joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f4bd
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
cmp dword [esi], 0x68
mov edi, 0x28ddd204
pop eax
cmp eax, 0xdd29ba91
mov esp, 0x976371b7
push 0xddd204bf
rcr ch, cl
sub byte [eax + 0x3d], bl
xchg ecx, eax
mov edx, 0xb7bcdd29
jno 0x40f4b2
xchg edi, eax
pushfd
add byte [ebx - 0x626a8114], 0x92
jle 0x40f4af
cwde
jle 0x40f480
jge 0x40f43c
and edi, ebx
in eax, dx
mov edi, 0x709bf56f
imul edi, dword [ebx + 0x65], 0x7a
xchg esi, eax
insb byte es:[edi], dx
sbb edi, dword [ebx - 0x602b2471]
loopne 0x40f43f
clc
std
push cs
invalid
mov ebx, 0xff87cd03
dec esp
nop
imul ebp, dword [ecx + 0x23], 0xe1c99ac9
leave
loope 0x40f442
mov bl, 0xe5
mov ch, 0x25
cmp byte [edx*2 - 0x311adc7d], cl
in eax, 0xb5
and eax, 0x83550c38
and esp, ebp
into
sbb bh, dh
mov eax, dword [0xa411872]
dec ecx
aaa
xor bl, byte [ecx - 0x58]
invalid
xchg ebp, eax
int1
bound edx, qword [ebp - 0x7a]
scasd eax, dword es:[edi]
xor dword [eax - 0x2ed3a24e], edx
push ebp
xchg byte [edi + 0x5db29031], ch
sub al, 0xd1
mov eax, dword [0xc1cb0975]
push eax
mov byte [0xc1f62599], al
invalid
or ebx, ecx
rcl dword [eax - 0x5e], 0x99
and eax, 0x648fc1f6
popfd
mov dword [ecx + 0x5c8e9401], edx
xor al, byte [ecx]
add ecx, dword [ecx]
cli
add dword [esi + ecx*4 + 0x301325c], edx
or edx, edi
rcr dword [eax - 0x4f27e9dc], 0x2e
jl 0x40f4c3
push ebp
jae 0x40f48e
je 0x40f516
into
xchg ebp, eax
push edi
jno 0x40f4cc
das
shl byte [ebx - 0x76bb711d], 1
sub dword [ebx + 0x72b5be83], esi
aaa
xor byte [edx + 0x5e], dh
jns 0x40f48c
pop es
cld
mov ebp, 0x535ce4b4
pop esi
out dx, al
mov ecx, edi
push ecx
fbstp tbyte [edi]
rol ecx, cl
adc bl, byte [ecx + 0x4f1589cf]
jne 0x40f50d
inc ebx
jnp 0x40f569
adc al, 0xab
leave
push 0xdf4c80d6
fdivr st(3)
aas
xor dword [ebx], edx
cmp al, 0xf
int 0x52
xor byte [eax + 0x63], dl
test eax, 0x3b5cc9c3
inc ebp
jno 0x40f561
mov word [eax + 0xe], cs
pop esp
xchg ebx, eax
sub ecx, dword [ebx + ecx - 0x34]
mov al, 0x9d
jle 0x40f558
dec ebp
jne 0x40f515
add byte [edx - 0xa1573fb], 0x9e
wait
test byte [ebx - 0x58], 0xfc
cld
sbb cl, bh
sub byte [ecx], ch
loopne 0x40f576
mov ah, 0x55
js 0x40f588
mul dword [esi]
cmp esi, ebp
mov byte [0xdb88a92e], al
mov bl, bl
stosb byte es:[edi], al
aad 0xe1
sbb dword [edx + 0x46efc2ae], edx
enter 0x3674, 0xffffffffffffffbf
xchg edx, eax
invalid
scasb al, byte es:[edi]
ret 0x46ef
dec ecx
xor eax, 0x1ff7490b
jae 0x40f5d3
call 0x2a0775b0
pop es
xor ecx, dword [edx]
pop esp
fistp qword [edx + esi*4 - 0x4b10346e]
sub eax, 0xc7a1bc99
stosb byte es:[edi], al
invalid
mov esp, 0xefcb92b2
mov ah, 0x2d
cdq
mov esp, 0x8caac7a1
jne 0x40f54f
dec esp
invalid
inc edi
push cs
mov ecx, 0x22db1571
fcmovb st(0), st(5)
add eax, 0x2463d62
stosb byte es:[edi], al
sti
in al, dx
and al, 0x28
xchg edx, eax
test dword [ebx], eax
pop esi
mov edi, 0x97f4aa30
mov esi, 0xa9dfb81d
cmp ecx, dword [edi]
add edx, dword [edx - 0x77]
cmp ebx, ebx
test al, 0x95
mov esp, 0x86856241
sub dword [edi - 0x7c], 0xd246a618
aaa
push ds
inc ebp
invalid
Function at 0x411815
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xad
and ebp, dword [edx + eax + 0x2e3ce846]
invalid
sbb eax, 0xe27523
add byte [eax - 0x4f], bh
xchg edi, eax
push ecx
scasd eax, dword es:[edi]
and ecx, dword [esp + ebx*4 + 0x7d05a8e]
imul ebp, ecx, 0xb03e0f2f
cwde
xchg ebp, eax
loopne 0x4117b2
or al, byte [ecx + edi*4]
mov eax, dword [0x1780508e]
cmp dword [eax - 0x77e7f9c], esi
test dword [edi + 0x1a], edi
jo 0x411883
push esi
out dx, eax
cmpsb byte [esi], byte es:[edi]
cmc
mov ebx, 0xff2024a8
xor eax, 0x37fcdca2
pop ss
xchg eax, edx
xor eax, 0xb9d4ed77
dec edx
jmp 0x52e1aca5
invalid
sbb dword [ebx + 0x29], ecx
insb byte es:[edi], dx
fadd qword [ebx]
sbb byte [esi], bh
wait
jae 0x4118c5
mov eax, dword [0x5cdd0e01]
aam 0x1a
push ss
pop eax
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
jb 0x411875
stc
sbb eax, dword [edi + 0x79d2534b]
or bl, ch
and eax, 0x30a06252
ret 0xa3ab
invalid
Function at 0x427468
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x63765d74
jno 0x42724e
arpl word [ecx + 0x1c], si
jnp 0x427281
xchg byte [ebp - 0x7ff384cc], dl
push cs
cwde
add al, 0x1d
mov ecx, dword [eax - 0x7816b0f2]
cmpsb byte [esi], byte es:[edi]
sub al, byte [ebp + 0x37476458]
fist word [ebp + edi - 0x1a1ae1b5]
dec ebx
push ds
in eax, 0xe5
mov eax, dword [0x1f7d16f7]
adc dword [eax], edi
lds ebp, [eax + 0x61]
xchg ecx, eax
and cl, byte [ecx - 0x48]
xchg edx, eax
and ah, byte [eax]
jmp 0x788851e8
js 0x4272b0
aas
jl 0x42722f
mov bl, 0x52
mov cl, 0xc7
popal
push esi
fild qword [edx + 0x4e85ab18]
sbb byte [ebx], 0xa0
test al, 0xeb
pop esp
dec esp
add eax, 0xaece3cd8
cmp al, 0xce
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
loop 0x4272d6
aaa
dec esp
xchg esi, eax
mov eax, dword [0xb19de3ab]
jbe 0x42728c
jecxz 0x42722b
mov cl, 0x76
sti
jae 0x427267
inc ecx
or dword [0x76778bfe], 0xffffff89
sbb byte [edx], ch
inc ebp
aaa
loope 0x42730f
sbb byte [ebx], 0x85
lcall 0x1402, 0xdb0f5f8f
ret
xor dword [edi - 0x5d5396f9], 0x4e
sbb bh, byte [esi + 0x4e4c3910]
pop ds
add ecx, dword [ecx + 0x2b]
push esp
add eax, dword [ebx - 0x4fb09c5d]
nop
in al, 0x87
mov al, 0x78
push 0xfffffffffffffff0
adc byte [ebx + 0x7ca0e170], cl
dec edx
mov ecx, 0x6dc686fc
pop esp
push eax
add dword [eax], esp
popfd
loope 0x427284
into
mov al, dh
xor dword [ebx + 0x430f390b], ebp
and byte [edi - 0x64], ah
aaa
out dx, al
pushal
and al, 0xb6
invalid
cmp al, byte [edi + eax*2 + 0x18]
salc
pop ss
pop edx
mov ecx, dword [ebx]
cmc
ja 0x4272f2
lcall 0x9935, 0x61c482e0
loopne 0x427293
les esp, [ecx + 0x35]
cdq
cmpsd dword ds:[esi], dword es:[edi]
dec ebx
jb 0x4272e0
invalid
xchg byte [ebp + 0x6a72d17a], dh
mov bh, 0xe8
mov cl, 0x88
xlatb
jbe 0x427302
and dword [esi], eax
jno 0x4273be
das
dec esp
in al, dx
pop ds
push esi
cmp dword [esi - 0x58fe3189], 0xa23cde9b
int 0xd6
pop esi
invalid
or dword [edx], edi
loop 0x427370
lds edx, [edi + 0x1d]
sbb dword [edx + 0x62cd37a3], ebp
dec ebp
mov dword [0x4d62cd37], eax
lodsb al, byte [esi]
out dx, eax
outsd dx, dword [esi]
lodsb al, byte [esi]
out dx, eax
jp 0x427443
invalid
sub al, 0x6b
mov bh, 0x83
insb byte es:[edi], dx
std
out 0, al
dec ecx
add dword [eax], ebp
pop ecx
xchg edx, eax
jl 0x4273b5
fmul st(0)
inc edi
insd dword es:[edi], dx
in eax, 0x8b
in eax, 0x81
push ebx
invalid
jae 0x42748d
pop ss
xor eax, esi
stosb byte es:[edi], al
push ds
or eax, 0x9efe8698
push esi
xlatb
aam 0x29
aam 2
dec esi
iretd
mov eax, 0xd499f1c1
add eax, 0x176b49d8
pop ss
enter 0xffffffffffffa2d8, 0xffffffffffffffc2
stosb byte es:[edi], al
stc
loopne 0x427423
ret 0xf9aa
invalid
add al, cl
fld xword [edi + 0x7119d8c9]
jecxz 0x4274d2
push ss
ja 0x427475
dec ebx
retf
lahf
jno 0x42752b
xor bh, byte [edi - 0x5f]
fsubr dword [eax + 0x3961318e]
imul eax, eax, 0x5d
xor al, 0x4c
sar al, 0x15
das
mov dl, 0xb3
dec ecx
jecxz 0x427471
jle 0x42748d
dec ebx
jmp 0x7ef14887
pop ss
imul edi, dword [edx], 0xd483a1bf
dec esi
int1
cli
mul edi
aad 0xb3
xchg edi, eax
cmp ch, byte [edi + 0x3f744039]
push cx
push ds
jmp 0xf324bfce
Function at 0x428c50
Capabilities:
Encode data using xor

Disassembly:
sub ch, byte [edi]
lea ebp, [ebp - 0x7c]
mov eax, dword [0x8e164cc2]
jmp 0x428c11
xchg sp, ax
popal
int3
les esp, [esi + 0x4b]
das
lahf
and bh, byte [edx - 0x36]
jp 0x428c0e
jecxz 0x428bed
sbb dword [edx - 0x5e7c0a46], edx
xor eax, 0xf526454b
cmc
mov al, byte [0x8503a26a]
push ebp
add dh, byte [edi - 0x1d]
mov esi, 0xd2e6fde6
inc esp
or al, 0x9c
js 0x428c42
scasb al, byte es:[edi]
scasb al, byte es:[edi]
frstor dword [edi - 0x49407f6]
retf

Function at 0x46c60d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [edx + eax*8 - 0x5c]
xor ch, byte [edx + ebx - 0x3e]
dec ecx
mov dl, 0xd2
add ah, bl
adc ebp, dword [ebx]
mov ch, byte [edx - 0x9d2516c]
arpl word [ecx - 0x5341cc30], bp
test eax, 0xacbe33d0
fsub dword [eax + 0x4e3a3dd7]
fdiv qword [esi + 0x5c]
imul esi, dword [ecx], 0xffffffee
das
mov dword [ecx - 0x50], esi
xor byte [ecx], cl
adc eax, 0xb5cd3359
push ebx
jo 0x46c623
mov bh, 0x84
nop
or esi, dword [edi + 0x2b]
outsd dx, dword [esi]
lcall 0x5a9, 0xaddac1b4
invalid

Function at 0x484f84
Capabilities:
Encode data using xor

Disassembly:
and al, byte [ecx + 0x57]
cmp byte [ebp + 0x6f4efc03], ch
ret
enter 0x74a5, 0x14
aam 0x76
cmp byte [eax - 0x5c], dh
fcmovb st(0), st(7)
mov cl, 0xfe
adc esi, 0x8888a7d5
xor ah, bh
clc
sbb byte [esi - 0x5b], dh
sal dword [ecx + ebp*4], 0xa6
lahf
mov eax, dword [0x1dd13600]
popfd
sub dword [edx - 0x7c5743c9], 0xbdd600e8
mov ebx, 0x315a6254
dec edx
insb byte es:[edi], dx
sbb eax, 0x37aa819d
mov esp, 0xe883a8
salc
mov ebp, 0x5a6254bb
xor dword [edx + 0x6c], ecx
pop esp
loopne 0x484f71
dec ebx
jns 0x484f1e
xor ch, byte [ebx]
cmp eax, 0x1d0746c6
push esp
lcall 0x591e, 0xf272bad2
pop ebx
mov cl, 0xa8
nop
rcl byte [ecx], 0x34
mov dh, 4
in al, 0xa1
test ecx, edi
jg 0x484f4e
iretd

Function at 0x48cc05
Capabilities:
Encode data using xor

Disassembly:
std
add byte [esi - 0x2490388a], ah
push edi
push es
ficom word [edx + 0x77fa251b]
arpl word [ebp + 0x72], sp
mov al, byte [edx + 0x4ef4eba7]
pop esp
mov edx, 0xc6ac0cf8
dec ebp
push esp
and eax, 0x275e078b
pop esi
daa
pop esi
daa
cmp al, 0x82
or dword [esi - 0x2d74cf7], esi
mov dh, 9
mov bl, 0x28
std
jo 0x48cbe2
pushfd
pop ebp
mov edx, 0xca434364
adc al, 0x5c
and eax, 0x7af85b7e
mov edx, 0xbb87fe82
or al, 0xfc
mov eax, dword [0x5e54177f]
xchg byte [edx + esi], ah
std
xchg dword [ecx + 0x2c], edx
xor al, 0x41
jnp 0x48cc0a
sub esi, dword [ebx]
pop ecx
fnstenv [eax - 0x32]
sti
mov ecx, 0x52a740ab
invalid

Function at 0x496fd2
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x2d5a30bb
pop ss
aad 0xf9
pop ecx
sal dword [ebx], cl
pop ss
mov dword [0xbcbcaf3f], eax
sbb al, 0xdb
jmp dword [ecx]
inc ebx
invalid
stc
enter 0x3faf, 2
scasd eax, dword es:[edi]
add ebx, dword [edi]
cld
jp 0x496fc9
jmp 0x496f7e
Function at 0x4bd755
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c63a8
cmp edx, dword [eax]
je 0x4bd777
add eax, 8
inc ecx
cmp eax, 0x4c6438
jl 0x4bd768
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c63a8]
jne 0x4bd8a5
mov eax, dword [0x4cad3c]
cmp eax, 1
je 0x4bd87f
test eax, eax
jne 0x4bd7a8
cmp dword [0x4c62d4], 1
je 0x4bd87f
cmp edx, 0xfc
je 0x4bd8a5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bd7df
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004be140
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004be5d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bd822
lea eax, [ebp - 0x1a4]
push eax
call fcn.004be5d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c2ab4
push edi
call fcn.004c04a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004be140
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004be150
lea eax, [ebp - 0xa0]
push 0x4c2a94
push eax
call fcn.004be150
push dword [esi + 0x4c63ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004be150
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c0414
add esp, 0x2c
pop edi
jmp 0x4bd8a5
lea eax, [ebp + 8]
lea esi, [esi + 0x4c63ac]
push 0
push eax
push dword [esi]
call fcn.004be5d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x43b639
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
push esi
pop esi
mov edi, 0xcd6552ef
call fcn.0043b676
and esi, edi
add edi, 0x44e7b343
mov edi, esi
xor dword [ecx], eax
add esi, 0xb228bd5
or esi, esi
add edi, esi
inc ecx
inc edi
cmp ecx, edx
jne fcn.0043b639
or esi, edi
sub esp, 4
mov dword [esp], 0x591bf9bc
pop edi
ret
Function at 0x45c490
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x41000]
push edi
jmp 0x45c4aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c4b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c4a0
mov eax, 1
add ebx, ebx
jne 0x45c4c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c4d4
jne 0x45c4f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c4f3
dec eax
add ebx, ebx
jne 0x45c4e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45c4b8
add ebx, ebx
jne 0x45c4ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45c545
xor ecx, ecx
sub eax, 3
jb 0x45c50b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c57a
sar eax, 1
mov ebp, eax
jmp 0x45c516
add ebx, ebx
jne 0x45c516
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c4e4
inc ecx
add ebx, ebx
jne 0x45c524
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c4e4
add ebx, ebx
jne 0x45c531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c526
jne 0x45c542
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c526
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c556
jmp 0x45c4a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c564
add edi, ecx
jmp 0x45c4a6
pop esi
mov edi, esi
mov ecx, 0x1573
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c582
cmp byte [edi], 5
jne 0x45c582
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c587
lea edi, [esi + 0x59000]
mov eax, dword [edi]
or eax, eax
je 0x45c5ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x681f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x68310]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c5b4
mov ecx, edi
jns 0x45c5e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x68314]
or eax, eax
je 0x45c5f9
mov dword [ebx], eax
add ebx, 4
jmp 0x45c5d1
call dword [esi + 0x68324]
mov ebp, dword [esi + 0x68318]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c633
sub esp, 0xffffff80
jmp 0x41ef17
Function at 0x401283
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
test esi, esi
jne 0x40129a
xor al, al
jmp 0x40132f
call fcn.00401231
test al, al
je 0x4012f5
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.00401c77
add esp, 0xc
lea ecx, [ebp - 0x208]
mov edx, 0x104
push esi
call fcn.004011c9
push 0x402128
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40132d
push 0
push 0x1c
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401293
push str.lbmini
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40132d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
jmp 0x40132f
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401334
Capabilities:
Get file attributes

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str..zip
push eax
push str.TEMP_MIN_LIEBAO
push esi
push str._s_s__d_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
pop esi
ret

Function at 0x40137d
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x44
push 0
push eax
mov bl, dl
mov esi, ecx
call fcn.00401c77
and dword [ebp - 0x14], 0
lea edi, [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
push 0x7fe
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x85c], ax
xor edi, edi
lea eax, [ebp - 0x85a]
push edi
push eax
call fcn.00401c77
add esp, 0x18
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401461
push str.____install
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x85c]
push str.__s__s
push eax
call esi
add esp, 0x10
test bl, bl
jne 0x401414
push str._____disable_shortcut
lea eax, [ebp - 0x85c]
push eax
push str._s_s
push eax
call esi
add esp, 0x10
cmp byte [ebp + 8], 0
jne 0x401431
push str._____no_start
lea eax, [ebp - 0x85c]
push eax
push str._s_s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x85c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401461
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401943
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa44
push ebx
push esi
push edi
push 0xa
push str.LIEBAOSETUP
push 0
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1a], cl
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x401b51
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x401b51
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x401b51
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x840]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x401b51
lea edx, [esp + 0x630]
lea ecx, [esp + 0x840]
call fcn.00401334
mov esi, eax
cmp esi, 0xffffffff
je 0x401b51
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
test ecx, ecx
jg 0x4019f8
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4019ef
sub ecx, edx
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esi, 0x206
push esi
mov word [esp + 0x224], ax
xor ebx, ebx
lea eax, [esp + 0x226]
push ebx
push eax
call fcn.00401c77
add esp, 0xc
lea ecx, [esp + 0x220]
call fcn.00401693
xor eax, eax
push esi
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push ebx
push eax
call fcn.00401c77
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00401283
test al, al
je 0x401b43
push 0x402128
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x18]
call fcn.0040184b
xor eax, eax
mov byte [esp + 0xd], bl
push esi
mov word [esp + 0x42c], ax
lea eax, [esp + 0x42e]
push ebx
push eax
call fcn.00401c77
add esp, 0xc
lea eax, [esp + 0x18]
mov edx, 0x104
lea ecx, [esp + 0x428]
push eax
call fcn.004011c9
lea eax, [esp + 0xd]
push eax
lea edx, [esp + 0x42c]
lea ecx, [esp + 0x634]
call fcn.00401468
lea edx, [esp + 0x224]
pop ecx
test eax, eax
jne 0x401b38
push ebx
lea ecx, [esp + 0x42c]
call fcn.0040171e
pop ecx
cmp byte [esp + 0xd], bl
jne 0x401afb
mov byte [esp + 0x10], 1
cmp byte [esp + 0xe], bl
je 0x401aff
mov byte [esp + 0x10], bl
push 4
push str.duba
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x401b20
mov byte [esp + 0x10], bl
mov al, bl
jmp 0x401b24
mov al, byte [esp + 0xf]
push dword [esp + 0x10]
mov dl, al
lea ecx, [esp + 0x42c]
call fcn.0040137d
jmp 0x401b42
push eax
lea ecx, [esp + 0x1c]
call fcn.0040171e
pop ecx
lea eax, [esp + 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b5a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, eax
xor esi, esi
xor al, al
mov dword [ebp - 8], ecx
mov bl, 1
mov byte [ebp + 0x13], al
cmp dword [ebp - 4], esi
jle 0x401c15
push edi
mov edx, dword [ecx + esi*4]
mov ecx, str.__upgrade
mov eax, edx
mov di, word [eax]
cmp di, word [ecx]
jne 0x401bba
test di, di
je 0x401bb6
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x401bba
add eax, 4
add ecx, 4
test di, di
jne 0x401b94
xor eax, eax
jmp 0x401bbf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401bca
mov al, 1
mov byte [ebp + 0x13], al
jmp 0x401c07
mov eax, str.__disable_shortcut
mov cx, word [edx]
cmp cx, word [eax]
jne 0x401bf5
test cx, cx
je 0x401bf1
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x401bf5
add edx, 4
add eax, 4
test cx, cx
jne 0x401bcf
xor eax, eax
jmp 0x401bfa
sbb eax, eax
or eax, 1
xor ecx, ecx
movzx ebx, bl
test eax, eax
mov al, byte [ebp + 0x13]
cmove ebx, ecx
mov ecx, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jl 0x401b8a
pop edi
mov dl, bl
mov cl, al
call fcn.00401943
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x3c244434
xor al, 0xc7
and al, 0x3c
xor al, 0x6c
mov cl, 0x35
xor al, 0xc7
and al, 0x3c
xor al, 0xe5
and al, 0x3c
xor al, 0xac
mov cl, 0x35
xor al, 0xf4
and al, 0x3c
xor al, 0x22
and al, 0x3c
xor al, 0xbc
mov cl, 0x35
xor al, 0x22
and al, 0x3c
xor al, 0x3e
and eax, 0xb1e4343c
xor eax, 0x3c253e34
xor al, 0x5a
and eax, 0xb1f0343c
xor eax, 0x3c255a34
xor al, 0x79
and eax, 0xb1fc343c
xor eax, 0x3c258434
xor al, 0x6d
sub bh, byte [esp + esi]
or byte [ecx + 0x2a6d3435], dh
cmp al, 0x34
xchg esp, eax
sub bh, byte [esp + esi]
push esp
mov bl, 0x35
xor al, 0x94
sub bh, byte [esp + esi]
mov ebx, 0x70343c2a
mov bl, 0x35
xor al, 0xbb
sub bh, byte [esp + esi]
sbb byte [edx], ch
cmp al, 0x34
invalid