joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570c68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405388
xor eax, eax
push ebp
push 0x570cfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404f08
mov eax, dword [ebp - 4]
test eax, eax
je 0x570ca4
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test bx, bx
jbe 0x570cde
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
movzx edx, word [ebp - 6]
xor dx, 0xf
call fcn.004050f0
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004051d4
inc edi
dec bx
jne 0x570caf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570d03
lea eax, [ebp - 0xc]
call fcn.00404f08
lea eax, [ebp - 4]
call fcn.00404f08
ret

Function at 0x572cc0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x599e90
movzx edx, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x572cce
xor ebx, ebx
mov ecx, 0x599a90
mov eax, ebx
mov edx, 8
test al, 1
je 0x572cfd
shr eax, 1
xor eax, esi
jmp 0x572cff
shr eax, 1
dec edx
jne 0x572cf3
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x572cec
pop esi
pop ebx
ret

Function at 0x572d14
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x599a90
test esi, esi
je 0x572d29
test edi, edi
jg 0x572d30
xor eax, eax
jmp 0x572e2f
mov ebx, 0xedb88200
cmp dword [0x599a8c], 0
je 0x572d43
call fcn.00572cc0
xor ebx, 0xffffffff
cmp edi, 8
jl 0x572e0b
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x572d4f
test edi, edi
je 0x572e2a
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x572e0f
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x574624
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x574651
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x5746d0
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00572fe8
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x57469e
mov cx, word [esp]
sub cx, si
jmp 0x5746a0
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x574687
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5746c6
mov cx, word [esp]
sub cx, si
jmp 0x5746c8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5746af
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x57472d
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.005742f8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x574718
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x57472d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x57462e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x577a00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x577a21
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x577a0e
pop edi
pop esi
pop ebx
ret
Function at 0x5796a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405388
lea eax, [ebp - 0x170]
mov edx, dword [0x408aa4]
call fcn.00405b88
xor eax, eax
push ebp
push 0x579828
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5796f4
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x174]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405400
mov eax, dword [ebp - 0x174]
mov edx, 0x57983c
call fcn.00405330
je 0x57972e
lea eax, [ebp - 8]
mov ecx, 0x57983c
mov edx, dword [ebp - 4]
call fcn.00405220
jmp 0x579739
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404fa0
lea eax, [ebp - 0x178]
mov ecx, 0x579848
mov edx, dword [ebp - 8]
call fcn.00405220
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x170]
mov edx, 0x3f
call fcn.0040aaa8
test eax, eax
jne 0x5797e4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x15c]
call fcn.00409ea8
mov eax, dword [ebp - 0xc]
mov edx, 0x579854
call fcn.00405330
je 0x5797ca
mov eax, dword [ebp - 0xc]
mov edx, 0x579860
call fcn.00405330
je 0x5797ca
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.00405220
mov eax, dword [ebp - 0x160]
mov edx, eax
and edx, 0x10
cmp edx, eax
jne 0x5797bc
mov eax, dword [ebp - 0xc]
call fcn.005796a0
jmp 0x5797ca
mov eax, dword [ebp - 0xc]
call fcn.00405398
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x170]
call fcn.0040aaf8
test eax, eax
je 0x579766
lea eax, [ebp - 0x170]
call fcn.0040ab1c
mov eax, dword [ebp - 8]
call fcn.0040ad78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57982f
lea eax, [ebp - 0x178]
mov edx, 2
call fcn.00404f2c
lea eax, [ebp - 0x170]
mov edx, dword [0x408aa4]
call fcn.00405c58
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f2c
ret
Function at 0x57c2c4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x57c3d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x36c]
mov edx, dword [eax]
call dword [edx + 0x38]
test al, al
je 0x57c2f9
xor edx, edx
mov eax, dword [esi + 0x36c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [esi + 0x368]
cmp byte [eax + 0x30], 0
je 0x57c30a
call fcn.00524af4
xor edx, edx
mov eax, dword [esi + 0x480]
call fcn.00458620
mov dl, 1
mov eax, dword [esi + 0x470]
call fcn.00458620
xor edx, edx
mov eax, dword [esi + 0x478]
call fcn.00458620
xor edx, edx
mov eax, dword [esi + 0x3c8]
call fcn.00461b10
xor edx, edx
mov eax, dword [esi + 0x3d8]
call fcn.00461b10
xor edx, edx
mov eax, dword [esi + 0x3d4]
call fcn.00461b10
xor edx, edx
mov eax, dword [esi + 0x3dc]
call fcn.00461b10
xor edx, edx
mov eax, dword [esi + 0x3a8]
call fcn.00461b10
xor ebx, ebx
movzx edx, bl
xor ecx, ecx
mov eax, esi
call fcn.0057e310
inc ebx
cmp bl, 4
jne 0x57c374
lea eax, [ebp - 4]
mov edx, dword [esi + 0x4cc]
call fcn.00405190
mov eax, dword [ebp - 4]
call fcn.0040a9dc
test al, al
je 0x57c3bc
lea eax, [ebp - 8]
mov edx, dword [esi + 0x4cc]
call fcn.00405190
mov eax, dword [ebp - 8]
call fcn.00405398
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57c3de
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f2c
ret
Function at 0x57f558
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x57f561
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57f782
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x4cc]
call fcn.00405190
mov eax, dword [ebp - 0xc]
call fcn.0040a9dc
test al, al
je 0x57f5ba
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x4cc]
call fcn.00405190
mov eax, dword [ebp - 0x10]
call fcn.00405398
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
push ebp
push 0x57f725
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x57f798
push 0x57f7a0
mov ecx, dword [0x5a17f8]
mov dl, 1
mov eax, dword [0x41e680]
call fcn.00423f0c
mov esi, eax
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 0x4cc]
call fcn.00405190
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00423b88
mov eax, esi
call fcn.00403ec4
mov eax, dword [ebx + 0x36c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov dl, 1
mov eax, dword [0x41e57c]
call fcn.00403e94
mov dword [ebp - 8], eax
mov esi, edi
test esi, esi
je 0x57f62c
sub esi, 4
mov esi, dword [esi]
mov eax, edi
call fcn.00405398
mov edx, eax
mov ecx, esi
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov edx, 0x57f7ac
mov eax, dword [ebp - 8]
call fcn.00423b88
mov eax, dword [ebp - 8]
call fcn.00403ec4
movzx eax, byte [0x57f7b4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x36c]
mov cl, 1
mov edx, 0x57f7bc
call fcn.00503568
mov eax, 0x57f7ac
call fcn.00405398
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebx + 0x370]
call fcn.004dc3dc
cmp byte [ebp - 1], 0
je 0x57f69e
mov eax, dword [ebx + 0x370]
call fcn.004df110
mov ecx, 0x57f82c
mov edx, 4
mov eax, ebx
call fcn.0057e310
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0057e478
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00405190
mov ecx, dword [ebp - 0x1c]
mov edx, 1
mov eax, ebx
call fcn.0057e310
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0057e5bc
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00405190
mov ecx, dword [ebp - 0x24]
mov edx, 2
mov eax, ebx
call fcn.0057e310
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0057e540
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.00405190
mov ecx, dword [ebp - 0x2c]
mov edx, 3
mov eax, ebx
call fcn.0057e310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57f72f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f789
lea eax, [ebp - 0x30]
call fcn.004056e8
lea eax, [ebp - 0x2c]
call fcn.00404f08
lea eax, [ebp - 0x28]
call fcn.004056e8
lea eax, [ebp - 0x24]
call fcn.00404f08
lea eax, [ebp - 0x20]
call fcn.004056e8
lea eax, [ebp - 0x1c]
call fcn.00404f08
lea eax, [ebp - 0x18]
call fcn.00407058
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404f2c
ret
Function at 0x401100
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x828
mov eax, dword [0x445164]
mov dword [esp + 0x824], eax
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x830]
mov dword [esp + 4], eax
push ecx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x5c]
mov dword [esp + 0x10], eax
push 0x4365fc
push edx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x1c], eax
call fcn.00419260
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x78]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40118f
mov ecx, dword [esp + 0x824]
call fcn.0041923c
add esp, 0x828
ret 4
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x828]
mov eax, 1
pop esi
call fcn.0041923c
add esp, 0x828
ret 4

Function at 0x4011e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011fb
pop edi
pop ebx
ret 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401211
pop esi
pop edi
xor eax, eax
pop ebx
ret 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401232
cmp esi, eax
jae 0x401209
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401224
cmp esi, eax
jae 0x401209
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret 0xc

Function at 0x401360
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x445164]
push esi
mov esi, dword [esp + 0x214]
push edi
push esi
mov dword [esp + 0x214], eax
mov edi, ecx
call fcn.0041924a
add esp, 4
test eax, eax
je 0x4013dc
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x14]
push 0x436610
push ecx
call fcn.004197f7
lea edx, [esp + 0x10]
push esi
push edx
call fcn.004197cd
add esp, 0x10
push 1
push 0
push 0
push esi
push 0x436604
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4013dc
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.00401100
mov ecx, dword [esp + 0x210]
pop edi
pop esi
call fcn.0041923c
add esp, 0x20c
ret 4
Function at 0x402ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x284], 2
jne 0x402ade
jmp fcn.004027c0
jmp fcn.004024e0

Function at 0x402af0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x436770
mov esi, ecx
call ebx
test eax, eax
mov dword [esi], eax
jne 0x402b0a
pop esi
pop ebx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43675c
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi]
push 0x43674c
push eax
call edi
mov ecx, dword [esi]
push 0x43672c
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi]
push 0x43670c
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push 0x4366f0
push eax
call edi
push 0x4366d4
mov dword [esi + 0x10], eax
call ebx
test eax, eax
mov dword [esi + 4], eax
jne 0x402b62
pop edi
pop esi
pop ebx
ret
push 0x43670c
push eax
call edi
mov ecx, dword [esi + 4]
push 0x43670c
push ecx
mov dword [esi + 0x20], eax
call edi
pop edi
mov dword [esi + 0x1c], eax
pop esi
mov eax, 1
pop ebx
ret

Function at 0x403d00
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x445164]
push edi
mov dword [esp + 0x214], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403d7f
push 0x104
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 8]
push eax
push 0x43683c
push ecx
call fcn.00419260
add esp, 0xc
mov ecx, dword [esp + 0x214]
call fcn.0041923c
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4043f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x433c78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00404240
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401500
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x404482
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x405bb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x445164]
push edi
mov dword [esp + 0x12c], eax
xor eax, eax
mov ecx, 0x47
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jne 0x405c1d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405bfd
cmp eax, 1
jne 0x405c1d
cmp byte [esp + 0x122], 1
jne 0x405c1d
mov eax, 1
mov ecx, dword [esp + 0x12c]
call fcn.0041923c
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
call fcn.0041923c
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x405c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x433e08
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
call fcn.00430945
movzx ecx, word [esp + 0x28]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x40]
push 0x436be0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x405c7e
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
push edi
call fcn.00430945
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x40]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
call fcn.00430945
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x40]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x28]
push 0x1001
push edx
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0042c5f2
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 0x20], 0
lea ecx, [esp + 8]
jne 0x405cf9
mov dword [esp + 0x20], 0xffffffff
call fcn.0042c202
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
push esi
push edi
call fcn.0042bf16
lea ecx, [esp + 8]
call fcn.0042c161
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0042c202
mov ecx, dword [esp + 0x18]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x405d40
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa3c
mov eax, dword [0x445164]
mov dword [esp + 0xa38], eax
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
xor esi, esi
mov word [esp + 0x838], si
mov ecx, 0x81
lea edi, [esp + 0x83a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x428], si
mov ecx, 0x81
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x220], si
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x630], si
mov ecx, 0x81
lea edi, [esp + 0x632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x18], si
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
push 0x1a
lea eax, [esp + 0x840]
push eax
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x838]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.004197f7
lea eax, [esp + 0x20]
push eax
call fcn.0041924a
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.00419d10
add esp, 0x14
cmp eax, esi
je 0x405f37
lea edx, [esp + 0x18]
mov word [eax], si
push edx
lea eax, [esp + 0x42c]
push eax
call fcn.004197f7
lea ecx, [esp + 0x430]
push 0x436c2c
push ecx
call fcn.004197cd
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea edx, [esp + 0x428]
push edx
call edi
test eax, eax
je 0x405e72
mov dword [esp + 0x10], 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x224]
push ecx
call fcn.004197f7
lea edx, [esp + 0x228]
push 0x436c18
push edx
call fcn.004197cd
add esp, 0x10
lea eax, [esp + 0x220]
push eax
call edi
test eax, eax
je 0x405eaf
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x634]
push edx
call fcn.004197f7
lea eax, [esp + 0x638]
push 0x436c04
push eax
call fcn.004197cd
add esp, 0x10
lea ecx, [esp + 0x630]
push ecx
call edi
test eax, eax
mov eax, 1
jne 0x405eed
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], esi
je 0x405f37
cmp dword [esp + 0xc], esi
je 0x405f37
cmp eax, esi
je 0x405f37
mov ecx, ebx
call fcn.00405bb0
test eax, eax
je 0x405f37
lea edx, [esp + 0x220]
push edx
push 0x436be8
add ebx, 0x98
push ebx
call fcn.00419260
add esp, 0xc
mov ecx, dword [esp + 0xa44]
call fcn.0041923c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x1a
lea edi, [ebx + 0x98]
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x436bc8
push edi
call fcn.004197cd
mov ecx, dword [esp + 0xa4c]
add esp, 8
call fcn.0041923c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406170
Capabilities:
Get common file path

Disassembly:
mov eax, dword [ecx + 0x10]
mov edx, dword [eax - 4]
push esi
lea esi, [ecx + 0x10]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, 0x104
or ecx, edx
jge 0x40619d
push 0x104
mov ecx, esi
call fcn.004014b0
mov eax, dword [esi]
push 0
push 0x2b
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [esi]
test eax, eax
je 0x4061bf
push eax
call fcn.0041924a
add esp, 4
test eax, eax
jl 0x4061ed
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x4061ed
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
push 0x436c3c
mov word [ecx + eax*2], 0
call fcn.0041924a
add esp, 4
push eax
push 0x436c3c
mov ecx, esi
call fcn.004042e0
pop esi
ret
push 0x80070057
call fcn.004011c0
int3
Function at 0x4080f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x82c
mov eax, dword [0x445164]
mov dword [esp + 0x828], eax
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x834]
mov dword [esp + 4], eax
push ecx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x60]
mov dword [esp + 0x10], eax
push 0x4365fc
push edx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x1c], eax
call fcn.00419260
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x40817f
mov ecx, dword [esp + 0x828]
call fcn.0041923c
add esp, 0x82c
ret 4
mov eax, dword [esp]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x82c]
mov eax, 1
pop esi
call fcn.0041923c
add esp, 0x82c
ret 4