joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403029
Capabilities:
Check mutex on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x20
push edi
lea edi, [ebp - 0x88]
sub esp, 0xa4
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x88]
mov dword [esp + 4], edi
mov dword [esp], 0x17
call fcn.00402096
mov edx, 1
cmp byte [ebp - 0x88], 0
je 0x4030f6
mov eax, dword [0x419c4c]
test eax, eax
je 0x403087
mov dword [esp + 8], edi
mov dword [esp + 4], str.Create_mutex:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x94]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x94], 0xc
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x90], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
call sub.kernel32.dll_GetLastError
mov edx, 1
cmp eax, 0xb7
jne 0x4030f6
mov eax, dword [0x419c4c]
test eax, eax
je 0x4030f4
mov dword [esp + 8], str.Instance_already_exists.
mov dword [esp + 4], str.Error:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
mov eax, edx
mov edi, dword [ebp - 4]
leave
ret

Function at 0x4032e1
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ba60
xor esi, esi
mov ecx, 0x7fff
sub esp, eax
mov eax, esi
lea edi, [ebp - 0x8017]
rep stosb byte es:[edi], al
lea ebx, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], str.Path
call sub.kernel32.dll_GetEnvironmentVariableA
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
mov edx, eax
mov eax, esi
repne scasb al, byte es:[edi]
mov esi, 0x7ffe
sub esp, 0xc
sub esi, edx
xor eax, eax
not ecx
dec ecx
cmp esi, ecx
jb 0x403372
mov dword [esp + 4], 0x40e277
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], ebx
mov dword [esp], str.Path
call sub.kernel32.dll_SetEnvironmentVariableA
push esi
push esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4033f8
Capabilities:
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ba60
mov ecx, 0x2000
sub esp, eax
xor eax, eax
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10017]
lea ebx, [ebp - 0x10017]
mov cx, 0x7fff
rep stosb byte es:[edi], al
mov dword [esp + 4], ebx
mov dword [esp], 0x13
call fcn.00402096
mov dword [esp], ebx
lea ebx, [ebp - 0x8018]
mov dword [esp + 4], 0x40e3ce
call sub.msvcrt.dll_strtok
mov esi, eax
test esi, esi
je 0x4034d3
mov dword [esp + 4], 0x3d
mov dword [esp], esi
call sub.msvcrt.dll_strchr
mov edx, dword [ebp + 0xc]
mov byte [eax], 0
inc eax
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov byte [ebp - 0x8018], 0
mov dword [esp + 8], edx
call fcn.00402aa3
mov eax, dword [0x419c4c]
test eax, eax
je 0x4034ad
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.Set_var:_t_s___s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.kernel32.dll_SetEnvironmentVariableA
push edi
push edi
mov dword [esp + 4], 0x40e3ce
mov dword [esp], 0
call sub.msvcrt.dll_strtok
mov esi, eax
jmp 0x403453
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403b8c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, 0x100
mov ebp, esp
xor eax, eax
push edi
push esi
mov esi, 0x400
push ebx
lea edi, [ebp - 0x418]
sub esp, 0x43c
lea ebx, [ebp - 0x41c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x418]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.kernel32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x403bee
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x403bee
add edi, eax
sub esi, eax
jne 0x403bb8
cmp dword [0x411024], 0
lea ebx, [ebp - 0x418]
je 0x403c1a
mov eax, dword [0x419c4c]
test eax, eax
je 0x403c1a
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Java_version_output:__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov dword [esp + 4], 0x22
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x403c4e
mov eax, dword [0x419c4c]
test eax, eax
je 0x403ce0
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_get_version_string:_cannot_find_quote_n
jmp 0x403c96
lea esi, [eax + 1]
mov dword [esp + 4], 0x22
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x403c7b
mov eax, dword [0x419c4c]
test eax, eax
je 0x403ce0
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_get_version_string:_missing_end_quote_n
jmp 0x403c96
sub eax, esi
cmp eax, dword [ebp + 0x10]
jb 0x403c9d
mov eax, dword [0x419c4c]
test eax, eax
je 0x403ce0
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_get_version_string:_data_too_large_n
call sub.msvcrt.dll_fputs
jmp 0x403ce0
mov edi, dword [ebp + 0xc]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
mov dword [esp + 4], str.64_Bit
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, 1
test eax, eax
jne 0x403cdb
mov dword [esp + 4], str.64_bit
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
xor edx, edx
test eax, eax
setne dl
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403ce8
Capabilities:
Create process on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 4
push edi
push esi
lea edx, [ebp - 0x6c]
push ebx
mov edi, edx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
lea esi, [ebp - 0x5c]
mov edi, esi
cmp dword [0x411024], 0
mov cl, 0x11
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 0x100
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
je 0x403d51
mov eax, dword [0x419c4c]
test eax, eax
je 0x403d51
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Create_process:__s_n
mov dword [esp], eax
mov dword [ebp - 0x7c], edx
call sub.msvcrt.dll_fprintf
mov edx, dword [ebp - 0x7c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.kernel32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
mov esi, eax
jne 0x403dc1
mov eax, dword [0x419c4c]
test eax, eax
je 0x403dd9
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Cannot_create_process__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403dd9
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push edx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403eb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x35c
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x419c4c]
and ebx, 0x100
test edx, edx
je 0x403ef9
mov esi, dword [ebp + 8]
mov eax, 0x40e540
test ebx, ebx
mov ecx, 0x40e543
cmove eax, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s_bit_search:_t_s..._n
mov dword [esp], edx
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x334]
mov dword [esp + 0x10], eax
mov eax, ebx
or eax, 0x20019
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4040b8
lea edi, [ebp - 0x324]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov dword [ebp - 0x330], 0x104
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edx, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x334]
lea esi, [ebp - 0x32c]
mov dword [ebp - 0x33c], edx
lea edi, [ebp - 0x220]
lea edx, [ebp - 0x330]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExA
sub esp, 0x20
test eax, eax
jne 0x4040a9
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x324]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.0040260e
mov eax, dword [0x419c4c]
test eax, eax
je 0x403ff9
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x220]
lea edi, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004023e0
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00403def
test eax, eax
je 0x404071
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call fcn.00402966
test eax, eax
je 0x404071
mov dword [esp + 4], edi
mov dword [esp], 0x42207c
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [0x421e6c], eax
mov eax, dword [0x419c4c]
test eax, eax
je 0x4040a9
mov dword [esp + 8], edi
mov dword [esp + 4], str.Match:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4040a9
mov eax, dword [0x419c4c]
test eax, eax
je 0x404094
lea edx, [ebp - 0x11c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Ignore:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x330], 0x104
mov eax, dword [ebp - 0x33c]
jmp 0x403f5f
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404285
Capabilities:
Create pipe

Disassembly:
push ebp
mov eax, 0x824c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ba60
sub esp, eax
mov esi, dword [ebp + 8]
cmp dword [0x411024], 0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x8230], 0
mov dword [ebp - 0x822c], 0
je 0x4042e7
mov eax, dword [0x419c4c]
test eax, eax
je 0x4042e7
mov dword [esp + 0x10], 0x421ffc
mov dword [esp + 0xc], 0x421f7c
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check_Java_Version:__s_min_s_max_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x8228]
mov dword [esp + 8], eax
lea eax, [ebp - 0x822c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8230]
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [ebp - 0x8228], 0xc
mov dword [ebp - 0x8220], 1
mov dword [ebp - 0x8224], 0
call sub.kernel32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x404356
mov eax, dword [0x419c4c]
test eax, eax
je 0x40434f
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_create_pipe_n
call sub.msvcrt.dll_fputs
xor eax, eax
jmp 0x4044bf
mov eax, dword [ebp - 0x8230]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.kernel32.dll_SetHandleInformation
sub esp, 0xc
test eax, eax
jne 0x4043ae
mov eax, dword [0x419c4c]
test eax, eax
je 0x404394
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_set_handle_information_n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x822c]
jmp 0x404438
xor eax, eax
mov ecx, 0x2000
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x811c]
mov cl, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 4], esi
lea esi, [ebp - 0x811c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call fcn.00402651
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x8018]
mov dword [esp + 8], str.__s___version
mov dword [esp + 4], 0x8000
mov dword [esp], esi
call fcn.004065e0
mov eax, dword [ebp - 0x822c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00403ce8
test eax, eax
jne 0x404446
mov eax, dword [0x419c4c]
test eax, eax
je 0x404432
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_run_java_w___version_n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
jmp 0x40434f
xor eax, eax
mov ecx, 0x20
lea edi, [ebp - 0x821c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x819c]
lea esi, [ebp - 0x821c]
mov cl, 0x20
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x8230]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00403b8c
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x821c], 0
push edi
lea edi, [ebp - 0x819c]
je 0x40434f
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004023e0
mov eax, dword [ebx]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00403def
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405350
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4053a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40546b
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x4053f1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x4053d9
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x4053e9
cmp ecx, 0x40
je 0x4053e9
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00405350
lea esi, [esi]
lea edi, [edi]
Function at 0x40c0d0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.004056f0
call sub.kernel32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40c106
jmp 0x40c145
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40c103
cmp al, 0x20
je 0x40c103
cmp al, 0x22
jne 0x40c129
jmp 0x40c194
cmp al, 0x20
lea esi, [esi]
je 0x40c130
test al, al
je 0x40c145
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x40c117
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40c1aa
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40c137
cmp al, 0x20
je 0x40c137
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40c154
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401801
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40c19e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x40c190
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x40c130
cmp al, 9
je 0x40c137
jmp 0x40c145
Function at 0x100739d
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x1001898
call fcn.01007568
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10073da
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10073da
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10073f2
cmp eax, 0x20b
je 0x10073df
mov dword [ebp - 0x1c], ebx
jmp 0x1007406
cmp dword [ecx + 0x84], 0xe
jbe 0x10073da
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1007400
cmp dword [ecx + 0x74], 0xe
jbe 0x10073da
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100ab9c], 0xffffffff
or dword [0x100aba0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1009ab8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1009ab4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100aba4], eax
call fcn.010075f4
cmp dword [0x1009608], ebx
jne 0x1007461
push fcn.010075f4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010075dd
push 0x1009010
push 0x100900c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1009ab0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1009aac]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1009008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x10074f7
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10074cb
cmp al, 0x22
jne 0x10074bd
cmp byte [esi], 0x22
jne 0x10074d4
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10074de
cmp al, 0x20
jbe 0x10074d0
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
jmp 0x100876e
cmp byte [esi], 0x20
jbe 0x10074d4
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10074f7
nop
not dh
lea edx, [ecx - 0x33]
nop
jg 0x10087c6
mov ecx, esp
and al, 0xff
or dh, ch
inc ecx
test ecx, esi
jmp 0x1018851
xor dh, 0x2e
mov ecx, 0xff8d278d
test edx, 0xc732d745
mov eax, 0x4e84
xchg edx, ecx
and ecx, 0xffffffb5
dec dh
or ch, al
jmp 0x10087c6
mov edx, eax
or cl, ah
not edx
sub cl, 0x9f
sub eax, 2
wait
jmp 0x1008748
stc
or ecx, eax
mov ecx, edi
not ecx
jmp 0x1008793
cmp dl, dl
nop
xchg dh, cl
inc edx
inc ecx
xchg edx, ecx
sub edx, 0x75
add word [eax + 0x10139fe], 0xdb14
xchg edx, edx
mov dl, bh
cmc
jmp 0x10087ae
Function at 0x401110
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x4300a0]
xor eax, esp
mov dword [esp + 0x410], eax
lea eax, [esp + 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.4119cc3b_444e_4050_8e7a_bb78a60bcbf7
lea ecx, [esp + 0x20c]
push ecx
lea edx, [esp + 8]
push str._s_s
push edx
call fcn.004128fa
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x4000100
push 2
push 0
push 0
push 0x101f01ff
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x431148], eax
cmp eax, 0xffffffff
je 0x4011cd
push 0
push 0x429ca8
push 0xa
call dword [sym.imp.RPCRT4.dll_RpcServerUseAllProtseqsIf]
test eax, eax
jne 0x4011cd
push eax
push 0x4d2
push 1
push eax
push eax
push 0x429ca8
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
jne 0x4011cd
mov eax, 1
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0041237e
add esp, 0x414
ret
mov ecx, dword [esp + 0x410]
xor ecx, esp
xor eax, eax
call fcn.0041237e
add esp, 0x414
ret
Function at 0x4011f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42d560
push 0x413aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x1e0
mov eax, dword [0x4300a0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
call fcn.00401110
test eax, eax
jne 0x4012ee
mov eax, dword [0x429b98]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x429b9c]
mov dword [ebp - 0x38], ecx
mov edx, dword [0x429ba0]
mov dword [ebp - 0x34], edx
mov eax, dword [0x429ba4]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x429ba8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x429bac]
mov dword [ebp - 0x28], edx
mov eax, dword [0x429bb0]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x429bb4]
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x1dc]
push edx
xor esi, esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
lea ecx, [ebp - 0x3c]
push ecx
push esi
call dword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
lea edx, [ebp - 0x1d4]
push edx
mov eax, dword [ebp - 0x1dc]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x1d4]
push ecx
call fcn.004115e0
add esp, 4
jmp 0x4012c6
mov dword [ebp - 4], 0xfffffffe
lea edx, [ebp - 0x1dc]
push edx
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
lea eax, [ebp - 0x1d4]
push eax
call dword [sym.imp.RPCRT4.dll_RpcBindingFree]
push 0xffffffffffffffff
call fcn.00412c50
lea ecx, [ebp - 0x1d0]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x429f00
push esi
call fcn.00412ce8
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00412ee4
add esp, 4
call fcn.00401980
push 0x64
mov edx, dword [0x432748]
push edx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [0x433428], eax
mov dword [ebp - 0x1ec], 1
mov dword [ebp - 0x1e8], esi
mov dword [ebp - 0x1e4], esi
mov dword [ebp - 0x1e0], esi
push esi
lea eax, [ebp - 0x1ec]
push eax
push 0x4333b4
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x1d8], 8
mov dword [ebp - 0x1d4], 0xff
lea ecx, [ebp - 0x1d8]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041237e
mov esp, ebp
pop ebp
ret
Function at 0x401440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [0x432748]
sub esp, 8
push edi
push 0x429bb8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x401462
pop edi
add esp, 8
ret
mov edx, dword [0x432748]
push ebx
push ebp
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [0x432748]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x22
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov ebx, eax
push ebp
push ebx
call fcn.00415a90
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, dword [esp + 0x14]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x4014f5
lea edx, [esp + 0x10]
push edx
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [esp + 0x18], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStreamICM
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
jmp 0x4014f7
xor esi, esi
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret