joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110d0
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a640
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.00456be4
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call fcn.0044dad3
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4712dc
push esi
push edi
call fcn.0044dad3
push str.ProcessCheck.dll
push esi
push edi
call fcn.0044dad3
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47232c
push 0xb9
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x4111ef
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
mov ecx, 0x51eff8
call fcn.0041bb40
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x51eff8
call fcn.0041b7b0
push 1
mov ecx, 0x51eff8
mov dword [0x52e298], 1
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.004139d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.INSTITUTION
push 0xad
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41133e
test esi, esi
je 0x41132a
test edi, edi
je 0x4112e5
cmp esi, 0x800
ja 0x4112e5
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044a380
add esp, 0xc
jmp 0x41132a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0044a900
add esp, 0xc
test edi, edi
jne 0x41130c
call fcn.004529ca
mov dword [eax], 0x16
jmp 0x41131f
cmp esi, 0x800
jbe 0x411330
call fcn.004529ca
mov dword [eax], 0x22
call fcn.004528f0
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x4113f8
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49c560]
push 0x49c564
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4113e2
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4113db
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x4113d4
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x556050
push eax
call fcn.004449c0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444949
jne 0x4113d4
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x4707d4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
call fcn.004480d3
int3
Function at 0x411400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.INTERVAL
push 0x85
push 0
mov dword [ebp - 0x1854], 0x1d4c0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x4114de
test esi, esi
je 0x4114ca
test edi, edi
je 0x411485
cmp esi, 0x800
ja 0x411485
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044a380
add esp, 0xc
jmp 0x4114ca
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0044a900
add esp, 0xc
test edi, edi
jne 0x4114ac
call fcn.004529ca
mov dword [eax], 0x16
jmp 0x4114bf
cmp esi, 0x800
jbe 0x4114d0
call fcn.004529ca
mov dword [eax], 0x22
call fcn.004528f0
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x411598
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49c560]
push 0x49c564
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x411582
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41157b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x411574
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x556050
push eax
call fcn.004449c0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a544e49
jne 0x411574
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x4707d4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
call fcn.004480d3
int3
Function at 0x411610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x41175f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1050], eax
inc eax
push eax
push 0x2040
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x4116c5
lea ecx, [eax + 1]
test edi, edi
jne 0x411692
call fcn.004529ca
mov dword [eax], 0x16
jmp 0x4116ba
cmp ecx, eax
jb 0x4116a3
push eax
push ebx
push edi
call fcn.0044a380
add esp, 0xc
jmp 0x4116bf
push ecx
push 0
push edi
call fcn.0044a900
add esp, 0xc
call fcn.004529ca
mov dword [eax], 0x22
call fcn.004528f0
mov eax, dword [ebp - 0x1050]
mov byte [edi + eax], 0
lea eax, [ebp - 0x104c]
push eax
push dword [0x49c560]
push 0x49c564
call fcn.00404720
lea eax, [ebp - 0x1050]
push eax
push edi
call fcn.00404370
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x14
mov dword [ebp - 0x1054], eax
push edi
call ebx
mov eax, dword [ebp - 0x1054]
test eax, eax
je 0x41175f
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1050]
push ecx
push eax
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x411756
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x411753
shr eax, 1
inc eax
push eax
push 0x2040
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push dword [ebp - 0x1050]
mov esi, eax
mov ecx, 0x556050
push esi
call fcn.004449c0
push edi
call ebx
mov eax, dword [ebp - 0x1054]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 8
Function at 0x411780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1858
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.OPTIONS
push 0x88
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x1858], xmm0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41185f
test esi, esi
je 0x41184b
test edi, edi
je 0x411806
cmp esi, 0x800
ja 0x411806
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044a380
add esp, 0xc
jmp 0x41184b
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0044a900
add esp, 0xc
test edi, edi
jne 0x41182d
call fcn.004529ca
mov dword [eax], 0x16
jmp 0x411840
cmp esi, 0x800
jbe 0x411851
call fcn.004529ca
mov dword [eax], 0x22
call fcn.004528f0
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x41192a
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49c560]
push 0x49c564
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41190e
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x411907
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x411900
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x556050
push eax
call fcn.004449c0
lea ecx, [ebp - 0x804]
mov eax, 0x5354504f
cmp eax, dword [ecx]
jne 0x411900
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x411900
lea eax, [ebp - 0x1858]
push eax
lea eax, [ebp - 0x7ff]
push 0x472878
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1858]
xor ecx, ebp
mov edx, dword [ebp - 0x1854]
pop edi
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
call fcn.004480d3
int3
Function at 0x411930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.PROGRAM
push 0xab
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x411a0e
test esi, esi
je 0x4119fa
test edi, edi
je 0x4119b5
cmp esi, 0x800
ja 0x4119b5
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044a380
add esp, 0xc
jmp 0x4119fa
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0044a900
add esp, 0xc
test edi, edi
jne 0x4119dc
call fcn.004529ca
mov dword [eax], 0x16
jmp 0x4119ef
cmp esi, 0x800
jbe 0x411a00
call fcn.004529ca
mov dword [eax], 0x22
call fcn.004528f0
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x411ac8
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49c560]
push 0x49c564
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x411ab2
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x411aab
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x411aa4
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x556050
push eax
call fcn.004449c0
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444950
jne 0x411aa4
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x4707d4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
call fcn.004480d3
int3
Function at 0x411ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x472c9c
push 0xa2
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x411bae
test esi, esi
je 0x411b9a
test edi, edi
je 0x411b55
cmp esi, 0x800
ja 0x411b55
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044a380
add esp, 0xc
jmp 0x411b9a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0044a900
add esp, 0xc
test edi, edi
jne 0x411b7c
call fcn.004529ca
mov dword [eax], 0x16
jmp 0x411b8f
cmp esi, 0x800
jbe 0x411ba0
call fcn.004529ca
mov dword [eax], 0x22
call fcn.004528f0
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x411c73
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49c560]
push 0x49c564
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x411c5d
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x411c56
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x411c4f
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x556050
push eax
call fcn.004449c0
lea ecx, [ebp - 0x804]
mov eax, 0x44494552
cmp eax, dword [ecx]
jne 0x411c4f
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x411c4f
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x7ff]
push 0x4707d4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret
call fcn.004480d3
int3
Function at 0x411c80
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00456be4
push 0x4712dc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, word [ebp + 0x10]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
mov ebx, eax
lea eax, [ebp - 0x20c]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x411d51
push 0
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10

Function at 0x411d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.00447f50
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, eax
jae 0x411e15
test esi, esi
je 0x411e0d
test edi, edi
je 0x411ddf
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044a380
add esp, 0xc
jmp 0x411e01
push eax
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0044a900
add esp, 0xc
call fcn.004529ca
mov dword [eax], 0x16
call fcn.004528f0
cmp esi, 0x800
jae 0x411e99
mov byte [ebp + esi - 0x804], 0
push 0x800
lea eax, [ebp - 0x1804]
mov ecx, 0x4d71d0
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
call fcn.00402f20
lea ecx, [ebp - 0x1804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411e40
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x1804]
push 0
push 0
push 0
push 0
sub ecx, edx
sar ecx, 1
push ecx
push eax
push 0
push 0xfde9
call esi
push 0
push 0
push eax
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x1804]
push eax
push 0
push 0xfde9
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0x10
call fcn.004480d3
int3
Function at 0x411ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0x104
push eax
call fcn.00456be4
push 0x472a10
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044dad3
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x472a28
push 0xaa
push str.ENVIRONMENT
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472a40
push 0xae
push str.CANDIDATE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472a5c
push 0xa1
push str.ERRORURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472a78
push 0x8d
push 0x472a94
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472aa0
push 0xad
push str.INSTITUTION
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472abc
push 0x85
push str.INTERVAL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472ad8
push 0xaf
push str.LANGUAGE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472af4
push 0x8b
push str.LOGPATH
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push str.message.bin
push 0x9e
push str.MESSAGE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472b34
push 0x88
push str.OPTIONS
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472b4c
push 0xab
push str.PROGRAM
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472b64
push 0x67
push 0x472b78
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472b80
push 0x8e
push 0x472b98
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472ba0
push 0x6f
push 0x472bb8
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472bc0
push 0x96
push 0x472bdc
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472be8
push 0x94
push str.UPDATEURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472c04
push 0x75
push 0x471174
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472c14
push 0xa8
push str.KILLLIST
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472c3c
push 0x7c
push str.ALTURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push str.ecminver.bin
push 0xa5
push str.ECMINVERSION
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00411c80
push 0x472c70
push 0xbc
push str.KILLONQUITLIST
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00411c80
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 4
Function at 0x412160
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ce6a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a640
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
cmp dword [0x509c20], 1
push esi
jne 0x4121de
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.00456be4
push 0x4712dc
push esi
push edi
call fcn.0044dad3
add esp, 0x18
jmp 0x4121eb
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.00456be4
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call fcn.0044dad3
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4712dc
push esi
push edi
call fcn.0044dad3
push 0x4712e0
push esi
push edi
call fcn.0044dad3
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47232c
push 0xf4
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x4122b4
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
mov ecx, 0x51eff8
call fcn.0041bb40
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x51eff8
call fcn.0041b7b0
push 1
mov ecx, 0x51eff8
mov dword [0x52e298], 1
mov dword [0x50e0a0], 1
call fcn.0041bbb0
mov ecx, 0x51eff8
call fcn.004139d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00447cbd
mov esp, ebp
pop ebp
ret 0xc