joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b060
Capabilities:
Allocate thread local storage
Contain obfuscated stackstrings
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x419060]
xor eax, esp
mov dword [esp + 0x150], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [0x5fa840], ecx
call fcn.00409cf0
push 0x40aed0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea esi, [esp + 0x30]
mov dword [0x5f643c], 0x408ed0
call fcn.00403c30
xor ebx, ebx
cmp dword [esp + 0x30], ebx
je 0x40b0bd
mov ebx, 1
cmp dword [esp + 0x34], 0
je 0x40b0c7
or ebx, 2
cmp dword [esp + 0x38], 0
je 0x40b0d1
or ebx, 4
cmp dword [esp + 0x3c], 0
je 0x40b0db
or ebx, 8
cmp dword [esp + 0x40], 0
je 0x40b0ec
cmp dword [esp + 0x48], 1
jle 0x40b0ec
or ebx, 0x10
lea edi, [esp + 0x30]
call fcn.00409eb0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0xffff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x419f60
mov byte [esp + 0x15e], 0
mov byte [esp + 0x154], 0x57
mov byte [esp + 0x155], 0x6d
mov byte [esp + 0x156], 0x74
mov byte [esp + 0x157], 0x76
mov byte [esp + 0x158], 0x4f
mov byte [esp + 0x159], 0x33
mov byte [esp + 0x15a], 0x4d
mov byte [esp + 0x15b], 0x49
mov byte [esp + 0x15c], 0x7a
mov byte [esp + 0x15d], 0x6b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x18], 0x417ac8
mov dword [esp + 0x1c], 0x417adc
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x408e80
mov dword [esp + 0x28], 0x408eb0
mov dword [esp + 0x2c], 0x408ef0
call fcn.00408d40
mov edi, dword [sym.imp.KERNEL32.dll_RaiseException]
test eax, eax
jne 0x40b202
lea edx, [esp + 0xc]
mov dword [esp + 0xc], str.Initialization_error_1
push edx
push 1
push 1
push 0x20555a43
call edi
lea eax, [esp + 0xc]
push eax
push 1
push 1
push 0x20555a43
mov dword [esp + 0x1c], str.Initialization_error_3
call edi
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040b281
mov esp, ebp
pop ebp
ret 0x10
push 0x6fa940
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
mov dword [0x5fa844], eax
call fcn.004014c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b251
push esi
call fcn.00408cd0
lea eax, [esp + 0x154]
add esp, 4
push eax
mov ecx, esi
call fcn.004017a0
add esp, 4
test eax, eax
je 0x40b1d1
mov edx, dword [esp + 0xc]
push ebx
push edx
call eax
add esp, 8
jmp 0x40b1e9
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], str.Initialization_error_2
push ecx
jmp 0x40b1c6

Function at 0x40b281
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419060]
jne 0x40b28b
repz ret
jmp fcn.0040bcec
Function at 0x411be1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040dc32
and dword [ebp - 4], 0
cmp dword [0x5dfefc], 0
mov ebx, eax
jne 0x411c92
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411d43
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x416b04
push edi
call esi
test eax, eax
je 0x411d43
push eax
call fcn.0040dbc0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5dfefc], eax
call esi
push eax
call fcn.0040dbc0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5dff00], eax
call esi
push eax
call fcn.0040dbc0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5dff04], eax
call esi
push eax
call fcn.0040dbc0
pop ecx
mov dword [0x5dff0c], eax
test eax, eax
je 0x411c92
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dbc0
pop ecx
mov dword [0x5dff08], eax
mov eax, dword [0x5dff08]
cmp eax, ebx
je 0x411cea
cmp dword [0x5dff0c], ebx
je 0x411cea
push eax
call fcn.0040dc3b
push dword [0x5dff0c]
mov esi, eax
call fcn.0040dc3b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411cea
test edi, edi
je 0x411cea
call esi
test eax, eax
je 0x411ce1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411ce1
test byte [ebp - 0xc], 1
jne 0x411cea
or dword [ebp + 0x10], 0x200000
jmp 0x411d23
mov eax, dword [0x5dff00]
cmp eax, ebx
je 0x411d23
push eax
call fcn.0040dc3b
pop ecx
test eax, eax
je 0x411d23
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411d23
mov eax, dword [0x5dff04]
cmp eax, ebx
je 0x411d23
push eax
call fcn.0040dc3b
pop ecx
test eax, eax
je 0x411d23
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5dfefc]
call fcn.0040dc3b
pop ecx
test eax, eax
je 0x411d43
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411d45
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000118f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100011a4
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x100011b6
xor eax, eax
jmp 0x100011e8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100011da
cmp esi, eax
jae 0x100011b2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100011cc
cmp esi, eax
jae 0x100011b2
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x10001599
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, str.Path
jne 0x100015fc
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
add ebx, 0x114
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
push str.SOFTWAREThunder_NetworkMiniThunderMinithunder_backwnd
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x100017cb
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x1000182d
push ebx
push edi
push edi
push edi
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, edi
je 0x1000182c
push esi
mov esi, dword [ebp + 0xc]
push 0x18
push ebx
push esi
call sub.MSVCR71.dll_memcpy
add esp, 0xc
cmp dword [esi], 1
jne 0x10001824
cmp dword [esi + 4], edi
jne 0x10001824
cmp dword [esi + 8], edi
jne 0x10001824
cmp dword [esi + 0xc], 1
jne 0x10001824
mov esi, dword [esi + 0x10]
cmp esi, edi
je 0x10001821
cmp esi, 1
jne 0x10001824
mov dword [ebp - 4], esi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x10001ed6
Capabilities:
Get file version info

Disassembly:
mov eax, 0x100080e5
call fcn.10007c20
sub esp, 0x110
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.10001e6b
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x40
xor eax, eax
test esi, esi
mov byte [ebp - 0x11c], 0
pop ecx
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x10001f2b
push 0x104
lea eax, [ebp - 0x11c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x11c]
lea eax, [ebp - 0x14]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 0x10], eax
je 0x10001f8f
push eax
call fcn.1000787e
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10001f88
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0x10009500
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10001f88
push 0x34
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.MSVCR71.dll_memcpy
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
xor esi, esi
add esp, 0x10
inc esi
jmp 0x10001f91
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
pop ecx
xor esi, esi
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.100012ba
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10003d21
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10003d3b
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc

Function at 0x10003d64
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10003d6f
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10004829
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push edi
push dword [ebp + 0x14]
mov edi, SysReAllocStringLen
push edi
call esi
push dword [ebp + 0x14]
call sub.MSVCR71.dll_strlen
add eax, 3
push eax
call fcn.1000787e
push dword [ebp + 0x14]
mov ebx, eax
push ebx
call sub.MSVCR71.dll_strcpy
push 0x10009b14
push ebx
call sub.MSVCR71.dll_strcat
add esp, 0x18
push ebx
push edi
call esi
push ebx
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
xor ebx, ebx
test eax, eax
jne 0x100048dd
cmp dword [ebp - 4], ebx
je 0x100048dd
push ebx
push ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str.CLSID_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push edi
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_StringFromIID]
test eax, eax
jne 0x1000493d
cmp dword [ebp - 4], ebx
je 0x1000493d
push ebx
push ebx
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push str.TypeLib_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push edi
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ole32.dll_StringFromIID]
test eax, eax
jne 0x1000499d
cmp dword [ebp - 4], ebx
je 0x1000499d
push ebx
push ebx
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x108]
push str.Interface_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push edi
call esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x100049a5
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
push esi
push edi
push 0x19
pop ecx
push 7
xor eax, eax
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExtStats485463B7_8FB2_4B3B_B29B_8B919B0EACCEiexplore
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp + 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x74]
push eax
xor esi, esi
push esi
push 0x20006
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10004a13
push 4
pop eax
push eax
lea ecx, [ebp + 0x70]
push ecx
push eax
push esi
push str.Flags
push dword [ebp + 0x74]
mov dword [ebp + 0x70], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x10004cd8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.10003cec
cmp eax, esi
jne 0x10004d50
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x10004d19
lea eax, [ebp - 0x110]
push eax
call fcn.10004cd8
cmp eax, esi
jne 0x10004d4f
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x10004d09
call fcn.10003c87
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.10003c87
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x10004f18
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1000c2d0]
test eax, eax
jne 0x10004f31
call sym.ThunderAgent.DLL_RegisterServerDirect
leave
ret
push ebx
push esi
push edi
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.ThunderAgent_Now.dll
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x210]
push eax
mov ebx, str._sThunderAgent_OLD__d.dll
lea eax, [ebp - 0x10c]
push ebx
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
jmp 0x10004ff0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x314]
push eax
call esi
test eax, eax
je 0x10004fd9
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
inc dword [ebp - 4]
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push ebx
push eax
call edi
lea eax, [ebp - 0x10c]
add esp, 0x10
push eax
call esi
test eax, eax
jne 0x10004fab
lea eax, [ebp - 0x314]
push eax
call esi
test eax, eax
je 0x10005021
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 8], eax
je 0x100050a2
push 0x10009cd4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005099
call eax
and dword [ebp - 4], 0
push 0
jmp 0x10005078
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc dword [ebp - 4]
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push ebx
push eax
call edi
lea eax, [ebp - 0x10c]
add esp, 0x10
push eax
call esi
test eax, eax
jne 0x10005065
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10006c0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x10008274
call fcn.10007c20
sub esp, 0x418
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x1000c040]
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x424], ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], 1
je 0x10006c94
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
cmp esi, 0x400
jg 0x10006c7c
push esi
call fcn.10003b2f
test al, al
pop ecx
je 0x10006c7c
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.10007bd0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x10006c85
push esi
lea ecx, [ebp - 0x14]
call fcn.10003ba3
push edi
push esi
push dword [ebp + 8]
push eax
call fcn.100010db
cmp eax, ebx
jne 0x10006cb7
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10006cad
lea ecx, [ebp - 0x424]
call fcn.10004ac9
mov esi, 0x8007000e
jmp 0x10006d92
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x18], edi
jne 0x10006cd6
call fcn.10003c30
mov esi, eax
jmp 0x10006d79
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x10006cf8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x10006cff
call fcn.10003c30
jmp 0x10006d6e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x424]
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
call fcn.1000511f
jmp 0x10006d2c
cmp dword [ebp - 0x424], ebx
mov dword [ebp - 4], 1
jne 0x10006d42
mov esi, 0x8007000e
jmp 0x10006d70
push esi
push dword [ebp + 0x10]
push dword [ebp - 0x424]
call sub.MSVCR71.dll_memcpy
mov eax, dword [ebp - 0x424]
add esp, 0xc
push dword [ebp + 0x14]
mov byte [esi + eax], bl
push dword [ebp - 0x424]
lea ecx, [ebp - 0x20]
call fcn.100064d3
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10006d92
lea ecx, [ebp - 0x424]
call fcn.10004ac9
lea ecx, [ebp - 0x14]
call fcn.10003b89
mov eax, esi
lea esp, [ebp - 0x430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100075e6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1000c280]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.10007568
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR71.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10007648
cmp dword [ebp - 0x1c], 5
jb 0x10007660
jmp 0x1000765c
cmp dword [ebp - 0x10], 1
jne 0x10007660
cmp dword [ebp - 0x1c], 4
ja 0x1000765c
jne 0x10007660
cmp dword [ebp - 0x18], 0
jbe 0x10007660
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x10009fc4
call fcn.1000113f
test eax, eax
jge 0x10007681
mov byte [0x1000c298], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.10007f95
add ebp, 0x78
leave
ret
Function at 0x4010c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010d7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401108
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401104
cmp esi, eax
jae 0x401108
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4010f4
cmp esi, eax
jb 0x40110e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4011a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebp
push esi
push 0x410fb0
xor ebp, ebp
push 0x86
push ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebp
je 0x40122f
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
je 0x401228
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
je 0x401220
mov eax, dword [esp + 0x18]
push ebp
push ebp
push 2
push ebp
push ebp
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebp
je 0x401220
push ebp
lea ecx, [esp + 0x14]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
lea eax, [ebp + 1]
pop ebp
pop ecx
ret
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
pop esi
mov eax, ebp
pop ebp
pop ecx
ret

Function at 0x401240
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x41313c]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x401297
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x114
call esi
test eax, eax
jne 0x401297
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004039ac
add esp, 0x120
ret
mov ecx, dword [esp + 0x120]
xor eax, eax
cmp dword [esp + 8], 6
pop esi
sete al
xor ecx, esp
call fcn.004039ac
add esp, 0x120
ret
Function at 0x4012c0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
push str.MSDNWEB
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
jne 0x4012de
pop esi
pop ecx
ret
mov eax, dword [esp + 0xc]
push edi
push 0
push 0x80000000
push 0
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
jne 0x401309
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov dword [esp + 8], 0x400
test ebx, ebx
je 0x401329
lea ecx, [esp + 8]
push ecx
push 0x400
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x401331
mov dword [esp + 8], 1
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
xor edx, edx
cmp edx, dword [esp + 8]
pop edi
sbb eax, eax
neg eax
pop esi
pop ecx
ret