joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0eda
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x31c
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, dword [ebp + 0x74]
xor edx, edx
push edi
xor edi, edi
cmp esi, 0xffffffff
mov dword [ebp + 0x64], edx
mov dword [ebp + 0x68], edx
jne 0x4a0f0e
cmp ebx, esi
jne 0x4a0f0e
mov eax, dword [ebp + 0x7c]
call fcn.004a0ebb
jmp 0x4a10ab
cmp dword [ebp + 0x7c], edx
jle 0x4a0f23
mov edi, dword [ebp + 0x7c]
call fcn.004a24a0
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x64], eax
xor edx, edx
xor eax, eax
or ecx, 0xffffffff
inc eax
cmp esi, ecx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x1ac], edx
je 0x4a0f53
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], eax
mov ecx, esi
cmp ebx, 0xffffffff
mov dword [ebp - 0x2b0], edx
je 0x4a0faa
mov dword [ebp - 0x2b0], eax
xor eax, eax
cmp dword [ebp - 0xa8], edx
mov dword [ebp - 0x2ac], ebx
jbe 0x4a0f86
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x4a0f86
inc eax
cmp eax, dword [ebp - 0xa8]
jb 0x4a0f74
cmp eax, dword [ebp - 0xa8]
jne 0x4a0fa4
cmp dword [ebp - 0xa8], 0x40
jae 0x4a0fa4
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp - 0xa8]
cmp ebx, ecx
jbe 0x4a0faa
mov ecx, ebx
cmp dword [ebp + 0x7c], edx
jge 0x4a0fb3
xor ebx, ebx
jmp 0x4a0fb6
lea ebx, [ebp + 0x5c]
lea esi, [ecx + 1]
xor eax, eax
cmp dword [ebp + 0x7c], eax
jle 0x4a0fd5
mov eax, edi
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp + 0x60], edx
jmp 0x4a0fda
jne 0x4a0fdd
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x5c], eax
push ebx
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x1ac]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4a1036
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4a1010
cmp eax, 0x2714
jne 0x4a103a
cmp dword [ebp + 0x7c], 0
jle 0x4a0fb9
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call fcn.004a24a0
push edx
push eax
call fcn.004a24b6
mov edi, dword [ebp + 0x7c]
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x4a0fb9
jmp 0x4a103a
test eax, eax
jge 0x4a103f
or eax, 0xffffffff
jmp 0x4a10ab
jne 0x4a1045
xor eax, eax
jmp 0x4a10ab
xor esi, esi
cmp dword [ebp + 0x74], 0xffffffff
je 0x4a1077
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a1061
inc esi
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a1077
or esi, 4
cmp dword [ebp + 0x78], 0xffffffff
je 0x4a10a9
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a1093
or esi, 2
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a10a9
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x4a2ff8
Capabilities:
Parse pe header

Disassembly:
movsx eax, byte [esp + 4]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4a3005
jmp dword [eax*4 + 0x4a3060]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, byte [esp + 4]
ret

Function at 0x4a4d48
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x4a4d6c
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x4a4d9d
cmp dword [esi + 8], 0
jne 0x4a4d8d
push 0x4e90a4
push dword [eax + 8]
call fcn.004ab5c6
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x4a4d8d
or eax, 0xffffffff
jmp 0x4a4dc3
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.004aacc7
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4a4dab
cmp edi, dword [ebp + 0xc]
jbe 0x4a4dc1
test ebx, ebx
jne 0x4a4dbb
push dword [esi + 8]
call fcn.004aad54
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aa652
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4aa67f
call fcn.004b068c
mov dword [eax], esi
call fcn.004b0679
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004a7b70
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4aa65b
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4aa6ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b069f
pop ecx
call fcn.004b0679
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4aa6d5
test al, 1
je 0x4aa6d5
test byte [esp + 0xc], 2
je 0x4aa6d5
call fcn.004b068c
mov dword [eax], 5
call fcn.004b0679
mov dword [eax], 0xd
jmp 0x4aa6a5
xor eax, eax
pop esi
ret
Function at 0x4aaa2b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4aaa68
cmp dword [ebp + 0x14], edi
je 0x4aaa68
cmp ecx, edi
jne 0x4aaa6f
call fcn.004b0679
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004a7b70
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4aaa83
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4aaaa4
cmp ebx, 0xffffffff
je 0x4aaa93
push ebx
push edi
push ecx
call fcn.004a6df0
add esp, 0xc
cmp esi, edi
je 0x4aaa50
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4aaa50
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4aaac0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4aaac7
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4aabb8
test word [esi + 0xc], 0x10c
je 0x4aab1b
mov eax, dword [esi + 4]
test eax, eax
je 0x4aab1b
jl 0x4aac19
cmp ebx, eax
mov edi, ebx
jb 0x4aaaec
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4aabc0
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004a6c8f
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4aabb0
cmp ebx, dword [ebp - 0xc]
jb 0x4aab88
cmp dword [ebp - 0xc], 0
je 0x4aab45
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4aab3a
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4aab41
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4aab50
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4aab50
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4aabec
push eax
push dword [ebp - 8]
push esi
call fcn.004abe92
pop ecx
push eax
call fcn.004bd00c
add esp, 0xc
test eax, eax
je 0x4aac2b
cmp eax, 0xffffffff
je 0x4aac19
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4aabb0
push esi
call fcn.004bc92b
cmp eax, 0xffffffff
pop ecx
je 0x4aac1d
cmp dword [ebp - 4], 0
je 0x4aabec
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4aaacf
mov eax, dword [ebp + 0x14]
jmp 0x4aaa6a
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4aabd7
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004a6df0
add esp, 0xc
call fcn.004b0679
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4aaa60
cmp dword [ebp + 0xc], 0xffffffff
je 0x4aac02
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004a6df0
add esp, 0xc
call fcn.004b0679
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4aaa60
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4aaa6a
or dword [esi + 0xc], 0x10
jmp 0x4aac1d
Function at 0x4ae9de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5041ec]
jne 0x4ae9e8
repz ret
jmp fcn.004c0bfc
Function at 0x4b790c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x504e40]
je 0x4b7927
inc edi
cmp edi, 0x17
jb 0x4b7918
cmp edi, 0x17
jae 0x4b7aa7
push ebp
push 3
call fcn.004c40f9
cmp eax, 1
pop ecx
je 0x4b7a73
push 3
call fcn.004c40f9
test eax, eax
pop ecx
jne 0x4b795b
cmp dword [0x5041e0], 1
je 0x4b7a73
cmp ebx, 0xfc
je 0x4b7aa6
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x50bd78
push ebp
call fcn.004acdf0
add esp, 0xc
test eax, eax
je 0x4b7991
push esi
push esi
push esi
push esi
push esi
call fcn.004a7a74
add esp, 0x14
push 0x104
mov esi, 0x50bd91
push esi
push 0
mov byte [0x50be95], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b79d5
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004acdf0
add esp, 0xc
test eax, eax
je 0x4b79d5
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004a7a74
add esp, 0x14
push esi
call fcn.004a5bf0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4b7a1a
push esi
call fcn.004a5bf0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x50c08c
push 0x4d7be4
sub ecx, eax
push ecx
push eax
call fcn.004ad2b8
add esp, 0x14
test eax, eax
je 0x4b7a1a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004a7a74
add esp, 0x14
jmp 0x4b7a1c
xor esi, esi
push 0x4d7be0
push ebx
push ebp
call fcn.004c1871
add esp, 0xc
test eax, eax
je 0x4b7a3c
push esi
push esi
push esi
push esi
push esi
call fcn.004a7a74
add esp, 0x14
push dword [edi*8 + 0x504e44]
push ebx
push ebp
call fcn.004c1871
add esp, 0xc
test eax, eax
je 0x4b7a5e
push esi
push esi
push esi
push esi
push esi
call fcn.004a7a74
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004c3f3c
add esp, 0xc
jmp 0x4b7aa6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4b7aa6
cmp ebp, 0xffffffff
je 0x4b7aa6
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x504e44]
push dword [esi]
call fcn.004a5bf0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4c3f3c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004b3185
xor ebx, ebx
cmp dword [0x50c6c8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4c4012
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4c40f2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4c40f2
push eax
call fcn.004b3117
mov dword [esp], 0x4dea28
push edi
mov dword [0x50c6c8], eax
call esi
push eax
call fcn.004b3117
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x50c6cc], eax
call esi
push eax
call fcn.004b3117
mov dword [0x50c6d0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004afab9
test eax, eax
pop ecx
pop ecx
je 0x4c3fe0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a7a74
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4c4012
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004b3117
cmp eax, ebx
pop ecx
mov dword [0x50c6d8], eax
je 0x4c4012
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b3117
pop ecx
mov dword [0x50c6d4], eax
mov eax, dword [0x50c6d4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4c4097
cmp dword [0x50c6d8], ecx
je 0x4c4097
push eax
call fcn.004b318e
push dword [0x50c6d8]
mov esi, eax
call fcn.004b318e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4c4097
cmp edi, ebx
je 0x4c4097
call esi
cmp eax, ebx
je 0x4c4064
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4c4064
test byte [ebp - 0x18], 1
jne 0x4c4097
lea eax, [ebp - 0x10]
push eax
call fcn.004afaf0
test eax, eax
pop ecx
je 0x4c407f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a7a74
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4c408e
or dword [ebp + 0x10], 0x200000
jmp 0x4c40d2
or dword [ebp + 0x10], 0x40000
jmp 0x4c40d2
mov eax, dword [0x50c6cc]
cmp eax, dword [ebp - 8]
je 0x4c40d2
push eax
call fcn.004b318e
cmp eax, ebx
pop ecx
je 0x4c40d2
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4c40d2
mov eax, dword [0x50c6d0]
cmp eax, dword [ebp - 8]
je 0x4c40d2
push eax
call fcn.004b318e
cmp eax, ebx
pop ecx
je 0x4c40d2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50c6c8]
call fcn.004b318e
cmp eax, ebx
pop ecx
je 0x4c40f2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c40f4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [esp + 0x208]
sbb eax, eax
xor ecx, esp
neg eax
call fcn.004034f3
add esp, 0x20c
ret

Function at 0x401041
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x810]
sub esp, 0x890
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x80c], eax
mov eax, dword [ebp + 0x818]
push ebx
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x80]
mov esi, ecx
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp + 0x600]
push esi
push eax
call fcn.00403530
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
pop ecx
pop ecx
lea eax, [ebp + 0x600]
push eax
call esi
mov ecx, 0x4040d4
mov edx, edi
call fcn.004016f9
xor ebx, ebx
cmp eax, 0xffffffff
je 0x401101
lea eax, [ebp + 0x3f4]
push eax
push ebx
push ebx
call fcn.00401000
xor ecx, ecx
test al, al
setne cl
lea ecx, [ecx*4 + 0x25]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp + 0x3f4]
push eax
call esi
push dword [ebp - 0x24]
lea eax, [ebp + 0x600]
push edi
push eax
lea eax, [ebp + 0x3f4]
push eax
lea eax, [ebp - 0x20]
push str.__srundll32.exe_____s_s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x401136
mov ecx, str..msi
mov edx, edi
call fcn.004016f9
push dword [ebp - 0x24]
cmp eax, 0xffffffff
lea eax, [ebp + 0x600]
push edi
push eax
lea eax, [ebp - 0x20]
je 0x401127
push str.msiexec__i___s_s___s
jmp 0x40112c
push str.__s_s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40115a
push 0xc
pop eax
jmp 0x401185
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x80c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004034f3
add ebp, 0x810
leave
ret
Function at 0x4012dc
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0xb7
mov dword [ebp - 0x22c], 5
mov eax, dword [ebp - 0x22c]
dec dword [ebp - 0x22c]
test eax, eax
je 0x40143b
push 3
pop esi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x40136e
mov al, byte [ebp - 0x22c]
mov dword [ebp - 0x228], 0x1df14869
mov byte [ebp - 0x220], 0x87
mov byte [ebp - 0x21f], 0x2f
mov byte [ebp - 0x21e], 0x49
mov byte [ebp - 0x21d], 0x3a
mov byte [ebp - 0x21c], 0xe
mov byte [ebp - 0x21b], al
mov byte [ebp - 0x21a], 0xdb
mov byte [ebp - 0x219], 0x17
mov eax, 0xbab0
mov word [ebp - 0x224], ax
mov eax, 0x7891
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40143b
lea eax, [ebp - 0x218]
push eax
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
movzx eax, byte [ebp - 0x219]
push eax
movzx eax, byte [ebp - 0x21a]
push eax
movzx eax, byte [ebp - 0x21b]
push eax
movzx eax, byte [ebp - 0x21c]
push eax
movzx eax, byte [ebp - 0x21d]
push eax
movzx eax, byte [ebp - 0x21e]
push eax
movzx eax, byte [ebp - 0x21f]
push eax
movzx eax, byte [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x224]
push eax
push dword [ebp - 0x228]
lea eax, [ebp - 0x218]
push eax
push str._s_08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X_
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x38
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40143b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
je 0x4012ff
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
sete al
xor ecx, ebp
pop esi
call fcn.004034f3
leave
ret

Function at 0x4014bc
Capabilities:
Accept command line arguments

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x4014e2
movzx eax, word [esi]
cmp ax, 0x20
je 0x4014e2
cmp ax, 0x2f
je 0x4014e2
cmp ax, 0x2d
je 0x4014e2
inc esi
inc esi
jne 0x4014c9
push str.CommandLine
push dword [esp + 0xc]
call fcn.0040144f
push eax
push dword [esp + 0x18]
call fcn.00403530
push 0x4041ec
push dword [esp + 0x20]
call fcn.00403502
push esi
push dword [esp + 0x28]
call fcn.00403502
add esp, 0x20
xor eax, eax
pop esi
ret
Function at 0x401519
Capabilities:
Delete directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa08], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
lea ebx, [esp + 0x30]
mov dword [esp + 0x2c], esi
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 1
call fcn.004012dc
test al, al
jne 0x401563
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xa
push 0x4041f0
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
cmp eax, ebx
je 0x40158d
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00401b25
add esp, 0x10
jmp 0x401592
mov eax, 0x716
cmp eax, ebx
jne 0x4015c9
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 3
mov dword [esp + 0x18], ebx
call fcn.004017d1
test eax, eax
je 0x4015cc
lea esi, [esp + 0x14]
call fcn.0040179d
push ebx
jmp 0x40155d
push 1
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.00401966
cmp eax, ebx
jne 0x4015c9
lea eax, [esp + 0x240]
push eax
push esi
call fcn.004014bc
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
jne 0x4016c5
xor edi, edi
cmp word [esp + 0x240], bx
je 0x401675
lea esi, [esp + 0x240]
push 3
push 0x4041fc
push esi
call fcn.00403599
add esp, 0xc
test eax, eax
je 0x401663
push 3
push 0x404204
push esi
call fcn.00403599
add esp, 0xc
test eax, eax
je 0x401663
push 6
push 0x40420c
push esi
call fcn.00403599
add esp, 0xc
test eax, eax
je 0x40165d
push 6
push str._nodel
push esi
call fcn.00403599
add esp, 0xc
test eax, eax
jne 0x401668
mov byte [esp + 0x13], bl
jmp 0x401668
mov byte [esp + 0x12], 1
inc edi
lea esi, [esp + edi*2 + 0x240]
cmp word [esi], bx
jne 0x40160d
push str.ExecuteFiles
push dword [esp + 0x30]
call fcn.0040144f
mov esi, eax
push esi
call fcn.004035d0
add esp, 0xc
test eax, eax
je 0x4016a6
push esi
lea edx, [esp + 0x244]
lea ecx, [esp + 0x34]
call fcn.0040124c
pop ecx
jmp 0x4016bd
lea ebx, [esp + 0x240]
mov ecx, str.setup.exe
lea esi, [esp + 0x30]
call fcn.0040119c
xor ebx, ebx
mov edi, eax
cmp byte [esp + 0x13], bl
je 0x4016e0
push 1
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040186a
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea esi, [esp + 0x14]
call fcn.0040179d
cmp byte [esp + 0x12], bl
je 0x4015c9
push edi
jmp 0x40155d
Function at 0x40186a
Capabilities:
Check if file exists
Delete directory
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x40188d
and dword [esi], 0
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4018ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401956
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4018a3
push ebx
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jae 0x40193a
mov ecx, dword [esi + 8]
mov edx, dword [ecx + eax]
add eax, 4
mov dword [esi], eax
mov ebx, dword [eax + ecx]
add eax, 4
mov dword [esi], eax
cmp ebx, 2
je 0x40193a
test ebx, ebx
jne 0x4018e8
cmp dword [esi + 0xc], 1
jbe 0x4018e8
add eax, 8
mov dword [esi], eax
add dword [esi], edx
call fcn.004017be
mov edi, dword [esi]
add edi, dword [esi + 8]
push edi
call fcn.004035d0
lea eax, [eax + eax + 2]
add dword [esi], eax
pop ecx
call fcn.004017be
cmp ebx, 1
jne 0x401922
push 0
push edi
mov ecx, esi
call fcn.0040186a
test eax, eax
jne 0x401955
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4018ba
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4018ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4018ba
jmp 0x401955
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x401953
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401955
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004034f3
leave
ret 8