joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x4057e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x405803
mov eax, 0
jmp 0x405847
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x405826
mov eax, 0
jmp 0x405847
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x405842
mov eax, 0
jmp 0x405847
mov eax, 1
leave
ret

Function at 0x405849
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4058a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4058a0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4058a0
mov eax, dword [ebp - 4]
jmp 0x4058bc
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40587d
mov eax, 0
leave
ret
Function at 0x4012a4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [0x41b5b0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5b4]
mov dword [ebp - 0x34], eax
call fcn.0040129d
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5b8]
add edi, 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5bc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0x2d38604]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132d
push 0x418228
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x2d38604]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d38600]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x2d38600], eax
mov eax, dword [0x2d38558]
cmove eax, dword [ebp - 0x24]
mov dword [0x2d38558], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x2d385fc], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4012f5
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d2ec
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404c55
mov dword [ebp - 0x14], eax
cmp dword [0x43ecb8], esi
jne 0x40d3df
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d36c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d4bf
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d4bf
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d4bf
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43ecb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43ecbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43ecc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ecc8], eax
test eax, eax
je 0x40d3dc
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ecc4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d404
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3f7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d419
push 4
pop eax
jmp 0x40d4c1
cmp dword [ebp - 0x14], esi
je 0x40d419
push dword [0x43ecb8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3fe
mov eax, dword [0x43ecc4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d477
cmp dword [0x43ecc8], edi
je 0x40d477
push eax
call ebx
push dword [0x43ecc8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d477
test eax, eax
je 0x40d477
call ecx
test eax, eax
je 0x40d46c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d46c
test byte [ebp - 8], 1
jne 0x40d477
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4a7
mov eax, dword [0x43ecbc]
cmp eax, edi
je 0x40d4a4
push eax
call ebx
test eax, eax
je 0x40d4a4
call eax
mov esi, eax
test esi, esi
je 0x40d4a4
mov eax, dword [0x43ecc0]
cmp eax, edi
je 0x40d4a4
push eax
call ebx
test eax, eax
je 0x40d4a4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43ecb8]
call ebx
test eax, eax
je 0x40d4bf
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d4c1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fbb
mov esp, ebp
pop ebp
ret
Function at 0x403720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00424d9b

Function at 0x403ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x45
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea edx, [eax - 0x37]
mov cl, byte [esi + eax - 0x3c30a2a0]
xor cl, al
mov byte [edi + eax - 0x45], cl
inc eax
sub edx, 1
jne 0x403ef2
mov byte [edi + 0xe], dl
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x403f10
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58ae55
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5f4274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x21c], edi
mov eax, dword [ebp + 8]
push eax
push 0x65
mov dword [ebp - 0x228], edi
call fcn.00409f20
lea esi, [edi + 0x8f0]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi], vtable.CNewAppDlg.0
mov dword [ebp - 0x21c], esi
call fcn.0041b5cb
mov dword [esi], vtable.CExplorer.0
lea ecx, [edi + 0x990]
mov byte [ebp - 4], 1
call fcn.00409040
lea ecx, [edi + 0xb50]
mov byte [ebp - 4], 2
call fcn.004095d0
lea ecx, [edi + 0xc70]
mov byte [ebp - 4], 3
call fcn.004095d0
lea ecx, [edi + 0xd94]
mov byte [ebp - 4], 4
call fcn.004110f0
cmp byte [edi + 0x6a0], 0
mov byte [ebp - 4], 5
jne 0x404073
mov dword [edi + 0x5a8], 0x2ee
mov dword [edi + 0x5ac], 0x21d
mov dword [edi + 0x5b0], 0x83
mov dword [edi + 0x5b4], 0x89
mov dword [edi + 0x5b8], 0x8a
mov dword [edi + 0x5bc], 0x969696
mov dword [edi + 0x5c0], 0x262626
mov dword [edi + 0x5c4], 1
mov dword [edi + 0x5c8], 1
mov dword [edi + 0x5cc], 0
mov dword [edi + 0x5d0], 1
mov dword [edi + 0x5d4], 1
mov dword [edi + 0x5d8], 0
mov dword [edi + 0x5dc], 1
mov dword [edi + 0x5e0], 1
mov dword [edi + 0x5e4], 0
mov dword [edi + 0x5e8], 0
push 0
push 0x26
lea eax, [ebp - 0x114]
mov dword [edi + 0xd90], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push str._s_Internet_Explorer_iexplore.exe
push eax
call fcn.00402080
lea eax, [ebp - 0x218]
push 0x59d7f4
push eax
call fcn.0056a614
add esp, 0x14
test eax, eax
jne 0x4040f0
push 0x31
push str.Warning_GunzLauncher
push str.Remember_that_you_need_Internet_Explorer_installed_to_run_GunZ__nIf_you_are_seeing_this_warning__means_launcher_can_not_detect_Internet_Explorer_installed_on_your_pc_n_Click_OK_to_Start_GunzLauncher_and_Cancel_to_Install_Internet_Explorer
mov ecx, edi
call fcn.0041e0f5
cmp eax, 1
je 0x4040f0
push 1
push 0
push 0
push str.http:__windows.microsoft.com_en_us_internet_explorer_download_ie
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 8
lea eax, [ebp - 0x224]
xorps xmm0, xmm0
push eax
push 0x32
movlpd qword [ebp - 0x224], xmm0
push 0
mov dword [ebp - 0x224], 1
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [edi + 0x19fc], 0
mov eax, edi
mov byte [edi + 0x1a00], 0
mov dword [edi + 0x8e4], 0
mov byte [edi + 0x19f8], 0
mov byte [edi + 0x8b0], 0
mov byte [edi + 0x8e8], 0
mov byte [edi + 0x8ea], 0
mov byte [edi + 0xb48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f63b
mov esp, ebp
pop ebp
ret 4
Function at 0x404610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 4], ecx
test eax, eax
je 0x40471f
test eax, 0xffff0000
jne 0x40471f
push ebx
push edi
movzx edi, ax
push edi
call fcn.0042a54a
mov ebx, eax
test ebx, ebx
je 0x40471b
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40471b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40471b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40471a
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4046a9
cmp esi, ecx
jae 0x40471a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404693
cmp esi, ecx
jae 0x40471a
cmp word [esi], 0
je 0x40471a
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x404727
mov ebx, dword [ebp - 4]
mov ecx, 1
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4046f1
push edi
mov ecx, ebx
call fcn.00403b10
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x404727
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
pop esi
pop edi
mov dl, 1
pop ebx
mov al, dl
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402850
int3
Function at 0x404a00
Capabilities:
Get file version info
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58af55
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5f4274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [ebx], 0x412f4e
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x404b56
push edi
call fcn.00417a16
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
push esi
push edi
push dword [ebp - 0x14]
mov dword [ebp - 4], 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x404b4b
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 0xc]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x404b4b
call fcn.0041938a
mov ecx, eax
test ecx, ecx
je 0x404b6a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
cmp dword [ebp - 0x10], 4
mov byte [ebp - 4], 1
jne 0x404ae9
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 0x18
push eax
movzx eax, cl
push eax
shr ecx, 8
movzx eax, cl
push eax
lea eax, [ebp + 8]
push str.StringFileInfo_02X_02X_02X_02XProductVersion
push eax
call fcn.00404860
add esp, 0x18
jmp 0x404b04
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp + 8]
push str.StringFileInfo_04X04B0ProductVersion
push eax
call fcn.00404860
add esp, 0xc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x404b2d
mov ecx, dword [ebp + 0xc]
sub ebx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x404b20
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x404b4b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push esi
call fcn.0055f649
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402850
int3
Function at 0x4059b0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8e8], 1
je 0x405a75
cmp byte [esi + 0xb48], 1
je 0x405a75
cmp byte [esi + 0x16e4], 0
jne 0x4059f8
push 0x59d4f9
push 0x59d4f9
push str.update_gunz_new
push 0x50
push dword [0x5f9684]
lea ecx, [esi + 0xd94]
call fcn.00411af0
push ebx
push edi
xor edi, edi
cmp byte [esi + 0x1a00], 1
jne 0x405a23
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
cmp edi, 0xa
jg 0x405a5a
push 0x64
call ebx
inc edi
cmp byte [esi + 0x1a00], 1
je 0x405a10
push 0
push 0
push 0
push 0
push esi
push 0x406620
mov byte [esi + 0x1a00], 1
call fcn.00425a11
mov dword [esi + 0x19fc], eax
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop ebx
lea ecx, [esi + 0x8f0]
pop esi
jmp fcn.00424836
push str._APP__ERROR___The_thread_is_not_terminating.
call fcn.00402060
add esp, 4
mov dword [esi + 0xd90], 1
pop edi
pop ebx
pop esi
ret
mov dword [esi + 0xd90], 8
pop esi
jmp fcn.004064f0
Function at 0x4063a0
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0055fad0
mov eax, dword [0x5f4274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0042a962
push 0x59dc08
push 0x8b
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4064da
call fcn.0042a962
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4064da
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
call fcn.0042a962
push esi
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x59d9c4
mov edi, eax
mov dword [ebp - 0x1008], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4064cb
push 0
lea eax, [ebp - 0x1008]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, dword [ebp - 0x1008]
jne 0x4064c4
push str._APP__Run_external_updater
call fcn.00402060
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00562660
push 0x59d9c4
lea eax, [ebp - 0x1004]
push str.._s
push eax
call fcn.00402080
add esp, 0x1c
lea eax, [ebp - 0x1004]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055f63b
mov esp, ebp
pop ebp
ret
push str._APP__Invalid_updater_file
jmp 0x4064d0
push str._APP__Cannot_create_updater_file
call fcn.00402060
add esp, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0055f63b
mov esp, ebp
pop ebp
ret
Function at 0x4064f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0055fad0
mov eax, dword [0x5f4274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
push edi
mov edi, ecx
mov ecx, dword [0x5fd244]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5f9694]
cmp eax, dword [ecx + 4]
jg 0x4065e1
call esi
sub eax, dword [0x5f9690]
cmp byte [0x5f9698], 0
jne 0x4065b3
cmp eax, 0x3e8
jbe 0x4065d1
push 0
lea ecx, [ebp - 0x1005]
call fcn.00401cf0
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00562660
push str.Gunz.exe
lea eax, [ebp - 0x1004]
push str.._s
push eax
call fcn.00402080
add esp, 0x18
lea eax, [ebp - 0x1004]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [0x5f9698], 1
call esi
pop edi
mov dword [0x5f9690], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055f63b
mov esp, ebp
pop ebp
ret
cmp byte [0x5f9699], 0
jne 0x4065d1
cmp eax, 0x3a98
jbe 0x4065d1
mov ecx, edi
call fcn.00405f00
mov byte [0x5f9699], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055f63b
mov esp, ebp
pop ebp
ret
push 0x5f9694
call fcn.0055fb4c
add esp, 4
cmp dword [0x5f9694], 0xffffffff
jne 0x406531
call esi
push 0x5f9694
mov dword [0x5f9690], eax
call fcn.0055fafb
add esp, 4
jmp 0x406531
Function at 0x40b640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0042a962
push 0x59f148
mov ecx, dword [eax + 0xc]
movzx eax, word [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40b687
call fcn.0042a962
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b687
push 7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call dword [sym.imp.WINMM.dll_sndPlaySoundA]
pop esi
pop ebp
ret 4
Function at 0x411640
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5f4274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
push 0
lea ebx, [esi + 0xc5c]
push 0x59d4f9
mov ecx, ebx
call fcn.00403c60
cmp byte [esi + 0x950], 0
jne 0x411694
push str._ZUpdate__ERROR_:_Do_not_Created.
call fcn.00402060
push str._ZUpdate__ERROR_:_Start_update_FAILED___
call fcn.00402060
add esp, 8
jmp 0x41174d
push str._ZUpdate__Start_update.
call fcn.00402060
add esp, 4
mov word [esi + 0xc58], 0
lea ecx, [esi + 0xc]
mov byte [esi + 0xc60], 0
mov dword [esi + 0x93c], 0
mov dword [esi + 0x940], 0
push 1
push 0
push edi
push edi
mov dword [esi + 0x944], 0
mov dword [esi + 0x948], 0
mov dword [esi + 0x94c], 0
call fcn.0040d8d0
test al, al
jne 0x411762
push str.STR_130
call fcn.00402870
push str.STR_129
mov esi, eax
call fcn.00402870
add esp, 8
push esi
push eax
push str.STR_128
call fcn.00402870
add esp, 4
push eax
lea eax, [ebp - 0x404]
push str._s_n______Tip___s_n______Tip___s_n
push eax
call fcn.00402080
add esp, 0x14
lea eax, [ebp - 0x404]
mov ecx, ebx
push eax
call fcn.00404490
push str._ZUpdate__ERROR_:_Start_update_FAILED___
call fcn.00402060
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055f63b
mov esp, ebp
pop ebp
ret 4
push edi
mov ecx, esi
call fcn.004121b0
test al, al
je 0x411740
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.00411970
test al, al
je 0x411740
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055f63b
mov esp, ebp
pop ebp
ret 4
Function at 0x4117a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd40
mov eax, dword fs:[0]
push eax
sub esp, 0x978
mov eax, dword [0x5f4274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x980]
mov byte [esi + 0x120], 0
push eax
lea edi, [esi + 6]
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x411835
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x210]
push str._ZUpdatePatchNode__Needs_to_update_:__s__s__not_exist_
push eax
call fcn.00402080
lea eax, [ebp - 0x210]
push eax
call fcn.00402060
add esp, 0x14
xor al, al
jmp 0x41193f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
lea edi, [esi + 4]
lea eax, [ebp - 0x840]
push edi
push eax
call fcn.00411ee0
add esp, 0xc
lea eax, [esi + 0x108]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x828]
call fcn.00411010
cmp dword [ebp - 0x814], 0x10
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0x840]
cmovae ecx, dword [ebp - 0x828]
cmp dword [ebp - 0x82c], 0x10
push ecx
cmovae eax, dword [ebp - 0x840]
push eax
call fcn.0056aea2
mov ecx, dword [ebp - 0x814]
add esp, 8
mov ebx, eax
cmp ecx, 0x10
jb 0x4118d9
mov edx, dword [ebp - 0x828]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4118cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41195d
push ecx
push edx
call fcn.0055f649
add esp, 8
test ebx, ebx
je 0x411900
push edi
lea eax, [ebp - 0x410]
push str._ZUpdatePatchNode__Needs_to_update_:__s
push eax
call fcn.00402080
lea eax, [ebp - 0x410]
push eax
call fcn.00402060
add esp, 0x10
jmp 0x411907
mov byte [esi + 0x120], 1
mov ecx, dword [ebp - 0x82c]
cmp ecx, 0x10
jb 0x41193d
mov edx, dword [ebp - 0x840]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411933
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411962
push ecx
push edx
call fcn.0055f649
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f63b
mov esp, ebp
pop ebp
ret 4
call fcn.0056a062
call fcn.0056a062
int3