joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436c4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
mov edi, eax
call fcn.00436edb
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040b63e
mov eax, dword [ebp - 4]
pop ecx
xor edx, edx
pop ecx
mov ecx, 0x14b
div ecx
xor eax, eax
inc dl
cmp dword [ebp + 8], eax
jbe 0x436c8d
mov cl, al
add cl, dl
xor byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 8]
jb 0x436c80
pop edi
leave
ret

Function at 0x436c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 4
push dword [ebp + 0xc]
mov edi, eax
lea eax, [ebp - 4]
push eax
call fcn.0040b663
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 0x14b
div ecx
add esp, 0xc
xor eax, eax
inc dl
cmp dword [ebp + 8], eax
jbe 0x436cca
mov cl, al
add cl, dl
xor byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 8]
jb 0x436cbd
push dword [ebp + 8]
call fcn.00436edb
pop ecx
xor ecx, ecx
cmp dword [ebp - 4], eax
pop edi
sete cl
mov al, cl
leave
ret

Function at 0x436edb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor edx, edx
push 0xa
pop ebx
div ebx
or esi, 0xffffffff
xor ecx, ecx
mov edx, 0xff
test eax, eax
mov dword [ebp - 4], eax
jbe 0x436f28
xor eax, eax
cmp ecx, 0xa
jae 0x436f28
mov ebx, dword [ecx*4 + 0x4863b0]
add ebx, eax
movzx ebx, byte [ebx + edi]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x485fb0]
inc ecx
add eax, 0xa
cmp ecx, dword [ebp - 4]
jb 0x436eff
cmp dword [ebp + 8], 0
je 0x436f4b
mov eax, edi
movzx ecx, byte [eax]
dec dword [ebp + 8]
xor ecx, esi
and ecx, edx
shr esi, 8
xor esi, dword [ecx*4 + 0x485fb0]
inc eax
cmp dword [ebp + 8], 0
jne 0x436f30
mov eax, esi
pop esi
not eax
pop ebx
leave
ret

Function at 0x436f53
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x44146f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x49b390]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov esi, ecx
lea eax, [esi + 0x98]
cmp byte [eax], 0
jne 0x4414ac
mov byte [eax], 1
call fcn.0044368b
push dword [eax + 0x94]
call fcn.0044136d
test al, al
je 0x441558
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push eax
mov dword [esi + 4], eax
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x10
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0045c920
and word [esp + 0x1a], 0
and dword [esp + 0x1c], 0
add esp, 0xc
push 0x10
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_bind]
push 0x10
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0045c920
movzx eax, word [esi + 0xac]
add esp, 0xc
push eax
mov word [esp + 0x20], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1e], ax
mov eax, dword [esi + 0xa8]
mov dword [esp + 0x20], eax
push 0x10
lea eax, [esp + 0x20]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
push esi
call fcn.0044368b
push eax
call fcn.00443aff
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
mov al, 1
call fcn.0045c29b
mov esp, ebp
pop ebp
ret

Function at 0x4431be
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x49b390]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
lea eax, [esp + 8]
push eax
push 2
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0044368b
push eax
call fcn.00443ec8
cmp dword [0x4a69ac], 0
jne 0x443225
push 0x4a6bb8
push 4
push 0
push 0x442e4f
push 0
push 0
call int.004607e2
add esp, 0x18
test eax, eax
mov dword [0x4a69ac], eax
jne 0x44321e
push 4
pop eax
jmp 0x443227
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [esp + 0x19c]
pop ebx
xor ecx, esp
call fcn.0045c29b
add esp, 0x1a0
ret
Function at 0x448578
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jl 0x4485f4
mov edx, dword [ebp + 8]
jg 0x44858f
test edx, edx
jb 0x4485f4
mov ecx, dword [ebp + 0x14]
xor eax, eax
add ecx, edx
adc eax, ebx
cmp eax, dword [esi + 0xc]
jg 0x4485f4
jl 0x4485a4
cmp ecx, dword [esi + 8]
ja 0x4485f4
and dword [ebp - 0x14], 0
push edi
xor eax, eax
and dword [ebp + 0xc], 0
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0xc], edx
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp + 0xc], 0
pop edi
ja 0x4485ef
and dword [ebp + 0xc], 0
push 1
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebp + 0xc]
jmp 0x4485f6
xor eax, eax
pop ebx
leave
ret

Function at 0x4485f9
Capabilities:
Get file size

Disassembly:
push 0x64
mov eax, 0x47fae8
call fcn.00464302
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
call fcn.004493dc
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [0x4ae58c]
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x4ae588
call fcn.0041eaa7
xor esi, esi
test al, al
je 0x448682
lea edi, [ebp - 0x70]
call fcn.00448317
mov dword [ebp - 4], esi
mov eax, dword [0x4ade18]
mov dword [ebp - 0x60], eax
mov eax, edi
push eax
push ecx
push dword [ebp + 0xc]
call fcn.00449048
pop ecx
push eax
call fcn.00448716
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
call fcn.004493dc
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x38]
mov dword [ebp - 0x14], ecx
call fcn.0044977a
mov edi, dword [ebp - 0x14]
cmp edi, esi
jne 0x44868e
call fcn.0045d307
cmp ebx, dword [edi + 4]
jne 0x448698
call fcn.0045d307
cmp dword [ebx + 0x18], esi
jne 0x4486fb
cmp dword [0x4ade18], 1
mov ecx, 0x80
jne 0x4486b0
mov ecx, 0x40000080
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push ecx
push 3
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4486e1
mov eax, dword [ebp + 8]
mov ecx, dword [0x4ae58c]
mov dword [eax + 4], ecx
mov dword [eax], 0x4ae588
jmp 0x448703
lea ecx, [ebx + 0x24]
push ecx
push eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x5c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [eax + 4], ebx
call int.004643da
ret
Function at 0x44f3bf
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x94
mov eax, 0x47eca1
call fcn.0046436b
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x88], eax
jne 0x44f3e8
xor ax, ax
jmp 0x44f593
mov eax, dword [0x48d12c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x48d130]
xor ecx, ecx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x88]
shr eax, cl
cmp eax, ebx
je 0x44f58f
test al, 1
je 0x44f579
lea eax, [ebp - 0x18]
add ecx, 0x41
push eax
mov word [ebp - 0x18], cx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x44f579
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x44f579
xor eax, eax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [ebp - 0x18]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x68]
call fcn.00404670
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 4], ebx
call fcn.0044f269
test al, al
pop ecx
jne 0x44f56a
mov eax, dword [ebp - 0x70]
cmp eax, ebx
jne 0x44f49f
cmp dword [ebp - 0x6c], ebx
je 0x44f557
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [ebp - 0x7c]
ja 0x44f56a
jb 0x44f4b6
cmp eax, dword [ebp - 0x80]
jae 0x44f56a
mov esi, 0x48d134
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x32]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
push 3
stosw word es:[edi], ax
mov ax, word [ebp - 0x18]
push ebx
push 3
mov word [ebp - 0x38], ax
push 0x80000000
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x78], eax
je 0x44f557
mov edi, 0x227
push edi
call fcn.0045b0a4
pop ecx
push ebx
mov esi, eax
mov dword [esi + 4], edi
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push dword [esi + 4]
lea eax, [ebp - 0x4c]
push esi
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
je 0x44f547
cmp dword [esi + 0x1c], 7
jne 0x44f547
push esi
call fcn.0045c99a
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44f56a
push esi
call fcn.0045c99a
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x6c], eax
movzx eax, word [ebp - 0x18]
mov dword [ebp - 0x74], eax
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x68]
call fcn.004049f4
mov ecx, dword [ebp - 0x84]
inc ecx
cmp ecx, 0x1a
mov dword [ebp - 0x84], ecx
jl 0x44f409
mov ax, word [ebp - 0x74]
call fcn.004643ee
ret
Function at 0x450ba2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.00450c12
mov ecx, dword [esi + 0x10]
lea edx, [eax + edi]
cmp edx, ecx
jb 0x450bc3
sub ecx, eax
mov dword [ebp - 4], ecx
jmp 0x450bc6
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub eax, dword [esi + 4]
push 0x64
xor edx, edx
pop ecx
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov ecx, edx
cmp ecx, dword [esi]
je 0x450c00
mov eax, dword [esi]
mov edx, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x14], edx
mov eax, dword [esi]
push 0x3c
inc eax
xor edx, edx
pop edi
div edi
cmp edx, ecx
mov dword [esi], edx
jne 0x450be5
mov dword [esi], ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x450c0a
add dword [esi + 0xc], eax
pop edi
mov dword [esi + 8], ebx
pop esi
pop ebx
leave
ret
Function at 0x45b18f
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp - 0x26], ah
lodsd eax, dword [esi]
cmp byte [ecx], 0xfb
fild qword [edi - 0x4951ff01]
ror dword [eax], 1
xchg ebp, eax
mov al, byte [ebx + edx]
popfd
lahf
imul esp, dword [0x7e300c1b], 0xf53ef9ef
xchg ebp, eax
stosb byte es:[edi], al
stosb byte es:[edi], al
std
wait
dec esp
push ebp
inc ebp
cwde
mov ebx, 0xc690f2b6
rcl edi, 0xe6
cmp eax, 0xad76f873
xor dword [esi + ebx*4], ebx
outsb dx, byte [esi]
or dword [edi - 0x49], ecx
jns 0x45b14f
retf
test byte [esi + 0x5b], bl
pop esp
dec ecx
popfd
mov ecx, 0xfe209f37
das
mov ebx, 0xb47e3afd
idiv byte [ecx + 0x32]
into
adc ebp, edx
xlatb
js 0x45b1c1
aaa
and bl, dh
mov edx, 0x1de7df7c
jns 0x45b117
bound eax, qword [edi - 0x66]
mov byte [0xde726457], al
sahf
bound ecx, qword [edi + 0x7bdfcb3]
stc
out dx, eax
dec ebx
mov esp, 0x521e4633
mov byte [esi + edi*4 - 0x9561ac], ch
sahf
push 0xffffffffffffffff
add byte [ebp + 0x4a9f7f7a], ah
jp 0x45b216
lahf
dec edx
insb byte es:[edi], dx
jb 0x45b1e5
out 0x6e, al
invalid
push esp
pushal
invalid
int1
xlatb
fisub dword [esi + 0x17346f67]
fidiv dword [edi + 0x3e147118]
jno 0x45b195
mov cl, byte [eax]
in al, 0x8c
jge 0x45b212
sbb al, 0x66
xchg ebp, eax
pop edi
insb byte es:[edi], dx
scasd eax, dword es:[edi]
in al, 0xba
mov dl, 7
jns 0x45b25d
or dword [ecx], esi
popfd
mov al, byte [0xc7e547e1]
adc al, 0xac
inc ebx
cmp dh, byte [0x411eef42]
push edi
aas
xor ebx, ebx
fcompi st(5)
cmc
cmpsd dword [esi], dword es:[edi]
pop ds
xor al, 0x15
fsub dword [ebx]
mov esi, 0x819c345f
mov bh, 0xbe
cmp eax, 0xc9fe2fa
xchg ecx, eax
xor dword [ebp - 0x1ab81e60], ebx
invalid
cli
loop 0x45b1ae
or al, 0x91
leave
adc byte [eax - 0x77], ch
sub dword [edx - 0x3e46e1c6], edx
jmp 0x45b20c
xchg edx, eax
cmp bl, byte [esi]
mov ecx, 0x4befebc1
mov dword [esp + ebp*2 + 0x37], ecx
and byte [esp + ebx*4 + 0x1c], bh
adc al, byte [edi]

Function at 0x467314
Capabilities:
Encode data using xor

Disassembly:
push esi
pop ds
cld
dec ebp
pop ebp
mov byte [0x86ed75b1], al
out 0xc0, al
xor byte [0x635cb984], ah
mov word [edx], es
jae 0x4672b9
invalid
inc dword [eax]
mov dword [eax - 2], 0xc78a7e75
aam 0x2d
shl bh, cl
pop edi
mov dl, 0x56
and byte [ecx + edx*2], dh
dec eax
loopne 0x4672b8
mov esp, 0x4d73f9f1
aam 0xa1
invalid
Function at 0x468c10
Capabilities:
Encode data using xor

Disassembly:
pop es
add ebp, dword [edi + 0x78ea36b5]
fisub word [esi]
dec edi
in al, dx
mov dword [esi], esp
dec edi
loop 0x468beb
xchg ecx, eax
stosb byte es:[edi], al
xchg ecx, eax
xlatb
clc
invalid
xor edi, ebx
invalid
cmp eax, ebx
xchg esi, eax
push edi
lahf
sbb dword [ebp - 0x31b5190f], ebx
push es
jecxz 0x468be2
mov al, byte [0x9fdf1ef4]
adc eax, 0x3e2d35a4
push ebp
invalid
cmp ebx, dword [esi - 0x2f148886]
loopne 0x468c7a
test al, 0xdc
nop
jae 0x468c42
pop edx
xchg esp, eax
push ss
xchg edx, eax
cwde
enter 0xffffffffffff8a56, 0xffffffffffffffe5
jno 0x468bf8
jge 0x468baf
in eax, dx
insb byte es:[edi], dx
sti
invalid
dec eax
in ax, dx
retf
xor eax, 0xa2fe1a1c
insb byte es:[edi], dx
mov ds, word [ebp + 0x6495fe73]
push esp
test al, 0xb7
loope 0x468d07
and byte [edx + esi*2 - 0x90712f8], 0xad
invalid
cmpsb byte [esi], byte es:[edi]
lahf
outsd dx, dword [esi]
in eax, 0xac
sahf
pop esp
mov dh, 0xa8
int3
dec esi
clc
xchg ebx, eax
popal
mov ch, 0x23
mov edx, 0xed89ab0
add dword [eax + 0x4e075086], ecx
cmp bh, al
loope 0x468cef
mov bh, 0x35
aam 0x69
pop esi
and edx, edx
jne 0x468d87
add eax, 0xa43cea95
outsb dx, byte [esi]
adc dword [ecx], edi
fcomp st(7)
xchg edi, eax
clc
je 0x468d20
fidiv word [ebx + 0xb637d7c]
jmp 0x307ce041
movsd dword es:[edi], dword [esi]
push eax
invalid

Function at 0x47a930
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx - 0x1bb3ff01], eax
pop ds
xor al, 0x67
mov esi, 0x9c6a7d3a
xchg edi, eax
aaa
xchg esi, eax
xchg ebx, eax
jns fcn.0047a976
test byte [ebx], dh
pop esi
jns 0x47a96b
dec edx
fisub word [ebp - 0x6a9f461f]
mov edi, ds
cmc
push ebx
sahf
jbe 0x47a970
xor eax, 0x27571475
jne 0x47a951
push edi
daa
invalid
Function at 0x4010d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40112c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40111e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40111a
cmp edi, eax
jae 0x40111e
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40110c
cmp edi, eax
jb 0x401122
xor eax, eax
jmp 0x40112b
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4012fb
Capabilities:
Identify system language via api

Disassembly:
push 0xc
mov eax, 0x4b324e
call fcn.00498965
mov ebx, 0x4dee48
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [0x4dee5c], 7
mov dword [0x4dee58], edi
mov word [0x4dee48], ax
mov dword [ebp - 4], edi
mov al, byte [ebp - 0xd]
mov esi, 0x4dee68
mov dword [ebp - 0x18], esi
mov byte [0x4dee68], al
mov dword [0x4dee70], edi
call fcn.00402377
mov dword [0x4dee6c], eax
mov dword [eax], eax
mov eax, dword [0x4dee6c]
mov dword [eax + 4], eax
mov dword [0x4dee78], edi
mov dword [0x4dee7c], edi
mov dword [0x4dee80], edi
mov byte [ebp - 4], 2
fld1
push 8
fstp dword [0x4dee90]
pop edi
call fcn.00401f4c
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
movzx eax, ax
push 0x19
pop ecx
cmp ax, cx
je 0x4013a8
xor ecx, ecx
cmp eax, 0x13
setne cl
dec ecx
and ecx, 0xa
add ecx, 9
mov dword [0x4dee64], ecx
call fcn.00401413
mov eax, ebx
call fcn.00498a3d
ret
Function at 0x4032d6
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
push 0xc
mov eax, 0x4b2e16
call fcn.00498965
lea eax, [ebp - 0x10]
push eax
mov edi, ecx
mov dword [ebp - 0x14], 1
call fcn.004017e2
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edi, dword [ecx - 0xc]
test edi, edi
je 0x403341
lea eax, [edi - 1]
test eax, eax
js 0x40336c
cmp eax, edi
jg 0x40336c
push 0x5c
pop edx
cmp dx, word [ecx + eax*2]
je 0x403341
lea ebx, [edi + 1]
push ebx
lea esi, [ebp - 0x10]
call fcn.004022aa
push 0x5c
pop ecx
mov word [eax + edi*2], cx
test ebx, ebx
js 0x40336c
mov eax, dword [ebp - 0x10]
cmp ebx, dword [eax - 8]
jg 0x40336c
mov dword [eax - 0xc], ebx
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ecx + ebx*2], ax
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jle 0x4033e5
push 0x5c
push eax
call fcn.004955b5
pop ecx
pop ecx
test eax, eax
je 0x4033e5
sub eax, dword [ebp - 0x10]
sar eax, 1
mov esi, eax
or ebx, 0xffffffff
jmp 0x4033e1
push 0x80070057
call fcn.00401085
mov ecx, esi
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00403a11
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
jne 0x4033ae
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4033f9
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and dword [ebp - 0x14], 0
lea eax, [esi + 1]
test eax, eax
js 0x4033d7
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx - 0xc]
jge 0x4033d7
lea eax, [ecx + eax*2]
push 0x5c
push eax
call fcn.004955b5
pop ecx
pop ecx
test eax, eax
je 0x4033d7
sub eax, dword [ebp - 0x10]
sar eax, 1
mov esi, eax
jmp 0x4033d9
mov esi, ebx
lea eax, [edi - 0x10]
call fcn.0040112f
cmp esi, ebx
jne 0x403376
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040112f
mov eax, dword [ebp - 0x14]
call fcn.00498a3d
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40340c
call fcn.004032c1
mov esi, eax
jmp 0x403411
mov esi, 0x80004005
lea eax, [edi - 0x10]
call fcn.0040112f
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040112f
mov eax, esi
jmp 0x4033f3
Function at 0x403428
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403470
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040112f
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.0040112f
pop edi
mov eax, esi
pop esi
leave
ret
movzx eax, word [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
pop ebx
jmp 0x403454

Function at 0x40378f
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x4d897c]
xor eax, esp
mov dword [esp + 0x438], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x40]
push eax
xor ebx, ebx
push 0x200
mov dword [esp + 0x1c], ebx
xor esi, esi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [esp + 0x24], eax
cmp eax, ebx
jbe 0x403865
lea eax, [esp + 0x20]
lea edi, [esp + esi*2 + 0x40]
push eax
call fcn.004017e2
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x403837
movzx eax, word [edi]
push eax
call fcn.004036e7
pop ecx
test eax, eax
jne 0x403837
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [esp + 0x1c], ebx
jb 0x403837
mov eax, dword [esp + 0x18]
ja 0x40382b
cmp eax, dword [esp + 0x28]
jbe 0x403837
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], edi
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40383c
sub eax, edx
sar eax, 1
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.0040112f
cmp esi, dword [esp + 0x24]
jb 0x4037db
push dword [esp + 0x10]
mov edi, dword [esp + 0x18]
call fcn.004017e2
mov ecx, dword [esp + 0x444]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00494bb0
mov esp, ebp
pop ebp
ret
Function at 0x40392d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4d897c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4039bd
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4039b2
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40399b
test dx, dx
je 0x403997
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40399b
add ecx, 4
add eax, 4
test dx, dx
jne 0x403975
xor eax, eax
jmp 0x4039a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4039cc
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40396c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00494bb0
leave
ret
mov eax, dword [ebp - 0x228]
mov dword [edi], eax
xor eax, eax
inc eax
jmp 0x4039bf

Function at 0x40455f
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40456a
sub eax, edx
sar eax, 1
push esi
mov esi, eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0
jne 0x40458c
xor eax, eax
jmp 0x404606
push ebx
push edi
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045bc5f
pop ecx
mov edi, eax
test esi, esi
je 0x4045fa
mov esi, dword [ebp + 8]
mov ebx, edi
sub ebx, esi
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4045c0
cmp eax, 0x2f
jne 0x4045ec
push dword [ebp - 4]
push dword [ebp + 8]
push edi
call fcn.00495d52
add esp, 0xc
xor eax, eax
push edi
mov word [ebx + esi], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4045ec
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404609
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, dword [ebp - 8]
jb 0x4045b3
push edi
call fcn.0045c9e1
xor eax, eax
pop ecx
inc eax
pop edi
pop ebx
pop esi
leave
ret
xor eax, eax
jmp 0x404604

Function at 0x407e79
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040112f
pop esi
mov eax, ebx
pop ebx
pop ebp
ret