joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ecea4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x4ed10e
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x22c], 0x224
mov edx, eax
mov eax, 8
call fcn.004e834c
mov dword [ebp - 4], eax
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 4]
call fcn.004e83ac
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4ed0d7
mov eax, dword [0x4f709c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ed0c3
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [0x4f709c]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0x230]
mov eax, 0x4ed124
call fcn.00408d50
mov eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.00404b68
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00408d50
mov edx, dword [ebp - 0x234]
pop eax
call fcn.00404d04
jne 0x4ecfd8
mov edi, dword [ebp - 0x224]
cmp edi, dword [0x4fa5b8]
je 0x4ecfd8
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404b68
mov edx, dword [ebp - 0x23c]
mov eax, edi
call fcn.004ec874
jmp 0x4ed0e8
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.00408d50
mov eax, dword [ebp - 0x240]
push eax
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.00404b68
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00408d50
mov edx, dword [ebp - 0x244]
pop eax
call fcn.00404d04
jne 0x4ed0bb
mov eax, dword [0x4fa5b0]
test eax, eax
je 0x4ed037
push 0
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [0x4f6d64]
mov eax, dword [eax]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.00433674
mov eax, dword [0x4f6bb4]
mov eax, dword [eax]
call fcn.004ecd34
push 0x30
lea eax, [ebp - 0x250]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404b68
mov ecx, dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
mov edx, 0x4ed138
call fcn.00404c04
mov eax, dword [ebp - 0x24c]
call fcn.00404db8
mov edx, eax
mov ecx, 0x4ed1a0
mov eax, dword [0x4f6f20]
mov eax, dword [eax]
call fcn.0046b020
mov eax, dword [0x4f6bb4]
mov eax, dword [eax]
call fcn.004ecd34
mov eax, dword [0x4f6f20]
mov eax, dword [eax]
call fcn.0046af7c
inc esi
dec ebx
jne 0x4ecf45
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 4]
call fcn.004e83cc
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4ecf2b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed115
lea eax, [ebp - 0x250]
mov edx, 9
call fcn.0040491c
lea eax, [ebp - 8]
call fcn.004048f8
ret
Function at 0x4ee918
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
xor eax, eax
push ebp
push 0x4eea2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004048f8
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4eea10
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.00409c24
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4ee9fd
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4ee9fd
mov esi, dword [edx]
test esi, esi
je 0x4ee9fd
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
mov ecx, 3
mov eax, 0x4eea44
call fcn.0040a268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eea17
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4eea50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eec08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
cmp dword [eax + 0xc], 0
je 0x4eebea
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
cmp dword [eax + 8], 0
je 0x4eebea
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x384]
cmp eax, 0x1f4
jbe 0x4eebea
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x384], eax
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0046f6b4
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0046f77c
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0046f6fc
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 8]
call fcn.004946d8
test al, al
je 0x4eeb30
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x2fc]
call fcn.0046f6fc
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
mov eax, 0x4fa5c8
call fcn.0040494c
jmp 0x4eeb8d
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea edx, [ebp - 4]
call fcn.004ee918
mov eax, dword [ebp - 4]
call fcn.004946d8
test al, al
je 0x4eeb80
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2fc]
call fcn.0046f6fc
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
mov eax, 0x4fa5c8
call fcn.0040494c
jmp 0x4eeb8d
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.0046f77c
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x2fc]
call fcn.0046f7fc
mov dl, 1
mov eax, dword [ebx + 0x2fc]
call fcn.0046f6b4
mov eax, dword [ebx + 0x37c]
call fcn.0043b8cc
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 8]
call fcn.00405178
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x378]
call fcn.004a9cb0
mov dl, 1
mov eax, dword [ebx + 0x374]
call fcn.0044b260
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eec0f
lea eax, [ebp - 8]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.004048f8
ret
Function at 0x4eec9c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
xor eax, eax
push ebp
push 0x4eedb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004048f8
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4eed94
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.00409c24
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4eed81
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4eed81
mov esi, dword [edx]
test esi, esi
je 0x4eed81
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
mov ecx, 3
mov eax, 0x4eedc8
call fcn.0040a268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eed9b
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4f1e60
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 7
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
jne 0x4f1e7f
xor eax, eax
pop ecx
pop ebp
ret
mov al, 1
pop ecx
pop ebp
ret
Function at 0xdb970f
Capabilities:
Parse pe header

Disassembly:
push ebx
jmp 0xdb948a
push ebp
jmp 0xdb9a0d
call 0xdb9612
inc esi
fiadd word [edi - 0x6472dbe4]
sub byte [esi], al
add byte [eax], al
xchg dword [esp], ebx
jmp 0xdb9c38
call 0xdb970f
cmc
mov esp, 0x8d241487
xchg edx, eax
mov esi, edi
invalid
call dword [0xdb9244]
jmp 0xdb9412
sub esp, 0xc
jmp 0xdb9973
jne 0xdb9c21
jmp 0xdb9a92
jmp 0xdb960b
call 0xdb9903
or esi, dword [ecx]
xchg dword [esp], ebx
lea ebx, [ebx - 0x37c]
xchg dword [esp], ebx
jmp 0xdb983b
push esp
jmp 0xdb98fc
cmp dword [0xdb9240], 0
jmp 0xdb989a
jmp 0xdb9412
push esi
jmp 0xdb9bc8
mov dword [0xdb9240], 1
jmp 0xdb99f4
push edi
jmp 0xdb9708
mov eax, dword [esp + 0x10]
jmp 0xdb9caa
pushal
jmp 0xdb996b
push eax
jmp 0xdb9783

Function at 0xdb9c53
Capabilities:
Parse pe header

Disassembly:
shl eax, 0x10
jmp 0xdb98c2
ret
pop eax
jmp 0xdb99d5
shr eax, 0x10
jmp 0xdb942b
jne 0xdb972f
jmp 0xdb99e0
sub eax, 0x10000
jmp 0xdb9929
cmp word [eax], 0x5a4d
jmp 0xdb9a87
add eax, 0x10000
jmp 0xdb972f
shr eax, 0x10
jmp 0xdb9b07
add eax, dword [eax + 0x3c]
jmp 0xdb9c85
jne 0xdb972f
jmp 0xdb9a7e
shl eax, 0x10
jmp 0xdb949e
xchg dword [esp], ebp
lea ebp, [ebp - 0x698]
xchg dword [esp], ebp
jmp 0xdb95b9
cmp dword [eax], 0x4550
jmp 0xdb9851
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x434c24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.00416400
push 0x4364f0
mov esi, 0x401
lea eax, [ebp - 0x808]
push esi
push eax
call fcn.00413daa
lea eax, [ebp - 0x808]
add esp, 0x18
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40104a
sub eax, ecx
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [ebp + eax*2 - 0x808]
push eax
call fcn.00413f9c
push 0x42d7c0
lea eax, [ebp - 0x808]
push esi
push eax
call fcn.00413fb9
add esp, 0x1c
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413d9b
leave
ret

Function at 0x4010a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x434c24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.00416400
push 0x436530
mov esi, 0x401
lea eax, [ebp - 0x408]
push esi
push eax
call fcn.00414036
lea eax, [ebp - 0x408]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4010ea
sub eax, ecx
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x408]
push eax
call fcn.004141f2
push 0x42d7c8
lea eax, [ebp - 0x408]
push esi
push eax
call fcn.0041420f
add esp, 0x1c
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413d9b
leave
ret
Function at 0x4011c9
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x434c24]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x439128
push 0x67
push edi
call esi
push 0x64
push 0x439060
push 0x6d
push edi
call esi
mov eax, edi
call fcn.0040135d
mov eax, dword [ebp + 0x10]
mov edx, 0x439c30
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401218
call fcn.00403767
push 0x7d0
mov dword [0x435f90], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040165f
test eax, eax
je 0x401251
call fcn.00402fa7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.0040206e
pop ecx
test eax, eax
jne 0x401273
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413d9b
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00416400
mov ecx, dword [0x439878]
add esp, 0xc
test ecx, ecx
jbe 0x4012c0
cmp word [0x43987c], 0
jbe 0x4012c0
mov esi, 0x4364d8
call fcn.00403703
mov ax, word [0x43987c]
mov word [0x4364e8], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
xor edx, edx
mov esi, ecx
div esi
xor edx, edx
mov ebx, 0x439e38
div ecx
push edx
push 0x42d7cc
push ebx
call fcn.00402f8c
add esp, 0xc
call fcn.00402951
lea edi, [esp + 0x10]
call fcn.00403133
push 0x42d7e4
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00413fb9
add esp, 0xc
push ebx
mov eax, edi
push esi
push eax
call fcn.00413fb9
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401348
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor eax, eax
push eax
push 0x42dca8
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004026e5
jmp 0x401249
Function at 0x4015af
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x42d848
push dword [ebp + 8]
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00414593
add esp, 0xc
test eax, eax
je 0x4015d9
xor eax, eax
jmp 0x40165c
push ebx
push esi
push 2
push edi
push dword [ebp - 4]
call fcn.00414670
push dword [ebp - 4]
call fcn.00414892
push edi
push edi
push dword [ebp - 4]
mov esi, eax
call fcn.00414670
lea eax, [esi + 0x32]
push eax
mov dword [ebp - 8], eax
call fcn.004142d2
push dword [ebp - 4]
mov edi, eax
push 1
push esi
push edi
call fcn.00414ba0
push dword [ebp - 4]
call fcn.00414c34
push 0x32
lea ebx, [edi + esi]
call fcn.004039b7
push 0x42d850
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00414593
add esp, 0x44
pop esi
pop ebx
test eax, eax
jne 0x4015d2
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push edi
call fcn.00414e12
push dword [ebp - 4]
call fcn.00414c34
xor eax, eax
add esp, 0x14
inc eax
pop edi
leave
ret
Function at 0x402508
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402531
push dword [ebp + 8]
call fcn.00403803
pop ecx
cmp eax, dword [ebp + 0x10]
jne 0x402531
inc ebx
jmp 0x4025a1
mov edi, 0x200000
push edi
call fcn.004142d2
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea edi, [ebp - 4]
call fcn.00406468
add esp, 0xc
test eax, eax
je 0x40259a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00414e94
pop ecx
push 0x32
mov eax, 0xc8
call fcn.0040318d
mov edi, dword [ebp - 4]
pop ecx
push eax
lea ebx, [edi + esi]
mov dword [ebp + 0x10], eax
call fcn.004039b7
add edi, dword [ebp + 0x10]
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.004063b3
add esp, 0xc
mov ebx, eax
dec ebx
neg ebx
sbb ebx, ebx
inc ebx
push esi
call fcn.0041439c
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x402a15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x434c24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
push eax
call fcn.00405b9d
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x402b97
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.00416400
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push eax
call fcn.00416400
add esp, 0xc
lea edi, [ebp - 0x220]
call fcn.00403133
push 0x42d7e4
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00413fb9
mov byte [ebp - 0x18], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, 0x439200
jmp 0x402ac1
mov esi, 0x104
cmp word [ebx], 0
je 0x402b18
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.00413daa
add esp, 0xc
push ebx
lea eax, [ebp - 0x428]
push esi
push eax
call fcn.00413fb9
lea eax, [ebp - 0x428]
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
call fcn.00405316
pop ecx
test eax, eax
je 0x402b18
push 5
pop ecx
lea edi, [ebx + 0x104]
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x402b18
mov word [ebx], ax
add ebx, 0x118
cmp ebx, 0x439778
jl 0x402abc
mov esi, 0x439200
cmp word [esi], 0
je 0x402b4e
push dword [ebp + 0xc]
mov eax, dword [esi + 0x100]
push dword [ebp - 0x430]
mov ecx, esi
mov dword [0x4391f4], eax
call fcn.00405dc2
pop ecx
pop ecx
add esi, 0x118
cmp esi, 0x439778
jl 0x402b2b
push 0x439e38
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.00413fb9
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402b91
mov dword [ebp - 0x42c], 2
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413d9b
leave
ret
Function at 0x402cc5
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x434c24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x42dbc0
push 0x42dbc4
call fcn.00414f8c
mov esi, eax
xor edi, edi
pop ecx
pop ecx
cmp esi, edi
je 0x402d1b
push edi
push 0x2580
push esi
call fcn.00414670
add esp, 0xc
push esi
push 5
push 1
push 0x42dbd0
call fcn.00414e12
push esi
call fcn.00414c34
add esp, 0x14
cmp byte [0x439783], 1
jne 0x402e00
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00416400
add esp, 0xc
mov eax, 0x42dbd8
mov dword [ebp - 0x684], edi
call fcn.0040641e
mov eax, 0x42dbf4
call fcn.0040641e
mov eax, 0x42dc20
call fcn.0040641e
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x684]
push eax
movzx eax, word [ebp - 0x210]
sub eax, 0x41
push eax
call fcn.00403d62
push dword [ebp - 0x684]
call fcn.00403c6c
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x402dbb
push dword [ebp - 0x684]
push 0x42dc5c
call fcn.00401000
pop ecx
jmp 0x402dff
lea esi, [ebp - 0x448]
call fcn.0040403c
test eax, eax
je 0x402e00
call fcn.00402e65
mov eax, dword [ebp - 0x448]
mov ecx, 0x8d
lea edi, [ebp - 0x680]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x680]
call fcn.004040c7
push 0x42dc84
call fcn.00401000
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413d9b
leave
ret
Function at 0x402fa7
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x318
mov eax, dword [0x434c24]
xor eax, ebp
mov dword [ebp + 0x294], eax
push ebx
push esi
lea eax, [ebp + 0x190]
push eax
mov esi, 0x104
xor ebx, ebx
push esi
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x42dcac
lea eax, [ebp + 0x190]
push esi
push eax
call fcn.0041420f
add esp, 0xc
push esi
lea eax, [ebp + 0x8c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00414036
lea eax, [ebp - 0x78]
push 0x5c
push eax
call fcn.00415160
add esp, 0x14
cmp eax, ebx
je 0x403025
mov byte [eax], bl
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x40311c
mov eax, 0x436550
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403055
sub eax, edx
lea ecx, [ebp + 0x8c]
push edi
mov esi, eax
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x40306a
lea eax, [ebp + 0x190]
sub ecx, edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40307c
imul ecx, ecx, 3
sub eax, edi
add ecx, eax
lea esi, [ecx + esi + 0x32]
push esi
call fcn.0040996b
push esi
mov edi, eax
push ebx
push edi
call fcn.00416400
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x8c]
push eax
push eax
push 0x436550
push esi
push edi
call fcn.0041518d
mov eax, edi
add esp, 0x2c
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4030c5
push ebx
lea ecx, [ebp - 0x80]
push ecx
sub eax, esi
push eax
push edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
lea eax, [ebp + 0x190]
push eax
push 0x42dcb8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp + 0x8c]
push eax
push 0x42dcc0
call fcn.004010a0
pop ecx
pop ecx
cmp edi, ebx
je 0x40311b
push edi
call fcn.00409960
pop ecx
pop edi
mov ecx, dword [ebp + 0x294]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413d9b
add ebp, 0x298
leave
ret
Function at 0x403239
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x42db88
push dword [ebp + 8]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x40326d
push 0x42dcd4
call fcn.00401000
pop ecx
jmp 0x4032ad
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 4]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [eax], esi
call fcn.0040996b
push esi
mov edi, eax
push 0
push edi
call fcn.00416400
push esi
push ebx
push edi
call fcn.0041ddb0
add esp, 0x1c
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret