joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410f48
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4110d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040272c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040553c
mov edx, dword [ebp - 0x10]
mov eax, 0x415ae8
call fcn.00403780
cmp byte [0x415b41], 0
jne 0x410fa9
mov eax, dword [0x415ae8]
push eax
mov ecx, 0x4110e8
mov edx, 0x4110f8
mov eax, 0x80000002
call fcn.00406dfc
cmp byte [0x415b41], 0
je 0x410fbc
call fcn.004111a8
jmp 0x4110b9
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0x411138
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410fe2
push 0x3e8
call sub.KERNEL32.DLL_Sleep
jmp 0x410fc1
push 0xea60
call sub.KERNEL32.DLL_Sleep
push 0
push 0x411148
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
push 0x411150
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411021
push 0x41115c
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411097
push 0x411168
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x411097
call dword [ebp - 0xc]
push 0xbb8
call sub.KERNEL32.DLL_Sleep
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.KERNEL32.DLL_Sleep
push 0
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0xc8
call sub.KERNEL32.DLL_Sleep
mov eax, 0x411178
call fcn.00404e44
push 0x3e8
call sub.KERNEL32.DLL_Sleep
mov edx, 0x411180
mov eax, 0x415b54
mov ecx, 0xbb8
call fcn.00406ae4
test al, al
je 0x4110b9
call fcn.004111a8
call fcn.00412ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4110db
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403750
ret
Function at 0x412fc4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4130b0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x415b48], 0
jne 0x412ff6
call fcn.00412f78
push 2
push 0
push 0
mov eax, dword [0x415b48]
push eax
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x413011
call fcn.00412f78
lea edx, [ebp - 0xc]
mov al, byte [0x415b42]
call fcn.004055b8
push dword [ebp - 0xc]
push 0x4130c8
push dword [ebp - 4]
push 0x4130d4
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403964
mov byte [0x415b42], 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
jns 0x413059
call fcn.00402f14
push eax
lea eax, [ebp - 4]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x413071
cmp edx, dword [eax - 4]
jb 0x413076
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [0x415b48]
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x413092
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4130b7
lea eax, [ebp - 0xc]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x10014ea
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1001968
call fcn.01001674
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x100237c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10012a1
cmp eax, esi
jne 0x1001294
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10012a4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100127b
xor esi, esi
inc esi
mov eax, dword [0x1002378]
cmp eax, esi
jne 0x10012b7
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10012e6
mov eax, dword [0x1002378]
test eax, eax
jne 0x10012e0
mov dword [0x1002378], esi
push 0x10010b0
push 0x10010a4
call fcn.010011e0
pop ecx
pop ecx
test eax, eax
je 0x10012e6
jmp 0x100140e
mov dword [0x1002038], esi
mov eax, dword [0x1002378]
cmp eax, esi
jne 0x100130a
push 0x10010a0
push 0x1001098
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1002378], 2
test ebx, ebx
jne 0x1001316
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002380], 0
je 0x100133a
push 0x1002380
call fcn.010015e9
pop ecx
test eax, eax
je 0x100133a
push 0
push 2
push 0
call dword [0x1002380]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1001396
test al, al
je 0x1001354
cmp dword [ebp - 0x1c], 0
jne 0x1001396
mov al, byte [esi]
test al, al
je 0x1001364
cmp al, 0x20
ja 0x1001364
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001354
test byte [ebp - 0x3c], 1
je 0x1001370
movzx eax, word [ebp - 0x38]
jmp 0x1001373
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1002034], eax
cmp dword [0x1002028], 0
jne 0x10013ea
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10013a5
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10013b8
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1001341
cmp dword [0x1002038], 0
jne 0x10013f9
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002034]
jmp 0x100141a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010016b9
ret
call fcn.010017c1
jmp 0x1001241
Function at 0x100010f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0x20019
push eax
xor esi, esi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov edi, eax
test edi, edi
je 0x1000112a
push esi
push esi
push esi
push esi
push str.NoDisplayClass
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
push edi
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
ret

Function at 0x100011e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100011f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001234
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001230
lea ebx, [ebx]
cmp esi, eax
jae 0x10001234
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001220
cmp esi, eax
jb 0x1000123a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x10003800
Capabilities:
Print debug messages

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
lea edx, [eax + 1]
jmp 0x10003810
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10003810
sub eax, edx
je 0x100038d7
push edi
mov ecx, 0xc
mov edi, 0x100647a0
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [esp + 0x14]
cmp edi, 0x8000
je 0x10003848
cmp edi, 0x8004
jne case.0x10003854.4
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 4]
cmp eax, 6
ja case.0x10003854.4
jmp dword [eax*4 + 0x100038dc]
push str.DBT_DEVTYP_DEVICEINTERFACE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x20]
push eax
jmp 0x1000387d
push str.DBT_DEVTYP_DEVNODE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esp + 0x20]
push edx
push edi
push esi
call fcn.10003150
mov ecx, dword [esp + 0x28]
add esp, 0xc
pop edi
mov byte [ecx], al
mov al, 1
pop esi
pop ecx
ret
push str.DBT_DEVTYP_HANDLE
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
pop ecx
ret
push str.DBT_DEVTYP_OEM
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
pop ecx
ret
push str.DBT_DEVTYP_PORT
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
pop ecx
ret
push str.DBT_DEVTYP_VOLUME
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret

Function at 0x10004569
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1002ca30]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x100045a9
push 0x10024c18
push 4
push eax
call fcn.10010d4e
push eax
call fcn.10001130
add esp, 0x10
jmp 0x100045bb
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10004629
push edi
call fcn.10010a0e
mov edi, dword [eax]
call fcn.10010a0e
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.10010dcf
add esp, 0x18
mov ebx, eax
call fcn.10010a0e
cmp dword [eax], 0
je 0x10004609
call fcn.10010a0e
push dword [eax]
call fcn.10003e3c
pop ecx
jmp 0x10004610
call fcn.10010a0e
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x10004629
cmp ebx, esi
jae 0x10004629
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x1000462b
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f47d
leave
ret
Function at 0x10018f31
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1002d638]
je 0x10018f4c
inc edi
cmp edi, 0x17
jb 0x10018f3d
cmp edi, 0x17
jae 0x100190cc
push ebp
push 3
call fcn.1001eaa6
cmp eax, 1
pop ecx
je 0x10019098
push 3
call fcn.1001eaa6
test eax, eax
pop ecx
jne 0x10018f80
cmp dword [0x1006666c], 1
je 0x10019098
cmp ebx, 0xfc
je 0x100190cb
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10066bb0
push ebp
call fcn.10010d4e
add esp, 0xc
test eax, eax
je 0x10018fb6
push esi
push esi
push esi
push esi
push esi
call fcn.10012d89
add esp, 0x14
push 0x104
mov esi, 0x10066bc9
push esi
push 0
mov byte [0x10066ccd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10018ffa
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10010d4e
add esp, 0xc
test eax, eax
je 0x10018ffa
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10012d89
add esp, 0x14
push esi
call fcn.100108f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001903f
push esi
call fcn.100108f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10066ec4
push 0x10026514
sub ecx, eax
push ecx
push eax
call fcn.10012bd2
add esp, 0x14
test eax, eax
je 0x1001903f
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10012d89
add esp, 0x14
jmp 0x10019041
xor esi, esi
push 0x10026510
push ebx
push ebp
call fcn.10010e75
add esp, 0xc
test eax, eax
je 0x10019061
push esi
push esi
push esi
push esi
push esi
call fcn.10012d89
add esp, 0x14
push dword [edi*8 + 0x1002d63c]
push ebx
push ebp
call fcn.10010e75
add esp, 0xc
test eax, eax
je 0x10019083
push esi
push esi
push esi
push esi
push esi
call fcn.10012d89
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1001e8e9
add esp, 0xc
jmp 0x100190cb
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100190cb
cmp ebp, 0xffffffff
je 0x100190cb
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1002d63c]
push dword [esi]
call fcn.100108f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1001cacf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7d6], 0x9c
mov byte [ebp - 0x7d5], 0x9c
mov byte [ebp - 0x7d4], 0x81
mov byte [ebp - 0x7d3], 0x9c
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.1001abd3
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
invalid
Function at 0x1001e8e9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10013946
xor ebx, ebx
cmp dword [0x10067108], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1001e9bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001ea9f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100276b8
push edi
call esi
cmp eax, ebx
je 0x1001ea9f
push eax
call fcn.100138d8
mov dword [esp], 0x100276a8
push edi
mov dword [0x10067108], eax
call esi
push eax
call fcn.100138d8
mov dword [esp], 0x10027694
push edi
mov dword [0x1006710c], eax
call esi
push eax
call fcn.100138d8
mov dword [0x10067110], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10010afb
test eax, eax
pop ecx
pop ecx
je 0x1001e98d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012d89
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1001e9bf
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100138d8
cmp eax, ebx
pop ecx
mov dword [0x10067118], eax
je 0x1001e9bf
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100138d8
pop ecx
mov dword [0x10067114], eax
mov eax, dword [0x10067114]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001ea44
cmp dword [0x10067118], ecx
je 0x1001ea44
push eax
call fcn.1001394f
push dword [0x10067118]
mov esi, eax
call fcn.1001394f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001ea44
cmp edi, ebx
je 0x1001ea44
call esi
cmp eax, ebx
je 0x1001ea11
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001ea11
test byte [ebp - 0x18], 1
jne 0x1001ea44
lea eax, [ebp - 0x10]
push eax
call fcn.10010b32
test eax, eax
pop ecx
je 0x1001ea2c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012d89
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1001ea3b
or dword [ebp + 0x10], 0x200000
jmp 0x1001ea7f
or dword [ebp + 0x10], 0x40000
jmp 0x1001ea7f
mov eax, dword [0x1006710c]
cmp eax, dword [ebp - 8]
je 0x1001ea7f
push eax
call fcn.1001394f
cmp eax, ebx
pop ecx
je 0x1001ea7f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1001ea7f
mov eax, dword [0x10067110]
cmp eax, dword [ebp - 8]
je 0x1001ea7f
push eax
call fcn.1001394f
cmp eax, ebx
pop ecx
je 0x1001ea7f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10067108]
call fcn.1001394f
cmp eax, ebx
pop ecx
je 0x1001ea9f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001eaa1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10021d4c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1002ca30]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.10021ce1
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000e870
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10021d9b
cmp dword [ebp - 0x1c], 5
jb 0x10021db3
jmp 0x10021daf
cmp dword [ebp - 0x10], 1
jne 0x10021db3
cmp dword [ebp - 0x1c], 4
ja 0x10021daf
jne 0x10021db3
cmp dword [ebp - 0x18], 0
jbe 0x10021db3
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10027728
call fcn.10021bb5
test eax, eax
jge 0x10021dd4
mov byte [0x1006487c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000f47d
add ebp, 0x78
leave
ret
Function at 0x409430
Capabilities:
Get file version info

Disassembly:
mov eax, 0x418e20
call fcn.0040e6c0
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
mov dword [esi], edi
mov dword [ebp - 0x10], edi
jne 0x409458
mov eax, 0x401108
lea ecx, [ebp - 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, edi
je 0x409517
push ebx
call fcn.0040ea15
cmp eax, edi
pop ecx
mov dword [esi], eax
jne 0x4094a1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0x404a38
call fcn.0040ea3f
lea eax, [ebp - 0x24]
push 0x402b50
push eax
mov dword [ebp - 0x24], 0x4013f8
call fcn.0040eb1a
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
jne 0x4094ad
mov ecx, 0x401108
push eax
push ebx
push edi
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4094db
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0x404a14
call fcn.0040ea3f
lea eax, [ebp - 0x24]
push 0x402b40
push eax
call fcn.0040eb1a
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
lea eax, [esi + 4]
push eax
push 0x4049f8
push dword [esi]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x409517
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0x4049cc
call fcn.0040ea3f
lea eax, [ebp - 0x24]
push 0x402b40
push eax
call fcn.0040eb1a
push 1
lea ecx, [ebp + 8]
call fcn.00408e76
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x40b5e4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0x40117c
xor edi, edi
push 1
push edi
push 0x40118c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x40b6bb
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x14], edi
je 0x40b62f
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
cmp dword [ebp + 0x18], edi
je 0x40b643
push dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], edi
je 0x40b654
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x10], edi
je 0x40b665
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
lea edx, [ebp + 8]
push edx
push 0x40119c
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x40b6b2
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x20c]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x10042c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, dword [ebp + 0x14]
mov edi, eax
cmp edi, esi
je 0x1004329
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp + 0x10], eax
jbe 0x1004329
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x1004329
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
je 0x1004329
push ebx
push 0x15
push 0x400
push esi
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.010119d2
cmp eax, esi
jge 0x1004329
mov dword [ebx], esi
jmp 0x1004339
mov eax, dword [ebx]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1007126
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1014028]
jne 0x1007137
test ecx, 0xffff0000
jne 0x1007137
ret
jmp fcn.01007141
Function at 0x1007457
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1012958
call fcn.01007694
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x1015cfc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10072ea
cmp eax, esi
jne 0x10072dd
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x10072ed
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10072c4
xor esi, esi
inc esi
mov eax, dword [0x1015cf8]
cmp eax, esi
jne 0x1007300
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100732f
mov eax, dword [0x1015cf8]
test eax, eax
jne 0x1007329
mov dword [0x1015cf8], esi
push 0x1001214
push 0x1001208
call fcn.01007226
pop ecx
pop ecx
test eax, eax
je 0x100732f
jmp 0x1007440
mov dword [0x1015818], esi
mov eax, dword [0x1015cf8]
cmp eax, esi
jne 0x1007353
push 0x1001204
push 0x10011fc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1015cf8], 2
cmp dword [ebp - 0x24], ebx
jne 0x1007360
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [0x1015d00]
cmp eax, ebx
je 0x100736f
push ebx
push 2
push ebx
call eax
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10073c8
cmp al, bl
je 0x1007388
cmp dword [ebp - 0x1c], ebx
jne 0x10073c8
mov al, byte [esi]
cmp al, bl
je 0x1007398
cmp al, 0x20
ja 0x1007398
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1007388
test byte [ebp - 0x40], 1
je 0x10073a4
movzx eax, word [ebp - 0x3c]
jmp 0x10073a7
push 0xa
pop eax
push eax
push esi
push ebx
push 0x1000000
call main
mov dword [0x1015814], eax
cmp dword [0x1015808], ebx
jne 0x100741d
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10073d7
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10073ea
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1007376
cmp dword [0x1015818], ebx
jne 0x100742b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1015814]
jmp 0x100744c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010076d9
ret
call fcn.010070b3
jmp 0x1007287

Function at 0x1007c00
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1007c13
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1007c0f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret