esp + 1]
jmp 0x6c05ae
mov esi, dword [esp]
add esp, 0
cld
add esp, 0
bswap edi
mov bl, 0x48
jmp 0x6c0591
cpuid
xchg bp, ax
add esp, 0
xchg di, bp
xchg ch, dl
xchg ah, bl
jmp 0x6c056a
not ebx
xchg byte [esp], cl
lea esp, [esp]
mov dx, 0xa56f
xchg ah, bl
mov ch, byte [esp]
jmp 0x6c0635
xchg dword [esp], esi
lea ebx, [eax*4]
xchg bh, cl
add di, 0x1426
mov bp, di
add esp, 3
jmp 0x6c0581
mov dword [esp + 0x13], eax
bsf cx, ax
mov al, 0x5e
and di, 0x2b82
lea ebp, [eax - 0x7720d7ef]
call fcn.006c0671
xchg byte [ecx], dh
add esp, 8
xchg word [esp + 1], dx
pushal
lea edi, [ebp + 0xff]
mov cx, 0xc85
pop dword [esp + 0x14]
jmp 0x6c05c7
rdtsc
mov dx, word [esp]
lea eax, [ebx*4]
sub esp, 0xe
clc
xchg word [esp], ax
jmp 0x6c05e3
mov al, 0xfe
setle dh
cpuid
cmc
lea edx, [esi + 0x6391002d]
lea edi, [ecx + 0x83]
jmp 0x6c060d

Function at 0x6c0979
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x7c], edi
lea esp, [esp + 0x7c]
jmp 0x6c09bf
mov byte [esp + 7], dh
pop dword [esp]
pop word [esp + 1]
mov dword [esp], esi
jmp 0x6c0931
Function at 0x4028a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4028b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4028f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4028f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4028f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4028e0
cmp esi, eax
jb 0x4028fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4038a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
mov dword [edi + 0xb0], 0
call fcn.00424bd0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40390d
push eax
push 0x440b20
mov ecx, esi
call fcn.00402990
or eax, 0xffffffff
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push edx
push eax
push ecx
push str.dwMajorVersion_d_dwMinorVersion_d_dwBuildNumber_d
push esi
call fcn.00402aa0
mov eax, dword [esp + 0x24]
add esp, 0x14
sub eax, 0
je 0x403abd
sub eax, 1
je 0x403a66
sub eax, 1
je 0x40394f
push 0x440b20
jmp 0x403ac2
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x40397e
push str.Microsoft_Windows_NT
mov ecx, esi
call fcn.00402910
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
cmp eax, 5
jne 0x403a0b
mov eax, dword [esp + 8]
test eax, eax
jne 0x4039b5
push str.Microsoft_Windows_2000
mov ecx, esi
call fcn.00402910
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
cmp eax, 1
jne 0x4039e0
push str.Microsoft_Windows_XP
mov ecx, esi
call fcn.00402910
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
cmp eax, 2
jne 0x403a40
push str.Microsoft_Windows_2003
mov ecx, esi
call fcn.00402910
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
cmp eax, 6
jb 0x403a40
push str.Microsoft_Visat_SP1
mov ecx, esi
call fcn.00402910
mov dword [edi + 0xb0], 1
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
push str.Microsoft_Windows_NT_other_
mov ecx, esi
call fcn.00402910
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422f00
add esp, 0x118
ret
cmp dword [esp + 4], 4
jne 0x403ab6
mov eax, dword [esp + 8]
test eax, eax
jne 0x403a8d
cmp word [esp + 0x16], 0x43
mov ecx, esi
jne 0x403a86
push str.Microsoft_Windows_95_OSR2
jmp 0x403ac4
push str.Microsoft_Windows_95
jmp 0x403ac4
cmp eax, 0xa
jne 0x403aaa
cmp word [esp + 0x16], 0x41
mov ecx, esi
jne 0x403aa3
push str.Microsoft_Windows_98_SE
jmp 0x403ac4
push str.Microsoft_Windows_98
jmp 0x403ac4
cmp eax, 0x5a
jne 0x403ab6
push str.Microsoft_Windows_ME
jmp 0x403ac2
push str.Microsoft_Windows_9X_Other_
jmp 0x403ac2
push str.Microsoft_Win32s
mov ecx, esi
call fcn.00402910
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.00422f00
add esp, 0x118
ret
Function at 0x403ae0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43a5b6
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0xbc], eax
push esi
push edi
mov eax, dword [0x44a5dc]
xor eax, esp
push eax
lea eax, [esp + 0xcc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004077c6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403b35
push 0x80004005
call fcn.00402320
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push str.haoparam.ini
lea ecx, [esi + 0xa4]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0xe0], 0
call fcn.00403cf0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xd8], 1
call fcn.00402b60
mov byte [esp + 0xd4], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403ba3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0xc]
push edi
push 0x58
lea ecx, [esp + 0x1c]
push ecx
push 0x440fb4
push str.name
push str.PARAM
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x14]
lea ecx, [esi + 0xb8]
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x403bd1
sub eax, esi
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
call fcn.00402990
lea eax, [edi - 0x10]
mov dword [esp + 0xd4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xcc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.00422f00
add esp, 0xcc
ret

Function at 0x4046f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 0x1a
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x404764
lea eax, [esp]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404720
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00402990
push 0x29
push 0x4412b8
mov ecx, esi
call fcn.00402290
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00422f00
add esp, 0x20c
ret
push 0
push 0x440b20
mov ecx, esi
call fcn.00402990
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.00422f00
add esp, 0x20c
ret
Function at 0x404790
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4047f6
lea eax, [esp]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4047c0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00402990
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00422f00
add esp, 0x20c
ret
push 0x440ad0
mov ecx, esi
call fcn.00402be0
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.00422f00
add esp, 0x20c
ret

Function at 0x404820
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 0x19
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x404886
lea eax, [esp]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404850
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00402990
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00422f00
add esp, 0x20c
ret
push 0x440ad0
mov ecx, esi
call fcn.00402be0
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.00422f00
add esp, 0x20c
ret

Function at 0x4051a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x230
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esi]
push edi
xor edi, edi
push eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4051f4
pop edi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00422f00
add esp, 0x230
ret 4
mov ecx, dword [esi]
lea eax, [esp + 4]
push eax
push ecx
call fcn.004133cb
cmp dword [esp + 0x238], edi
mov ecx, dword [esi]
lea eax, [esp + 4]
push eax
setne dl
push ecx
mov byte [esp + 0x2c], dl
call fcn.004135c0
mov ecx, dword [esp + 0x230]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00422f00
add esp, 0x230
ret 4
Function at 0x4058f0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [esp + 0x18], ebx
call edi
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0040770a
add esp, 4
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
push ebx
call edi
mov edi, eax
test edi, edi
je 0x40597c
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
lea ecx, [ecx]
test dword [esi + 0xc], 0x100000
je 0x405943
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
mov dword [esp + 0x18], 0
call ebx
push esi
call fcn.0040770f
mov edx, dword [esp + 0x10]
push edx
call fcn.0040770a
add esp, 8
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x405930
mov ebx, 1
test esi, esi
je 0x405989
push esi
call fcn.0040770f
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x405990
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43a2bb
mov eax, dword fs:[0]
push eax
mov eax, 0x271c
call fcn.00424ec0
mov eax, dword [0x44a5dc]
xor eax, esp
mov dword [esp + 0x2718], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a5dc]
xor eax, esp
push eax
lea eax, [esp + 0x2730]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
call fcn.004077c6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4059ed
push 0x80004005
call fcn.00402320
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x2710
lea ecx, [esp + 0x20]
push 0
push ecx
mov dword [esp + 0x2744], 0
call fcn.00424bd0
add esp, 0xc
test esi, esi
jne 0x405a24
xor eax, eax
jmp 0x405a3f
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405a30
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402990
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx - 0xc]
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
lea esi, [edi + 1]
sub eax, esi
or eax, edx
jge 0x405a73
push esi
lea ecx, [esp + 0x18]
call fcn.00402460
mov ecx, dword [esp + 0x14]
test esi, esi
mov word [ecx + edi*2], 0x5c
jl 0x405bbc
cmp esi, dword [ecx - 8]
jg 0x405bbc
test ebx, ebx
mov dword [ecx - 0xc], esi
mov word [ecx + esi*2], 0
jne 0x405a9b
xor eax, eax
jmp 0x405aaf
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405aa0
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.00402290
mov ebp, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405b2a
mov dword [esp + 0x2738], eax
lea eax, [ebp - 0x10]
lea edx, [eax + 0xc]
or ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405b00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x2730]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2718]
xor ecx, esp
call fcn.00422f00
add esp, 0x2728
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0x40
mov edi, eax
push esi
sub edi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
jbe 0x405b84
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
nop
cmp edi, 0x2710
push 0
jbe 0x405b76
lea ecx, [esp + 0x1c]
push ecx
push 0x2710
lea edx, [esp + 0x28]
push edx
push esi
call ebx
sub edi, 0x2710
jne 0x405b50
jmp 0x405b84
lea eax, [esp + 0x1c]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
mov dword [esp + 0x2738], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405bb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x405b02
push 0x80070057
call fcn.00402320
int3
Function at 0x407620
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
test edi, edi
jne 0x40762f
push 0x80004005
call fcn.00402320
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [edx]
push 0
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x4076a7
mov ecx, dword [edi]
test ecx, ecx
jbe 0x4076a2
mov edx, dword [esp]
test edx, edx
jbe 0x40769d
cmp edx, 2
jbe 0x40768e
cmp edx, 7
jne 0x40769d
test cl, 1
jne 0x40769d
shr ecx, 1
cmp ecx, 1
jb 0x40769d
cmp word [esi + ecx*2 - 2], 0
jne 0x40769d
cmp ecx, 1
jbe 0x4076a7
cmp word [esi + ecx*2 - 4], 0
jmp 0x40769b
test cl, 1
jne 0x40769d
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4076a7
mov eax, 0xd
mov word [esi], 0
pop ecx
ret 8

Function at 0x409004
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40904a
call fcn.0040cdf1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40904a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40908d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x409076
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x409076
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40908a
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4128e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x412925
call fcn.0040cdf1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412925
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412940
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041249c
test ebx, ebx
mov esi, eax
je 0x41293e
test edi, edi
je 0x41293e
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4135c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jne 0x4135f3
push dword [ebp + 8]
call edi
push eax
call fcn.00420186
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x20]
cmp eax, dword [ebp - 4]
je 0x41361e
test byte [ebp - 4], 1
je 0x41361e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x41361e
push dword [ebp + 8]
call edi
push eax
call fcn.00420186
lea eax, [esi + 8]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x4136ce
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00413525
pop ecx
lea eax, [esi + 0x10]
pop ecx
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x413654
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00413525
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x41366d
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00413525
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x413698
push dword [ebp + 8]
call edi
push eax
call fcn.00420186
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4136b8
push dword [ebp + 8]
call edi
push eax
call fcn.00420186
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4136ce
push dword [ebp + 8]
call edi
push eax
call fcn.00420186
movzx eax, byte [esi + 0x20]
cmp eax, dword [ebp - 4]
je 0x4136f6
test byte [ebp - 4], 1
jne 0x4136f6
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4136f6
push dword [ebp + 8]
call edi
push eax
call fcn.00420186
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4152a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4152ce
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4152ec
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041520a
jmp 0x4152ec
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4152ec
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0041520a
test edi, edi
mov eax, edi
jne 0x4152d6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x44d768]
test ecx, ecx
je 0x4153af
jmp 0x41529f
ret 8

Function at 0x422f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a5dc]
jne 0x422f0a
repz ret
jmp fcn.00428caf