joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4293e0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00493270
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x429440
mov eax, dword [ebp - 0x218]
jmp 0x42951b
push 0x4f9bc4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea ecx, [ebp - 0x20c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jbe 0x429515
mov edx, dword [ebp - 0x210]
push edx
call fcn.004915be
add esp, 4
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x210]
push edx
push 0
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4294fa
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0x4f9be0
mov eax, dword [ebp - 0x214]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4294fa
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.004915c7
add esp, 4
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret

Function at 0x429740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3030
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x52d474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401950
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4297a7
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405600
mov al, byte [ebp - 0xd]
jmp 0x4297fd
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402bc0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4297e7
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405600
mov al, byte [ebp - 0xe]
jmp 0x4297fd
mov byte [ebp - 0xf], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405600
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4298d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3053
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x52d474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401950
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x429937
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405600
mov al, byte [ebp - 0xd]
jmp 0x429989
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x14]
call fcn.00402bc0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42996a
mov dword [ebp - 0x18], 1
jmp 0x429971
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405600
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42e3a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3679
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x54]
call fcn.00425c50
mov dword [ebp - 4], 0
push 0x4fa30c
lea ecx, [ebp - 0x40]
call fcn.00405490
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
or eax, 1
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00401ba0
add esp, 8
movzx eax, al
test eax, eax
je 0x42e427
lea ecx, [ebp - 0x54]
call fcn.00426370
test eax, eax
jbe 0x42e427
mov dword [ebp - 0x58], 1
jmp 0x42e42e
mov dword [ebp - 0x58], 0
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x41], cl
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x48]
and edx, 1
je 0x42e44f
and dword [ebp - 0x48], 0xfffffffe
lea ecx, [ebp - 0x40]
call fcn.00404c10
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x42e593
push 0
push str.HEINOTE_MAIN_WND
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x5c], eax
push 0
push str.HEINOTE_MAIN_WND_U
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x60], eax
push 0
push str.HEINOTE_MAIN_WND_B
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x64], eax
push 0
push str.HEINOTE_MAIN_WND_U_B
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x5c], 0
jne 0x42e4b7
cmp dword [ebp - 0x60], 0
jne 0x42e4b7
cmp dword [ebp - 0x64], 0
jne 0x42e4b7
cmp dword [ebp - 0x68], 0
je 0x42e593
push 0x4fa3bc
lea ecx, [ebp - 0x28]
call fcn.00405490
mov byte [ebp - 4], 2
push 0x4fa3d8
lea ecx, [ebp - 0x28]
call fcn.00403050
push 0x4fa3e0
lea ecx, [ebp - 0x28]
call fcn.00403050
push 4
push 0x4fa418
lea ecx, [ebp - 0x28]
call fcn.00402fb0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 6
jne 0x42e563
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x54]
call fcn.004261c0
jmp 0x42e51f
push 0
lea edx, [ebp - 0x78]
push edx
lea ecx, [ebp - 0x4c]
call fcn.00425dd0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00426310
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043f150
movzx ecx, al
test ecx, ecx
je 0x42e561
lea ecx, [ebp - 0x4c]
call fcn.00425d80
mov edx, dword [eax]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x70], eax
push 0
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42e511
jmp 0x42e587
mov byte [ebp - 0x42], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404c10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00425ce0
mov al, byte [ebp - 0x42]
jmp 0x42e5a9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404c10
mov byte [ebp - 0x43], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00425ce0
mov al, byte [ebp - 0x43]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret
Function at 0x42eb30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3752
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.00493270
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.Check.7z.md5
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x114]
push eax
push str.7ZDATAMD5
mov ecx, dword [ebp - 0x268]
call fcn.0042f6a0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp - 0x268]
call fcn.0042f780
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00402fa0
test eax, eax
jne 0x42ec0d
mov byte [ebp - 0x261], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00404c10
mov al, byte [ebp - 0x261]
jmp 0x42ed2f
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.00493270
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.7zData.7z
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x218]
push eax
push str.7ZDATA
mov ecx, dword [ebp - 0x268]
call fcn.0042f6a0
lea ecx, [ebp - 0x218]
push ecx
call fcn.0042e310
add esp, 4
push eax
lea ecx, [ebp - 0x260]
call fcn.00402dd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.004043f0
push eax
lea edx, [ebp - 0x248]
push edx
mov ecx, dword [ebp - 0x268]
call fcn.0042e810
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
call fcn.00402fb0
push eax
lea ecx, [ebp - 0x230]
call fcn.00402fb0
push eax
call fcn.00402320
add esp, 8
mov esi, eax
lea ecx, [ebp - 0x230]
call fcn.00402fb0
cmp esi, eax
jne 0x42ece3
mov dword [ebp - 0x26c], 1
jmp 0x42eced
mov dword [ebp - 0x26c], 0
mov al, byte [ebp - 0x26c]
mov byte [ebp - 0x262], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00404c10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.00404860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00404c10
mov al, byte [ebp - 0x262]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret
Function at 0x42ef60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f37dd
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa4], ecx
cmp dword [ebp + 8], 0
je 0x42efa1
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x42efa8
xor al, al
jmp 0x42f12f
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.00495720
add esp, 8
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x42efcc
xor al, al
jmp 0x42f12f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405490
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x90]
sub ecx, dword [ebp + 8]
add ecx, 1
push ecx
push 0
lea edx, [ebp - 0x70]
push edx
lea ecx, [ebp - 0x28]
call fcn.00402e80
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x28]
call fcn.004030f0
lea ecx, [ebp - 0x70]
call fcn.00404c10
lea ecx, [ebp - 0x28]
call fcn.00402fb0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
je 0x42f03e
cmp dword [ebp - 0x94], 5
jne 0x42f05f
mov byte [ebp - 0x89], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404c10
mov al, byte [ebp - 0x89]
jmp 0x42f12f
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00405490
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x90]
sub edx, dword [ebp + 8]
add edx, 1
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402e80
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x40]
call fcn.004030f0
lea ecx, [ebp - 0x88]
call fcn.00404c10
push str._:____
lea ecx, [ebp - 0x58]
call fcn.00405490
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0xa4]
call fcn.0042f970
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffff
jne 0x42f0ec
mov dword [ebp - 0x98], 1
jmp 0x42f0f6
mov dword [ebp - 0x98], 0
mov cl, byte [ebp - 0x98]
mov byte [ebp - 0x8a], cl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00404c10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404c10
mov al, byte [ebp - 0x8a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret 4
Function at 0x42f150
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.00493270
add esp, 0xc
push 0
mov ecx, dword [ebp + 8]
call fcn.0040d730
movsx ecx, byte [eax]
push ecx
push str._c:_
lea edx, [ebp - 0x108]
push edx
call fcn.00422880
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret 4
Function at 0x42f1f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3810
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28c], ecx
push 1
push 0x64
push 0
push str.http_shellopencommand
push accept
lea eax, [ebp - 0x230]
push eax
call fcn.00402680
add esp, 0x18
mov dword [ebp - 4], 0
push 0
push 0x4fa1cc
lea ecx, [ebp - 0x230]
call fcn.00402ee0
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x230]
call fcn.00402fa0
sub eax, dword [ebp - 0x268]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x268]
add ecx, 1
push ecx
lea edx, [ebp - 0x248]
push edx
lea ecx, [ebp - 0x230]
call fcn.00402e80
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
push eax
lea ecx, [ebp - 0x230]
call fcn.004030f0
lea ecx, [ebp - 0x248]
call fcn.00404c10
push 0
push 0x4fa1d0
lea ecx, [ebp - 0x230]
call fcn.00402ee0
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
push ecx
push 0
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 0x230]
call fcn.00402e80
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
push eax
lea ecx, [ebp - 0x230]
call fcn.004030f0
lea ecx, [ebp - 0x260]
call fcn.00404c10
mov byte [ebp - 0x261], 0
lea ecx, [ebp - 0x230]
call fcn.00402fb0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42f377
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x4fa1d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x42f361
cmp dword [ebp - 0x26c], 0x20
ja 0x42f361
mov dword [ebp - 0x270], 0
jmp 0x42f36b
mov dword [ebp - 0x270], 1
mov dl, byte [ebp - 0x270]
mov byte [ebp - 0x261], dl
movzx eax, byte [ebp - 0x261]
test eax, eax
jne 0x42f43b
push 0x44
push 0
lea ecx, [ebp - 0x2d0]
push ecx
call fcn.00493270
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x2d0], 0x44
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00493270
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._C:Program_FilesInternet_Exploreriexplore.exe___s
lea eax, [ebp - 0x218]
push eax
call fcn.00422680
add esp, 0xc
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x2d0]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42f43b
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x284]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00404c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret 4
Function at 0x42f6a0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
call fcn.00425290
mov ecx, eax
call fcn.00435ed0
mov dword [ebp - 8], eax
push 0x4fa26c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42f6d9
jmp 0x42f76e
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42f720
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x42f76e
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8

Function at 0x42f780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0
push 0x4fa274
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049ae9c
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x42f7cf
push 0x4fa0f1
mov ecx, dword [ebp + 8]
call fcn.00405490
mov ecx, dword [ebp - 0x2c]
or ecx, 1
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
jmp 0x42f828
mov byte [ebp - 0x28], 0
xor edx, edx
mov dword [ebp - 0x27], edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov eax, dword [ebp - 0x30]
push eax
push 0x20
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.0049b0c6
add esp, 0x10
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.0049ac17
add esp, 4
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405490
mov ecx, dword [ebp - 0x2c]
or ecx, 1
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret 8
Function at 0x432050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x924], 0xffffffff
mov dword [ebp - 0x90c], 0
mov byte [ebp - 0x104], 0
push 0xff
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.00493270
add esp, 0xc
call fcn.0040db30
mov dword [ebp - 0x938], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x918], ecx
cmp dword [ebp - 0x918], 0
jne 0x4320c0
mov dword [ebp - 0x92c], 0
jmp 0x43217f
mov edx, dword [ebp - 0x918]
mov dword [ebp - 0x908], edx
mov eax, dword [ebp - 0x908]
add eax, 2
mov dword [ebp - 0x930], eax
mov ecx, dword [ebp - 0x908]
mov dx, word [ecx]
mov word [ebp - 0x90e], dx
add dword [ebp - 0x908], 2
cmp word [ebp - 0x90e], 0
jne 0x4320db
mov eax, dword [ebp - 0x908]
sub eax, dword [ebp - 0x930]
sar eax, 1
mov dword [ebp - 0x934], eax
mov ecx, dword [ebp - 0x934]
add ecx, 1
mov dword [ebp - 0x914], ecx
cmp dword [ebp - 0x914], 0x3fffffff
jle 0x432137
mov dword [ebp - 0x928], 0
jmp 0x432173
mov eax, dword [ebp - 0x914]
shl eax, 1
call fcn.00491e30
mov dword [ebp - 0x93c], esp
mov edx, dword [ebp - 0x938]
push edx
mov eax, dword [ebp - 0x914]
shl eax, 1
push eax
mov ecx, dword [ebp - 0x918]
push ecx
mov edx, dword [ebp - 0x93c]
push edx
call fcn.00431b30
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x92c], eax
mov ecx, dword [ebp - 0x92c]
push ecx
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
lea edx, [ebp - 0x104]
push edx
call fcn.00422880
add esp, 0xc
lea eax, [ebp - 0x90c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x104]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4322c3
xor edx, edx
mov word [ebp - 0x904], dx
push 0x7fe
push 0
lea eax, [ebp - 0x902]
push eax
call fcn.00493270
add esp, 0xc
mov dword [ebp - 0x940], 0x800
lea ecx, [ebp - 0x940]
push ecx
lea edx, [ebp - 0x904]
push edx
push 0
push 0
push str.PnpInstanceID
mov eax, dword [ebp - 0x90c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4322b6
push 3
push 0x4fa9c4
lea ecx, [ebp - 0x904]
push ecx
push 0
call dword [sym.imp.SHLWAPI.dll_StrIsIntlEqualW]
test eax, eax
je 0x4322b6
mov dword [ebp - 0x920], 0
mov dword [ebp - 0x944], 4
lea edx, [ebp - 0x944]
push edx
lea eax, [ebp - 0x920]
push eax
push 0
push 0
push str.MediaSubType
mov ecx, dword [ebp - 0x90c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 2
je 0x43228e
cmp dword [ebp - 0x91c], 0
jne 0x43229a
cmp dword [ebp - 0x920], 1
jne 0x43229a
mov dword [ebp - 0x924], 0
jmp 0x4322b6
cmp dword [ebp - 0x91c], 0
jne 0x4322b6
cmp dword [ebp - 0x920], 2
jne 0x4322b6
mov dword [ebp - 0x924], 1
mov edx, dword [ebp - 0x90c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x924]
lea esp, [ebp - 0x944]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret
Function at 0x432f10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x40c], 0
jmp 0x432f4e
mov eax, dword [ebp - 0x40c]
add eax, 1
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x100
jge 0x432fd3
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x414], 0
jmp 0x432f81
mov edx, dword [ebp - 0x414]
add edx, 1
mov dword [ebp - 0x414], edx
cmp dword [ebp - 0x414], 8
jge 0x432fbb
mov eax, dword [ebp - 0x408]
and eax, 1
je 0x432fab
mov ecx, dword [ebp - 0x408]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 0x408], ecx
jmp 0x432fb9
mov edx, dword [ebp - 0x408]
shr edx, 1
mov dword [ebp - 0x408], edx
jmp 0x432f72
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x408]
mov dword [ebp + eax*4 - 0x404], ecx
jmp 0x432f3f
mov dword [ebp - 0x410], 0xffffffff
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x418], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x418], 0
je 0x43302d
mov ecx, dword [ebp - 0x410]
shr ecx, 8
mov edx, dword [ebp - 0x410]
and edx, 0xff
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
xor edx, eax
xor ecx, dword [ebp + edx*4 - 0x404]
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x432fdd
mov eax, dword [ebp - 0x410]
xor eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret 8

Function at 0x433250
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52d474]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405490
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a9a0
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.00404c10
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00425290
mov ecx, eax
call fcn.00435c40
movzx eax, al
test eax, eax
jne 0x4332a5
or eax, 0xffffffff
jmp 0x4332cd
call fcn.00425290
mov ecx, eax
call fcn.00435f60
mov ecx, eax
call fcn.00432340
call fcn.00425290
mov ecx, eax
call fcn.00435f20
mov ecx, eax
call fcn.00433e10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491511
mov esp, ebp
pop ebp
ret 0x10