joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f364
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41f3fe
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x41f3d3
cmp dword [0x4b8c4c], 6
jl 0x41f3aa
push 0
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0041f40c
mov eax, dword [ebp - 4]
call fcn.00407830
push eax
call fcn.0040bbf0
mov ebx, eax
jmp 0x41f3da
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0041f40c
mov eax, dword [ebp - 8]
push eax
call fcn.00422330
pop edx
call fcn.004222d4
push eax
call fcn.00422330
pop edx
call fcn.00422298
mov ebx, eax
jmp 0x41f3da
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.0041ef88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f405
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ec0
ret

Function at 0x41f98c
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push esi
xor eax, eax
push ebp
push 0x41fa23
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_ReadFile
mov ecx, 0x41fa3c
mov edx, 0x100b
call fcn.0041ef10
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0041b7e8
mov esi, eax
mov eax, esi
add eax, 0xfffffffd
sub eax, 3
jae 0x41fa0d
push 4
push esi
call sub.KERNEL32.DLL_ReadFile
push eax
push 0x41f8d8
call sub.KERNEL32.DLL_LoadResource
mov edx, 7
mov eax, 0x4bdd68
mov dword [eax], 0xffffffff
add eax, 4
dec edx
jne 0x41f9ee
push 3
push esi
call sub.KERNEL32.DLL_ReadFile
push eax
push 0x41f914
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fa2a
lea eax, [ebp - 4]
call fcn.00406e60
ret
Function at 0x41fc3c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41fd61
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041fa4c
mov esi, eax
mov eax, dword [0x4ba218]
cmp byte [eax], 0
je 0x41fd09
mov eax, dword [0x4b9fe4]
call fcn.00404b64
call fcn.004044fc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_TlsSetValue
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41fc14]
call fcn.0040895c
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_TlsSetValue
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_RaiseException
push eax
call sub.KERNEL32.DLL_Sleep
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41fd7c
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_RaiseException
push eax
call sub.KERNEL32.DLL_Sleep
jmp 0x41fd45
push pe_nt_image_headers32
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4b9f78]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4bdc34]
call fcn.00408a50
push eax
call fcn.0040c398
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call fcn.0040c3b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fd68
lea eax, [ebp - 4]
mov edx, dword [0x41fc14]
call fcn.00408968
ret

Function at 0x420da0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x420e76
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407268
lea eax, [ebp - 4]
call fcn.00407404
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407830
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x420e60
mov eax, ebx
call fcn.00404380
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x420e59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407830
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x420e43
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x420e88
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x420e43
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420e60
mov eax, dword [ebp - 0x10]
call fcn.0040439c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420e7d
lea eax, [ebp - 4]
call fcn.00406e60
ret
Function at 0x4213ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, 0x4bdd3b
mov dword [ebx], 0x409
mov dword [ebx + 4], 9
mov dword [ebx + 8], 1
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4213d9
mov dword [ebx], eax
test ax, ax
je 0x4213f4
mov edx, eax
and dx, 0x3ff
movzx edx, dx
mov dword [ebx + 4], edx
movzx eax, ax
shr eax, 0xa
mov dword [ebx + 8], eax
mov esi, 0x421420
mov edi, 0x4b8c8c
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov byte [ebx + 0xd], 1
mov al, 1
mov byte [ebx + 0xc], al
test al, al
je 0x421419
push ebp
call fcn.00421350
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4217f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407310
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a40c
mov edi, eax
cmp edi, 0x104
jbe 0x42179f
mov eax, edi
add eax, eax
call fcn.00404380
mov esi, eax
jmp 0x4217a1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a40c
push esi
call fcn.0040c040
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4217da
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4217c4
mov eax, esp
cmp esi, eax
je 0x4217e7
mov eax, esi
call fcn.0040439c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x421820
cmp bl, 0
je 0x42181c
cmp bl, 0x41
jl 0x421817
cmp bl, 0x5a
jg 0x421817
or bl, 0x20
xor al, bl
inc esi
jmp 0x4217fb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x421760

Function at 0x42221c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
test dl, dl
je 0x42222a
add esp, 0xfffffff0
call fcn.00405924
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004053dc
mov dword [0x4bfea8], esi
push 2
push 0x422044
call sub.KERNEL32.DLL_LockResource
mov eax, esi
test bl, bl
je 0x42225e
call fcn.0040597c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x422350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push edx
call sub.KERNEL32.DLL_WideCharToMultiByte
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4223c2
push dword fs:[eax]
mov dword fs:[eax], esp
fnstcw word [ebp - 2]
xor eax, eax
push ebp
push 0x4223a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407830
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4223ab
fnclex
fldcw word [ebp - 2]
ret
Function at 0x438f60
Capabilities:
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, eax
test edx, edx
je 0x439077
mov ebp, edx
mov edi, ebp
call sub.KERNEL32.DLL_SuspendThread
mov ebx, eax
jmp 0x438f82
add edi, dword [esp + 0x10]
push 0x1c
lea eax, [esp + 8]
push eax
push edi
push ebx
call sub.KERNEL32.DLL_GetModuleHandleW
cmp eax, 0x1c
jne 0x438f9b
cmp ebp, dword [esp + 8]
je 0x438f7e
mov byte [esp], 0
mov eax, dword [esi + 0xc]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x438fdf
mov edx, ebx
mov eax, dword [esi + 0xc]
call fcn.0043a5bc
mov edx, eax
cmp edx, ebp
jb 0x438fbf
cmp edx, edi
jb 0x438fc3
xor eax, eax
jmp 0x438fc5
mov al, 1
test al, al
je 0x438fd9
xor ecx, ecx
mov edx, ebx
mov eax, dword [esi + 0xc]
call fcn.0043a768
mov byte [esp], 1
dec ebx
cmp ebx, 0xffffffff
jne 0x438fab
cmp byte [esp], 0
je 0x438fed
mov eax, dword [esi + 0xc]
call fcn.0043a7ec
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x439031
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x439031
mov ebx, eax
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, eax
cmp edx, ebp
jb 0x439017
cmp edx, edi
jb 0x43901b
xor eax, eax
jmp 0x43901d
mov al, 1
test al, al
je 0x43902b
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x439003
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x439097
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x439097
mov ebx, eax
mov edx, ebx
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, eax
cmp edx, ebp
jb 0x43905b
cmp edx, edi
jb 0x43905f
xor eax, eax
jmp 0x439061
mov al, 1
test al, al
je 0x43906f
mov edx, ebx
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x439047
jmp 0x439097
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x43908b
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi + 8]
test eax, eax
je 0x439097
mov edx, dword [eax]
call dword [edx + 0x44]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44679c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
cmp byte [esi + 0x3c], 0
je 0x4467c0
mov ecx, dword [0x4ba10c]
mov dl, 1
mov eax, dword [0x436078]
call fcn.0041feb4
call fcn.00406564
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call fcn.00445cc0
mov eax, dword [eax + 8]
mov edx, dword [0x4ba350]
cmp eax, dword [edx]
jne 0x446831
xor ebx, ebx
mov eax, dword [0x4bff64]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x4467fb
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.0040c3c8
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call fcn.0040c3b8
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.00445c80
cmp ebx, 1
jne 0x44682b
xor eax, eax
call fcn.004456f0
test ebx, ebx
jne 0x4467e4
jmp 0x44683d
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
push esp
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.00445c80
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4498a4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, eax
mov eax, dword [0x4ba2c8]
cmp dword [eax], 1
setg byte [esp]
cmp byte [esp], 0
je 0x4498c4
mov edi, 0xfa0
jmp 0x4498c7
or edi, 0xffffffff
mov ebx, dword [ebp]
and ebx, 0xfffffffe
mov esi, ebx
push esi
mov eax, esi
or eax, 1
push eax
push ebp
call sub.KERNEL32.DLL_ResumeThread
cmp eax, esi
je 0x4498ff
test edi, edi
jge 0x4498fa
call sub.KERNEL32.DLL_VirtualAlloc
cmp byte [esp], 0
je 0x4498f6
mov edi, 0xfa0
jmp 0x4498fc
xor edi, edi
jmp 0x4498fc
pause
dec edi
jmp 0x4498c7
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x449a9c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
call sub.KERNEL32.DLL_WaitForMultipleObjectsEx
cmp eax, dword [ebx + 0xc]
jne 0x449b84
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_GlobalFindAtomW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x449b7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00449908
mov dword [ebx + 8], 1
mov eax, esi
dec eax
neg eax
push eax
lea eax, [ebx + 4]
push eax
call sub.KERNEL32.DLL_SetEvent
push ebx
call sub.KERNEL32.DLL_GetLastError
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_TlsGetValue
sub eax, 1
jb 0x449b35
sub eax, 0x101
jne 0x449b3b
mov byte [ebp - 5], 0
push 0x5b4
call sub.KERNEL32.DLL_GetVersion
jmp 0x449b46
mov byte [ebp - 5], 1
jmp 0x449b46
mov byte [ebp - 5], 0
push 0
call sub.KERNEL32.DLL_GetVersion
push ebx
call sub.KERNEL32.DLL_LoadLibraryW
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00449a10
mov eax, esi
dec eax
push eax
lea eax, [ebx + 4]
push eax
call sub.KERNEL32.DLL_SetEvent
mov dword [ebx + 8], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449b88
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalAlloc
ret
mov byte [ebp - 5], 0
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b940
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00404bc8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
mov edx, eax
mov eax, esi
call fcn.0044b2f0
mov edx, dword [0x4ba354]
cmp byte [edx + 0xc], 0
je 0x44b9a8
mov edx, dword [0x4ba344]
cmp dword [edx], 2
jne 0x44b9a8
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x451b88
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x451b8e
ret
Function at 0x47b34c
Capabilities:
Get file size
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4ba354]
cmp byte [eax + 0xc], 0
je 0x47b4b9
push 0x8000
call sub.KERNEL32.DLL_WideCharToMultiByte
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b4b2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c017c], 0
jne 0x47b3a0
push 0x47b4c0
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
push 0x47b4d0
push ebx
call fcn.0040bb4c
mov dword [0x4c017c], eax
cmp dword [0x4b95d0], 0
jne 0x47b49b
push 0x47b4f0
call sub.KERNEL32.DLL_GetLocaleInfoW
mov dword [0x4b95d0], eax
cmp dword [0x4b95d0], 0
je 0x47b49b
push 0x47b504
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c0180], eax
push 0x47b520
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c0184], eax
push 0x47b544
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c0188], eax
push 0x47b574
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c018c], eax
push 0x47b5a4
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c0190], eax
push 0x47b5c8
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c0194], eax
push 0x47b5f8
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c0198], eax
push 0x47b628
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c019c], eax
push 0x47b65c
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c01a0], eax
push 0x47b670
mov eax, dword [0x4b95d0]
push eax
call fcn.0040bb4c
mov dword [0x4c01a4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b4b9
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_WideCharToMultiByte
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x47b794
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x4c0178]
xor edx, edx
mov dword [0x4c0178], edx
call fcn.0040540c
mov eax, dword [0x4ba1a4]
mov eax, dword [eax]
call fcn.0040540c
mov eax, dword [0x4ba1a4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4ba32c]
mov eax, dword [eax]
call fcn.0040540c
mov eax, dword [0x4ba32c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4c0118]
call fcn.0040540c
xor eax, eax
mov dword [0x4c0118], eax
mov eax, dword [0x4c0174]
call fcn.0040540c
movzx eax, word [0x4c0132]
push eax
call sub.KERNEL32.DLL_CreateThread
mov eax, 0x4c0138
call fcn.00406e60
movzx eax, word [0x4c0130]
push eax
call sub.KERNEL32.DLL_CreateThread
mov eax, 0x4c0134
call fcn.00406e60
cmp dword [0x4b95d0], 0
je 0x47b82d
mov eax, dword [0x4b95d0]
push eax
call sub.KERNEL32.DLL_ResetEvent
ret
Function at 0x47b830
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b9bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_TryEnterCriticalSection
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x47b9d4
call fcn.0041c378
mov edx, dword [ebp - 4]
mov eax, 0x4c0134
call fcn.00407220
mov eax, dword [0x4c0134]
call fcn.00407830
push eax
call sub.KERNEL32.DLL_WriteFile
mov word [0x4c0130], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4bdc34]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.KERNEL32.DLL_WaitForMultipleObjectsEx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x47b9f8
call fcn.0041c378
mov edx, dword [ebp - 0x10]
mov eax, 0x4c0138
call fcn.00407220
mov eax, dword [0x4c0138]
call fcn.00407830
push eax
call sub.KERNEL32.DLL_WriteFile
mov word [0x4c0132], ax
mov eax, dword [0x4c0138]
call fcn.00407830
push eax
call fcn.0040c408
mov dword [0x4c013c], eax
mov dl, 1
mov eax, dword [0x42f964]
call fcn.0043af50
mov dword [0x4c0174], eax
call fcn.0047b34c
mov dl, 1
mov eax, dword [0x467734]
call fcn.0047b0cc
mov dword [0x4c0118], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a01a4]
call fcn.004abe80
mov edx, dword [0x4ba32c]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4a11e8]
call fcn.004ad4cc
mov edx, dword [0x4ba1a4]
mov dword [edx], eax
mov eax, dword [0x4ba1a4]
mov eax, dword [eax]
mov dl, 1
call fcn.004afc98
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4624b4]
call fcn.0046b170
mov dword [0x4c0178], eax
push 0x47ba20
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
mov ecx, 0x468dc8
mov edx, 0x468dd8
mov eax, dword [0x45df74]
call fcn.00439c94
test ebx, ebx
je 0x47b99d
push 0x47ba30
push ebx
call fcn.0040bb4c
mov dword [0x4b9424], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b9c2
lea eax, [ebp - 0x10]
call fcn.00406e60
lea eax, [ebp - 4]
call fcn.00406e60
ret
Function at 0x4b16a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004078bc
mov esp, ebp
pop ebp
ret
Function at 0x401820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x424008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, 0xffffffff
jne 0x401867
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret 4
push edi
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xe
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40189c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x1c], 0xe
jne 0x40187f
mov eax, 0x4d42
cmp word [ebp - 0x14], ax
jne 0x40187f
push ebx
mov ebx, dword [ebp - 0x12]
add ebx, 0xfffffff2
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x4018d3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40194b
xor eax, eax
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x40191c
mov ecx, 0x4000
cmp ebx, 0x4000
mov esi, ebx
push 0
cmova esi, ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
add eax, edi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401962
cmp esi, dword [ebp - 0x1c]
jne 0x401962
mov eax, dword [ebp - 0x20]
mov ecx, 0x4000
add eax, esi
mov dword [ebp - 0x20], eax
sub ebx, esi
jne 0x4018e1
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
cmp eax, 0xc
jb 0x401931
jbe 0x40194d
cmp eax, 0x10
jae 0x40194d
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401931
Function at 0x403fc0
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x424008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push 0x425750
push 0x425548
push 0x425414
push str._s_s_s
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x108]
push str..ini
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
lea eax, [ebp - 0x108]
push eax
push 0x400
lea eax, [ebp - 0x508]
push eax
push 0x420860
push str.GUID
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x508]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea eax, [ebp - 0x908]
push 0x420870
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x910]
push eax
lea eax, [ebp - 0x90c]
push eax
push 0
push 0xf003f
push 0
push 0x420862
push 0
lea eax, [ebp - 0x908]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4040aa
push 0x30
push 0x42564c
push 0x420e58
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x42564c
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push 0x42564c
push 1
push 0
push str.DisplayName
push dword [ebp - 0x90c]
call ebx
push str.Setup.exe
push 0x425854
lea eax, [ebp - 0x508]
push str._s_s_Del
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x508]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x508]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0x90c]
call ebx
push 0x425750
push 0x425854
lea eax, [ebp - 0x508]
push 0x420870
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x508]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x508]
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0x90c]
call ebx
cmp byte [0x425958], 0
lea eax, [ebp - 0x508]
push 0x425548
je 0x404179
push 0x425958
push str._s__s
push eax
call esi
add esp, 0x10
jmp 0x404184
push 0x420ecc
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x508]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0x90c]
call ebx
push dword [ebp - 0x90c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret