joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4611e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x485781
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x46121d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.0047da4d
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.0047cd95
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.0045a120
lea ecx, [esp + 8]
call fcn.0047dcbc
lea ecx, [esp + 0x30]
call fcn.0047cef9
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.0047cd95
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.0045a590
lea ecx, [esp + 0x74]
call fcn.0047cef9
lea ecx, [esp + 8]
call fcn.0047dcbd
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.00457dc0
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.0045a0c0
mov ecx, esi
call fcn.0045acb0
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.0045a0c0
mov ecx, esi
call fcn.0045acb0
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.0045a0c0
mov ecx, esi
call fcn.0045acb0
mov ecx, dword [edi + 0x5c]
call fcn.004575a0
push eax
mov ecx, esi
call fcn.004575b0
mov ecx, dword [edi + 0x5c]
call fcn.00457b60
push eax
mov ecx, esi
call fcn.00457b00
mov ecx, dword [edi + 0x5c]
call fcn.00457c80
push eax
mov ecx, esi
call fcn.00457c30
mov ecx, dword [edi + 0x5c]
push 0
call fcn.00456e80
push eax
mov ecx, esi
call fcn.00456e90
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.0047ce71
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.0047ce71
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0047dad6
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x462a70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4859a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.00473ef5
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.00473ef5
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.00463590
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x4635e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x485a80
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0047fa40
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x463613
xor al, al
jmp 0x46373f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x463635
xor al, al
jmp 0x46373f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x463648
xor al, al
jmp 0x46373f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x46365c
xor al, al
jmp 0x46373f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.00473fa5
test eax, eax
jne 0x463690
xor al, al
jmp 0x46373f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x57d9bc
mov dword [esp + 0x20], ebp
call fcn.0047fa40
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.0047ca4a
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.0047caa1
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x463724
mov ax, word [ebx]
test ax, ax
je 0x463716
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00463760
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4636fa
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0047caa1
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x463ca0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.0047e0fa
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x463ce6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004656b8
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x595ddc
push ecx
call fcn.00466d2e
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x478010
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x478048
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004760b5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047608d
jmp 0x478054
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47980e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x479850
call fcn.0047fa40
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x479850
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x479847
xor eax, eax
jmp 0x479858
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047985e
pop edi
pop esi
pop ebx
ret 4

Function at 0x47ff70
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ff9e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ffbc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047fed6
jmp 0x47ffbc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ffbc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047fed6
test edi, edi
mov eax, edi
jne 0x47ffa6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x745091
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf3e73904
sti
xor ebx, ebp
fistp dword [ebx]
test al, 0x58
cmpsb byte [esi], byte es:[edi]
ror byte ss:[ebp + 0xf0c2464], cl
lea esp, [esp + 0xc]
jne 0xa970ab
movzx ax, bl
lea esp, [esp + 0xc]
jne 0xa970ab
movzx ax, bl
mov byte [edi - 1], 0
pushfd
lahf
pop eax
cwde
push ebx
pushfd
push 0x9f08c4b6
call fcn.0074592e
mov ah, 0x64
cli
loop 0x745087
in al, dx
mov ah, 0x84
je 0x74505e
inc esp
inc eax
insd dword es:[edi], dx
aam 0x54
cmp al, 0x3c
les esi, [esp + eax*4]
and al, 0x50
mov al, byte [0xe8183cac]
invalid

Function at 0xa97a75
Capabilities:
Encode data using xor

Disassembly:
pushfd
rol al, 5
setle bl
call fcn.0074497a
push eax
invalid

Function at 0xaa23e6
Capabilities:
Encode data using xor

Disassembly:
btr bx, di
sal bl, 1
mov bx, word [esi]
stc
stc
and ebx, 0xfff
pushal
pushfd
cmp al, ch
cmc
add dword [ebx + edi], edx
sub esp, 0xffffffdc
mov byte [esp], cl
lea esp, [esp + 0x28]
je 0xa78a38
pushfd
pushfd
mov byte [esp + 4], 0x78
lea esp, [esp + 8]
jmp 0xa78a54
Function at 0x4011b4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x28
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401221
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x401221
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401221
push 0x40000
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp dword [ebp - 4], esi
pop esi
je 0x401230
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret

Function at 0x40194b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 8], esi
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x18], esi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
xor edi, edi
inc edi
push 0x4237c4
lea ecx, [ebp - 4]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], edi
call fcn.00402cf4
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.00401938
mov eax, dword [ebp + 0x14]
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0xa
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov ebx, dword [ebp + 0x18]
je 0x4019e9
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp ebx, esi
mov dword [ebp - 8], edi
je 0x4019e9
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
cmp dword [ebp - 0x18], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401a00
cmp ebx, esi
jne 0x401a00
push dword [ebp - 0x18]
call edi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x14], esi
je 0x401a0d
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401234
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c2f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00401b3a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401c64
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401234
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x401c4f
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x401c4f
lea eax, [ebp - 4]
push eax
call fcn.00401a40
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], 0
pop ecx
jne 0x401c9d
xor esi, esi
jmp 0x401c52
push eax
call fcn.00401c2f
test eax, eax
pop ecx
je 0x401c99
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x401c4f
call edi
cmp eax, ebx
jne 0x401c99
jmp 0x401c4f

Function at 0x401cbb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4234f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
push 0x23
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esi + 0x14], edi
je 0x401d56
mov eax, dword [esi + 0x14]
push ebx
lea ebx, [eax - 1]
cmp eax, ebx
ja 0x401d0b
call dword [sym.imp.MSVCP80.dll_public:_static_void___cdecl_std::_String_base::_Xran_void_]
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x401d18
mov eax, dword [edi]
jmp 0x401d1a
mov eax, edi
movzx eax, word [eax + ebx*2]
cmp ax, 0x5c
pop ebx
je 0x401d38
cmp ax, 0x2f
je 0x401d38
push 0x41d664
mov ecx, esi
call dword [0x41d254]
push str.kingsoftkis_
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
cmp dword [esi + 0x18], 8
jb 0x401d4d
mov edi, dword [edi]
push edi
call fcn.00401c2f
pop ecx
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041c236
leave
ret
Function at 0x401d66
Capabilities:
Delete directory

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x4234f4]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
mov eax, dword [ebp + 0x1fc]
and dword [ebp - 0x68], 0
push esi
push edi
push eax
lea ecx, [ebp - 0x64]
call fcn.00401b3a
push 0x41d6bc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0040186d
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x60]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401234
cmp edi, 0xffffffff
jne 0x401dd6
mov dword [ebp - 0x68], 1
jmp 0x401ef4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test byte [ebp - 0x60], 0x10
lea eax, [ebp - 0x34]
je 0x401e58
push 0x41d6b8
push eax
call ebx
test eax, eax
je 0x401ed5
push 0x41d6b0
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
je 0x401ed5
push 0x41d664
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0040186d
add esp, 0xc
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040186d
push dword [eax]
call fcn.00401d66
mov ecx, dword [ebp - 0x80]
add esp, 0x10
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401234
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.00401234
test esi, esi
je 0x401eef
jmp 0x401ed5
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040186d
add esp, 0xc
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.00401234
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040186d
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401234
test esi, esi
jne 0x401ed5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0040186d
add esp, 0xc
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.00401234
lea eax, [ebp - 0x60]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401ddd
mov dword [ebp - 0x68], 1
test edi, edi
pop ebx
je 0x401efb
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi - 0x10]
call fcn.00401234
mov ecx, dword [ebp + 0x1f0]
mov eax, dword [ebp - 0x68]
pop edi
xor ecx, ebp
pop esi
call fcn.0041c236
add ebp, 0x1f4
leave
ret
Function at 0x403c08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push edi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x403c7e
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x403c4f
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x403c4f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x403c53
xor eax, eax
jmp 0x403c7d
mov ecx, dword [ebp + 0x10]
push esi
push eax
lea eax, [esi + 1]
push eax
call fcn.00403234
push eax
call sub.MSVCR80.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push esi
call fcn.00402c99
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop esi
pop edi
pop ebp
ret

Function at 0x403fa8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
mov dword [ebp - 8], edi
je 0x40407a
push 0x4237c4
lea ecx, [ebp - 4]
call fcn.00402cf4
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 8]
push dword [esi]
push str._s_d._s
push eax
call fcn.00401938
add esp, 0x14
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40406f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x404068
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0xa]
push eax
mov dword [ebp + 0x10], edi
call fcn.00403234
push edi
lea ecx, [ebp + 0x10]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x40405f
cmp dword [ebp + 0x10], esi
jne 0x40405f
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00402c99
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401234
xor eax, eax
inc eax
jmp 0x40407d
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00402579
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401234
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x406ed8
Capabilities:
Hide graphical window

Disassembly:
push esi
push dword [ecx + 0x10]
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x406eff
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x406eff
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x40acce
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x278]
cmp dword [edi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x40acfc
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov eax, dword [esi + 0x26c]
cmp eax, ebx
je 0x40adc8
push eax
call fcn.00404dd2
mov edi, eax
cmp edi, ebx
pop ecx
je 0x40ad7d
push 2
push ebx
push edi
mov ecx, esi
call fcn.0040a859
mov eax, dword [esi + 0x26c]
cmp eax, dword [esi + 0x268]
jne 0x40ad7d
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.00402bb7
mov eax, dword [edi + 0x40]
cmp eax, ebx
je 0x40ad6c
cmp word [eax], bx
je 0x40ad6c
push 1
push ebx
push ebx
push eax
push 0x41e1ac
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40ad7d
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x40ad7d
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
mov dword [esi + 0x26c], ebx
je 0x40adc8
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0xc