joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001628d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x138]
sub esp, 0x1b8
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x134], eax
push ebx
push 0x104
xor ebx, ebx
lea eax, [ebp + 0x30]
push ebx
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
lea eax, [ebp + 0x30]
push eax
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x100162e8
xor eax, eax
mov ecx, dword [ebp + 0x134]
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0x138
leave
ret
push esi
lea eax, [ebp + 0x30]
push edi
mov dword [ebp + 0x28], 0xf
mov dword [ebp + 0x24], ebx
mov byte [ebp + 0x14], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100162fd
sub eax, esi
push eax
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp + 0x14]
call fcn.10016afd
push str.JavaJava_Updatejucheck.exe
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000ee21
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp + 0x14]
call fcn.10007ace
push 0x22
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x14]
push 0x22
push eax
call fcn.10016def
add esp, 0xc
push eax
lea eax, [ebp - 8]
push eax
call fcn.1000ee21
add esp, 0xc
push ebx
push esi
lea ecx, [ebp + 0x14]
call fcn.10007ace
push 0x40
lea eax, [ebp - 0x7c]
push ebx
push eax
call sub.msvcr100.dll_memset
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp + 0xc], 0x10
stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0x44
mov eax, ecx
jae 0x1001638f
lea eax, [ebp - 8]
add eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 0x10
jae 0x1001639b
lea ecx, [ebp - 8]
push dword [ebp - 0x29]
mov dword [ebp + 0x20], ebx
push eax
push ecx
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
call fcn.10016e6a
lea eax, [ebp - 0x25]
push eax
lea ecx, [ebp + 0x20]
mov byte [ebp - 0x25], bl
call fcn.10016b94
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
jae 0x100163cc
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push ebx
push 0x8000000
push esi
push ebx
push ebx
push dword [ebp + 0x20]
push eax
call fcn.1000ee21
add esp, 0x28
test eax, eax
jne 0x10016415
xor edi, edi
lea ecx, [ebp + 0x20]
call fcn.1001685d
push ebx
push esi
lea ecx, [ebp - 8]
call fcn.10007ace
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.10007ace
mov eax, edi
pop edi
pop esi
jmp 0x100162d2
mov edi, esi
jmp 0x100163f0
Function at 0x401d80
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
push ebx
xor ebx, ebx
cmp dword [0x40481c], ebx
mov dword [ebp + 0x70], ebx
je 0x401da0
xor eax, eax
jmp 0x401ed4
lea eax, [ebp - 0x24]
push eax
mov dword [0x40481c], 1
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401d99
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x14], 1
mov dword [0x40483c], ecx
sete al
mov dword [0x404838], edx
test eax, eax
mov dword [0x40482c], eax
je 0x401df9
cmp ecx, 4
jne 0x401df9
cmp edx, 3
jge 0x401df9
mov dword [0x404834], 1
jmp 0x401dff
and dword [0x404834], ebx
xor ecx, ecx
cmp dword [ebp - 0x14], 2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sete cl
test eax, eax
push edi
mov edi, 0x4015ec
mov dword [0x404824], ecx
je 0x401e43
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov eax, dword fs:[0x30]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x74]
xor eax, ecx
push edi
mov dword [0x404820], eax
call esi
mov ebx, eax
test ebx, ebx
je 0x401ead
cmp dword [0x404824], 0
je 0x401eb1
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x401ead
push 0x4015fc
call esi
mov edi, eax
test edi, edi
je 0x401ead
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401608
push edi
call esi
test eax, eax
mov dword [0x404828], eax
je 0x401ead
push 0x401620
push edi
call esi
test eax, eax
mov dword [0x404830], eax
je 0x401ead
push 0x40163c
push ebx
call esi
cmp dword [0x40483c], 5
mov dword [0x404818], eax
jne 0x401eb4
cmp dword [0x404838], 2
jl 0x401eb4
test eax, eax
jne 0x401eb4
xor eax, eax
jmp 0x401ed2
mov edi, dword [ebp + 0x70]
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x401ec1
push ebx
call esi
test edi, edi
je 0x401ec8
push edi
call esi
and dword [0x40481c], 0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x4020fa
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 0xc]
mov cl, byte [edi]
mov dword [ebp + 8], eax
xor ebx, ebx
add esi, 4
xor eax, eax
cmp cl, bl
je 0x40212c
mov edx, 0x404018
sub edx, edi
mov byte [edx + edi], cl
inc eax
inc edi
mov cl, byte [edi]
cmp cl, bl
jne 0x402121
mov byte [eax + 0x404018], 0x5c
inc eax
cmp dword [ebp + 8], ebx
je 0x402148
mov cl, byte [esi]
mov byte [eax + 0x404018], cl
inc eax
inc esi
dec dword [ebp + 8]
jne 0x402139
mov byte [eax + 0x404018], bl
mov edi, dword [esi]
mov eax, dword [0x404010]
add esi, 4
cmp eax, ebx
mov dword [ebp - 8], edi
jne 0x402205
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0xc0000000
push 0x404018
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x402197
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x402218
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push edi
push ebx
push 4
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x402185
push edi
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4021dc
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0xc]
call esi
jmp 0x402185
push edi
push esi
push eax
call fcn.00401f0d
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp + 0xc]
call edi
mov edi, dword [ebp - 8]
jmp 0x402215
cmp eax, 1
jne 0x402215
push 0x404018
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [edi + esi]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40221d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40223d
cmp ax, 5
jb 0x40223d
push 0x40153c
jmp 0x402242
push 0x40153a
push edi
call fcn.00401f85
pop ecx
pop ecx
push esi
push 0x401530
push edi
call fcn.00401fb8
pop ecx
pop ecx
lea esi, [ebp - 0x40]
mov eax, dword [ebp + 8]
xor edx, edx
push 0xa
pop ecx
div ecx
add dl, 0x30
mov byte [esi], dl
inc esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x40225b
push edi
call fcn.00401f94
pop ecx
add eax, edi
dec esi
mov cl, byte [esi]
mov byte [eax], cl
lea ecx, [ebp - 0x40]
inc eax
cmp esi, ecx
jne 0x40227b
mov byte [eax], 0
pop esi
leave
ret
Function at 0x4025eb
Capabilities:
Create directory
Query environment variable
Set current directory

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x14
jl 0x4025f7
xor eax, eax
ret
cmp eax, 6
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov byte [esi], 0
jge 0x402682
xor ebx, ebx
cmp dword [0x40400c], ebx
push ebp
mov ebp, 0x401584
je 0x40265a
push 0x1a
pop edi
push esi
xor eax, eax
push eax
push eax
push edi
push eax
inc ebx
call dword [0x40400c]
test eax, eax
jl 0x402645
cmp edi, 0x1a
jne 0x402655
push 0x401578
push esi
call fcn.0040200a
test eax, eax
pop ecx
pop ecx
je 0x402655
push 0x23
jmp 0x40264c
cmp edi, 0x23
jne 0x402650
push 0x1a
mov byte [esi], 0
pop edi
cmp ebx, 3
jl 0x402619
cmp byte [esi], 0
jne 0x402667
push 0x800
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebp
push esi
call fcn.00401f2f
pop ecx
pop ecx
pop ebp
test eax, eax
jne 0x4026c9
push 0x401574
push esi
call fcn.00401f85
jmp 0x4026c7
cmp eax, 0xd
jge 0x4026bc
mov eax, dword [0x40400c]
xor ecx, ecx
cmp eax, ecx
mov edi, 0x401564
je 0x4026a4
push esi
push ecx
push ecx
push 0x26
push ecx
call eax
cmp byte [esi], 0
jne 0x4026b1
push 0x800
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
push esi
call fcn.00401f2f
pop ecx
pop ecx
jmp 0x402671
push 0x401574
push esi
call fcn.00401fb8
pop ecx
pop ecx
mov edi, 0x401560
push edi
push esi
call fcn.00401fb8
push dword [esp + 0x18]
push esi
call fcn.00401fb8
mov eax, dword [esp + 0x28]
add esp, 0x10
push 6
cdq
pop ecx
idiv ecx
test edx, edx
je 0x402724
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
add ebx, dword [esp + 0x18]
push edi
push esi
call fcn.00401fb8
push esi
call fcn.00401f94
add esp, 0xc
add eax, esi
jmp 0x40271e
mov cl, bl
and cl, 7
add cl, 0x30
shr ebx, 4
mov byte [eax], cl
inc eax
test ebx, ebx
jne 0x402710
mov byte [eax], bl
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
call edi
test eax, eax
jne 0x402756
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402746
pop edi
pop esi
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call edi
test eax, eax
jne 0x402756
pop edi
pop esi
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00402069
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x4028fb
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov ecx, dword [ebp + 8]
push ebx
push edi
call fcn.004020d1
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
jne 0x402954
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4029dc
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [ebp - 8], esi
jne 0x402969
push 2
pop esi
jmp 0x4029d0
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x402987
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4029c2
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, edi
jne 0x4029a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4029b5
mov eax, dword [ebp - 8]
sub esi, eax
push esi
add eax, ebx
push eax
push dword [ebp + 0xc]
call fcn.00402761
add esp, 0xc
cmp ebx, edi
mov esi, eax
je 0x4029c2
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 4], edi
je 0x4029d0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4029e0
Capabilities:
Accept command line arguments
Delete directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10898
call fcn.00401fd0
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 4
jae 0x402a3c
push 0x800
lea eax, [ebp - 0x898]
push eax
push 1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10
push 0
lea eax, [ebp - 0x898]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402b75
push ebx
push esi
push edi
push 0x4015e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4015cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40400c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [eax], 0x22
mov edi, dword [sym.imp.USER32.dll_CharNextA]
sete bl
push eax
lea ebx, [ebx + ebx + 0x20]
jmp 0x402a79
cmp al, bl
je 0x402a83
push esi
call edi
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x402a74
cmp byte [esi], 0x22
jne 0x402a89
inc esi
cmp byte [esi], 0
je 0x402a8f
inc esi
push 0x12
push esi
push 0x4015b8
call fcn.00401f3e
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
test eax, eax
je 0x402abd
push 0xc
push esi
push 0x4015a8
call fcn.00401f3e
add esp, 0xc
test eax, eax
jne 0x402acc
push 0x40
xor esi, esi
push esi
push 0x401598
push esi
call edi
jmp 0x402ace
xor esi, esi
lea eax, [ebp - 0x10898]
push eax
push dword [ebp + 8]
call fcn.004028fb
cmp eax, esi
pop ecx
pop ecx
jne 0x402af9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10898]
push eax
call fcn.004022ce
cmp eax, esi
pop ecx
pop ecx
je 0x402b27
push esi
push 0x800
lea ecx, [ebp - 0x898]
push ecx
push esi
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x402b42
push 0x10
push esi
lea eax, [ebp - 0x898]
push eax
push esi
call edi
jmp 0x402b42
lea eax, [ebp - 0x10898]
push eax
push dword [ebp + 8]
mov dword [0x404010], 1
call fcn.004028fb
pop ecx
pop ecx
mov eax, dword [0x404004]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x402b5d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x404004], 0xffffffff
push 0x401594
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10898]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or eax, 0xffffffff
leave
ret 0x10
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
xlatb
jg 0x4152ac
mov dh, 0xd7
xlatb
jg 0x4152b0
mov dh, 0xd7
xlatb
jg 0x4152b4
mov dh, 0xd7
xlatb
jg 0x4152b8
mov dh, 0xd7
xlatb
jg 0x4152bc
mov dh, 0xd7
xlatb
jg 0x4152c0
mov dh, 0xd7
xlatb
jg 0x4152c4
mov dh, 0xd7
xlatb
jg 0x4152c8
mov dh, 0xd7
xlatb
jg 0x4152cc
add dword [esi - 0x49fe8029], esi
mov dh, 0xd7
xlatb
jg 0x4152d0
mov dh, 0xd7
xlatb
jg 0x4152d4
mov dh, 0xd7
xlatb
jg 0x4152d8
mov dh, 0xd7
xlatb
jg 0x4152dc
mov dh, 0xd7
xlatb
jg 0x4152e0
mov dh, 0xd7
xlatb
jg 0x4152e4
mov dh, 0xd7
xlatb
jg 0x4152e8
mov dh, 0xd7
xlatb
jg 0x4152ec
mov dh, 0xd7
xlatb
jg 0x4152f0
add dword [esi - 0x49fe8029], esi
mov dh, 0xd7
xlatb
jg 0x4152f4
mov dh, 0xd7
xlatb
jg 0x4152f8
mov dh, 0x4b
dec ebx
jmp 0x2ac43652
jecxz 0x41536b
and dword [edx + 0x54e97d1c], ebp
jecxz 0x41528b
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx - 0x29]
mov dword [0x3abf60b1], eax
and al, 0xa2
sub byte [edx], 0x20
idiv byte [ebp + 0x1f]
inc esp
xchg ebx, eax
ret
jecxz 0x4152b3
jecxz 0x4152ca
jecxz 0x4152b7
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx + 0x6a]
loope 0x4152ee
sbb al, 0x7d
jmp 0x2ac4369e
jge 0x41532f
push esp
jecxz 0x4152cb
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx + 0x41]
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx + 0x41]
sub dl, byte [ebx - 0x7e]
sub dl, byte [ebx - 0x7e]
push esp
jecxz 0x4152eb
sub dl, byte [ebx - 0x7e]
jecxz 0x4152ef
sub dl, byte [ebx + 0x22]
stosb byte es:[edi], al
xor al, 0xa2
or byte [eax + 0x2ac39364], 0x97
jecxz 0x4152ff
xchg ebx, eax
ret
sub dl, byte [ebx - 0x29]
mov dword [0x22c768b1], eax
fbld tbyte [esi - 0xcfe5e72]
add dl, byte [edi]
test byte [edx - 0x69abd53d], al
lds ebp, [ecx + 0x68f0e2ac]
xlatb
or eax, dword [ebx + 0x6a60585e]
sub esp, dword [eax]
invalid
or eax, dword [edx + 0x7e]
stosd dword es:[edi], eax
sbb al, 0x6a
ror dword [ecx], 0x1c
jge 0x415377
jno 0x4153c3
cmpsb byte [esi], byte es:[edi]
jae 0x415366
sbb al, 0x3a
sub dl, byte [ebx - 0x7d]
push esp
jecxz 0x415344
ret 0xb51e
mov ch, 0x7d
aad 0xbf
idiv dword [ebp + 0x1f]
xor al, 0x8a
ret
mov al, bl
sub bh, byte [esi + edi*8 + 0x66abd43c]
inc edx
pop esi
push ecx
or edx, dword [esi + 0x4b1cab7d]
call 0xa419373a
xlatb
mov dword [0xca8725b1], eax
xlatb
mov dword [0xca8725b1], eax
xor eax, 0x3c2b82a2
xor eax, dword [eax]
popal
push esp
mov dword [edx + eax*8 + 0xe], esi
pop edi
jl 0x4153cb
add al, 0xb
push es
xchg edi, eax
stosb byte es:[edi], al
sbb al, 0x3b
sub dh, ah
test al, 0x82
nop
push eax
inc ebx
leave
sub ch, ah
mov dword [0xb546bf2], eax
rcl ch, cl
stosd dword es:[edi], eax
sbb al, 0x6a
jno 0x4153be
sbb al, 0x7d
xchg edx, eax
je 0x4153ab
ret
Function at 0x100027db
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x100029b2
cmp dword [0x100d4b70], 0
jne 0x100029ab
push ebx
push ebp
push edi
call fcn.10002fe4
mov ebx, eax
test ebx, ebx
jne 0x1000281e
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x1000298c
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x100d4b70
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x100029ab
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100d4b70]
jmp 0x100029b4
xor eax, eax
add esp, 0x74
ret
Function at 0x10003a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100d0d40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1f4
xorps xmm0, xmm0
mov dword [ebp - 0x204], 0
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x200], 0xf
push 0
movups xmmword [ebp - 0x214], xmm0
push eax
mov byte [ebp - 0x214], 0
mov dword [ebp - 0x1fc], 0
call sub.msvcrt.dll_memset
push 0x1f3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.1009b5c0
mov ecx, dword [ebp - 0x200]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x10003aab
mov edx, dword [ebp - 0x214]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003aa1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003b03
push ecx
push edx
call fcn.10099daf
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.10005b30
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.1009e620
add esp, 0x1c
lea eax, [ebp - 0x1fc]
push 0
push 0x100d4bb0
push 0x1f8
push eax
push dword [0x100d0300]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10099dbd
mov esp, ebp
pop ebp
ret
call fcn.1009b2a0
int3
Function at 0x10003b10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d0d40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x100d4b90]
push edi
push eax
push ecx
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10003b7b
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003b55
sub ecx, edx
push ecx
push 0
mov ecx, ebx
call fcn.10003320
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10099dbd
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x10003bcc
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003ba6
sub ecx, edx
push ecx
push 0
mov ecx, ebx
call fcn.10003320
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10099dbd
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
movups xmmword [ebp - 0x1c], xmm0
push dword [ebp - 0x20]
push esi
call fcn.10003320
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov eax, ebx
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebx + 0x14], 0
xor ecx, ebp
pop edi
movups xmmword [ebx], xmm0
pop esi
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.10099dbd
mov esp, ebp
pop ebp
ret