joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403563
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004022a2
and dword [ebp - 4], 0
cmp dword [0x40b260], 0
mov ebx, eax
jne 0x403614
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4036c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4036c5
push eax
call fcn.00402230
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b260], eax
call esi
push eax
call fcn.00402230
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b264], eax
call esi
push eax
call fcn.00402230
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b268], eax
call esi
push eax
call fcn.00402230
pop ecx
mov dword [0x40b270], eax
test eax, eax
je 0x403614
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402230
pop ecx
mov dword [0x40b26c], eax
mov eax, dword [0x40b26c]
cmp eax, ebx
je 0x40366c
cmp dword [0x40b270], ebx
je 0x40366c
push eax
call fcn.004022ab
push dword [0x40b270]
mov esi, eax
call fcn.004022ab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40366c
test edi, edi
je 0x40366c
call esi
test eax, eax
je 0x403663
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403663
test byte [ebp - 0xc], 1
jne 0x40366c
or dword [ebp + 0x10], 0x200000
jmp 0x4036a5
mov eax, dword [0x40b264]
cmp eax, ebx
je 0x4036a5
push eax
call fcn.004022ab
pop ecx
test eax, eax
je 0x4036a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4036a5
mov eax, dword [0x40b268]
cmp eax, ebx
je 0x4036a5
push eax
call fcn.004022ab
pop ecx
test eax, eax
je 0x4036a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b260]
call fcn.004022ab
pop ecx
test eax, eax
je 0x4036c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4036c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4053ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40aa08]
jne 0x4053d8
repz ret
jmp fcn.004069b5
Function at 0x4060c9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edx
push ecx
push edi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
jne 0x4060e4
jmp 0x406211
mov eax, 0x6c
sub eax, 0x58
mov dword [ebp - 8], eax
mov eax, 0x58
mul dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
add eax, dword [ebp - 8]
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x406211
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
pop dword [eax + 0x10]
push 0x10
push dword [ebp + 0x10]
lea eax, [eax]
push eax
call fcn.0042ba20
mov eax, dword [ebp - 4]
lea edi, [eax + 0x14]
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push edi
call fcn.0042ba20
push ebx
push 0
push dword [ebp - 4]
push dword [ebp + 8]
push 0
push 0x58
push 0
push dword [0x441044]
call sub.KERNEL32.dll_HeapAlloc
or eax, eax
jne 0x4061e7
pushfd
pushal
sub esp, 0x6c
wait
fnsave dword [esp]
cld
mov eax, esp
and esp, 0xfffffffc
push eax
mov eax, dword [eax + 0x88]
push 0x441054
call sub.KERNEL32.dll_EnterCriticalSection
push str.DBPLUGIN
push 0
push 0xff
push 0x43b0f8
call fcn.0042c32b
test dword [0x441050], 1
je 0x4061bc
push str.DBPLUGIN
push 0
push 0x808080
push str.__BookObj.inc__396_
call fcn.0042c32b
push str.DBPLUGIN
push 0x80
push 0
push 0x43a5b4
call fcn.0042c32b
push 0x441054
call sub.KERNEL32.dll_LeaveCriticalSection
pop esp
frstor dword [esp]
add esp, 0x6c
popal
popfd
xor eax, eax
push eax
mov ebx, eax
push 0x58
push 0x44f484
push eax
call fcn.0042ba20
mov edx, dword [eax]
call dword [edx - 0xc]
mov eax, ebx
pop ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406211
mov edx, dword [ebp - 0x10]
push edx
mov edx, dword [edx]
call dword [edx - 0x44]
mov eax, dword [ebp - 0x10]
pop edi
pop ecx
pop edx
leave
ret 0x14
Function at 0x408c90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push dword [0x4519bc]
call sub.USER32.dll_GetDC
mov dword [ebp - 0x14], eax
push dword [0x4519c4]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [ebp - 0x14]
call sub.GDI32.dll_GetTextExtentPoint32A
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push dword [ebp - 8]
pop dword [ebp - 0x24]
push dword [ebp - 4]
pop dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
push dword [ebp + 8]
push 0xffffffffffffffeb
push dword [0x4519bc]
call sub.USER32.dll_SetWindowLongA
add dword [ebp - 0x10], 8
add dword [ebp - 0xc], 8
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [0x4519bc]
call sub.USER32.dll_MoveWindow
push 4
push dword [0x4519bc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push dword [0x4519bc]
call sub.USER32.dll_InvalidateRect
push dword [0x4519bc]
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0x14]
push dword [0x4519bc]
call sub.USER32.dll_ReleaseDC
leave
ret 4
Function at 0x40b106
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
cmp eax, 6
jb 0x40b14b
push 0xc8
call sub.KERNEL32.dll_Sleep
leave
ret

Function at 0x40b185
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ecx
push edx
mov dword [0x45388b], 0x94
push 0x45388b
call sub.KERNEL32.dll_GetVersionExA
cmp dword [0x45388f], 5
jbe 0x40b1f2
push str.dwmapi.dll
call sub.KERNEL32.dll_LoadLibraryA
or eax, eax
je 0x40b1f2
mov dword [0x443194], eax
push str.DwmIsCompositionEnabled
push dword [0x443194]
call sub.KERNEL32.dll_GetProcAddress
or eax, eax
je 0x40b1d9
mov dword [0x443198], eax
push str.DwmEnableComposition
push dword [0x443194]
call sub.KERNEL32.dll_GetProcAddress
or eax, eax
je 0x40b1f2
mov dword [0x44319c], eax
cmp dword [0x443198], 0
je 0x40b224
lea eax, [ebp - 4]
push eax
call dword [0x443198]
and dword [ebp - 4], 0xff
push dword [ebp - 4]
pop dword [0x4431a0]
cmp dword [ebp - 4], 1
jne 0x40b224
cmp dword [0x44319c], 0
je 0x40b224
cmp dword [0x4431a0], 0
je 0x40b273
push str.dnaml_reader
push 0x8023
push 0x4431a4
call fcn.0040dd12
or eax, eax
je 0x40b273
push 0x4431a4
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.dll_lstrcpyA
push str.Cursors
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x108]
push eax
call fcn.0042d0d0
mov ecx, 4
lea edx, [0x451a7c]
mov eax, 0x4e20
push ecx
sub ecx, 4
neg ecx
shl eax, cl
mov dword [edx + ecx*4], eax
pop ecx
loop 0x40b27e
mov eax, 4
shl eax, 2
add edx, eax
mov ecx, 9
mov eax, 0x3d090
push ecx
sub ecx, 9
neg ecx
shl eax, cl
mov dword [edx + ecx*4], eax
pop ecx
loop 0x40b2a0
mov dword [0x4518ac], 1
mov dword [0x4518b0], 1
mov dword [0x4518b4], 1
mov dword [0x45391f], 1
pop edx
pop ecx
leave
ret

Function at 0x40cca8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x40ccf9
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x40ccf1
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8

Function at 0x40d354
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x40d3b6
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.0040d3bb
push eax
cmp dword [ebp + 8], 0
je 0x40d3b5
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0042e300
pop eax
pop esi
leave
ret 0x14
Function at 0x40d3bb
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push esi
push ebx
push dword [ebp + 8]
call fcn.0042d0d0
test eax, eax
je 0x40d4aa
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x40d4aa
cmp dword [ebp + 0x18], 0
je 0x40d44c
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_DeleteFileA
mov dword [ebp - 0x108], 0
lea esi, [ebp - 0x104]
lodsb al, byte [esi]
cmp al, 0
je 0x40d42b
cmp al, 0x2e
jne 0x40d414
mov dword [ebp - 0x108], esi
dec dword [ebp - 0x108]
jmp 0x40d414
cmp dword [ebp - 0x108], 0
je 0x40d44c
mov esi, dword [ebp - 0x108]
mov byte [esi], 0
push dword [ebp + 0x18]
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
cmp dword [ebp + 8], 0
je 0x40d464
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0042e300
cmp dword [ebp + 0x14], 1
jne 0x40d471
mov eax, pe_nt_image_headers32
jmp 0x40d490
cmp dword [ebp + 0x14], 2
jne 0x40d47e
mov eax, 0x4000000
jmp 0x40d490
cmp dword [ebp + 0x14], 3
jne 0x40d48b
mov eax, 0x4000100
jmp 0x40d490
mov eax, 0x80
push 0
push eax
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_CreateFileA
pop ebx
pop esi
leave
ret 0x14

Function at 0x40d861
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x40d8d7
push 0
push 0
push dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40d8cf
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.KERNEL32.dll_ReadFile
or eax, eax
je 0x40d8cf
mov dword [ebp - 4], 1
cmp dword [ebp + 0x18], 0
je 0x40d8cf
mov eax, dword [ebp + 0x18]
push dword [ebp - 0xc]
pop dword [eax]
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 4]
leave
ret 0x14

Function at 0x40dba2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov dword [ebp - 4], 0
cmp dword [0x4431a0], 0
je 0x40dbce
push 0x4431a4
call sub.KERNEL32.dll_lstrlenA
cmp eax, 0
jbe 0x40dbce
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 1
jne 0x40dbe3
push 0x4431a4
push dword [ebp + 8]
call sub.KERNEL32.dll_lstrcpyA
jmp 0x40dbee
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_GetWindowsDirectoryA
leave
ret 8
Function at 0x40f008
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], 0
cmp dword [0x443084], 0
je 0x40f1b1
cmp dword [ebp + 0xc], 0x20
jne 0x40f04e
cmp dword [0x451998], 1
jne 0x40f1b1
push 0
call sub.USER32.dll_SetCursor
mov dword [ebp - 4], 1
mov eax, 1
jmp 0x40f1b1
cmp dword [ebp + 0xc], 6
jne 0x40f07f
and dword [ebp + 0x10], 0xffff
cmp dword [ebp + 0x10], 0
jne 0x40f070
mov dword [0x451980], 0
jmp 0x40f1b1
mov dword [0x451980], 1
jmp 0x40f1b1
cmp dword [ebp + 0xc], 0x112
jne 0x40f0ad
and dword [ebp + 0x10], 0xfff0
cmp dword [ebp + 0x10], 0xf140
jne 0x40f1b1
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40f1b1
cmp dword [ebp + 0xc], 0x100
je 0x40f0d1
cmp dword [ebp + 0xc], 0x201
je 0x40f0d1
cmp dword [ebp + 0xc], 0x204
je 0x40f0d1
cmp dword [ebp + 0xc], 0x207
jne 0x40f10b
cmp dword [0x451998], 1
jne 0x40f1b1
push 0
push 0x3f2
push 0x111
push dword [0x441160]
call sub.USER32.dll_SendMessageA
call fcn.0040f442
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40f1b1
cmp dword [ebp + 0xc], 0x200
jne 0x40f1a1
cmp dword [0x451998], 1
jne 0x40f1b1
cmp dword [0x45198c], 0
jne 0x40f156
push 0x451990
call sub.USER32.dll_GetCursorPos
mov dword [0x45198c], 1
push dword [0x451990]
pop dword [ebp - 0xc]
push dword [0x451994]
pop dword [ebp - 8]
jmp 0x40f15f
lea eax, [ebp - 0xc]
push eax
call sub.USER32.dll_GetCursorPos
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x451990]
jne 0x40f177
mov eax, dword [ebp - 8]
cmp eax, dword [0x451994]
jne 0x40f177
jmp 0x40f19f
push 0
push 0x3f2
push 0x111
push dword [0x441160]
call sub.USER32.dll_SendMessageA
call fcn.0040f442
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40f1b1
cmp dword [ebp + 0xc], 0x10
jne 0x40f1b1
mov dword [0x451980], 0
mov ebx, dword [ebp + 0x18]
push dword [ebp - 4]
pop dword [ebx]
pop ebx
leave
ret 0x14
Function at 0x40f970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
push ecx
cmp dword [0x443100], 0
je 0x40f987
pop ecx
pop edi
pop esi
leave
ret
cmp dword [0x4430f4], 0
je 0x40fae0
mov eax, dword [0x4430f4]
dec eax
push eax
call fcn.00411166
mov edi, eax
push dword [edi + 0x1c]
pop dword [0x44e2e1]
mov eax, dword [edi + 8]
mov edx, 0
div dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi]
add eax, dword [edi + 8]
add eax, edi
mov esi, eax
mov dword [ebp - 4], esi
mov ecx, dword [edi + 4]
mov dword [ebp - 0xc], 0
cmp ecx, 0
jbe 0x40f9f4
sub esi, dword [ebp - 8]
cmp dword [esi + 0x2c], 0
jne 0x40f9f2
inc dword [ebp - 0xc]
cmp dword [esi + 0x38], 0x28
jne 0x40f9f2
cmp dword [0x443124], 0
jne 0x40f9f2
dec dword [ebp - 0xc]
loop 0x40f9d4
push dword [ebp - 0xc]
pop dword [0x443104]
cmp dword [0x443104], 0
jbe 0x40fae0
mov eax, 0x58
mul dword [0x443104]
mov dword [ebp - 0xc], eax
push 0x40
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x443100], eax
cmp dword [0x443100], 0
je 0x40fae0
mov edi, dword [ebp - 4]
mov esi, dword [0x443100]
add esi, dword [ebp - 0xc]
mov ecx, dword [0x443104]
mov dword [ebp - 0xc], 1
sub edi, dword [ebp - 8]
cmp dword [edi + 0x2c], 0
je 0x40fa5f
jmp 0x40fa54
cmp dword [edi + 0x38], 0x28
jne 0x40fa70
cmp dword [0x443124], 0
jne 0x40fa70
jmp 0x40fa54
sub esi, 0x58
push dword [ebp - 0xc]
pop dword [esi]
inc dword [ebp - 0xc]
mov byte [esi + 0x18], 1
mov eax, dword [edi + 0x1c]
mov byte [esi + 0x25], al
mov eax, dword [edi + 0x20]
mov byte [esi + 0x27], al
mov eax, dword [edi + 0x2c]
mov byte [esi + 0x26], al
lea eax, [esi + 0x34]
mov dword [esi + 0x2c], eax
push dword [edi + 0x14]
pop dword [esi + 0x34]
push dword [edi + 4]
pop dword [esi + 0x38]
push dword [edi + 8]
pop dword [esi + 0x3c]
push dword [edi + 0xc]
pop dword [esi + 0x40]
push dword [edi + 0x10]
pop dword [esi + 0x54]
push dword [edi + 0x30]
pop dword [esi + 0x50]
push dword [edi + 0x34]
pop dword [esi + 0x4c]
push dword [edi + 0x18]
pop dword [esi + 0x19]
push dword [edi + 0x24]
pop dword [esi + 0x1d]
push dword [edi + 0x28]
pop dword [esi + 0x21]
push dword [edi + 0x38]
pop dword [esi + 4]
dec ecx
jne 0x40fa54
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40ffed
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov dword [ebp - 4], 0
cmp dword [0x443118], 0
jne 0x4100cd
push ebx
push 0x104
push 0
push 0x24
push 0
push dword [0x441044]
call sub.KERNEL32.dll_HeapAlloc
or eax, eax
jne 0x4100b0
pushfd
pushal
sub esp, 0x6c
wait
fnsave dword [esp]
cld
mov eax, esp
and esp, 0xfffffffc
push eax
mov eax, dword [eax + 0x88]
push 0x441054
call sub.KERNEL32.dll_EnterCriticalSection
push str.DBPLUGIN
push 0
push 0xff
push 0x43b1ab
call fcn.0042c32b
test dword [0x441050], 1
je 0x410085
push str.DBPLUGIN
push 0
push 0x808080
push str.__BackGround.asm__1070_
call fcn.0042c32b
push str.DBPLUGIN
push 0x80
push 0
push 0x43a5b4
call fcn.0042c32b
push 0x441054
call sub.KERNEL32.dll_LeaveCriticalSection
pop esp
frstor dword [esp]
add esp, 0x6c
popal
popfd
xor eax, eax
push eax
mov ebx, eax
push 0x24
push 0x44f664
push eax
call fcn.0042ba20
mov edx, dword [eax]
call dword [edx - 0xc]
mov eax, ebx
pop ebx
mov dword [0x443118], eax
cmp dword [0x443118], 0
je 0x410182
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, dword [0x443118]
push edx
mov edx, dword [edx]
call dword [edx - 0x4c]
or eax, eax
je 0x410170
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 1
jne 0x410170
push 1
push 0
push 0
push dword [ebp - 4]
push str.open
push dword [0x441160]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1b
je 0x410122
cmp eax, 0x1f
jne 0x410170
push 0x5c
push dword [ebp - 4]
call fcn.0042bee0
or eax, eax
je 0x410170
push str.shell32.dll_OpenAs_RunDLL
lea eax, [ebp - 0x204]
push eax
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 4]
lea eax, [ebp - 0x204]
push eax
call sub.KERNEL32.dll_lstrcatA
push 1
push 0
lea eax, [ebp - 0x204]
push eax
push str.rundll32.exe
push str.open
push dword [0x441160]
call sub.SHELL32.dll_ShellExecuteA
push dword [ebp + 0x14]
push dword [ebp + 8]
mov edx, dword [0x443118]
push edx
mov edx, dword [edx]
call dword [edx - 0x50]
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x14
Function at 0x41128e
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x18], 1
je 0x4112a7
cmp dword [ebp + 0x18], 2
jne 0x4112ac
mov eax, dword [ebp + 8]
jmp 0x4112c6
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4112d8
mov dword [ebp - 0xc], 1
je 0x411364
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x18], 2
jne 0x4112ef
push dword [ebp + 0xc]
pop dword [ebp - 0x18]
push dword [ebp + 0x10]
pop dword [ebp - 0x10]
jmp 0x411327
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_SizeofResource
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.KERNEL32.dll_LockResource
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call sub.KERNEL32.dll_WriteFile
or eax, eax
jne 0x411346
mov dword [ebp - 0xc], 1
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp + 0x18], 2
je 0x411364
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 0x14

Function at 0x41136b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push dword [ebp + 0xc]
call fcn.00411183
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.00411166
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x4113c7
cmp dword [ebp - 0xc], 0
je 0x4113c7
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
or eax, eax
jne 0x4113c7
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x41528a
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff990
push edx
lea eax, [ebp - 0x654]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x550]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x4c], 0x4c
mov eax, dword [0x441160]
mov dword [ebp - 0x48], eax
push 0x400
push 0x453027
call sub.KERNEL32.dll_RtlZeroMemory
push str.EXE_file
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x66c], eax
inc dword [ebp - 0x66c]
push dword [ebp - 0x66c]
push 0x453027
push str.EXE_file
call fcn.0042e300
mov eax, dword [ebp - 0x66c]
add eax, 0x453027
mov dword [ebp - 0x66c], eax
push 6
push dword [ebp - 0x66c]
push str..exe
call fcn.0042e300
mov dword [ebp - 0x40], 0x453027
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x32
mov dword [ebp - 0x34], 1
push 0x44118c
call sub.KERNEL32.dll_lstrlenA
mov ebx, 0
jmp 0x41535c
mov bl, byte [eax + 0x44118c]
dec eax
cmp eax, 0
jbe 0x415366
cmp bl, 0x5c
jne 0x415355
add eax, 2
add eax, 0x44118c
push eax
lea eax, [ebp - 0x150]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0x150]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x550]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], str.Save_EXE_Book:
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x18], 0x806
mov word [ebp - 0x14], 0
mov word [ebp - 0x12], 0
lea eax, [ebp - 0x668]
mov byte [eax], 0
push 0x442630
push eax
call fcn.0042e2b0
lea eax, [ebp - 0x668]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x4c]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
cmp eax, 1
jne 0x41542d
push 0x400
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp - 0x670]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x550]
push eax
call fcn.00418c6d
push 0
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.dll_CopyFileA
pop edx
leave
ret