joyce8/EMBER2024-capa huggingface dataset:
Function at 0x641c39
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 2]
jmp 0x641c2c
lea esp, [esp + 1]
or edx, ebp
call fcn.00641bdf
pop word [esp]
jmp 0x60f484
mov dword [eax + 4], 0
call 0x641c39
aam 0x8d
and al, 1
lea esp, [esp + 3]
jmp 0x641c73
mov byte [esp + 1], bh
mov word [esp], dx
jmp 0x641ced
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
push esp
mov word [esp], bx
jmp 0x641c5d
mov dword [eax + 0x10], reloc.RASAPI32.dll_RasHangUpA
mov dword [eax + 0x14], 0x10325476
call fcn.00641ca2
push esp
mov byte [esp], ch
jmp 0x641ed3
lea esp, [esp + 4]
mov dword [eax + 0xc], 0xefcdab89
jmp 0x641cc3
lea esp, [esp + 2]
shl edx, 8
sub esp, 0xc
mov byte [esp + 6], dh
add esp, 0xb
jmp 0x641c18
lea esp, [esp + 0x20]
movzx edx, byte [eax + 9]
cmc
pushal
pop word [esp + 0x17]
jmp 0x641d04
mov ecx, dword [esi + 4]
clc
sub esp, 0xe
push dword [esp + 6]
pop word [esp + 0xb]
jmp 0x641eaf
mov eax, dword [esi]
lea ecx, [esp + ecx]
bswap ecx
lea ecx, [ecx + edi]
btr ecx, ebx
jmp 0x641e7d
lea esp, [esp + 0x10]
mov dword [esp + 0x44], eax
clc
sub esp, 0
stc
jmp 0x641f1b
lea esp, [esp + 4]
add dword [esp + 8], ecx
mov ch, bh
setb al
xchg cl, ch
jmp 0x641ea0
lea esp, [esp + 0x28]
and eax, 0x3f
call fcn.00641f44
invalid
sub esp, 0xc
shr eax, 3
pushal
mov word [esp + 0x10], dx
pop dword [esp + 0xc]
jmp 0x641efe
pop word [esp]
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + ecx*4 + 0x10], edx
pushal
jmp 0x641e69

Function at 0x73740c
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc al
mov esi, eax
call fcn.007373a8
mov eax, 0x51b8492e
adc byte [ebp + 0x7d9f6c05], dl
test byte [edi], dh
push ds
and ebx, ecx
xor cx, 0x64a4
add al, dh
lea ecx, [esi + edi]
btc edx, ebx
pop edx
jmp 0x7373cd
rdtsc
mov al, ah
rdtsc
mov ebx, esi
mov bp, bx
jmp 0x7373e5

Function at 0x737472
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ax, 0xaa56
shr esi, 9
lea esp, [esp + 4]
btc ecx, edi
mov bl, 0xd8
cld
jmp 0x737499
cmc
mov cx, 0x1e05
shr ah, 1
cld
jmp 0x737447

Function at 0x737772
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7377d5
neg edi
inc edi
add esp, 3
mov dl, 0x34
xchg byte [esp], al
lea esi, reloc.RASAPI32.dll_RasHangUpA
jmp 0x7377b7
mov eax, dword [esp + 8]
lea esi, reloc.RASAPI32.dll_RasHangUpA
xor esi, esi
pop esi
mov eax, ebp
mov dx, word [esp + 1]
jmp 0x737774
Function at 0x737a70
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 6
rdtsc
xor dl, ch
shr bh, 3
mov edx, ebp
bswap esi
jmp 0x737acf
rdtsc
pop dx
lea ebx, [ecx*4]
push edx
lea esi, [ebp*4]
jmp 0x737a20
inc dl
xchg esi, ebx
push edx
add esp, 1
add edx, ebp
setne bh
jmp 0x737a39
lea esp, [esp + 0x41]
cpuid
jmp 0x737a53
pop dword [esp + 1]
xchg ah, bl
lea esi, [ecx + edx]
mov dl, 0x34
cld
xchg bp, ax
jmp 0x737b8d
mov di, word [esp + 7]
bsf ax, ax
add al, dh
pushal
mov dword [esp + 0xe], esi
xchg byte [esp + 0x14], al
jmp 0x737ab9
xchg si, di
mov ecx, dword [esp]
mov cl, byte [esp]
rol di, cl
sub esp, 0x1a
btr edx, esp
jmp 0x737b40
bsf ax, ax
shr esi, 0x1b
mov bl, bh
mov dl, 0x24
mov ebx, 0xb7f62c28
jmp 0x737b00
not edx
shr edx, 0x1b
xor ebp, esi
mov ax, dx
cpuid
cmc
jmp 0x737b1a
xchg byte [esp + 0x15], bl
mov byte [esp + 0x16], ah
pop di
xchg ah, bl
mov ecx, dword [esp + 5]
shr ecx, 1
jmp 0x737b6f
mov cx, sp
shr dh, 7
xchg dh, al
mov bl, bh
rdtsc
mov dl, byte [esp]
jmp 0x737b31
push word [esp + 0x15]
rdtsc
cpuid
rcr bh, 3
cpuid
sub esp, 0xe
jmp 0x737d39
bswap ebp
inc ax
mov bp, 0x6a3d
pushal
lea esp, [esp + 0x47]
xchg ah, bl
jmp 0x737b5e
mov ax, bx
mov dl, dh
inc si
mov byte [esp], ch
lea esi, [edx + edi]
btr ebp, esp
jmp 0x737c57
mov esi, dword [esp]
xchg byte [esp], al
stc
lea edi, [edx + ebx]
shr ecx, 0xf
lea edi, [ecx*4]
jmp 0x737b9e
lea esp, [esp + 0xf]
pop edx
mov edx, ecx
rcr ecx, 0x17
xor bx, 0x50ac
push edx
jmp 0x737cf7
bsr dx, cx
mov byte [esp + 0x15], bh
mov bl, 0x48
cpuid
pop si
lea edx, [eax - 0x91]
jmp 0x737bd2
xchg bx, cx
pushal
mov word [esp + 0x13], di
xchg word [esp + 0xe], di
and cx, 0x6aea
mov di, word [esp + 0x1d]
jmp 0x737bec
neg ebp
sub cx, 0xc808
mov di, dx
neg ch
rdtsc
cld
jmp 0x737c15
neg bh
lea edi, [ebp*4]
add esp, 0
mov di, 0x2119
rdtsc
lea esp, [esp]
jmp 0x737c38
mov eax, 0x5953502e
mov ch, byte [esp + 0x11]
lea ecx, [ecx - 0x23]
add esp, 0x2b
cpuid
mov si, dx
jmp 0x737bbc
sub esp, 0x1e
setl ch
push esp
cpuid
xchg ebp, edi
pop eax
jmp 0x737ce0
push edx
pop dword [esp + 8]
mov dx, word [esp + 8]
neg ch
btc esi, ebx
mov esi, dword [esp + 5]
jmp 0x737c94
mov bh, byte [esp + 9]
setge ah
call fcn.00737d12
wait
adc al, 0x8a
in eax, dx
sbb al, 0xfe
add eax, eax
cmp dword [edx], 0x15
xchg byte [esp + 0xc], dl
stc
lea ebp, [ebx + edi]
pop dword [esp + 0x16]
btr ebx, esp
jmp 0x737cc9
bsf bx, si
mov bx, 0x82db
xchg word [esp + 5], cx
xchg byte [esp + 2], bl
pop dword [esp + 4]
push dword [esp + 6]
jmp 0x737cb4
lea ecx, [ecx + 0xdb]
mov ah, byte [esp + 0x21]
lea ebp, [ecx - 0x2b]
not dh
lea ecx, [ecx + edx]
push dword [esp + 0x24]
jmp 0x737c7b

Function at 0x7380cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
inc ebx
lea edi, [ebx*4]
xchg ecx, esi
pop ecx
and cl, bh
jmp 0x7380dd
mov ax, di
pop cx
setl bh
xchg di, si
mov dword [esp + 4], eax
jmp 0x7380ab
bswap edx
push esp
pushal
pop dword [esp + 0x16]
inc esi
rdtsc
jmp 0x73811a
mov eax, esi
mov word [esp + 0x20], di
lea ebp, [edi*4]
btr ecx, edx
neg ax
mov cl, 0xea
jmp 0x7380fd
Function at 0x7387d7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov byte [esp + 6], dh
mov dword [esp + 1], ebp
jmp 0x738801
push word [esp + 3]
pop word [esp + 3]
push word [esp + 3]
lea esp, [esp + 7]
lea esp, [esp + 2]
mov byte [esp], ch
jmp 0x73888c
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x738834
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x73884a
lea esp, [esp]
mov byte [esp], dh
lea esp, [esp + 1]
mov dword [esp + 0x70], edi
lea esp, [esp + 0x70]
jmp 0x738862
Function at 0x4046ea
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40bcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00402d0f
mov dword [ebp - 0x14], eax
cmp dword [0x40ca30], edi
jne 0x4047db
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x404768
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4048bb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4048bb
push 0x409144
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4048bb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x40ca30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x40ca34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x40ca38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x40ca40], eax
test eax, eax
je 0x4047d8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x40ca3c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404800
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4047f3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x404815
push 4
pop eax
jmp 0x4048bd
cmp dword [ebp - 0x14], edi
je 0x404815
push dword [0x40ca30]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4047fa
mov eax, dword [0x40ca3c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x404873
cmp dword [0x40ca40], esi
je 0x404873
push eax
call ebx
push dword [0x40ca40]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x404873
test eax, eax
je 0x404873
call ecx
test eax, eax
je 0x404868
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x404868
test byte [ebp - 8], 1
jne 0x404873
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4048a3
mov eax, dword [0x40ca34]
cmp eax, esi
je 0x4048a0
push eax
call ebx
test eax, eax
je 0x4048a0
call eax
mov edi, eax
test edi, edi
je 0x4048a0
mov eax, dword [0x40ca38]
cmp eax, esi
je 0x4048a0
push eax
call ebx
test eax, eax
je 0x4048a0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x40ca30]
call ebx
test eax, eax
je 0x4048bb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4048bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004048cc
leave
ret
Function at 0x401000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x40d9a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi + 4], 0x40f544
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esi + 0x18], eax
call fcn.0040d2e2
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 1
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [esp + 8]
mov dword [esi], 0x40f540
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402790
Capabilities:
Create process on windows
Resume thread
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0xa54
lea eax, [esp + 0x368]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push eax
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x378]
lea edx, [esp + 0x274]
push ecx
push edx
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea eax, [esp + 0x274]
push 0x5c
push eax
call ebp
add esp, 8
mov byte [eax], 0
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push str.Upgrade.bat
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40294f
lea ecx, [esp + 0x6c]
push 0x104
push ecx
push 0
call edi
lea edx, [esp + 0x57c]
push 0
lea eax, [esp + 0x480]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x78]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x170]
push eax
push ecx
call ebx
lea edx, [esp + 0x170]
push 0x5c
push edx
call ebp
mov byte [eax], 0
mov eax, dword [esp + 0xa70]
add esp, 8
test eax, eax
jne 0x402890
lea eax, [esp + 0x170]
push str.Upgrade.bat
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x688]
push str.__s:__r_nCD___s__r_nCOPY_UPGRADEhypwise.exe__Y__r_nDEL_UPGRADEhypwise.exe__S_Q__r_nStart_hypwise.exe__r_r_ndel___s__r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x24]
push 0
lea ecx, [esp + 0x680]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x684]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0x412058
push 0
push 0x44
push 0
push 0
push 0
push str.Upgrade.bat
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40294f
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push edx
call edi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esp + 0x18]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa54
ret 4
Function at 0x404060
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 0x11c]
push 8
push edi
mov ecx, ebx
call fcn.004040c0
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x404084
push 0x20
push eax
mov ecx, ebx
mov dword [esi], ebp
call fcn.004040c0
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x40406e
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x404100
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, dword [ecx]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x404138
push ebx
push edi
lea edi, [ecx]
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [esi + ecx*4 + 0x11c]
xor eax, ecx
inc edx
dec edi
jne 0x404118
pop edi
pop ebx
not eax
pop esi
ret 8

Function at 0x404140
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40df87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov eax, dword [esp + 0x3c]
push ebp
push esi
push edi
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
mov ebp, ecx
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40419f
mov esi, dword [esp + 0x44]
push 0x412244
mov ecx, esi
call fcn.0040d498
jmp 0x404286
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esp + 0x48]
push esi
push 0x20
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
push 0
push ecx
mov ebx, 1
push esi
push esi
lea ecx, [esp + 0x58]
mov dword [esp + 0x4c], ebx
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
lea ecx, [esp + 0x4c]
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp esi, dword [esp + 0x18]
je 0x404207
mov esi, dword [esp + 0x44]
push 0x412244
mov ecx, esi
call fcn.0040d498
mov dword [esp + 0x14], ebx
jmp 0x404278
lea edx, [esp + 0x1c]
push esi
push edx
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CString::Right
push esi
push eax
mov ecx, ebp
call fcn.00404100
lea ecx, [esp + 0x1c]
mov esi, eax
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x20]
push 0x10
push eax
push esi
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040d498
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::MakeUpper
mov esi, dword [esp + 0x44]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x3c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 8
Function at 0x404550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x40dfa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], 0
mov esi, 1
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4045a2
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret
push 0x2f
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::ReverseFind
mov ecx, dword [esp + 0x18]
lea edx, [eax + 1]
mov ecx, dword [ecx - 8]
cmp ecx, edx
jne 0x4045c5
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBufferSetLength
push 1
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404628
push 0x2f
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::ReverseFind
test eax, eax
jle 0x404609
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
call fcn.00404550
add esp, 4
test eax, eax
je 0x404635
push 0
push 1
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x404635
mov esi, 1
jmp 0x404637
cmp eax, 0x10
je 0x404637
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret
Function at 0x4047c0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f668
push 0x40d77e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x83c
push ebx
push esi
push edi
mov dword [ebp - 0x844], 0xffffffff
xor edi, edi
mov dword [ebp - 0x840], edi
mov dword [ebp - 0x83c], edi
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.MSVCRT.dll__strdate]
lea ecx, [ebp - 0x82c]
push ecx
call dword [sym.imp.MSVCRT.dll__strtime]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x838]
push ecx
push str._s__s__s
push 0x400
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x818]
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
add esp, 0x2c
mov dword [ebp - 4], edi
push edi
push edi
push 4
push edi
push edi
push 0xc0000000
push str..upgradeupdate.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x844], esi
cmp esi, 0xffffffff
je 0x40491c
lea eax, [ebp - 0x83c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x840], eax
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x840], eax
jne 0x40491c
mov cx, word [0x412250]
mov word [ebp - 0x84c], cx
mov dl, byte [0x412252]
mov byte [ebp - 0x84a], dl
mov dword [ebp - 0x848], edi
push edi
lea eax, [ebp - 0x848]
push eax
push 3
lea ecx, [ebp - 0x84c]
push ecx
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
call ebx
mov dword [ebp - 0x820], eax
cmp eax, edi
je 0x40491c
push edi
lea edx, [ebp - 0x848]
push edx
lea edi, [ebp - 0x818]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea eax, [ebp - 0x818]
push eax
push esi
call ebx
mov dword [ebp - 0x820], eax
xor edi, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00404941
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405771
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
push 0x40b
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x4057a7
mov ecx, dword [esi + 0x20]
push 0
push 0x1d4c0
push 0x40b
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ecx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 4]
mov ecx, edi
call fcn.00402d40
mov eax, dword [edi + 0x538]
test eax, eax
jne 0x4057f0
mov eax, dword [edi + 0x108]
push 0
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esi + 0x20]
shl edx, 5
push edx
push 0x40b
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ecx
ret 8
mov ecx, dword [edi + 0x534]
mov edx, dword [ecx]
cmp dword [edx], 0
jne 0x40580c
lea eax, [esp + 8]
push eax
push 4
push esi
push 0x409c20
jmp 0x405819
lea ecx, [esp + 8]
push ecx
push 4
push esi
push 0x40ab10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x70], eax
je 0x40589b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x3ec
mov ecx, esi
mov dword [esi + 0x60], 1
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
push 0x3ed
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
push 0x3ee
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
pop edi
pop esi
pop ecx
ret 8
Function at 0x4058b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x401
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x60]
xor ebx, ebx
cmp eax, ebx
je 0x4058ea
mov ecx, dword [esi + 0x20]
push ebx
push 0xea60
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
pop ecx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 4]
mov ecx, edi
call fcn.004036d0
cmp dword [edi + 0x524], ebx
jne 0x405947
cmp dword [esi + 0x6c], ebx
je 0x405917
mov edx, dword [esi + 0x20]
push ebx
push ebx
push 0x404
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [edi + 0x104]
mov ecx, dword [esi + 0x20]
push ebx
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 5
push eax
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
pop ecx
ret 8
cmp dword [edi + 0xf0], 1
je 0x40598a
cmp dword [esi + 0x6c], ebx
je 0x40598a
cmp dword [edi + 0xe8], ebx
jne 0x40598a
mov edx, dword [esi + 0x20]
push ebx
push ebx
push 0x404
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 0x20]
push ebx
push 0x927c0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
pop ecx
ret 8
mov ecx, dword [edi + 0x520]
mov edx, dword [ecx]
cmp dword [edx], ebx
jne 0x4059a5
lea eax, [esp + 0xc]
push eax
push 4
push esi
push 0x4064c0
jmp 0x4059b2
lea ecx, [esp + 0xc]
push ecx
push 4
push esi
push 0x407560
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x70], eax
je 0x405a31
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x3ec
mov ecx, esi
mov dword [esi + 0x60], 1
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push ebx
push 0x3ed
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
push 0x3ee
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
mov ecx, esi
call fcn.00405320
pop edi
pop esi
pop ebx
pop ecx
ret 8