joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001efa1
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x50
mov eax, 0x1002dcac
call fcn.1002b09b
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
push esi
call fcn.100229c5
pop ecx
pop ecx
test eax, eax
jne 0x1001f0c5
mov eax, dword [esi + 4]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
xor eax, eax
mov ebx, dword [esi + 4]
mov word [ebp - 0x4c], ax
lea eax, [esi + 0xc]
mov dword [ebp - 0x48], eax
xor eax, eax
push 4
pop ecx
mov word [ebp - 0x3c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push 0
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x54]
push 0x7fffffff
push eax
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x52535048
mov dword [ebp - 0x28], eax
call fcn.100229c5
mov dword [ebp - 0x24], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x20], 0x55524544
cmp byte [0x1003cdfb], 0
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
jne 0x1001f069
cmp byte [0x1003cdfa], 0
je 0x1001f09d
push ebx
push str.__lx__PDFXSendOrSave_kPDFXPushResponse_
mov esi, 0x1003d228
push esi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x1001f08d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1001f09d
push esi
call fcn.10005eb0
pop ecx
xor eax, eax
cmp word [ebp + 0x1c], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.1001ec31
add esp, 0x10
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.100229c5
mov eax, esi
call fcn.1002b045
ret
Function at 0x100223c5
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x440
mov eax, 0x1002dd87
call fcn.1002b109
mov eax, dword [ebp + 8]
mov esi, 0x208
mov dword [ebp - 0x438], eax
xor edi, edi
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x424]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x430], xmm0
push eax
push 0x20019
push edi
push 0x100333cc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100225e4
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
mov ebx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x100224d1
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
fstp qword [ebp - 0x44c]
movsd xmm0, qword [ebp - 0x44c]
comisd xmm0, xmmword [0x100336a8]
pop ecx
jbe 0x100224bd
comisd xmm0, xmmword [ebp - 0x430]
jbe 0x100224bd
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
inc ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x10022469
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x100225e4
push str.ClientUserInterface
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
mov dword [ebp - 0x42c], edi
push 2
pop edx
lea ebx, [eax + 0x105]
mov dword [ebp - 4], edi
add ebx, esi
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100229c5
mov esi, eax
mov dword [ebp - 0x42c], esi
pop ecx
pop ecx
test esi, esi
je 0x100225e4
push ebx
push edi
push esi
call fcn.100229c5
push str.SoftwareMicrosoftSoftGrid_
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.ClientUserInterface
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push edi
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100225dd
push dword [ebp - 0x438]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.10022617
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.10022617
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002b601
pop ecx
call fcn.1002b056
ret
Function at 0x10022617
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002ddaf
call fcn.1002b0d2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002275c
cmp dword [ebp - 0x18], 1
jne 0x1002275c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100229c5
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x1002275c
push dword [ebp - 0x14]
push ebx
push esi
call fcn.100229c5
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022751
cmp dword [ebp - 0x18], 1
jne 0x10022751
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100229c5
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10022751
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.100229c5
lea eax, [ebp - 0x20]
push eax
push 0x100333c8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10022735
push ebx
call fcn.100229c5
pop ecx
test al, al
je 0x10022735
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10022751
push dword [edi]
call fcn.1002b601
and dword [edi], 0
pop ecx
jmp 0x10022751
test esi, esi
je 0x1002275c
push esi
call fcn.1002b601
pop ecx
call fcn.1002b030
ret

Function at 0x10022f02
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10033124
xor esi, esi
call fcn.100229c5
pop ecx
test eax, eax
jne 0x10022f23
push 0x1003313c
call fcn.100229c5
pop ecx
test eax, eax
je 0x10022f26
xor esi, esi
inc esi
cmp byte [0x1003cdfb], 0
jne 0x10022f38
cmp byte [0x1003cdfa], 0
je 0x10022f6e
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d640
push edi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10022f5d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10022f6d
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.100229c5
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.100229c5
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100229c5
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.100229c5
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.100229c5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.100229c5
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.100229c5
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x4018a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x408072
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x804
push esi
push edi
mov dword [esp + 8], 0
mov edx, dword [esp + 0x824]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x828]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x824]
push 0x400
push ecx
push edx
push eax
push 0x40c08c
mov dword [esp + 0x82c], 3
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [esp + 0x81c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 0x820]
mov byte [esp + 0x814], 2
call fcn.00407b42
lea ecx, [esp + 0x824]
mov byte [esp + 0x814], 1
call fcn.00407b42
lea ecx, [esp + 0x828]
mov byte [esp + 0x814], 0
call fcn.00407b42
mov ecx, dword [esp + 0x80c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x810
ret

Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4080c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push str.c:windows_system_sys_syssettings_
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString
push 0
push str.c:windows_system_
mov dword [esp + 0x220], 1
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x401a8b
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
pop edi
jl 0x401a8b
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 4]
call fcn.00407bd2
push str._system_sys_syssettings_
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::operator_1
push esi
mov esi, dword [esp + 0x224]
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x21c], 0
call fcn.00407b42
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x401ad0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4080f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push str.c:windows_system_sys_syscon_
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString
push 0
push str.c:windows_system_
mov dword [esp + 0x220], 1
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x401b6b
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
pop edi
jl 0x401b6b
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 4]
call fcn.00407bd2
push str._system_sys_syscon_
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::operator_1
push esi
mov esi, dword [esp + 0x224]
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x21c], 0
call fcn.00407b42
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret

Function at 0x401bb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40812d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
push 0x40d6a8
lea ecx, [esp + 0xc]
mov dword [esp + 0x224], 1
call sub.MFC42u.DLL_CString::CString
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov byte [esp + 0x220], 2
push eax
push esi
push esi
push 0x1c
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
call fcn.00407bd2
push str.TempLow_
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator_1
mov esi, dword [esp + 0x228]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x220], 1
call fcn.00407b42
lea ecx, [esp + 0x22c]
mov byte [esp + 0x220], 0
call fcn.00407b42
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x4020d0
Capabilities:
Access peb ldr_data
Delete file
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4081f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x24]
push ebx
push esi
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00401da0
add esp, 8
push 0x40d778
push ecx
lea edx, [esp + 0x34]
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov dword [esp + 0x24], ebx
mov word [esp + 0x3a], si
mov word [esp + 0x38], bx
call sub.MFC42u.DLL_CString::CString
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x28], 2
call sub.MFC42u.DLL_CString::CString_3
mov byte [esp + 0x24], bl
call fcn.00401670
mov esi, dword [esp + 0x2c]
add esp, 0xc
mov ecx, esi
push ebx
push ebx
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00407b42
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x402440
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408288
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [edi]
add esp, 4
mov ax, word [ecx + eax*2 - 2]
cmp ax, 0x5c
je 0x402481
push 0x40c088
mov ecx, edi
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [edi]
mov ebx, dword [sym.imp.MSVCRT.dll__waccess]
push 0
push eax
call ebx
add esp, 8
test eax, eax
je 0x40250f
xor esi, esi
inc esi
mov ecx, edi
push esi
push 0x5c
call sub.MFC42u.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
je 0x40250f
lea edx, [esp + 0x1c]
push esi
push edx
mov ecx, edi
call sub.MFC42u.DLL_CString::Left
mov eax, dword [esp + 0x1c]
push 0
push eax
call ebx
add esp, 8
test eax, eax
je 0x4024d7
mov ecx, dword [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4024ea
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00407b42
jmp 0x402497
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00407b42
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x402890
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x854
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x44
rep stosd dword es:[edi], eax
mov al, byte [esp + 0x864]
test al, al
je 0x4028bf
mov dword [esp + 0x40], 1
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x5a]
mov word [esp + 0x58], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x85c]
push 0x3fc
lea ecx, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea edx, [esp + 4]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x402946
mov al, byte [esp + 0x85c]
test al, al
je 0x402930
mov edx, dword [esp]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
pop esi
lea ecx, [esp + 0x858]
call fcn.00407b42
add esp, 0x854
ret

Function at 0x402b20
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40836e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0x220], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 0x228]
mov esi, dword [sym.imp.MSVCRT.dll_wcsstr]
push 0x40c27c
push edx
mov byte [esp + 0x228], 1
call esi
add esp, 8
test eax, eax
jne 0x402bed
mov eax, dword [esp + 0x228]
push str.website
push eax
call esi
add esp, 8
test eax, eax
jne 0x402bed
push str.thcs_
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x220], 2
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x220], 1
call fcn.00407b42
jmp 0x402c18
mov edx, dword [esp + 0x228]
push 0x40c240
push edx
call esi
add esp, 8
test eax, eax
jne 0x402c0a
push str.Low_
jmp 0x402c0f
push 0x40c228
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator_1
lea eax, [esp + 0x228]
lea ecx, [esp + 8]
push eax
call sub.MFC42u.DLL_CString::operator
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 8]
mov byte [esp + 0x220], 0
call fcn.00407b42
lea ecx, [esp + 0x228]
mov dword [esp + 0x220], 0xffffffff
call fcn.00407b42
mov ecx, dword [esp + 0x218]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret