joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf00
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x194]
push edx
push 0x202
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x41bf51
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x41bf51
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41bfaa
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x41bfa2
mov edx, dword [ebp - 0x198]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042a7b0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00429d80
add esp, 4
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
jmp 0x41bfaa
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41cb74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov dword [ebp - 4], 1
mov dword [ebp - 0x408], 0x400
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41cbd6
push 0
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004266b4
add esp, 0xc
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx], 0
setne al
jmp 0x41cbd8
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x41cbdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov dword [ebp - 4], 1
mov dword [ebp - 0x808], 0x400
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cc3e
push 0
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00426768
add esp, 0xc
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx], 0
setne al
jmp 0x41cc40
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x41ccb6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov dword [ebp - 4], 3
mov dword [ebp - 0x408], 0x400
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41cd53
mov edx, dword [ebp + 0x10]
push edx
call fcn.004267ad
add esp, 4
mov eax, dword [ebp - 0x408]
add eax, 1
push eax
call fcn.00429a5b
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x408]
push edx
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call fcn.00428c60
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x408]
mov byte [ecx + edx], 0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [eax], 0
setne cl
mov al, cl
jmp 0x41cd55
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x41cdfc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.00429d80
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x41ce38
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
call fcn.0042ab04
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x41f44c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x41f4c7
cmp dword [ebp + 8], 0
je 0x41f4c7
mov ecx, dword [ebp + 8]
call fcn.00404410
test eax, eax
je 0x41f4c7
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x41f4c7
push 0
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404410
push eax
mov ecx, dword [ebp + 8]
call fcn.00420e60
push eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41f4bd
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x41f5d2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.00404410
test eax, eax
jne 0x41f5ef
mov al, 1
jmp 0x41f68f
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41f63d
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41f63d
xor al, al
jmp 0x41f68f
cmp dword [ebp - 0xc], 0xffffffff
je 0x41f68c
push 2
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41f682
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404410
push eax
mov ecx, dword [ebp + 8]
call fcn.00420e60
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41f682
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41f9e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10010
call fcn.0042ab30
mov byte [ebp - 4], 0
push 0x8000
mov eax, dword [ebp + 8]
push eax
call fcn.004341db
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x41fad8
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
test ecx, ecx
je 0x41fa2c
mov edx, dword [ebp + 0xc]
push edx
call fcn.00442f9a
add esp, 4
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00442f2a
add esp, 8
test eax, eax
jge 0x41fab6
push 0x1ff
push 0x8301
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004341db
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x41fab4
push 0x10000
lea edx, [ebp - 0x1000c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00433f9d
add esp, 0xc
mov dword [ebp - 0x10010], eax
cmp dword [ebp - 0x10010], 0
jle 0x41faa4
mov ecx, dword [ebp - 0x10010]
push ecx
lea edx, [ebp - 0x1000c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004318da
add esp, 0xc
test eax, eax
jle 0x41faa4
jmp 0x41fa5d
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0042f648
add esp, 4
mov byte [ebp - 4], 1
jmp 0x41faca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Utils_Files::CopyFile:_error_accessing_target_:__d
call fcn.004288c1
add esp, 8
mov edx, dword [ebp - 8]
push edx
call fcn.0042f648
add esp, 4
jmp 0x41faec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Utils_Files::CopyFile:_error_opening_source_:__d
call fcn.004288c1
add esp, 8
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4203fe
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
lea ecx, [ebp - 0x28]
call fcn.00404430
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 0xc]
call fcn.004043e0
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4204f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x4204e4
mov edx, dword [ebp - 0x168]
and edx, dword [ebp + 0x10]
test edx, edx
je 0x4204ce
mov eax, dword [ebp - 0x168]
and eax, dword [ebp + 0x14]
test eax, eax
jne 0x4204ce
movsx ecx, byte [ebp - 0x13c]
cmp ecx, 0x2e
je 0x4204ce
lea edx, [ebp - 0x13c]
push edx
call fcn.00420e10
add esp, 4
push eax
call fcn.00429d80
add esp, 4
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.00420e10
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00404330
push 0x46be80
mov ecx, dword [ebp + 0xc]
call fcn.00415680
lea ecx, [ebp - 0x168]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x42045f
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x420504
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46be84
call fcn.004288c1
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 0x174], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404480
mov al, byte [ebp - 0x174]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42067e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x21c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x20]
call fcn.00404430
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp dword [ebp + 0xc], 0
je 0x4207b7
cmp dword [ebp + 8], 0
je 0x4207a8
lea ecx, [ebp - 0x20]
call fcn.004043e0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
je 0x420799
push 0
lea ecx, [ebp - 0x224]
push ecx
push 0x200
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420773
cmp dword [ebp - 0x224], 0
jne 0x420736
jmp 0x420773
mov ecx, dword [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x20]
call fcn.00404330
mov byte [ebp - 0x14], 1
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.00404410
push eax
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x420771
jmp 0x420773
jmp 0x420705
push 0
lea ecx, [ebp - 0x20]
call fcn.00420e60
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004266b4
add esp, 0xc
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4207a6
push str.__FileToBuffer_Error:_creating_file
call fcn.004288c1
add esp, 4
jmp 0x4207b5
push str.__FileToBuffer_Error:_szBuffer__NULL
call fcn.004288c1
add esp, 4
jmp 0x4207c4
push str.__FileToBuffer_Error:_szFile__NULL
call fcn.004288c1
add esp, 4
jmp 0x4207e0
mov dword [ebp - 4], 0
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x22c], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404480
mov al, byte [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420816
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x4208f7
cmp dword [ebp + 8], 0
je 0x4208e8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4208d9
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4208ca
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00429d80
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4208b1
mov byte [ebp - 0x14], 1
jmp 0x4208be
push str.__BufferToFile2_Error:_writting_file
call fcn.004288c1
add esp, 4
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4208d7
push str.__BufferToFile2_Error:_creating_file
call fcn.004288c1
add esp, 4
jmp 0x4208e6
push str.__BufferToFile2_Error:_szBuffer__NULL
call fcn.004288c1
add esp, 4
jmp 0x4208f5
push str.__BufferToFile2_szBuffer__NULL
call fcn.004288c1
add esp, 4
jmp 0x420904
push str.__BufferToFile2_szFile__NULL
call fcn.004288c1
add esp, 4
jmp 0x420920
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4210d1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push edi
cmp dword [0x470ee0], 0
jne 0x4212fa
mov dword [ebp - 0x9c], 0
mov ecx, 0x26
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x9c], 0x9c
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x421163
mov dword [ebp - 0x9c], 0x94
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x421163
call fcn.00421475
and eax, 0xff
test eax, eax
je 0x42115c
mov dword [0x470ee0], 0x50
jmp 0x421163
xor eax, eax
jmp 0x4212ff
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0xa4], edx
cmp dword [ebp - 0xa4], 1
je 0x421186
cmp dword [ebp - 0xa4], 2
je 0x4211e3
jmp 0x4212fa
cmp dword [ebp - 0x98], 4
jne 0x4211a4
cmp dword [ebp - 0x94], 0
jne 0x4211a4
mov dword [0x470ee0], 0xa
jmp 0x4211de
cmp dword [ebp - 0x98], 4
jne 0x4211c2
cmp dword [ebp - 0x94], 0xa
jne 0x4211c2
mov dword [0x470ee0], 0x14
jmp 0x4211de
cmp dword [ebp - 0x98], 4
jne 0x4211de
cmp dword [ebp - 0x94], 0x5a
jne 0x4211de
mov dword [0x470ee0], 0x1e
jmp 0x4212fa
cmp dword [ebp - 0x98], 6
jne 0x42121d
cmp dword [ebp - 0x94], 1
jne 0x42121d
mov eax, dword [ebp - 2]
and eax, 0xff
cmp eax, 1
jne 0x42120e
mov dword [0x470ee0], 0x64
jmp 0x421218
mov dword [0x470ee0], 0x6e
jmp 0x4212fa
cmp dword [ebp - 0x98], 6
jne 0x421258
cmp dword [ebp - 0x94], 0
jne 0x421258
mov ecx, dword [ebp - 2]
and ecx, 0xff
cmp ecx, 1
jne 0x421249
mov dword [0x470ee0], 0x50
jmp 0x421253
mov dword [0x470ee0], 0x5a
jmp 0x4212fa
cmp dword [ebp - 0x98], 5
jne 0x4212ab
cmp dword [ebp - 0x94], 2
jne 0x4212ab
mov edx, dword [ebp - 2]
and edx, 0xff
cmp edx, 1
jne 0x421284
mov dword [0x470ee0], 0x3c
jmp 0x4212a9
mov eax, dword [ebp - 2]
and eax, 0xff
cmp eax, 3
je 0x42129f
mov ecx, dword [ebp - 2]
and ecx, 0xff
cmp ecx, 2
jne 0x4212a9
mov dword [0x470ee0], 0x46
jmp 0x4212fa
cmp dword [ebp - 0x98], 5
jne 0x4212c9
cmp dword [ebp - 0x94], 1
jne 0x4212c9
mov dword [0x470ee0], 0x3c
jmp 0x4212fa
cmp dword [ebp - 0x98], 5
jne 0x4212e7
cmp dword [ebp - 0x94], 0
jne 0x4212e7
mov dword [0x470ee0], 0x32
jmp 0x4212fa
cmp dword [ebp - 0x98], 4
ja 0x4212fa
mov dword [0x470ee0], 0x29
mov eax, dword [0x470ee0]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x422201
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004267ad
add esp, 4
push 0x46c31c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4222c2
push str.SHGetFolderPathA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4222b8
push 0x104
call fcn.00429a5b
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
push 0
push 0x2e
push 0
call dword [ebp - 8]
test eax, eax
jne 0x4222b8
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x4222b8
push 0x104
push 0x46c33c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0042b1a0
add esp, 0xc
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x4222b8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esp, ebp
pop ebp
ret
Function at 0x422ed0
Capabilities:
Create directory
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov dword [ebp - 4], 0
push 0x104
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x422f18
push 0xa
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x42304e
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x42304e
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x42304e
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
je 0x422fb2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0x46c3cc
push 0x208
lea edx, [ebp - 0x20c]
push edx
call fcn.0042a698
add esp, 0x14
push 0
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x422fcf
mov ecx, dword [ebp + 0x10]
push ecx
push 0x46c3d4
push 0x208
lea edx, [ebp - 0x20c]
push edx
call fcn.0042a698
add esp, 0x10
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x423001
xor al, al
jmp 0x423050
push 0
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 4]
sub edx, 2
push edx
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42303d
push 0x30
push str.Installation_error
push str.Cant_create_file__Disk_Full_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x423050
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x423054
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
call fcn.004043e0
push 0xa
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4230d3
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4230d3
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4230d3
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00404330
and eax, 0xff
test eax, eax
je 0x4230d3
mov al, 1
jmp 0x4230d5
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x423325
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4233a5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4233a5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4233a5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x423393
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
cmp dword [ebp + 0x14], 0
je 0x4233a1
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov byte [ebp - 8], 1
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4233ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42342c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42342c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42342c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x42341a
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
cmp dword [ebp + 0x14], 0
je 0x423428
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov byte [ebp - 8], 1
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4234d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xa
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x423523
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x423523
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x423523
mov eax, dword [ebp - 4]
jmp 0x423525
xor eax, eax
mov esp, ebp
pop ebp
ret