joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a6e7c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x6bfd38]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6a6ebc
cmp byte [ebx], 0xa
jne 0x6a6ebc
or byte [edi + eax + 0x28], 4
jmp 0x6a6ec1
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x6a6fc0
mov dl, byte [eax]
cmp dl, 0x1a
je 0x6a6fa3
inc eax
cmp dl, 0xd
je 0x6a6eed
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x6a6f13
cmp eax, ecx
jae 0x6a6f21
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x6a6ed5
jmp 0x6a6fc0
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x6a6f9e
cmp dword [ebp - 0x10], 0
je 0x6a6f9e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x6bfd38]
test byte [eax + edi + 0x28], 0x48
je 0x6a6f78
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x6a6f63
mov byte [esi], dl
jmp 0x6a6f74
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x6bfd38]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x6a6fc0
cmp byte [ebp - 1], 0xa
jne 0x6a6f87
cmp esi, ebx
jne 0x6a6f87
mov byte [esi], 0xa
jmp 0x6a6fbf
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.006a45e4
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x6a6fc0
mov byte [esi], 0xd
jmp 0x6a6fbf
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x6bfd38]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x6a6fbd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x6a6fc0
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x6a6fc9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x6bfd38]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6a700f
cmp word [ebx], dx
jne 0x6a700f
or byte [eax + edi + 0x28], 4
jmp 0x6a7014
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x6a7177
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x6a7157
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x6a7055
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x6a708b
cmp eax, edx
jae 0x6a7099
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x6a7030
jmp 0x6a7177
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x6a7152
cmp dword [ebp - 0x18], 0
je 0x6a7152
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x6bfd38]
test byte [eax + edi + 0x28], 0x48
je 0x6a7128
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x6a70ec
mov word [esi], cx
jmp 0x6a7123
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x6bfd38]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x6bfd38]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x6bfd38]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x6a7177
pop eax
cmp word [ebp - 4], ax
jne 0x6a7138
cmp esi, ebx
jne 0x6a7138
mov word [esi], ax
jmp 0x6a7174
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.006a45e4
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x6a7177
push 0xd
pop eax
jmp 0x6a7133
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x6bfd38]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x6a7171
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x6a7177
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x6aba58
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.006abbef
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x6abbc7
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x6abbc7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x6abb7c
jg 0x6abab4
test eax, eax
je 0x6abb72
push 1
push 0x1000
call fcn.0069fd94
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x6abad7
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x6abb69
push 0x8000
push ebx
call fcn.0069a30b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x6abb00
jg 0x6abafb
cmp ecx, 0x1000
jb 0x6abb00
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.006a5576
add esp, 0x10
cmp eax, 0xffffffff
je 0x6abb45
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x6abafb
jl 0x6abb2c
test ecx, ecx
jne 0x6abaed
push dword [ebp - 0xc]
push ebx
call fcn.0069a30b
push esi
call fcn.0069ea4f
add esp, 0xc
xor ebx, ebx
jmp 0x6abbd5
cmp byte [edi + 0x24], 0
je 0x6abb5c
cmp dword [edi + 0x20], 5
jne 0x6abb5c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x6abb67
mov ebx, dword [edi + 0x18]
jmp 0x6abb69
xor ebx, ebx
push esi
call fcn.0069ea4f
pop ecx
jmp 0x6abbd5
test ecx, ecx
jg 0x6abb3e
jl 0x6abb7c
test eax, eax
jae 0x6abb3e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.006a45e4
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x6abb9c
cmp byte [edi + 0x1c], 0
je 0x6abb3e
jmp 0x6abbcd
push ebx
call fcn.006a4c69
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x6abb3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x6abbd5
cmp byte [edi + 0x1c], 0
je 0x6abbd2
mov ebx, dword [edi + 0x18]
jmp 0x6abbd5
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.006a45e4
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x422ad0
push 0x84
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.004021ed
push str.net451
lea ecx, [ebp - 8]
call fcn.00401dda
test eax, eax
jne 0x40109b
inc esi
jmp 0x4010ee
push str.net452
lea ecx, [ebp - 8]
call fcn.00401dda
test eax, eax
jne 0x4010b0
push 2
jmp 0x4010ed
push 0x422afc
lea ecx, [ebp - 8]
call fcn.00401dda
test eax, eax
jne 0x4010c5
push 3
jmp 0x4010ed
push str.net461
lea ecx, [ebp - 8]
call fcn.00401dda
test eax, eax
jne 0x4010da
push 4
jmp 0x4010ed
push str.net462
lea ecx, [ebp - 8]
call fcn.00401dda
test eax, eax
jne 0x4010ee
push 5
pop esi
lea ecx, [ebp - 8]
call fcn.00401e11
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00409765
mov esp, ebp
pop ebp
ret
Function at 0x401822
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push 0x422fd8
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40184e
xor al, al
jmp 0x4018b8
push esi
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push 0x20
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4018a4
mov eax, dword [ebp - 0xc]
push esi
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4018a8
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4018b7
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409765
mov esp, ebp
pop ebp
ret

Function at 0x401b59
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x401b6b
push 0xd
pop eax
jmp 0x401b9c
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x401b74
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x402301
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402310
mov al, 1
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40231e
xor al, al
ret
cmp eax, 3
setne al
ret
Function at 0x402325
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0x820
mov eax, 0x41c847
call fcn.0041b933
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
mov dword [ebp - 0x828], ebx
push eax
lea ecx, [ebp - 0x828]
call fcn.004021ed
mov dword [ebp - 4], ebx
push 0x5c
push dword [ebp - 0x828]
mov dword [ebp - 0x824], ebx
call fcn.0040b9b1
pop ecx
pop ecx
test eax, eax
jne 0x402389
or eax, 0xffffffff
jmp 0x402391
sub eax, dword [ebp - 0x828]
sar eax, 1
lea ecx, [ebp - 0x420]
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x824]
call fcn.004021ed
push ecx
push ecx
lea ecx, [ebp - 0x824]
mov byte [ebp - 4], 1
call fcn.0040258c
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [ebp - 0x218]
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x4023d2
mov ebx, dword [ebp - 0x824]
xor ecx, ecx
mov eax, dword [0x4247ec]
mov edx, ebx
mov dword [edi], eax
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x4023f1
lea edi, [ebp - 0x218]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x402407
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
call fcn.00402301
test al, al
jne 0x40251b
lea eax, [ebp - 0x218]
mov dword [ebp - 0x82c], 0x200
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edi, [ebp - 0x218]
sub edi, 2
xor edx, edx
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, dx
jne 0x402471
mov eax, dword [0x4247ec]
mov esi, ebx
mov dword [edi], eax
mov cx, word [ebx]
add ebx, 2
cmp cx, dx
jne 0x402486
lea edi, [ebp - 0x218]
sub ebx, esi
sub edi, 2
mov cx, word [edi + 2]
add edi, 2
cmp cx, dx
jne 0x40249c
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x218]
sub edi, 2
mov cx, word [edi + 2]
lea edi, [edi + 2]
cmp cx, dx
jne 0x4024bf
lea edx, [ebp - 0x820]
mov dword [edi], eax
mov esi, edx
xor ecx, ecx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x4024d7
lea edi, [ebp - 0x218]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x4024ed
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
call fcn.00402301
test al, al
jne 0x40251b
xor ebx, ebx
inc ebx
jmp 0x40251d
xor bl, bl
lea ecx, [ebp - 0x824]
call fcn.00401e11
lea ecx, [ebp - 0x828]
call fcn.00401e11
mov al, bl
call fcn.0041b8dd
ret
Function at 0x4041d9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4041e4
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4042a0
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
sub edi, 1
jne 0x4041f9
pop edi
test esi, esi
je 0x4042bc
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
inc edx
sub esi, 1
jne 0x4042a4
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4042c3
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x423068]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x423068]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x404948
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x40498d
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404988
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x4049b4
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x40499d
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.0041beb0
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00409765
mov esp, ebp
pop ebp
ret
Function at 0x405543
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jne 0x4055e6
cmp dword [esi + 4], 0xffffffff
jne 0x4055e6
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x405576
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x4055aa
cmp eax, 0x2f
je 0x4055aa
push 0x4247ec
push 0x104
push edi
call fcn.0040d1d1
add esp, 0xc
push 0x20
call fcn.00409a06
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x18], ecx
mov ecx, eax
mov word [eax], 0x100
mov byte [eax + 0x10], bl
mov dword [eax + 0x1c], ebx
mov dword [eax + 0xc], ebx
call fcn.00404c12
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
pop edi
cmove ecx, edx
mov eax, ecx
jmp 0x4055eb
mov eax, 0x1000000
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x405bdc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x405c0e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405c0e
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x405cc7
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x405c2b
cmp ax, 0x5c
jne 0x405c2d
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x405c1f
cmp esi, ebx
je 0x405c71
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0041beb0
add esp, 0xc
cmp esi, 0x208
jae 0x405cd7
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.00405bdc
xor eax, eax
mov esi, 0x104
mov word [ebp - 0x20c], ax
test edi, edi
je 0x405c94
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040d16d
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040d1d1
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
cmp eax, 0xffffffff
jne 0x405cc7
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00409765
mov esp, ebp
pop ebp
ret
call fcn.004098ca
int3
Function at 0x406104
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x64
xor ebx, ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
mov esi, edx
mov edi, ecx
call fcn.0040c260
pop ecx
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.00401be2
xor ecx, ecx
mov dword [ebp - 0x10], str.Open_Setup_Log
inc ecx
mov dword [ebp - 8], str.Close
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x50], ecx
push 2
pop edx
mov dword [ebp - 0xc], edx
test esi, esi
jne 0x40615c
lea eax, [ebp - 0xc]
mov dword [ebp - 0x58], ecx
jmp 0x406162
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], edx
and dword [ebp - 0x70], 0xfffffffd
mov dword [ebp - 0x54], eax
mov eax, dword [edi]
push ecx
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x60], str.Installation_has_failed
mov dword [ebp - 0x64], 0xfffe
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00401992
test eax, eax
js 0x4061ac
cmp dword [ebp - 0x18], 1
jne 0x4061ac
test esi, esi
je 0x4061ac
push 5
push ebx
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409765
mov esp, ebp
pop ebp
ret
Function at 0x408ffe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x41cba2
call fcn.0041b9a1
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], esi
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
call fcn.0040c260
add esp, 0xc
mov dword [ebp - 0x424], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], edi
test edi, edi
jne 0x409087
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], eax
test edi, edi
jne 0x409087
call fcn.00401bcb
mov esi, eax
jmp 0x40918a
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4090aa
call fcn.00401bcb
jmp 0x40917d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x4090a0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x4090dd
mov esi, 0x8007000e
jmp 0x40917f
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x409111
cmp eax, 0xffffffff
ja 0x409111
cmp eax, 0x400
jbe 0x409103
push eax
lea ecx, [ebp - 0x424]
call fcn.00407961
jmp 0x40912f
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x40912f
push 0x80070216
call fcn.0040211b
mov eax, 0x409121
ret
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
je 0x4090d3
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4090a0
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.00408ea7
mov esi, eax
test edi, edi
je 0x40918a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x4091a3
lea ecx, [ebp - 0x424]
call fcn.0040794c
mov eax, esi
call fcn.0041b8ee
ret 0x10

Function at 0x40c6fc
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x41d570
push str.FlsAlloc
push 0
call fcn.0040c67c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c72e
push dword [ebp + 8]
mov ecx, esi
call fcn.0040a150
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x40c770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x41d594
push str.FlsGetValue
push 2
call fcn.0040c67c
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x40c7a1
mov ecx, esi
call fcn.0040a150
call esi
jmp 0x40c7a7
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret
Function at 0x40c7aa
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x41d5a8
push str.FlsSetValue
push 3
call fcn.0040c67c
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x40c7de
mov ecx, esi
call fcn.0040a150
call esi
jmp 0x40c7e4
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x415021
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414ccf