joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c20c5
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4c2100
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4c20e7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4c20f8
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4c2102
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4c20dd
xor eax, eax
pop edi
pop esi
ret
Function at 0x4c233e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004c204a
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4c2373
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004c2085
xor byte [edx], al
sti
lea eax, [ebp - 0x40]
push eax
call fcn.004c2095
push eax
push esi
push dword [ebp + 8]
call fcn.004c204a
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004c2085
or esp, dword [ebx + 0x458d4a70]
call 0x5134817b
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004c2095
push eax
push esi
push dword [ebp + 8]
call fcn.004c204a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004c2095
push eax
push esi
push dword [ebp + 8]
call fcn.004c204a
invalid
dec dword [ecx - 0xbb7b]
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004c2095
push eax
push esi
push dword [ebp + 8]
call fcn.004c204a
add esp, 0x30
mov dword [ebp - 0xb8], eax
invalid
invalid
invalid
call fcn.004c2085
mov eax, 0x88ec5587
popfd
jl 0x4c250a
invalid
invalid
Function at 0x4dc20a
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x528d82
call fcn.0050491e
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.004e1cb1
push 0x15c
call fcn.00402846
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x4dc24e
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004e3599
jmp 0x4dc250
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.004e1c83
call fcn.00407c33
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x4dc3f0
cmp dword [edi + 4], ebx
jle 0x4dc3f0
lea ecx, [ebp - 0x21c]
call fcn.00402080
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4dc3d4
lea ecx, [ebp - 0x220]
call fcn.00402080
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4dc325
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.00401fd0
add esp, 0xc
jmp 0x4dc357
jge 0x4dc345
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.00401fd0
add esp, 0x10
jmp 0x4dc357
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00404327
push 0x15c
call fcn.00402846
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4dc37b
mov ecx, eax
call fcn.004b4f35
mov esi, eax
jmp 0x4dc37d
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.00406e84
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.004e1c83
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402040
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00402040
inc ebx
cmp ebx, dword [edi + 4]
jl 0x4dc2be
call fcn.005049a1
ret
Function at 0x4e0e14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4e0e2c
mov edi, dword [esi + 0xc]
jmp 0x4e0e6c
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4e0e45
call fcn.00409416
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4e0e5a
call fcn.00409416
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4e0e6c
call fcn.00409416
call fcn.00407c33
cmp dword [eax + 0x3c], 0
je 0x4e0e81
push edi
mov ecx, ebx
call fcn.004dfcef
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004e0d3a
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4e0e9f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4e0eab
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4e8388
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x4e83d2
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e83d2
call fcn.004e7c43
test eax, eax
je 0x4e83d2
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.00401d90
xor eax, eax
inc eax
jmp 0x4e85ea
cmp dword [ebx + 4], 0x100
push edi
jne 0x4e85e1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x4e84cf
push 0x11
call edi
test ax, ax
jl 0x4e84cf
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e84cf
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x4e8442
cmp eax, 0x20
jbe 0x4e84cf
cmp eax, 0x24
jbe 0x4e8435
cmp eax, 0x26
je 0x4e8435
cmp eax, 0x28
jne 0x4e84cf
call fcn.004e7c43
test eax, eax
je 0x4e84cf
mov ecx, esi
call fcn.00412864
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.004e7c43
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x4e8477
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00401d90
jmp 0x4e85dc
call fcn.0040ece8
test eax, eax
je 0x4e85dc
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.0040ed20
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4e84a5
xor edi, edi
jmp 0x4e84a8
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.0040ece8
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4e85dc
mov eax, dword [ebx + 8]
sub eax, 9
je 0x4e85ab
sub eax, 0x12
je 0x4e8583
sub eax, 0xb
je 0x4e84f1
dec eax
dec eax
jne 0x4e85e1
push 0x12
call edi
test ax, ax
jl 0x4e85e1
push 0x11
call edi
test ax, ax
jl 0x4e85e1
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e85e1
call fcn.004e7c43
test eax, eax
jne 0x4e85dc
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.004e7bbd
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040d65b
test eax, eax
je 0x4e85dc
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.0040d65b
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4e85dc
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4e8597
push 0
call fcn.004e7bbd
mov ecx, esi
call fcn.0040e7b6
test eax, eax
je 0x4e85e1
mov ecx, esi
call fcn.0040e7b6
jmp 0x4e85d5
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040d65b
test eax, eax
je 0x4e85e1
push dword [esi + 0x20]
call edi
push eax
call fcn.0040d65b
push 0
push esi
mov ecx, eax
call fcn.00405224
mov ecx, eax
call fcn.00412864
xor eax, eax
inc eax
jmp 0x4e85e9
push ebx
mov ecx, esi
call fcn.0040b46c
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4fe22d
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4fe272
test edi, edi
jl 0x4fe272
cmp ax, 0x20
je 0x4fe267
cmp word [ebp + 8], 0x71
jne 0x4fe272
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x5035ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x578a10]
jne 0x5035b6
repz ret
jmp fcn.0050ad56

Function at 0x516ac8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0050a6ba
and dword [ebp - 4], 0
cmp dword [0x57fdec], 0
mov ebx, eax
jne 0x516b79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x516c2a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x516c2a
push eax
call fcn.0050a648
mov dword [esp], 0x5563e4
push edi
mov dword [0x57fdec], eax
call esi
push eax
call fcn.0050a648
mov dword [esp], 0x5563d0
push edi
mov dword [0x57fdf0], eax
call esi
push eax
call fcn.0050a648
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x57fdf4], eax
call esi
push eax
call fcn.0050a648
pop ecx
mov dword [0x57fdfc], eax
test eax, eax
je 0x516b79
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0050a648
pop ecx
mov dword [0x57fdf8], eax
mov eax, dword [0x57fdf8]
cmp eax, ebx
je 0x516bd1
cmp dword [0x57fdfc], ebx
je 0x516bd1
push eax
call fcn.0050a6c3
push dword [0x57fdfc]
mov esi, eax
call fcn.0050a6c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x516bd1
test edi, edi
je 0x516bd1
call esi
test eax, eax
je 0x516bc8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x516bc8
test byte [ebp - 0xc], 1
jne 0x516bd1
or dword [ebp + 0x10], 0x200000
jmp 0x516c0a
mov eax, dword [0x57fdf0]
cmp eax, ebx
je 0x516c0a
push eax
call fcn.0050a6c3
pop ecx
test eax, eax
je 0x516c0a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x516c0a
mov eax, dword [0x57fdf4]
cmp eax, ebx
je 0x516c0a
push eax
call fcn.0050a6c3
pop ecx
test eax, eax
je 0x516c0a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x57fdec]
call fcn.0050a6c3
pop ecx
test eax, eax
je 0x516c2a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x516c2c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405400
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, 0x4000000
je 0x405413
mov eax, 0x200
push esi
mov esi, ecx
and esi, 0x20000000
push edi
mov edx, 0x40000000
mov edi, 0x80000000
je 0x405431
test edx, ecx
je 0x405431
test edi, ecx
jne 0x40545f
test esi, esi
je 0x40543e
test edx, ecx
je 0x40543e
or eax, 0x20
jmp 0x405462
mov esi, ecx
and esi, edx
je 0x40544d
test edi, ecx
je 0x405456
or eax, 4
jmp 0x405462
test edi, ecx
je 0x405456
or eax, 8
jmp 0x405462
test esi, esi
je 0x40545f
or eax, 2
jmp 0x405462
or eax, 0x40
pop edi
pop esi
ret

Function at 0x45f420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0045f850
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45f452
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [fcn.00478ee0]
call dword [ebp - 8]
jmp 0x45f45c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x401020
Capabilities:
Terminate process

Disassembly:
push esi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401063
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401063
push 0x800
mov ecx, esi
call dword [0x4222ec]
call esi
test eax, eax
jne 0x4010a2
push 0x4225d4
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4010a2
push str.LdrEnumerateLoadedModules
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4010a2
push 0
push 0x401100
push 0
mov ecx, esi
call dword [0x4222ec]
call esi
push 0xa
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x4010c6
push 0x3eb
call fcn.00403a00
add esp, 4
push 0xc000001d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00407800
cmp eax, 0x5010300
jae 0x4010ea
push 0x3ec
call fcn.00403a00
add esp, 4
push 0x47e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004100ae
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402360
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
movzx eax, byte [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov edi, dword [ebp + 0x24]
mov dword [ebp - 8], edi
cmp esi, 0xffffffff
je 0x402405
push 0
push 0
xorps xmm0, xmm0
movq qword [ebp - 0x40], xmm0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4023fb
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x402405
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x402464
test ebx, ebx
je 0x40240f
mov dword [ebx], 0
test edi, edi
je 0x402419
mov dword [edi], 0
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0x38]
push eax
call fcn.00402640
add esp, 4
test al, al
jne 0x40243a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x40244f
mov eax, 0x51eb851f
mul dword [ebp - 0x14]
shr edx, 5
cmp edx, 2
je 0x402462
mov edi, 0x10dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x402420
jmp 0x402464
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0041038e
mov esp, ebp
pop ebp
ret
Function at 0x403020
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0x20
xor esi, esi
push eax
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4030d0
cmp eax, 0x20
ja 0x4030d0
call fcn.00408a40
push esi
mov ebx, eax
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x48]
push eax
push 1
push str.D:P_A_CIOI_FA___SY__A_CIOI_FA___BA__A_CIOI_FRFX___BU_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
test eax, eax
je 0x4030d0
mov eax, dword [ebp - 0x48]
push ebx
push dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x44]
push eax
push str._sTemp_asw._08x_08x
push edi
mov dword [ebp - 0x54], 0xc
mov dword [ebp - 0x4c], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4030d8
movzx eax, word [ebp - 0x44]
push ebx
push dword [ebp - 0x58]
push eax
push str._c:_asw._08x_08x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4030d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x4030e6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0041038e
mov esp, ebp
pop ebp
ret
Function at 0x403750
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], ecx
push esi
push esi
push esi
push 0x1000002
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x403790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x403826
push edi
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4037b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40381e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40380f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40380f
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], esi
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x4227e0
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40380f
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x4227e4
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x403817
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
pop ebx
call fcn.0041038e
mov esp, ebp
pop ebp
ret
Function at 0x403850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, 0x400000
push 0x10
cmovne esi, eax
mov dword [ebp - 0x18], ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40394f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40394f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4227e0
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40394f
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x4227e4
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test ebx, ebx
je 0x403913
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0Edition
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403913
push dword [ebp - 0x10]
call fcn.004146ca
add esp, 4
mov dword [ebx], eax
test edi, edi
je 0x40393c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0SubEdition
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40393c
push dword [ebp - 0x10]
push 0x40
push edi
call fcn.00413ac6
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041038e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041038e
mov esp, ebp
pop ebp
ret

Function at 0x404270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push 0x403eb0
push 0
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4042ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x4042b8
lock inc dword [0x42c9b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041038e
mov esp, ebp
pop ebp
ret

Function at 0x4042d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push 0x404040
push 0
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40430b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x404318
lock inc dword [0x42c9b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041038e
mov esp, ebp
pop ebp
ret