joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66ccd07e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6753f018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6753f018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x66ccd0ca
jmp 0x66ccd0f6
jmp 0x66ccd122
jmp 0x66ccd14e
jmp 0x66ccd17a
jmp 0x66ccd1a6
jmp 0x66ccd1d2
jmp 0x66ccd1fe
jmp 0x66ccd22a
jmp 0x66ccd256
jmp 0x66ccd282
jmp 0x66ccd2ae
jmp 0x66ccd2da
jmp 0x66ccd306
jmp 0x66ccd332
jmp 0x66ccd35e
mov dword [ebp - 0x14], 0
jmp 0x66ccd391
jmp 0x66ccd3bd
jmp 0x66ccd3e9
jmp 0x66ccd415
jmp 0x66ccd441
jmp 0x66ccd46d
jmp 0x66ccd499
jmp 0x66ccd4c5
jmp 0x66ccd4f1
jmp 0x66ccd51d
jmp 0x66ccd549
jmp 0x66ccd575
jmp 0x66ccd5a1
jmp 0x66ccd5cd
jmp 0x66ccd5f9
jmp 0x66ccd625
mov dword [ebp - 0x18], 0
jmp 0x66ccd658
jmp 0x66ccd684
jmp 0x66ccd6b0
jmp 0x66ccd6dc
jmp 0x66ccd708
jmp 0x66ccd734
jmp 0x66ccd760
jmp 0x66ccd78c
jmp 0x66ccd7b8
jmp 0x66ccd7e4
jmp 0x66ccd810
jmp 0x66ccd83c
jmp 0x66ccd868
jmp 0x66ccd894
jmp 0x66ccd8c0
jmp 0x66ccd8ec
mov dword [ebp - 0x10], 0
jmp 0x66ccd91f
jmp 0x66ccd94b
jmp 0x66ccd977
jmp 0x66ccd9a3
jmp 0x66ccd9cf
jmp 0x66ccd9fb
jmp 0x66ccda27
jmp 0x66ccda53
jmp 0x66ccda7f
jmp 0x66ccdaab
jmp 0x66ccdad7
jmp 0x66ccdb03
jmp 0x66ccdb2f
jmp 0x66ccdb5b
jmp 0x66ccdb87
jmp 0x66ccdbb3
mov dword [ebp - 0x10], 0
jmp 0x66cce9c7
jmp 0x66ccdbeb
jmp 0x66ccdc17
jmp 0x66ccdc43
jmp 0x66ccdc6f
jmp 0x66ccdc9b
jmp 0x66ccdcc7
jmp 0x66ccdcf3
jmp 0x66ccdd1f
jmp 0x66ccdd4b
jmp 0x66ccdd77
jmp 0x66ccdda3
jmp 0x66ccddcf
jmp 0x66ccddfb
jmp 0x66ccde27
jmp 0x66ccde53
jmp 0x66ccde7f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6753f014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x66ccdebc
jmp 0x66ccdee8
jmp 0x66ccdf14
jmp 0x66ccdf40
jmp 0x66ccdf6c
jmp 0x66ccdf98
jmp 0x66ccdfc4
jmp 0x66ccdff0
jmp 0x66cce01c
jmp 0x66cce048
jmp 0x66cce074
jmp 0x66cce0a0
jmp 0x66cce0cc
jmp 0x66cce0f8
jmp 0x66cce124
jmp 0x66cce150
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6753f01c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x66cce18d
jmp 0x66cce1b9
jmp 0x66cce1e5
jmp 0x66cce211
jmp 0x66cce23d
jmp 0x66cce269
jmp 0x66cce295
jmp 0x66cce2c1
jmp 0x66cce2ed
jmp 0x66cce319
jmp 0x66cce345
jmp 0x66cce371
jmp 0x66cce39d
jmp 0x66cce3c9
jmp 0x66cce3f5
jmp 0x66cce421
mov eax, dword [0x6753f008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x66cce46b
jmp 0x66cce497
jmp 0x66cce4c3
jmp 0x66cce4ef
jmp 0x66cce51b
jmp 0x66cce547
jmp 0x66cce573
jmp 0x66cce59f
jmp 0x66cce5cb
jmp 0x66cce5f7
jmp 0x66cce623
jmp 0x66cce64f
jmp 0x66cce67b
jmp 0x66cce6a7
jmp fcn.66cce6d3
mov eax, dword [0x6753f018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x66ccdbbf
nop
leave
ret
Function at 0x4020f0
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x402155
cmp dword [edi], 0
mov esi, dword [esi]
je 0x402135
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40214b
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40214b
push 0
push dword [edi]
push 0
push 0
push dword [esp + 0x1c]
push esi
call eax
pop edi
pop esi
ret 4
cmp dword [edi + 4], 0
je 0x40214b
push dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
cmp byte [0x556d0c], 0
jne 0x402195
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402187
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x556d10], eax
mov byte [0x556d0c], 1
jmp 0x40219a
mov eax, dword [0x556d10]
mov byte [0x556d0c], 1
jmp 0x40219a
mov eax, dword [0x556d10]
test eax, eax
je 0x4021b0
push 0
push dword [esi + 4]
push dword [esp + 0x14]
push dword [esi]
call eax
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
Function at 0x402a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x5022e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x55209c]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x410]
mov eax, dword [ebp + 0x414]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x402b38
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x402b38
call fcn.00401d80
mov edi, eax
jmp 0x402c40
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x402b55
call fcn.00401d80
jmp 0x402c33
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x402b70
call fcn.00401d80
jmp 0x402c33
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x402b8e
mov edi, 0x8007000e
jmp 0x402c35
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test edx, edx
ja 0x402c82
jb 0x402bb2
cmp eax, 0xffffffff
ja 0x402c82
cmp eax, 0x400
jbe 0x402bcb
push eax
lea ecx, [ebp]
call fcn.00406c20
mov dword [ebp - 4], 1
jmp 0x402bf0
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x402bf0
mov eax, dword [ebp]
test eax, eax
jne 0x402bfe
mov edi, 0x8007000e
jmp 0x402c35
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x402c19
call fcn.00401d80
jmp 0x402c33
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.00403880
mov edi, eax
test esi, esi
je 0x402c40
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x402c54
lea ecx, [ebp]
call fcn.00406c10
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.004c1f5d
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
push 0x80070216
call fcn.00401c00
int3
Function at 0x407350
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x55209c]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004da4e0
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4073ba
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x4073a3
cmp eax, 4
jne 0x4073ba
cmp dword [esp + 8], 0x5a
jb 0x4073ba
xor al, al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c1f5d
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
mov al, 1
xor ecx, esp
call fcn.004c1f5d
add esp, 0x118
ret

Function at 0x407600
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x55209c]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov edi, dword [esp + 0x128]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.004da4e0
push 0x110
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x114
push 0
push eax
call fcn.004da4e0
add esp, 0x18
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x407660
cmp dword [esp + 0xc], 6
mov eax, 0x30
jae 0x407665
mov eax, 0x2c
push edi
mov dword [esi], eax
mov dword [esi + 4], 0
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0xc], edi
mov ecx, dword [0x555a80]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x134]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x11c]
pop edi
mov dword [esi + 0x28], 0
pop esi
xor ecx, esp
call fcn.004c1f5d
add esp, 0x118
ret 0x18
Function at 0x407ef0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502dd4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x55209c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 3
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 5
mov dword [esi + 0x34], vtable.RC::RCWidgetWindow.0
mov word [esi + 0x38], 0
mov byte [esi + 0x3a], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 6
lea ecx, [esi + 0x40]
call fcn.00427840
mov byte [ebp - 4], 7
lea ecx, [esi + 0x80]
mov dword [esi], vtable.RC::RCFeedbackFrameWnd.0
mov dword [esi + 0x34], vtable.RC::RCFeedbackFrameWnd.2.0
mov dword [esi + 0x40], vtable.RC::RCFeedbackFrameWnd.1.0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
call fcn.00416970
mov byte [ebp - 4], 8
mov dword [esi + 0xc4], 0
mov byte [ebp - 4], 9
mov dword [esi + 0xc8], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0xd4]
mov dword [esi + 0xcc], 0
xor eax, eax
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x52d5ec
mov word [ecx], ax
call fcn.00406ac0
mov byte [ebp - 4], 0xb
xor eax, eax
lea ecx, [esi + 0xf0]
mov dword [esi + 0xec], 0x64
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x5286a0
mov word [ecx], ax
call fcn.00406ac0
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x108]
push dword [ebp + 8]
call fcn.00406860
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x120]
push dword [ebp + 0xc]
call fcn.00406860
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x138]
push dword [ebp + 0x10]
call fcn.00406860
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x150]
push dword [ebp + 0x14]
call fcn.00406860
mov byte [ebp - 4], 0x10
xor eax, eax
mov word [esi + 0x168], 0x100
mov dword [esi + 0x17c], 0
mov dword [esi + 0x180], 7
mov word [esi + 0x16c], ax
mov byte [ebp - 4], 0x11
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], 7
mov word [esi + 0x184], ax
mov byte [ebp - 4], 0x12
mov dword [esi + 0x19c], 1
mov dword [esi + 0x1a0], eax
mov byte [ebp - 4], 0x13
cmp dword [esi + 0x118], eax
jne 0x408106
mov byte [esi + 0x169], al
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4084f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503000
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55209c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x40b
call fcn.0040caf0
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x464
cmp esi, eax
je 0x40856a
mov dword [eax], 0x464
add eax, 4
mov dword [ebp - 0x18], eax
jmp 0x40857a
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040caf0
mov esi, dword [ebp - 0x14]
push 1
sub esp, 0xc
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0040b2e0
mov byte [ebp - 4], 1
push dword [ebx + 4]
mov byte [ebp - 4], 0
call fcn.004c0c60
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4085f0
sub esi, ecx
mov eax, ecx
and esi, 0xfffffffc
cmp esi, 0x1000
jb 0x4085d1
mov ecx, dword [ecx - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4086d5
push esi
push ecx
call fcn.004c27d8
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push dword [ebx + 4]
call dword [sym.imp.IMM32.dll_ImmAssociateContext]
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xff37ffff
cmp eax, ecx
je 0x40861e
push ecx
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [ebx + 0xec]
mov edi, eax
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push ecx
push edi
call esi
movzx ecx, word [ebx + 0xec]
push ecx
push edi
mov dword [ebx + 0x78], eax
call esi
mov ecx, dword [ebx + 0x78]
mov dword [ebx + 0x7c], eax
test ecx, ecx
je 0x408677
test eax, eax
je 0x408677
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ecx
push 1
push 0x80
push dword [ebx + 4]
call esi
push dword [ebx + 0x7c]
push 0
push 0x80
push dword [ebx + 4]
call esi
cmp dword [ebx + 0xe8], 8
lea eax, [ebx + 0xd4]
jb 0x408688
mov eax, dword [eax]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp + 8]
mov ecx, ebx
push dword [eax + 4]
call fcn.00408a70
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
mov ecx, ebx
call fcn.00408f60
push 0
push 0
push 0x40b
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004e566f
int3
Function at 0x414910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5041a4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x55209c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
lea eax, [esi + 0x30]
mov dword [esi], vtable.RC::RCRCOwnerDrawEdit.0
mov dword [ebp - 0x14], eax
mov dword [eax + 0x24], 0
mov byte [ebp - 4], 6
lea eax, [esi + 0x58]
mov dword [ebp - 0x14], eax
mov dword [eax + 0x24], 0
mov byte [ebp - 4], 8
push 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0xffffff
mov dword [esi + 0x2c], 0x333333
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4170d0
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0xfffffffffffffff0
push dword [esp + 0x10]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cl, byte [esi + 8]
mov edi, eax
test edi, 0x10000000
je 0x417112
push dword [esp + 0xc]
or cl, 4
mov byte [esi + 8], cl
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41710d
test edi, 0x21000000
jne 0x41710d
or byte [esi + 8], 2
mov cl, byte [esi + 8]
jmp 0x417118
and cl, 0xfd
mov byte [esi + 8], cl
test cl, 2
je 0x417129
mov ecx, esi
call fcn.00417870
pop edi
pop esi
ret 4
push 0
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 4

Function at 0x418dc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x55209c]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x418de8
mov eax, dword [esi]
xor ecx, ecx
push 0x412
mov word [eax], cx
lea eax, [esp + 8]
push ecx
push eax
call fcn.004da4e0
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x418e2c
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004c1f5d
add esp, 0x418
ret
cmp eax, 0x208
jae 0x418e14
xor eax, eax
lea edx, [esp + 4]
mov word [esp + 0x414], ax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x418e44
sub edx, ecx
lea eax, [esp + 4]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.00406ac0
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.004c1f5d
add esp, 0x418
ret

Function at 0x41a0a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x55209c]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.004da4e0
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41a11e
cmp dword [esp + 0x14], 6
jb 0x41a11e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00419eb0
add esp, 0xc
test al, al
je 0x41a11e
cmp word [esi], 0
jne 0x41a176
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00419eb0
add esp, 0xc
test al, al
je 0x41a14a
cmp word [esi], 0
jne 0x41a176
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00419eb0
add esp, 0xc
test al, al
je 0x41a18b
cmp word [esi], 0
je 0x41a18b
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.004c1f5d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.004c1f5d
mov esp, ebp
pop ebp
ret
Function at 0x41a7c0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x283c]
mov eax, 0x283c
call fcn.004c3480
push 0xffffffffffffffff
push 0x504ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x55209c]
xor eax, ebp
mov dword [ebp + 0x2838], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
lea eax, [ebp + 0x630]
mov dword [ebp - 0x10], 0
push 0
push eax
call fcn.004da4e0
add esp, 0xc
mov eax, 0x22
mov word [ebp + 0x630], ax
test esi, esi
je 0x41aa07
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x41aa07
push esi
call edi
cmp eax, 0xffa
jge 0x41aa07
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x630]
push eax
call esi
push 0x52d724
lea eax, [ebp + 0x630]
push eax
call esi
push 0x52e474
lea ecx, [ebp - 0x30]
call fcn.00406800
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.0041eef0
mov ecx, eax
call fcn.0041efc0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x41a8d5
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a8cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41aa2c
push edx
push ecx
call fcn.004c27d8
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
test esi, esi
je 0x41aa07
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x41aa07
lea ecx, [ebp]
call fcn.0041a1a0
xor edi, edi
lea esi, [ebp]
cmp word [esi], 0
je 0x41a934
push 1
push 0
lea eax, [ebp + 0x630]
push eax
push esi
push str.open
push 0
call ebx
cmp eax, 0x20
ja 0x41a942
inc edi
add esi, 0x210
cmp edi, 3
jl 0x41a914
jmp 0x41a967
imul eax, edi, 0x210
cmp dword [ebp + eax + 0x208], 0
mov eax, dword [ebp + eax + 0x20c]
jne 0x41a95c
add eax, 0x10
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x41aa09
push 1
push 0
push 0
lea eax, [ebp + 0x630]
push eax
push str.open
push 0
call ebx
cmp eax, 0x20
jbe 0x41a98c
mov eax, 0x10
jmp 0x41aa09
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
mov dword [ebp - 0x18], str._programfiles_x86__Internet_Exploreriexplore.exe
mov dword [ebp - 0x14], str._programfiles_Internet_Exploreriexplore.exe
push 0x208
lea eax, [ebp + 0x2630]
push 0
push eax
call fcn.004da4e0
add esp, 0xc
lea eax, [ebp + 0x2630]
push 0x103
push eax
push dword [ebp + esi*4 - 0x18]
call edi
lea eax, [ebp + 0x2630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a9fc
push 1
push 0
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x2630]
push eax
push str.open
push 0
call ebx
cmp eax, 0x20
ja 0x41a982
inc esi
cmp esi, 2
jb 0x41a9a2
mov eax, dword [ebp - 0x10]
jmp 0x41aa09
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2838]
xor ecx, ebp
call fcn.004c1f5d
lea esp, [ebp + 0x283c]
pop ebp
ret
call fcn.004e566f
int3
Function at 0x41ab40
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x55209c]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, dword [esp + 0x148]
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.004da4e0
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41ac87
cmp dword [esi + 4], 6
push edi
ja 0x41ab9b
jne 0x41ac23
cmp dword [esi + 8], 2
jb 0x41ac23
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x41ac23
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ac23
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ac23
movups xmm0, xmmword [0x52e8c8]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x52e8d8]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x41ac23
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41ac23
cmp word [edi + 2], ax
jbe 0x41ac23
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push 0x52e584
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x41ac6e
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004da4e0
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x41ac6e
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.004c1f5d
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.004c1f5d
add esp, 0x140
ret

Function at 0x41b3e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x41b418
mov edx, dword [esp + 4]
test edx, edx
je 0x41b418
cmp dword [eax], 0xffffffff
je 0x41b418
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b418
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x41b420
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x41b45a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x41b45a
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41b45a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41b45a
cmp edi, dword [esi]
jne 0x41b45a
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc