joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e570
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
jmp 0x41e58a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e580
mov eax, 1
add ebx, ebx
jne 0x41e5a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e598
jne 0x41e5b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e598
xor ecx, ecx
sub eax, 3
jb 0x41e5c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e63a
mov ebp, eax
add ebx, ebx
jne 0x41e5d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e5e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e604
inc ecx
add ebx, ebx
jne 0x41e5f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e5e5
jne 0x41e601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e5e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e624
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e615
jmp 0x41e586
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e624
add edi, ecx
jmp 0x41e586
pop esi
mov edi, esi
mov ecx, 0x5a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e642
cmp byte [edi], 4
jne 0x41e642
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e647
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e6bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e8e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e920]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e674
mov ecx, edi
jns 0x41e6a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e928]
or eax, eax
je 0x41e6b9
mov dword [ebx], eax
add ebx, 4
jmp 0x41e691
call dword [esi + 0x1e924]
mov ebp, dword [esi + 0x1e92c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e6f3
sub esp, 0xffffff80
jmp 0x4016ac
Function at 0x406d7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406da1
mov eax, dword [0x40b028]
cmp eax, 0xffffffff
je 0x406d98
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b028], 0xffffffff
jmp 0x406e16
cmp dword [0x790ba8], ebx
je 0x406e16
cmp byte [0x791bc0], bl
je 0x406de0
cmp dword [0x40b028], 0xffffffff
jne 0x406de9
push 4
push 0x40000000
push 0x791bc0
call fcn.00406702
mov dword [0x40b028], eax
cmp eax, 0xffffffff
je 0x406e16
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40b028], 0xffffffff
je 0x406e16
push esi
push 0x409e7c
mov esi, 0x790bc0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push dword [0x40b028]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x3e1f291a
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7f6555c4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x407701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x407710
pop dword [ebp - 0x18]
mov eax, 0xb10e59
add eax, 0xff8f68b7
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe4a3e385
add dword [ebp - 0x28], 0x69ae61c6
mov dword [ebp - 0x24], 0xa66dd0f
sub dword [ebp - 0x24], 0xd83390ca
mov dword [ebp - 0x20], 0xa75cd4a2
add dword [ebp - 0x20], 0xa4ef6f8c
mov dword [ebp - 0x1c], 0x1c3c4b10
add dword [ebp - 0x1c], 0xe3c3b4f0
lea eax, [ebp - 0x28]
push eax
mov eax, 0xc190b05
add eax, 0xf427750f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xe003afd9
add dword [ebp - 0x28], 0x946eb97d
mov dword [ebp - 0x24], 0xa90f951d
add dword [ebp - 0x24], 0x985ccc58
mov dword [ebp - 0x20], 0xd4f504dc
add dword [ebp - 0x20], 0x8e7a6790
mov dword [ebp - 0x1c], 0x99b48dbc
sub dword [ebp - 0x1c], 0x99b48dbc
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xeece2529
add eax, 0x11725ae7
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38ebc
push 0
call eax
mov ecx, 0x4f0a
mov esi, eax
mov edx, 0x26f1705c
add edx, 0xd94f7ba4
add edx, dword [ebp - 0x18]
mov edi, 0x42f94582
sub edi, 0x4d8d8633
sub dword [ebp - 0xc], esi
mov ebx, dword [edx]
xor dword [ebp - 8], ebx
sub ebx, edi
add dword [ebp - 8], edi
mov dword [esi], ebx
mov dword [ebp - 8], 0x552ef7c
add esi, 0x6ef65688
add esi, 0x9109a97c
add edx, 0xf861f36b
sub edx, 0xf861f367
loop 0x40782c
add eax, 0x12efb
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40704c], 1
mov dword [0x407050], 1
mov dword [0x407054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401914
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004028f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x4024e8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x402507
mov eax, 0
jmp 0x40254b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40252a
mov eax, 0
jmp 0x40254b
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x402546
mov eax, 0
jmp 0x40254b
mov eax, 1
leave
ret
Function at 0x40254d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4025ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4025a4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4025a4
mov eax, dword [ebp - 4]
jmp 0x4025c0
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402581
mov eax, 0
leave
ret

Function at 0x402ef1
Capabilities:
Copy file
Enumerate files on windows
Get disk information
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0x34
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], 0x405076
mov dword [esp + 4], str.insert_warning_message
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
cmp eax, 7
je 0x402f51
mov edx, dword [ebp - 0x1c]
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00402c80
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x85df20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x31f000]
push edi
jmp 0x85df3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x85df41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85df30
mov eax, 1
add ebx, ebx
jne 0x85df53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x85df64
jne 0x85df83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85df83
dec eax
add ebx, ebx
jne 0x85df70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x85df48
add ebx, ebx
jne 0x85df7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x85dfd5
xor ecx, ecx
sub eax, 3
jb 0x85df9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x85e00a
sar eax, 1
mov ebp, eax
jmp 0x85dfa6
add ebx, ebx
jne 0x85dfa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85df74
inc ecx
add ebx, ebx
jne 0x85dfb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85df74
add ebx, ebx
jne 0x85dfc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x85dfb6
jne 0x85dfd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x85dfb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x85dff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x85dfe6
jmp 0x85df36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x85dff4
add edi, ecx
jmp 0x85df36
pop esi
mov edi, esi
mov ecx, 0x8c67
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x85e012
cmp byte [edi], 0x1f
jne 0x85e012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x85e017
lea edi, [esi + 0x459000]
mov eax, dword [edi]
or eax, eax
je 0x85e08f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x47008c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4701cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x85e044
mov ecx, edi
jns 0x85e073
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4701d0]
or eax, eax
je 0x85e089
mov dword [ebx], eax
add ebx, 4
jmp 0x85e061
call dword [esi + 0x4701e0]
mov ebp, dword [esi + 0x4701d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x85e0c3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x401150
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401179
pop esi
pop ebp
add esp, 0x108
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40118f
pop esi
pop ebp
add esp, 0x108
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x4011a5
pop esi
pop ebp
add esp, 0x108
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405860]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x405214
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x28]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40126d
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret
Function at 0x401280
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4012a9
pop esi
pop ebp
add esp, 0x108
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4012bf
pop esi
pop ebp
add esp, 0x108
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x4012d5
pop esi
pop ebp
add esp, 0x108
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405860]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.32drivers_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x28]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40139d
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4013d9
pop esi
pop ebp
add esp, 0x108
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4013ef
pop esi
pop ebp
add esp, 0x108
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x401405
pop esi
pop ebp
add esp, 0x108
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405860]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.inf_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x28]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4014cd
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret

Function at 0x401850
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push 0x9c
push 1
push str.SYUNEW6A.DLL
call fcn.00401a60
push 0x9d
push 0
push str.SYUNEW6D.DLL
call fcn.00401a60
push 0xa0
push 0
push str.npsyunew6.dll
call fcn.00401a60
push str.SYUNEW6A.DLL
call fcn.00403750
push str.npsyunew6.DLL
call fcn.00403750
add esp, 0x2c
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 1
jne 0x40192f
cmp dword [esp + 8], 0xa
jne 0x40192f
push 0x84
push str.HIDCI.DLL
call fcn.00401150
push 0x88
push 0x4052c8
call fcn.00401280
push 0x86
push str.HIDDEV.INF
call fcn.004013b0
push 0x89
push 0x4052ac
call fcn.00401280
push 0x8a
push 0x4052a0
call fcn.00401280
push 0x8e
push 0
push str.Setup98.ex_
call fcn.00401a60
add esp, 0x34
call fcn.00401c40
call fcn.004026a0
call fcn.00401950
push str.CLSID83B77157_0860_42D6_917E_1C16BA081713
call fcn.00403550
push str.CLSID4f3a78e9_06b6_5897_9ac7_5dadea3bdeee
call fcn.00403550
mov eax, 1
add esp, 0x9c
ret
Function at 0x40185b
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push 0x9c
push 1
push str.SYUNEW6A.DLL
call fcn.00401a60
push 0x9d
push 0
push str.SYUNEW6D.DLL
call fcn.00401a60
push 0xa0
push 0
push str.npsyunew6.dll
call fcn.00401a60
push str.SYUNEW6A.DLL
call fcn.00403750
push str.npsyunew6.DLL
call fcn.00403750
add esp, 0x2c
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 1
jne 0x40192f
cmp dword [esp + 8], 0xa
jne 0x40192f
push 0x84
push str.HIDCI.DLL
call fcn.00401150
push 0x88
push 0x4052c8
call fcn.00401280
push 0x86
push str.HIDDEV.INF
call fcn.004013b0
push 0x89
push 0x4052ac
call fcn.00401280
push 0x8a
push 0x4052a0
call fcn.00401280
push 0x8e
push 0
push str.Setup98.ex_
call fcn.00401a60
add esp, 0x34
call fcn.00401c40
call fcn.004026a0
call fcn.00401950
push str.CLSID83B77157_0860_42D6_917E_1C16BA081713
call fcn.00403550
push str.CLSID4f3a78e9_06b6_5897_9ac7_5dadea3bdeee
call fcn.00403550
mov eax, 1
add esp, 0x9c
ret

Function at 0x401950
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
push 0x104
rep stosd dword es:[edi], eax
mov al, byte [0x405860]
mov ecx, 0x40
mov byte [esp + 0x6c], al
xor eax, eax
lea edi, [esp + 0x6d]
mov dword [esp + 0x28], 0x44
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x54], 1
push ecx
mov word [esp + 0x5c], 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str._setup98.ex_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x7f02
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], eax
mov esi, 6
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push 0
push 0x20
push 1
push 0
lea edx, [esp + 0x84]
push 0
push edx
push 0
call edi
mov eax, dword [esp + 0x14]
push 0xbb8
push eax
call ebx
push 0x1f4
call ebp
dec esi
jne 0x401a03
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret