joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405112
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 8], 0
push edi
je 0x4052f7
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x436]
push eax
call fcn.0040e740
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
add esp, 0xc
lea eax, [ebp - 0x438]
push 0x104
push eax
push dword [ebx + 8]
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrIW]
push 0x5c
push 0
lea eax, [ebp - 0x438]
push eax
call edi
test eax, eax
je 0x405191
xor ecx, ecx
push 0x5c
mov word [eax], cx
push ecx
lea eax, [ebp - 0x438]
push eax
call edi
test eax, eax
je 0x405191
xor ecx, ecx
mov word [eax + 2], cx
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x418d78
lea eax, [ebp - 0x438]
push eax
call edi
test eax, eax
jne 0x4051ba
push 0x104
lea eax, [ebp - 0x438]
push eax
push dword [ebx + 8]
call esi
mov eax, dword [ebx + 8]
and dword [ebp - 0x24], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x640]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x1c], 0x419540
mov dword [ebp - 0x18], 0x50
mov dword [ebp - 0x14], 0x4050f1
mov dword [ebp - 0xc], 0x80
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4052d2
lea eax, [ebp - 0x640]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x419550
lea eax, [ebp - 0x640]
push eax
call edi
test eax, eax
je 0x4052bd
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
push eax
call fcn.0040e740
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x230]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x418d78
lea eax, [ebp - 0x230]
push eax
call esi
mov ecx, dword [0x41edd4]
call fcn.004031fc
push eax
lea eax, [ebp - 0x230]
push eax
call esi
push 0x418d78
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x230]
push eax
mov eax, dword [0x41edd4]
push dword [eax]
call edi
lea eax, [ebp - 0x230]
push eax
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [ebp - 8]
jmp 0x4052d2
push 0x10
push 0x418f68
push 0x419554
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x4052f7
mov eax, dword [ebp - 4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407714
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40771f
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4077d7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
add edx, 8
sub esi, 8
dec edi
jne 0x40773a
pop edi
test esi, esi
je 0x4077f0
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x419960]
inc edx
dec esi
jne 0x4077db
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x4077f8
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov edx, 0xff
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x419960]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x419960]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x407f02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov esi, ebx
imul esi, dword [ebp + 8]
cmp byte [edi], 0
mov eax, ecx
mov dword [ebp - 4], eax
je 0x407f3c
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407f37
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x407f63
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x407f4c
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0040efa0
add esp, 0xc
add dword [edi + 0x1c], esi
mov eax, esi
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
leave
ret
Function at 0x409054
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x40907c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40907c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x409122
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x409099
cmp ax, 0x5c
jne 0x40909b
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x40908d
cmp edi, ebx
je 0x4090d7
sub edi, ebx
and edi, 0xfffffffe
push edi
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.0040efa0
xor eax, eax
add esp, 0xc
lea edx, [ebp - 0x410]
mov ecx, esi
mov word [ebp + edi - 0x410], ax
call fcn.00409054
xor eax, eax
mov word [ebp - 0x208], ax
pop edi
test esi, esi
je 0x4090f3
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409122
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebx
leave
ret
Function at 0x4095c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 5
xor eax, eax
mov word [ebp - 0x22], ax
pop eax
xor ecx, ecx
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ecx
push ecx
push 0x200
push ecx
push ecx
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x54], 0x44
push ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], 0x41871c
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40962e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x409630
xor al, al
leave
ret 0x10
Function at 0x409634
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x66c], ax
xor ebx, ebx
lea eax, [ebp - 0x66a]
push ebx
push eax
mov dword [ebp - 8], ecx
call fcn.0040e740
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.0040e740
mov esi, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x66c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x41b13c
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x464]
push eax
push ebx
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4096c7
xor al, al
jmp 0x409865
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test byte [ebp - 0x464], 0x10
push 0x418d64
lea eax, [ebp - 0x438]
push eax
jne 0x4097c3
call edi
test eax, eax
je 0x40983a
push 0x41b140
lea eax, [ebp - 0x438]
push eax
call edi
test eax, eax
je 0x40983a
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [ebp + 0xc], 0
je 0x40979c
cmp dword [ebp + 0x10], 0
je 0x40979c
xor eax, eax
push 0x3e6
push eax
mov word [ebp - 0xa54], ax
lea eax, [ebp - 0xa52]
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0xa54]
push str.ck_W_Rd
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa54]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp + 0xc]
call fcn.00409598
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40983a
push 4
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40983a
call edi
test eax, eax
je 0x40983a
push 0x41b140
lea eax, [ebp - 0x438]
push eax
call edi
test eax, eax
je 0x40983a
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x418d78
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push eax
call fcn.00409634
lea eax, [ebp - 0x464]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4096cd
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec eax
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x409bdb
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.0040e740
add esp, 0xc
call fcn.00402f5d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp + 0xc], ebx
je 0x409c56
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call esi
push 0x418d78
lea eax, [ebp - 0x210]
push eax
call esi
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0x18]
lea eax, [ebp - 0x210]
push eax
call esi
push 0x41b1b8
lea eax, [ebp - 0x210]
push eax
call esi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x414348
push 1
push ebx
push 0x414358
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x409d04
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push 0x41871c
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push ebx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
mov ecx, dword [eax]
push edx
push 0x414368
push eax
call dword [ecx]
test eax, eax
js 0x409d04
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409cf2
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 8]
push 2
mov ecx, dword [eax]
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0x18]
mov ecx, dword [ebp - 8]
pop esi
pop ebx
test ecx, ecx
je 0x409d13
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x409d20
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
leave
ret 0x14
Function at 0x409d2a
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor edi, edi
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x210]
push edi
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x418d78
lea eax, [ebp - 0x210]
push eax
call esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x210]
push eax
call esi
push 0x41b1b8
lea eax, [ebp - 0x210]
push eax
call esi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x414348
push 1
push edi
push 0x414358
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x409e25
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push edi
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
mov ecx, dword [eax]
push edx
push 0x414368
push eax
call dword [ecx]
test eax, eax
js 0x409e25
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409e13
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 8]
push 2
mov ecx, dword [eax]
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0x18]
mov ecx, dword [ebp - 8]
pop edi
pop esi
test ecx, ecx
je 0x409e34
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x409e41
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
leave
ret 0x10
Function at 0x409e4b
Capabilities:
Acquire debug privileges
Enumerate processes
Get file system object information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
push ebx
push esi
push edi
xor esi, esi
push esi
xor edi, edi
push 2
inc edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
test ebx, ebx
jne 0x409e72
xor eax, eax
jmp 0x409f8d
lea eax, [ebp - 0x248]
push eax
push ebx
mov dword [ebp - 0x248], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x409e6b
lea eax, [ebp - 4]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x409eec
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x409ee3
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2b4
lea eax, [ebp - 0x704]
push esi
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x704]
push 0x101
push 0x2b4
push eax
push esi
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 8]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x409f75
push dword [ebp - 0x240]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
neg eax
sbb eax, eax
and edi, eax
xor esi, esi
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x409eec
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x409f97
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor esi, esi
lea eax, [ebp - 0x20e]
push esi
push eax
mov dword [edi], 0x1b58
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.mshtml.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp + 8], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
je 0x40a099
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40a099
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push dword [ebp + 8]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40a060
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x418d78
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40a060
cmp dword [ebp - 8], esi
je 0x40a060
mov eax, dword [ebp - 4]
movzx esi, word [eax + 0xa]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0xb
jne 0x40a072
mov dword [edi], 0x2af8
cmp esi, 0xa
jne 0x40a07f
mov dword [edi], 0x2710
jmp 0x40a09f
cmp esi, 9
jne 0x40a08c
mov dword [edi], 0x2328
jmp 0x40a09f
cmp esi, 8
jne 0x40a099
mov dword [edi], 0x1f40
jmp 0x40a09f
mov dword [edi], 0x1b58
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40a0a6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push 1
lea eax, [ebp - 0x14]
push eax
mov ebx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, ecx
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40a177
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x40]
push eax
push 1
mov dword [ebp - 0x40], 0x1f01ff
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x40a177
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40a177
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40a177
push edi
push dword [ebp - 8]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x40a177
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40a186
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x40a197
push dword [ebp - 8]
call edi
test esi, esi
je 0x40a19e
push esi
call edi
test ebx, ebx
jne 0x40a1ae
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40a1b5
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
mov esi, ecx
call fcn.0040e740
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push 0
push 0x41b1e8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x41b208
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
leave
ret
Function at 0x40a21e
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x854
mov eax, dword [0x41eddc]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [esp + 0x224], ax
xor ebx, ebx
lea eax, [esp + 0x226]
push ebx
push eax
call fcn.0040e740
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x42c], ax
lea eax, [esp + 0x42e]
push ebx
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [esp + 0x428]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x220]
push eax
push ebx
push 0x41b210
lea eax, [esp + 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x419108
push 0x12d
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40a467
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40a467
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000004
lea eax, [esp + 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40a467
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
push ecx
mov dword [esp + 0x14], eax
call fcn.0040b195
mov esi, eax
pop ecx
test esi, esi
je 0x40a467
push dword [esp + 0x10]
push edi
push esi
call fcn.0040efa0
add esp, 0xc
lea eax, [esp + 0x14]
push 0
push eax
push dword [esp + 0x18]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040b27c
pop ecx
mov ecx, dword [esp + 0xc]
call fcn.0040a1b5
push ecx
push ecx
lea ecx, [esp + 0x228]
call fcn.004093ba
mov edx, dword [esp + 0x14]
mov ebx, eax
mov ecx, ebx
call fcn.004094ef
lea eax, [esp + 0x638]
push eax
or edx, 0xffffffff
mov ecx, ebx
call fcn.0040947f
mov eax, dword [esp + 0x63c]
add esp, 0xc
xor esi, esi
mov dword [esp + 0xc], eax
test eax, eax
jle 0x40a45b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x630]
push eax
mov edx, esi
mov ecx, ebx
call fcn.0040947f
xor eax, eax
mov dword [esp], 0x206
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0040e740
add esp, 0xc
lea eax, [esp + 0x634]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x41871c
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x40a450
push 0x418d64
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x40a450
push 0x41b140
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x40a450
push 0x2f
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
test eax, eax
je 0x40a42d
push 0x41b218
push eax
call edi
test eax, eax
je 0x40a450
push str..tmp
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
mov edx, esi
mov ecx, ebx
call fcn.004094be
add esp, 0xc
inc esi
cmp esi, dword [esp + 0xc]
jl 0x40a39e
mov ecx, ebx
call fcn.0040954e
xor eax, eax
inc eax
jmp 0x40a469
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret