joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e9bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push edi
mov dword [ebp - 0x88], ecx
lea eax, [ebp - 0x74]
push eax
call fcn.0040d480
mov ecx, eax
call fcn.004177b0
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x16a0
call fcn.00412030
push eax
lea edx, [ebp - 0x78]
push edx
call fcn.00419180
add esp, 8
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0x98]
push edx
lea eax, [ebp - 0x70]
push eax
call fcn.00402a90
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x78]
call fcn.0041c560
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x74]
call fcn.0041c560
push 0
call fcn.004260d0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x417057
jmp 0x41707d
mov edx, dword [ebp - 0x70]
push edx
push str.Call_LaunchGuaGua__s__n
push 0x338
push 0x4529a4
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x70]
call fcn.00412030
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0041b330
add esp, 8
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], ecx
mov byte [ebp - 4], 5
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0xa0]
call fcn.00412030
push eax
push 0
push 0
push 0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x70]
call fcn.00403340
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
call fcn.0041c560
cmp dword [ebp - 0x20], 0
je 0x41711a
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417186
push 0
call fcn.004260d0
add esp, 4
movzx eax, al
test eax, eax
jne 0x41712d
jmp 0x417186
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00403300
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
push ecx
push str.CSetupToolDlg::LaunchGuaGua___path_s_Fail_n
push 0x344
push 0x4529d0
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x80]
call fcn.0041c560
push 0
call fcn.004260d0
add esp, 4
movzx edx, al
test edx, edx
jne 0x417199
jmp 0x4171c3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
push str.Exec__s___d__n
push 0x346
push 0x452a10
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x84], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.0041c560
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x419450
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ec94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00419180
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 3
lea ecx, [ebp - 0x10]
call fcn.004032e0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0
jl 0x419505
mov edx, dword [ebp - 0x14]
push edx
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004047c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x4194b4
jmp 0x419505
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404870
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403320
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0041c560
push 0
lea ecx, [ebp - 0x10]
call fcn.00412030
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x419495
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00410990
lea ecx, [ebp - 0x18]
call fcn.00412030
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0041c560
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041c560
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x419720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ece2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push edi
mov dword [ebp - 0x48], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x48], 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0x440
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0
call fcn.004260d0
add esp, 4
movzx eax, al
test eax, eax
jne 0x419790
jmp 0x419818
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.00405470
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
call fcn.00405470
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
mov byte [ebp - 4], 1
xor edx, edx
cmp dword [ebp - 0x10], 0
setne dl
push edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x60]
mov eax, dword [edx]
push eax
push str.ExecApp__s__s___d__n
push 0x85
push 0x453364
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.0041c560
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0041c560
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41ad70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, 1
test eax, eax
je 0x41adba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 8]
jae 0x41adae
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x41adb0
jmp 0x41adba
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ad82
mov esp, ebp
pop ebp
ret 4

Function at 0x41af30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4654b0]
mov dword [ebp - 4], eax
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x41af5f
jmp 0x41b01f
mov dword [ebp - 0x130], 0x128
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x138]
call fcn.00405470
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41b007
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x138]
call fcn.00405250
test eax, eax
jne 0x41aff0
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x41aff0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41af9e
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x138]
call fcn.0041c560
mov ecx, dword [ebp - 4]
call fcn.004308f0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41b030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x4654b0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x138], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x41b06b
xor eax, eax
jmp 0x41b10d
mov dword [ebp - 0x130], 0x128
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00405470
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41b0e3
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00405250
test eax, eax
jne 0x41b0cc
mov dword [ebp - 0x138], 1
jmp 0x41b0e3
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41b0aa
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x140], ecx
lea ecx, [ebp - 0x13c]
call fcn.0041c560
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 4]
call fcn.004308f0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41bfc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x41bfd4
jmp 0x41bff8
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x41bff8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xc], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41f0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x41f0f9
mov ecx, dword [ebp - 0x10]
call fcn.0041f630
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x40], 0xffffffff
jne 0x41f132
xor eax, eax
jmp 0x41f26e
push 8
push 0x453e44
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call fcn.00430140
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0x4000
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x48], eax
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
push 0x2c
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0xc], 0x2c
je 0x41f1ce
jmp 0x41f22d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041f9f0
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 8]
add edx, 0x100
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41f20f
jmp 0x41f22d
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00406e80
mov dword [ebp - 4], 1
xor edx, edx
jne 0x41f100
cmp dword [ebp - 4], 0
jne 0x41f253
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x40], 0xffffffff
je 0x41f253
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov ecx, dword [ebp - 0x10]
call fcn.0041fa40
mov ecx, dword [ebp - 0x10]
call fcn.0041fa90
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x41f6c8
xor eax, eax
jmp 0x41f7b6
mov dword [ebp - 4], 0
push 0
push 0
push pe_nt_image_headers32
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406ea0
push eax
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406ee0
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406ea0
cmp dword [ebp - 4], eax
je 0x41f762
push 0
call fcn.004260d0
add esp, 4
movzx eax, al
test eax, eax
jne 0x41f735
jmp 0x41f75e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CBitmapFile::Read
push 0xf7
push 0x4540cc
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0xc
xor eax, eax
jmp 0x41f7b6
mov dword [ebp - 8], 0
jmp 0x41f774
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406ea0
cmp dword [ebp - 8], eax
jge 0x41f7b1
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406ee0
movzx eax, byte [eax]
cmp eax, 0xff
je 0x41f7af
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.00406ee0
mov byte [eax], 0
jmp 0x41f76b
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41f7c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x41f7d8
xor eax, eax
jmp 0x41f901
mov dword [ebp - 4], 0
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0x48]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], 0x2c
je 0x41f869
push 0
call fcn.004260d0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x41f839
jmp 0x41f862
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CBitmapFile::Write_
push 0x117
push 0x454120
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0xc
xor eax, eax
jmp 0x41f901
push 0
push 0
push pe_nt_image_headers32
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call fcn.00406ea0
push eax
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x30
call fcn.00406ee0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call fcn.00406ea0
cmp dword [ebp - 4], eax
je 0x41f8fc
push 0
call fcn.004260d0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x41f8cf
jmp 0x41f8f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CBitmapFile::Write_BITMAP
push 0x11f
push str.DownLoaderOnlineSetupV2CommonBitmapFile.cpp
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0xc
xor eax, eax
jmp 0x41f901
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4258f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f4e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x74], 0
jne 0x42591e
xor eax, eax
jmp 0x425a68
push 1
mov ecx, dword [ebp - 0x3c]
add ecx, 0x50
push ecx
lea ecx, [ebp - 0x18]
call fcn.0042716c
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
call fcn.004201b0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x425965
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a050
mov eax, dword [ebp - 0x30]
jmp 0x425a68
mov dword [ebp - 0x28], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x28]
je 0x425a15
push 0
call fcn.004260d0
add esp, 4
movzx edx, al
test edx, edx
jne 0x4259c5
jmp 0x4259fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.COutputFile::WriteData__I64d___d_
push 0xa3
push str.DownLoaderOnlineSetupV2CommonOutputFile.cpp
push 0
call fcn.004260f0
add esp, 0xc
push eax
call fcn.00426030
add esp, 0x18
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a050
mov eax, dword [ebp - 0x34]
jmp 0x425a68
push 0xff
mov ecx, dword [ebp - 0x3c]
call fcn.004201b0
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004314a0
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.0041f970
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.0041f910
mov ecx, dword [ebp - 0x3c]
call fcn.0041f7c0
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a050
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42760c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x42765f
call fcn.0044a049
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x42765f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x427655
xor eax, eax
jmp 0x427778
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x42768f
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x42768f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x427775
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x4276bc
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00426378
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x427775
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x427705
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x427705
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x4276ff
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00426378
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x427765
and dword [ebp + 0xc], 0
jmp 0x427765
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x427765
push 0xc
call fcn.00443a4a
mov esi, eax
test esi, esi
pop ecx
je 0x427747
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x427749
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x427760
push dword [ebp - 8]
call fcn.0043e81a
jmp 0x427765
call fcn.0043e7f1
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x4276ca
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x431276
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x431293
call fcn.00433337
mov dword [eax], 0x16
xor eax, eax
jmp 0x4312fd
push esi
push 0x8c
push 1
call fcn.00433ee7
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4312e8
push esi
call fcn.00435601
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4312c6
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4311e1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4312fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0043109c
test ebx, ebx
pop ecx
je 0x4312fa
push ebx
call fcn.00433349
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431395
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00431110
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x431430
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x469790]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x431430
cmp eax, 1
je 0x431451
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x431430
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4313fd
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x43142c
xor eax, eax
inc eax
jmp 0x431470
cmp edi, eax
jae 0x431434
xor eax, eax
jmp 0x431470
cmp eax, esi
jae 0x43143b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x469790]
jmp 0x431454
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret