joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x28
push 0
push 0x40c1c8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40c1cc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40c1c8], eax
mov eax, 0x40b320
mov dword [0x40c1d0], eax
call fcn.0040223f
call fcn.00408d00
call fcn.00408420
call fcn.00407e3c
call fcn.00407997
call fcn.0040775e
call fcn.004076c4
call fcn.00407090
call fcn.004051cc
call fcn.00404a70
call fcn.00403f86
call fcn.0040346f
call fcn.004033b6
call fcn.00403265
call fcn.00402dff
call fcn.00402c29
call fcn.004029f3
call fcn.0040238d
mov dword [0x40c1d8], 0
mov edx, dword [0x40c2fc]
push edx
push edx
mov edx, dword [0x40c2fc]
push edx
push edx
call fcn.004023bc
mov edx, dword [0x40b340]
add dword [esp], edx
call fcn.0040776a
push 0x40c1dc
call fcn.00408d80
call fcn.004014b4
push 0
jmp 0x4010eb
call 0x401105
call fcn.00408d50
push dword [0x40c1c8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004029e7
call fcn.00402bd3
call fcn.00402ddc
call fcn.00403264
call fcn.004033b5
call fcn.00403463
call fcn.004070b0
call fcn.00407752
call fcn.004077e9
call fcn.00407979
call fcn.00408555
call fcn.00408410
ret
Function at 0x403088
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push 0x40a020
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x403120
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x40311d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x40311d
lea eax, [esi - 1]
push eax
push dword [0x40c358]
call fcn.004085bf
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x40311f
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x403114
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x403207
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x4030fa
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x4031c6
push eax
call esi
test al, al
jns 0x4031c6
push 0x11
call esi
test al, al
js 0x4031c6
push 0x10
call esi
test al, al
js 0x4031c6
push 0x12
call esi
test al, al
js 0x4031c6
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x4031c6
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40319a
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4031b1
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x403211
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x403211
test ebp, ebp
je 0x4031ea
push 0x11
call esi
test al, al
js 0x4031e2
push 0x10
call esi
test al, al
js 0x4031e2
push 0x12
call esi
test al, al
jns 0x4031ea
push 1
push ebp
call fcn.0040321d
test ebx, ebx
je 0x4031fe
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x403211
test edi, edi
je 0x403211
mov eax, dword [edi + 8]
jmp 0x403213
and dword [esp + 0x14], 0
jmp 0x40311f
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x405160
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x405192
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40518d
cmp dword [esp + 0xc], esi
je 0x4051a9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x401b10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b54
test esi, esi
je 0x401b54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b30
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d40
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e68
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401dce
cmp eax, 4
jne 0x401df0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401dde
cmp edx, 4
je 0x401dde
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d40
Function at 0x1063c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
inc edx
mov dword [ecx], eax
push esi
mov eax, dword [ecx]
mov esi, eax
shr esi, 0x1e
xor esi, eax
imul esi, esi, 0x6c078965
add ecx, 4
add esi, edx
inc edx
cmp edx, 0x270
mov dword [ecx], esi
jl 0x1064a
pop esi
pop ebp
ret 4

Function at 0x10716
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x9c4]
cmp dword [esi], 0
jne 0x1072c
call fcn.00010674
dec dword [esi]
lea eax, [edi + 0x9c0]
mov edx, dword [eax]
mov ecx, dword [edx]
add edx, 4
mov dword [eax], edx
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
pop edi
xor eax, ecx
pop esi
ret

Function at 0x109b0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
xor edx, edx
cmp dword [ebp + 0xc], esi
je 0x109da
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov cl, byte [edx + ecx]
add eax, esi
xor byte [eax], cl
lea eax, [edx + 1]
xor edx, edx
div dword [ebp + 0x14]
inc esi
cmp esi, dword [ebp + 0xc]
jne 0x109bf
pop esi
pop ebp
ret 0x10
Function at 0x13554
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00013532
xor ecx, ecx
inc ecx
cmp dword [esi + 4], ecx
jbe 0x13582
mov eax, dword [esi]
lea eax, [eax + ecx*2]
mov dx, word [eax - 2]
xor word [eax], dx
inc ecx
cmp ecx, dword [esi + 4]
jb 0x13570
push dword [ebp + 0xc]
call fcn.0001da56
pop ecx
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x13598
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.000134f0
xor ecx, ecx
inc ecx
cmp dword [esi + 4], ecx
jbe 0x135c3
mov eax, dword [esi]
add eax, ecx
mov dl, byte [eax - 1]
xor byte [eax], dl
inc ecx
cmp ecx, dword [esi + 4]
jb 0x135b4
push dword [ebp + 0xc]
call fcn.0001da56
pop ecx
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x16d12
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0x10], 1
xor eax, eax
mov dl, byte [eax + 0x73618]
xor byte [ebp + ecx - 0x10], dl
inc ecx
inc eax
and eax, 0xf
cmp ecx, 8
jne 0x16d29
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 4], 2
call fcn.0001340e
mov ecx, dword [0x777b4]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00016b32
mov ecx, eax
call fcn.00011e06
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x16d74
call fcn.00010990
leave
ret
Function at 0x19960
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
push edi
test ecx, ecx
jbe 0x19996
mov edx, dword [eax + 0xc]
cmp dword [ebp + 0xc], edx
jb 0x1998e
mov edi, dword [eax + 8]
add edi, edx
cmp dword [ebp + 0xc], edi
jb 0x19998
add eax, 0x28
inc esi
cmp esi, ecx
jb 0x1997c
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x4061db
Capabilities:
Write file on windows

Disassembly:
fldcw word [esi + 0x3e]
pop edi
out 0xc9, eax
ret 0xd5df
std
mov ebp, esp
xor ecx, dword [ebx + 0x45d41075]
adc byte [edx - 0x35], ch
push eax
xor edi, edi
jne 0x4061f8
push es
jne 0x4061ce
call dword [0x40e9eb]
test eax, eax
je 0x406203
or bh, byte [ebx]
jne 0x40620c
cmp esi, dword [ebp + 0x10]
dec eax
add eax, 0xeb40c031
add dh, byte [ebx]
rcr byte [esi], 0xc2
xor eax, eax
pop esi
add dl, al
or al, 0
in al, dx

Function at 0x40620a
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp - 0x5f]
lea eax, [ebp - 0x71]
push 0
cmp byte [esi - 1], dl
jne 0x406227
clc
jne 0x406226
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x406232
or bh, byte [ebx]
jne 0x40623b
cmp esi, dword [ebp + 0x10]
jg 0x406232
xor eax, eax
shr ebx, cl
add dh, byte [ebx]
rcr byte [esi + 0x5d], 0xc6
or al, 0
xor eax, eax
pop esi
pop ebp
invalid
in al, dx
push ebx
fstp qword [ebp + 0xd]
mov eax, dword ds:[esi + 0x60]
add dword [eax], 0x6aff3357
add dword [edi + 0x57], edx
sar edi, cl
salc
test eax, eax
jne 0x4062a4
lea eax, [ebp + 0x31]
push 2
push eax
push ebx
call fcn.004061db
test eax, eax
or dword [esi], 0xffffff81
jge 0x406273
invalid
or al, 0x57
sub byte [edx + 1], ch
clc
push edi
push ebx
cmp dh, dl
test eax, eax
jne 0x40629e
push 2
push 0x40841c
push ebx
push esi
sub esp, edx
invalid
push edi
mov bl, 0xb3
test eax, 0xc033d6ff
xor eax, eax
inc eax
pop edi
pop esi
jge 0x406308
ret 8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
movd mm7, dword [esi + 0x3bb10010]
invalid
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x52
lea edi, [ebp - 0x154]
mov esi, 0x402108
rep movsd dword es:[edi], dword [esi]
push 0x40
push 0x3000
push 0x149
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
movaps xmm1, xmmword [str._r_r_r_r_r_r_r_r_r_r_r_r_r_r_r_r]
mov ecx, 0x52
lea esi, [ebp - 0x154]
mov edi, edx
mov eax, 0x140
rep movsd dword es:[edi], dword [esi]
lea ecx, [edx + 0x20]
movsb byte es:[edi], byte [esi]
mov esi, 5
lea ecx, [ecx + 0x40]
movups xmm0, xmmword [ecx - 0x60]
psubb xmm0, xmm1
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
psubb xmm0, xmm1
movups xmmword [ecx - 0x50], xmm0
movups xmm0, xmmword [ecx - 0x40]
psubb xmm0, xmm1
movups xmmword [ecx - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x30]
psubb xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
sub esi, 1
jne 0x401062
pop edi
pop esi
nop dword [eax]
add byte [edx + eax], 0xf3
inc eax
cmp eax, 0x149
jb 0x4010a0
lea eax, [ebp - 8]
push eax
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004010d8
mov esp, ebp
pop ebp
ret

Function at 0x4018de
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40191d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40191d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40191d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40191d
cmp dword [ecx + 0x74], 0xe
jbe 0x40191d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x117fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x118b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01176e52
and dword [ebp - 0x14], 0
cmp dword [0x11cd558], 0
mov dword [ebp - 0x18], eax
jne 0x117fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x117fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x117fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x11cd558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x11cd55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x11cd560], eax
call edi
push eax
call esi
mov dword [0x11cd568], eax
test eax, eax
je 0x117fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x11cd564], eax
mov eax, dword [0x11cd564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x117fc78
cmp dword [0x11cd568], ecx
je 0x117fc78
push eax
call esi
push dword [0x11cd568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x117fc78
test ebx, ebx
je 0x117fc78
call edi
test eax, eax
je 0x117fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x117fc6f
test byte [ebp - 8], 1
jne 0x117fc78
or dword [ebp + 0x10], 0x200000
jmp 0x117fcab
mov eax, dword [0x11cd55c]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x117fcab
mov eax, dword [0x11cd560]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x11cd558]
call esi
test eax, eax
je 0x117fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x117fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.011713cb
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10001020
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
mov esi, dword [ebp + 0xc]
xor edx, edx
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
lea esp, [esp]
lea esp, [esp]
nop
mov dl, byte [esi]
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x10001060]
add esi, 1
sub ecx, 1
jne 0x10001040
not eax
pop edx
pop ecx
pop esi
leave
ret 8

Function at 0x1000149b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x100014bc
jmp 0x100014de
push eax
push eax
push dword [ebp + 8]
call sub.kernel32.dll_SizeofResource
mov dword [0x1000d860], eax
pop eax
push eax
push dword [ebp + 8]
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x100014db
jmp 0x100014de
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x10001545
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
mov byte [ebp - 0x401], 0
pushal
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x400]
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
xor ecx, ecx
jmp 0x1000156b
inc ecx
cmp byte [ecx + ebx], 0x5c
jne 0x1000156a
mov byte [ecx + ebx], 0
lea esi, [ecx + esi + 1]
push ebx
call fcn.10001657
or eax, eax
je 0x100015d2
mov byte [ebx], 0
test dword [ebp + 0x14], 8
je 0x10001596
mov edx, 1
jmp 0x10001598
xor edx, edx
push edx
push dword [ebp + 0x10]
push esi
push eax
push ebx
call sym.dup2patcher.dll_GetRegString
push section..data
push ebx
call fcn.10001607
test dword [ebp + 0x14], 1
je 0x100015be
push ebx
call fcn.100015de
cmp byte [ebx], 0
je 0x100015d2
push ebx
push dword [ebp + 8]
call sub.kernel32.dll_SetEnvironmentVariableA
mov byte [ebp - 0x401], al
popal
movzx eax, byte [ebp - 0x401]
leave
ret 0x10
Function at 0x10001fe3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push esi
push edi
push ebx
push ecx
push edx
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push 0x1000d0e5
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
xor edi, edi
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x100020b2
mov dword [0x1000d87e], eax
mov esi, str.BASSMOD_Init
mov ebx, 0x1000d86a
jmp 0x10002071
push esi
push dword [0x1000d87e]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x1000205a
mov dword [ebx], eax
add ebx, 4
jmp 0x10002052
inc esi
cmp byte [esi], 0
jne 0x10002051
inc esi
jmp 0x10002071
push dword [0x1000d87e]
call sub.kernel32.dll_FreeLibrary
mov dword [0x1000d87e], 0
jmp 0x100020b2
cmp byte [esi], 0
jne 0x1000203a
push 0
push 0xac44
push 0xffffffffffffffff
call dword [0x1000d86a]
cmp eax, 1
jne 0x100020b2
call dword [0x1000d86e]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add eax, 4
push 6
push ecx
push 0
push eax
push 1
call dword [0x1000d872]
cmp eax, 1
jne 0x100020b2
call dword [0x1000d876]
inc edi
mov eax, edi
pop edx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x10002244
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
popal
leave
ret 4

Function at 0x10002313
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x6b
push dword [0x1000d886]
call sub.user32.dll_IsDlgButtonChecked
cmp eax, 1
jne 0x10002363
mov esi, 0x1000dcf1
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..BAK
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x1000235c
push 0
push esi
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
mov al, 0
jmp 0x1000235e
mov al, 1
mov byte [0x1000e50d], al
popal
leave
ret 4

Function at 0x10002368
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x6b
push dword [0x1000d886]
call sub.user32.dll_IsDlgButtonChecked
cmp eax, 1
jne 0x1000240c
mov esi, 0x1000dcf1
cmp dword [ebp + 8], 0
jne 0x100023b4
cmp byte [0x1000e50d], 0
jne 0x100023a3
push 0
push 0x1000d8f1
push esi
call sub.kernel32.dll_CopyFileA
cmp byte [0x1000e50d], 0
jne 0x1000240c
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x1000240c
mov eax, 1
cmp byte [0x1000e93c], 1
jne 0x100023d0
cmp byte [0x1000e93d], 0
jne 0x100023d0
mov eax, 0
cmp eax, 1
jne 0x1000240a
push 0x400
push 0x10012e1d
push 0xd
push dword [0x1000d882]
call sub.user32.dll_LoadStringA
push 0x10012e1d
call sym.dup2patcher.dll_AddMsg
push esi
call sym.dup2patcher.dll_AddMsg
push dword [0x1000e4f1]
push esi
call sub.kernel32.dll_SetFileAttributesA
jmp 0x1000240c
jmp 0x100023a3
popal
leave
ret 4
Function at 0x100028dc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x1000e4f5]
or esi, esi
je 0x100029c1
test dword [ebp + 0xc], 0x20
je 0x10002916
call fcn.100029f3
or eax, eax
je 0x1000290c
push str.PE_CheckSum_Fix_:_OK
call sym.dup2patcher.dll_AddMsg
jmp 0x10002916
push str.PE_CheckSum_Fix_:_Failed
call sym.dup2patcher.dll_AddMsg
push dword [0x1000e501]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x1000e505]
call sub.kernel32.dll_CloseHandle
push 0
push 0x1000e4fd
push dword [0x1000e509]
push esi
call sub.kernel32.dll_SetFilePointer
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
push dword [ebp + 8]
call fcn.10002368
push dword [0x1000e4f1]
push 0x1000d8f1
call sub.kernel32.dll_SetFileAttributesA
test dword [ebp + 0xc], 0x10
je 0x100029c1
push 0
push 0x82
push 3
push 0
push 0
push 0xc0000000
push 0x1000d8f1
call sub.kernel32.dll_CreateFileA
mov dword [0x1000e4f5], eax
cmp eax, 0xffffffff
je 0x100029c1
push 0x1000f171
push 0x1000f169
push 0x1000f161
push dword [0x1000e4f5]
call sub.kernel32.dll_SetFileTime
push dword [0x1000e4f5]
call sub.kernel32.dll_CloseHandle
push str.Restore_original_file_time_:_OK
call sym.dup2patcher.dll_AddMsg
popal
leave
ret 8

Function at 0x10002a81
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
push 1
push 8
push dword [0x1000d882]
call fcn.10001460
or eax, eax
je 0x10002ad5
mov esi, eax
push 0x1000e0f1
push 0x400
call sub.kernel32.dll_GetTempPathA
push str._bassmod.dll
push 0x1000e0f1
call sub.kernel32.dll_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
push 0x1000e0f1
call sym.dup2patcher.dll_write_disk_file
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret