joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480252
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047f193
and dword [ebp - 4], 0
cmp dword [0x4f16cc], 0
mov ebx, eax
jne 0x480303
push 0x4b6374
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4803b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x4803b4
push eax
call fcn.0047f121
mov dword [esp], 0x4b6358
push edi
mov dword [0x4f16cc], eax
call esi
push eax
call fcn.0047f121
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4f16d0], eax
call esi
push eax
call fcn.0047f121
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x4f16d4], eax
call esi
push eax
call fcn.0047f121
pop ecx
mov dword [0x4f16dc], eax
test eax, eax
je 0x480303
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047f121
pop ecx
mov dword [0x4f16d8], eax
mov eax, dword [0x4f16d8]
cmp eax, ebx
je 0x48035b
cmp dword [0x4f16dc], ebx
je 0x48035b
push eax
call fcn.0047f19c
push dword [0x4f16dc]
mov esi, eax
call fcn.0047f19c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x48035b
test edi, edi
je 0x48035b
call esi
test eax, eax
je 0x480352
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x480352
test byte [ebp - 0xc], 1
jne 0x48035b
or dword [ebp + 0x10], 0x200000
jmp 0x480394
mov eax, dword [0x4f16d0]
cmp eax, ebx
je 0x480394
push eax
call fcn.0047f19c
pop ecx
test eax, eax
je 0x480394
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x480394
mov eax, dword [0x4f16d4]
cmp eax, ebx
je 0x480394
push eax
call fcn.0047f19c
pop ecx
test eax, eax
je 0x480394
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f16cc]
call fcn.0047f19c
pop ecx
test eax, eax
je 0x4803b4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4803b6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4887ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047f193
and dword [ebp - 4], 0
cmp dword [0x4f1e84], 0
mov ebx, eax
jne 0x4888b0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x488961
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x488961
push eax
call fcn.0047f121
mov dword [esp], 0x4b6358
push edi
mov dword [0x4f1e84], eax
call esi
push eax
call fcn.0047f121
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4f1e88], eax
call esi
push eax
call fcn.0047f121
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4f1e8c], eax
call esi
push eax
call fcn.0047f121
pop ecx
mov dword [0x4f1e94], eax
test eax, eax
je 0x4888b0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047f121
pop ecx
mov dword [0x4f1e90], eax
mov eax, dword [0x4f1e90]
cmp eax, ebx
je 0x488908
cmp dword [0x4f1e94], ebx
je 0x488908
push eax
call fcn.0047f19c
push dword [0x4f1e94]
mov esi, eax
call fcn.0047f19c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x488908
test edi, edi
je 0x488908
call esi
test eax, eax
je 0x4888ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4888ff
test byte [ebp - 0xc], 1
jne 0x488908
or dword [ebp + 0x10], 0x200000
jmp 0x488941
mov eax, dword [0x4f1e88]
cmp eax, ebx
je 0x488941
push eax
call fcn.0047f19c
pop ecx
test eax, eax
je 0x488941
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x488941
mov eax, dword [0x4f1e8c]
cmp eax, ebx
je 0x488941
push eax
call fcn.0047f19c
pop ecx
test eax, eax
je 0x488941
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f1e84]
call fcn.0047f19c
pop ecx
test eax, eax
je 0x488961
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x488963
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404300
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040438f
jae 0x40430e
xor ecx, ecx
call fcn.0040438f
jae 0x40433d
xor eax, eax
call fcn.0040438f
jae 0x40434d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040438f
adc al, al
jae 0x40432f
jne 0x404379
stosb byte es:[edi], al
jmp 0x404311
call fcn.0040439b
sub ecx, ebx
jne 0x404356
call fcn.00404399
jmp 0x404375
lodsb al, byte [esi]
shr eax, 1
je 0x404383
adc ecx, ecx
jmp 0x404372
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00404399
cmp eax, 0x7d00
jae 0x404372
cmp ah, 5
jae 0x404373
cmp eax, 0x7f
ja 0x404374
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x404311
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10005e45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10005e54
pop dword [ebp - 0x30]
mov eax, 0xe302a90f
sub eax, 0xd3024abb
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xee1ee898
sub dword [ebp - 0x40], 0x9fcca34d
mov dword [ebp - 0x3c], 0xd6390aa6
add dword [ebp - 0x3c], 0x5bfa419f
mov dword [ebp - 0x38], 0xeb9cefd6
sub dword [ebp - 0x38], 0x9f50aba8
mov dword [ebp - 0x34], 0xa5d9658d
sub dword [ebp - 0x34], 0xa5d9658d
lea eax, [ebp - 0x40]
push eax
mov eax, 0xb21faec8
add eax, 0x5de2513c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xec38d4e7
add dword [ebp - 0x40], 0x8839946f
mov dword [ebp - 0x3c], 0xe3cd5756
add dword [ebp - 0x3c], 0x5d9f0a1f
mov dword [ebp - 0x38], 0x67a0a3e6
add dword [ebp - 0x38], 0xfbcec886
mov dword [ebp - 0x34], 0x861db1c6
sub dword [ebp - 0x34], 0x861db1c6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x77314f2f
add eax, 0x98d0b0d1
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3e47e
push 0
call eax
mov ecx, 0x26cd4715
add ecx, 0xd9330706
mov ebx, eax
mov edx, 0x3847678
add edx, 0xc7e4588
add edx, dword [ebp - 0x30]
mov edi, 0x9f76a1fc
sub edi, 0x4a38af61
xor dword [ebp - 0x2c], 0xe2e387d7
mov esi, dword [edx]
add dword [ebp - 8], ebx
xor esi, edi
sub dword [ebp - 0x28], 0x7e19d54d
mov dword [ebx], esi
add ebx, 0x1ff2f84f
add ebx, 0xe00d07b5
add edx, 0x4f383b75
add edx, 0xb0c7c48f
loop 0x10005f76
add eax, 0xe3481192
sub eax, 0xe346e653
xor ebx, ebx
add ebx, eax
add eax, 0x9f96153f
sub eax, 0x9f96153a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x405230]
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x228], dx
mov ecx, 0x81
lea edi, [ebp - 0x226]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x228]
push eax
push edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...XLBugHandler.dll
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x40107f
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4010c8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._XL_SetBugReportRootDir_4
push ebx
call edi
push str._XL_InitBugHandler_20
push ebx
mov dword [esi], eax
call edi
push str._XL_SetPeerID_4
push ebx
mov dword [esi + 4], eax
call edi
push str._XL_SetReportShowMode_4
push ebx
mov dword [esi + 8], eax
call edi
push str._XL_SetAlwaysSendReport_4
push ebx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00401a69
leave
ret
Function at 0x401185
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1cc]
sub esp, 0x24c
mov eax, dword [0x405230]
push esi
push edi
mov dword [ebp + 0x1c8], eax
xor esi, esi
xor eax, eax
mov word [ebp - 0x40], si
mov ecx, 0x81
lea edi, [ebp - 0x3e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...ShellLinkCreater.exe
lea eax, [ebp - 0x40]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4012c3
push ebx
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x1d4]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], str.open
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
call edi
test eax, eax
je 0x4012c0
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x48]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x48]
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x44], 1
je 0x4012c0
push 0x3c
lea eax, [ebp - 0x80]
push esi
push eax
call sub.MSVCR71.dll_memset
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x1d4]
mov dword [ebp - 0x6c], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], 0x40330c
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
call edi
test eax, eax
je 0x4012c0
push 0xffffffffffffffff
push dword [ebp - 0x48]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
cmp dword [ebp - 0x44], 1
sete al
jmp 0x4012c2
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x1c8]
pop edi
pop esi
call fcn.00401a69
add ebp, 0x1cc
leave
ret
Function at 0x4012d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x401377
cmp dword [ebp + 0xc], ebx
je 0x401377
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x401372
lea eax, [esi + esi + 2]
push edi
push eax
call fcn.00401a0e
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40136a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0x40336c
push edi
mov dword [ebp + 8], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40136a
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
inc ebx
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
mov eax, ebx
pop esi
jmp 0x401379
xor eax, eax
pop ebx
leave
ret
Function at 0x401863
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.MSVCR71.dll__wcslwr]
mov dword [esp], str._createhomeshelllink
push esi
call dword [sym.imp.MSVCR71.dll_wcsstr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
je 0x40189f
push eax
call fcn.00401185
pop ecx
jmp 0x4019f3
push edi
push str.12F5FB69_47F2_4eb6_96DF_FB624FF888EF
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401924
push str.AEE38D2B_0EB7_4644_AF71_E3EF7DE55B52
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4019e9
mov dword [ebp - 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
call dword [sym.imp.MSVCR71.dll_wcslen]
mov esi, eax
lea edi, [esi + esi + 2]
push edi
call fcn.00401a0e
push edi
push ebx
push eax
mov dword [ebp - 0x10], eax
call sub.MSVCR71.dll_memset
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x4a
push dword [ebp - 8]
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4019e9
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.004016d2
call fcn.004014a5
test al, al
je 0x4019e9
push str.XLUU.MainFrame
call dword [sym.imp.XLUE.dll__XLUE_GetHostWndByID_4]
cmp eax, ebx
je 0x4019ba
push eax
call dword [sym.imp.XLUE.dll__XLUE_GetHostWndWindowHandle_4]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4019ba
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
push 0x32
mov dword [ebp - 8], eax
call esi
push eax
push 0x31
call esi
mov edi, dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push 5
push dword [ebp - 8]
call edi
push eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x80
push dword [ebp - 0xc]
call ebx
push 0
push 0xc
call esi
push eax
push 0xb
call esi
push eax
push 1
push 5
push dword [ebp - 8]
call edi
push eax
push 1
push 0x80
push dword [ebp - 0xc]
call ebx
xor ebx, ebx
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4019d6
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp - 0x34]
push ebx
push eax
call esi
test eax, eax
jne 0x4019c2
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x401170
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x40e090]
push ebx
push esi
push edi
mov dword [esp + 0x124], eax
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x1c]
xor esi, esi
push eax
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40125a
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40125a
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x401253
cmp dword [esp + 0x14], esi
jne 0x401253
push edi
call fcn.00403bc8
mov esi, eax
add esp, 4
test esi, esi
je 0x40124f
push 0
lea eax, [esp + 0x18]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401246
mov eax, dword [esi + 0x3c]
sub edi, eax
push edi
add eax, esi
push eax
push 0
call fcn.00403530
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx + esi - 4]
add esp, 0xc
cmp eax, edx
jne 0x401246
mov dword [esp + 0x10], 1
push esi
call fcn.00403bc3
add esp, 4
mov esi, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x124]
mov eax, esi
call fcn.00403bb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401449
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40145d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40147e
cmp esi, eax
jae 0x401457
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401470
cmp esi, eax
jae 0x401457
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4015b0
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x54
test edx, edx
jne 0x4015c2
or eax, 0xffffffff
add esp, 0x54
ret
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 4]
push ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
push edx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x401616
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x54
ret
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40162a
mov ecx, dword [esp]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add esp, 0x54
ret
Function at 0x401630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
test ebp, ebp
je 0x4016aa
mov eax, dword [esp + 0xc]
push edi
push 0xa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4016af
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x4016a3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4016a3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4016a3
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi]
cmp esi, ecx
jae 0x401696
push esi
push eax
push ebp
call fcn.00403a60
add esp, 0xc
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret
push ecx
push eax
push ebp
call fcn.00403a60
add esp, 0xc
mov dword [edi], esi
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
pop ebp
mov eax, ebx
pop ebx
ret
pop edi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x401770
Capabilities:
Move file

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov dword [esp], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x12], eax
lea eax, [esp]
push eax
mov dword [esp + 8], 4
mov word [esp + 0x14], 0x414
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov eax, 1
add esp, 0x20
ret
Function at 0x4017e0
Capabilities:
Check if file exists
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x40e090]
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
mov dword [esp + 0x11c], eax
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
push edi
call esi
test eax, eax
jne 0x4018b9
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401830
sub eax, edx
test eax, eax
jle 0x401897
lea ebx, [esp + 0x10]
mov esi, edi
sub ebx, edi
mov dword [esp + 0xc], eax
lea esp, [esp]
cmp byte [esi], 0x5c
jne 0x401880
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401880
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x80
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [esi]
mov byte [ebx + esi], al
mov eax, dword [esp + 0xc]
inc esi
dec eax
mov dword [esp + 0xc], eax
jne 0x401850
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
call esi
test eax, eax
jne 0x4018b2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call esi
test eax, eax
je 0x4018d1
mov eax, 1
mov ecx, dword [esp + 0x11c]
call fcn.00403bb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x11c]
xor eax, eax
call fcn.00403bb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402600
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x114
mov eax, dword [0x40e090]
mov dword [esp + 0x110], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x40267f
lea ecx, [esp]
push ecx
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40267f
mov eax, dword [esp]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x40267f
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x11c]
call fcn.00402580
mov eax, 1
mov ecx, dword [esp + 0x110]
call fcn.00403bb5
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
xor eax, eax
call fcn.00403bb5
add esp, 0x114
ret
Function at 0x402d70
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x40a258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x40ea08]
push ebx
push ebp
push esi
push edi
mov ecx, 0x40ea08
xor ebx, ebx
call dword [eax + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x10], ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebx
push ebx
mov dword [esp + 0x2c], ebx
call edi
mov esi, eax
inc esi
push esi
call fcn.00404b2b
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x402ea3
push eax
push esi
call edi
mov eax, dword [esp + 0x14]
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402dd5
sub eax, edx
mov edi, eax
je 0x402e91
test esi, esi
jne 0x402dee
xor eax, eax
jmp 0x402dfc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402df3
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401cf0
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.004021d0
mov eax, dword [eax]
push 0x40b2ec
push eax
call fcn.00404359
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402e4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x402e5e
push 1
push 0x40b2ec
lea ecx, [esp + 0x18]
call fcn.00401e60
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x402e77
push ebp
call fcn.00402af0
add esp, 4
lea esi, [esi + edi + 1]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402e80
sub eax, edx
mov edi, eax
jne 0x402de6
mov eax, dword [esp + 0x14]
push eax
mov ebx, 1
call fcn.00404b26
add esp, 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ec5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret