joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cdbf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001ce5c
push ebx
push esi
call fcn.1001cd88
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001cd1c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001ce09
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ce5b
push edi
push eax
call fcn.1001dd7a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001ce29
call fcn.1001b864
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ce5a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001cd1c
add esp, 0x20
test eax, eax
jne 0x1001ce48
push edi
call fcn.1001b864
jmp 0x1001ce50
push ebx
call fcn.1001b864
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d0c9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cc8
push 0x10024cc0
push str.FlsAlloc
push 0x1f
call fcn.1001cfe5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d0fd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023150]
call esi
jmp 0x1001d103
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d147
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cd8
push 0x10024cd0
push str.FlsGetValue
push 0x21
call fcn.1001cfe5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d17e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001d186
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024ce0
push 0x10024cd8
push str.FlsSetValue
push 0x22
call fcn.1001cfe5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d1c0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10023150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022840
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002286d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002286d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xefc000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xefc00a
jmp 0xefe00f
jmp fcn.00aa0268
Function at 0x6428fafa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x64bf3014]
mov dword [ebp - 0xc], eax
jmp 0x6428fbf5
jmp 0x6428fce2
jmp 0x6428fdcf
jmp 0x6428febc
jmp 0x6428ffa9
jmp 0x64290096
jmp 0x64290183
jmp 0x64290270
jmp 0x6429035d
jmp 0x6429044a
jmp 0x64290537
jmp 0x64290624
jmp 0x64290711
jmp 0x642907fe
jmp 0x642908eb
jmp 0x642909d8
jmp 0x64290ac5
jmp 0x64290bb2
jmp 0x64290c9f
jmp 0x64290d8c
jmp 0x64290e79
jmp 0x64290f66
jmp 0x64291053
jmp 0x64291140
jmp 0x6429122d
jmp 0x6429131a
jmp 0x64291407
jmp 0x642914f4
jmp 0x642915e1
jmp 0x642916ce
jmp 0x642917bb
cmp dword [ebp - 0xc], 0
je 0x64298ae3
mov eax, dword [0x64bf3014]
mov dword [0x64bf300c], eax
jmp 0x642918bc
jmp 0x642919a9
jmp 0x64291a96
jmp 0x64291b83
jmp 0x64291c70
jmp 0x64291d5d
jmp 0x64291e4a
jmp 0x64291f37
jmp 0x64292024
jmp 0x64292111
jmp 0x642921fe
jmp 0x642922eb
jmp 0x642923d8
jmp 0x642924c5
jmp 0x642925b2
jmp 0x6429269f
jmp 0x6429278c
jmp 0x64292879
jmp 0x64292966
jmp 0x64292a53
jmp 0x64292b40
jmp 0x64292c2d
jmp 0x64292d1a
jmp 0x64292e07
jmp 0x64292ef4
jmp 0x64292fe1
jmp 0x642930ce
jmp 0x642931bb
jmp 0x642932a8
jmp 0x64293395
jmp 0x64293482
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x64bf3008], eax
jmp 0x6429357f
jmp 0x6429366c
jmp 0x64293759
jmp 0x64293846
jmp 0x64293933
jmp 0x64293a20
jmp 0x64293b0d
jmp 0x64293bfa
jmp 0x64293ce7
jmp 0x64293dd4
jmp 0x64293ec1
jmp 0x64293fae
jmp 0x6429409b
jmp 0x64294188
jmp 0x64294275
jmp 0x64294362
jmp 0x6429444f
jmp 0x6429453c
jmp 0x64294629
jmp 0x64294716
jmp 0x64294803
jmp 0x642948f0
jmp 0x642949dd
jmp 0x64294aca
jmp 0x64294bb7
jmp 0x64294ca4
jmp 0x64294d91
jmp 0x64294e7e
jmp 0x64294f6b
jmp 0x64295058
jmp 0x64295145
mov eax, dword [0x64bf3008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x6429523d
jmp 0x6429532a
jmp 0x64295417
jmp 0x64295504
jmp 0x642955f1
jmp 0x642956de
jmp 0x642957cb
jmp 0x642958b8
jmp 0x642959a5
jmp 0x64295a92
jmp 0x64295b7f
jmp 0x64295c6c
jmp 0x64295d59
jmp 0x64295e46
jmp 0x64295f33
jmp 0x64296020
jmp 0x6429610d
jmp 0x642961fa
jmp 0x642962e7
jmp 0x642963d4
jmp 0x642964c1
jmp 0x642965ae
jmp 0x6429669b
jmp 0x64296788
jmp 0x64296875
jmp 0x64296962
jmp 0x64296a4f
jmp 0x64296b3c
jmp 0x64296c29
jmp 0x64296d16
jmp 0x64296e03
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
Function at 0x6429c490
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x64bf3008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x64bf3008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6429c59d
jmp 0x6429c68a
jmp 0x6429c777
jmp 0x6429c864
jmp 0x6429c951
jmp 0x6429ca3e
jmp 0x6429cb2b
jmp 0x6429cc18
jmp 0x6429cd05
jmp 0x6429cdf2
jmp 0x6429cedf
jmp 0x6429cfcc
jmp 0x6429d0b9
jmp 0x6429d1a6
jmp 0x6429d293
jmp 0x6429d380
jmp 0x6429d46d
jmp 0x6429d55a
jmp 0x6429d647
jmp 0x6429d734
jmp 0x6429d821
jmp 0x6429d90e
jmp 0x6429d9fb
jmp 0x6429dae8
jmp 0x6429dbd5
jmp 0x6429dcc2
jmp 0x6429ddaf
jmp 0x6429de9c
jmp 0x6429df89
jmp 0x6429e076
jmp 0x6429e163
mov dword [ebp - 0x14], 0
jmp 0x6429e257
jmp 0x6429e344
jmp 0x6429e431
jmp 0x6429e51e
jmp 0x6429e60b
jmp 0x6429e6f8
jmp 0x6429e7e5
jmp 0x6429e8d2
jmp 0x6429e9bf
jmp 0x6429eaac
jmp 0x6429eb99
jmp 0x6429ec86
jmp 0x6429ed73
jmp 0x6429ee60
jmp 0x6429ef4d
jmp 0x6429f03a
jmp 0x6429f127
jmp 0x6429f214
jmp 0x6429f301
jmp 0x6429f3ee
jmp 0x6429f4db
jmp 0x6429f5c8
jmp 0x6429f6b5
jmp 0x6429f7a2
jmp 0x6429f88f
jmp 0x6429f97c
jmp 0x6429fa69
jmp 0x6429fb56
jmp 0x6429fc43
jmp 0x6429fd30
jmp 0x6429fe1d
mov dword [ebp - 0x18], 0
jmp 0x6429ff11
jmp 0x6429fffe
jmp 0x642a00eb
jmp 0x642a01d8
jmp 0x642a02c5
jmp 0x642a03b2
jmp 0x642a049f
jmp 0x642a058c
jmp 0x642a0679
jmp 0x642a0766
jmp 0x642a0853
jmp 0x642a0940
jmp 0x642a0a2d
jmp 0x642a0b1a
jmp 0x642a0c07
jmp 0x642a0cf4
jmp 0x642a0de1
jmp 0x642a0ece
jmp 0x642a0fbb
jmp 0x642a10a8
jmp 0x642a1195
jmp 0x642a1282
jmp 0x642a136f
jmp 0x642a145c
jmp 0x642a1549
jmp 0x642a1636
jmp 0x642a1723
jmp 0x642a1810
jmp 0x642a18fd
jmp 0x642a19ea
jmp 0x642a1ad7
mov dword [ebp - 0x10], 0
jmp 0x642a1bcb
jmp 0x642a1cb8
jmp 0x642a1da5
jmp 0x642a1e92
jmp 0x642a1f7f
jmp 0x642a206c
jmp 0x642a2159
jmp 0x642a2246
jmp 0x642a2333
jmp 0x642a2420
jmp 0x642a250d
jmp 0x642a25fa
jmp 0x642a26e7
jmp 0x642a27d4
jmp 0x642a28c1
jmp 0x642a29ae
jmp 0x642a2a9b
jmp 0x642a2b88
jmp 0x642a2c75
jmp 0x642a2d62
jmp 0x642a2e4f
jmp 0x642a2f3c
jmp 0x642a3029
jmp 0x642a3116
jmp 0x642a3203
jmp 0x642a32f0
jmp 0x642a33dd
jmp 0x642a34ca
jmp 0x642a35b7
jmp 0x642a36a4
jmp 0x642a3791
mov dword [ebp - 0x10], 0
jmp 0x642ac762
jmp 0x642a388a
jmp 0x642a3977
jmp fcn.642a3a64
mov eax, dword [0x64bf3008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x642a379d
nop
leave
ret

Function at 0x642fd9e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x64bf2040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.642fda40
Function at 0x642fda40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x64bf3378]
test esi, esi
jle 0x642fdb2d
mov edi, dword [0x64bf337c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x642fda74
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x642fdb26
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x642fda60
mov dword [esp], eax
mov esi, eax
call fcn.642fe1e0
test eax, eax
mov edi, eax
je 0x642fdb6a
mov esi, dword [0x64bf337c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.642fe2f0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x64bf337c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x642fdb4a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x642fdb1f
sub eax, 0x40
and eax, 0xffffffbf
je 0x642fdb1f
mov eax, dword [esp + 0x20]
add ebx, dword [0x64bf337c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x642fdb34
add dword [0x64bf3378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x642fda7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.642fd9e0
mov eax, dword [0x64bf337c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.642fd9e0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.642fd9e0
lea esi, [esi]

Function at 0x642fde50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x64bf3388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x64bf3380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x642fdea5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x642fde9e
test esi, esi
je 0x642fde9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x642fde80
mov dword [esp], 0x64bf3388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403830
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x108]
sub eax, 2
jne 0x4038af
cmp dword [ebp - 0x114], 6
jae 0x403879
cmp dword [ebp - 0x110], 2
jb 0x4038af
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51033c], eax
test eax, eax
jne 0x403937
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlInitUnicodeString
push str.ntdll.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [0x510350], eax
test eax, eax
je 0x40389d
push str.NtUnmapViewOfSection
push str.ntdll.dll
call esi
push eax
call edi
mov dword [0x510344], eax
test eax, eax
je 0x40389d
push str.NtOpenSection
push str.ntdll.dll
call esi
push eax
call edi
mov dword [0x510348], eax
test eax, eax
je 0x40389d
push str.NtMapViewOfSection
push str.ntdll.dll
call esi
push eax
call edi
mov dword [0x51034c], eax
test eax, eax
je 0x40389d
push str.RtlNtStatusToDosError
push str.ntdll.dll
call esi
push eax
call edi
mov dword [0x510340], eax
test eax, eax
je 0x40389d
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x403950
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x44], edx
mov edi, ecx
call fcn.00403830
test al, al
je 0x403a23
movups xmm0, xmmword [str.devicephysicalmemory]
mov eax, dword [0x4fcc8c]
mov dword [ebp - 0xc], eax
mov ax, word [0x4fcc90]
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 8], ax
lea eax, [ebp - 0x34]
movups xmm0, xmmword [0x4fcc74]
push eax
lea eax, [ebp - 0x6c]
movups xmmword [ebp - 0x24], xmm0
push eax
movq xmm0, qword [0x4fcc84]
movq qword [ebp - 0x14], xmm0
call dword [0x510350]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x64], 0x18
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x64]
push eax
push 4
lea eax, [ebp - 0x40]
mov dword [ebp - 0x60], 0
push eax
mov dword [ebp - 0x58], 0x40
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
call dword [0x510348]
test eax, eax
jns 0x403a36
push 0
push 0
lea ecx, [ebp - 0x44]
push ecx
push 0x400
push eax
call dword [0x510340]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x403a23
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov dword [ebp - 0x4c], 0
mov eax, edi
mov dword [ebp - 0x48], edi
div dword [ebp - 0x8c]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
push 2
push 0
push 1
push ecx
mov esi, edx
mov dword [ebp - 0x44], 0
add eax, esi
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x3c], eax
push ecx
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
push 0xffffffffffffffff
push ebx
call dword [0x51034c]
test eax, eax
jns 0x403add
push 0
push 0
lea ecx, [ebp - 0x40]
push ecx
push 0x400
push eax
call dword [0x510340]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x38]
call fcn.004b90b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x3c]
call fcn.004b90cb
mov edi, eax
add esp, 4
test edi, edi
je 0x403a23
mov ecx, dword [ebp - 0x3c]
sub ecx, esi
mov esi, dword [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x38]
add ecx, esi
push ecx
push edi
call fcn.004b5860
add esp, 0xc
push esi
push 0xffffffffffffffff
call dword [0x510344]
test eax, eax
jns 0x403b42
push 0
push 0
lea ecx, [ebp - 0x38]
push ecx
push 0x400
push eax
call dword [0x510340]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x403b60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x108]
sub eax, 2
je 0x403ba8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x114], 6
jae 0x403bbf
cmp dword [ebp - 0x110], 2
mov eax, 2
jb 0x403bc4
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret

Function at 0x403cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
mov eax, 0x4fcc94
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
mov ecx, 0x4fcc98
push edi
mov edi, dword [ebp + 0xc]
cmove eax, ecx
push eax
push edi
call fcn.004c37da
mov esi, eax
add esp, 8
test esi, esi
jne 0x403d32
push edi
push 0x4fcc9c
push 2
call fcn.004c2c3e
add esp, 4
push eax
call fcn.00402a00
add esp, 0xc
push str.fopen
call fcn.004c5c99
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
push esi
call fcn.004c3486
add esp, 0xc
test eax, eax
je 0x403d49
mov ebx, str.fseek
jmp 0x403d64
push esi
push 1
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.004c36c0
add esp, 0x10
cmp eax, 1
je 0x403d99
mov ebx, str.fwrite
push 2
call fcn.004c2c3e
add esp, 4
push edi
push 0x4fcc9c
push eax
call fcn.00402a00
add esp, 0xc
push ebx
call fcn.004c5c99
add esp, 4
push esi
call fcn.004c2d39
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004c2d39
add esp, 4
test eax, eax
je 0x403dd6
push edi
push 0x4fcc9c
push 2
call fcn.004c2c3e
add esp, 4
push eax
call fcn.00402a00
add esp, 0xc
push str.fclose
call fcn.004c5c99
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404a50
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 1
push 0x23
lea eax, [ebp - 0x108]
mov esi, ecx
push eax
mov dword [ebp - 0x10c], esi
push 0
mov dword [ebp - 0x10c], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x404a9b
push str.c:windows_temp
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x108]
push edi
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
jne 0x404ac2
push 0
lea eax, [ebp - 0x108]
push eax
call edi
push str.Thunder_Network
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x404aed
push 0
lea eax, [ebp - 0x108]
push eax
call edi
push str.DownloadLib
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x404b18
push 0
lea eax, [ebp - 0x108]
push eax
call edi
lea ecx, [ebp - 0x108]
mov dword [esi + 0x10], 0
pop edi
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
pop ebx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404b34
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
mov ecx, esi
call fcn.00407780
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x412ea0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, esi
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 0x10
jb 0x412ec7
mov eax, dword [esi]
push 0x64
mov byte [eax], 0
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004b5de0
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push 0
push 0
push 0
push eax
push 0x64
lea eax, [ebp - 0x7c]
push eax
push 0x4fd084
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x412f0c
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x80]
mov eax, ecx
shr eax, 0x18
push 0
push 0
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x18]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.00402ab0
lea edx, [ebp - 0x18]
add esp, 0x20
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x412f46
sub edx, ecx
lea eax, [ebp - 0x18]
push edx
push eax
mov ecx, esi
call fcn.00407780
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x413720
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b18
call fcn.004b4380
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
mov esi, ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4138ab
push 0x2710
lea eax, [ebp - 0x2afc]
mov dword [ebp - 0x2b00], 0
push 0
push eax
mov dword [ebp - 0x2b08], 0
mov dword [ebp - 0x2b04], 0
call fcn.004b5de0
add esp, 0xc
mov dword [ebp - 0x2b14], 0
lea eax, [ebp - 0x2b14]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2afc]
push eax
push 0xc
lea eax, [ebp - 0x2b08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4138a4
mov edx, dword [ebp - 0x2ae4]
lea eax, [ebp - 0x3ec]
push eax
push ecx
lea ecx, [ebp - 0x2afc]
call fcn.004135b0
movsx eax, byte [ebp - 0x3ec]
push eax
call fcn.004b94b0
add esp, 0xc
test eax, eax
jne 0x413815
movsx eax, byte [ebp - 0x3d9]
push eax
call fcn.004b94b0
add esp, 4
test eax, eax
je 0x4138a4
lea ecx, [ebp - 0x3ec]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413820
sub ecx, edx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, esi
call fcn.00407780
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 0x2b09], 0x20
jb 0x413859
mov eax, dword [esi]
add eax, dword [esi + 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0x2b10], eax
mov eax, dword [esi]
add eax, dword [esi + 0x10]
jmp 0x413869
mov eax, dword [esi + 0x10]
lea ecx, [esi + eax]
add eax, esi
mov dword [ebp - 0x2b10], ecx
mov ecx, esi
push eax
push ecx
lea edx, [ebp - 0x2b09]
lea ecx, [ebp - 0x2b18]
call fcn.00414080
add esp, 8
mov ecx, esi
push dword [ebp - 0x2b10]
push dword [eax]
lea eax, [ebp - 0x2b10]
push eax
call fcn.00413fe0
cmp dword [esi + 0x10], 0
mov eax, 1
movzx ebx, bl
cmovne ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x41af10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41af69
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41af69
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x41af5a
cmp esi, edx
jae 0x41af69
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x41af48
cmp esi, edx
jae 0x41af69
cmp word [esi], 0
je 0x41af69
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret