joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fe9ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5e74]
add ecx, 0xffffea42
mov dword [0x101f5e78], ecx
mov dword [ebp - 0x10], eax
call fcn.100ff5b5
mov ecx, eax
add eax, 0x3c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov dword [0x101f5e74], 0x1516
mov esi, dword [ebp - 0x14]
mov edx, dword [esi + edx + 0x78]
mov dword [0x101f5e74], 0x11d0
add esi, dword [esi + edx + 0x20]
mov dword [0x101f5e78], 0x6c2
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + edx + 0x18]
cmp ebx, 0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
je 0x100feb3e
jmp 0x100fea68
mov eax, dword [ebp - 0x2c]
add eax, 1
mov cl, byte [ebp - 0x2d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x34], eax
jne 0x100fea84
jmp 0x100fead1
mov eax, 0xffffefb4
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
jmp 0x100feaaf
mov eax, dword [ebp - 0x34]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], bh
mov byte [ebp - 0x2e], cl
je 0x100fead1
jmp 0x100fea3e
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
xor esi, esi
mov edi, dword [ebp - 0x24]
mov ebx, dword [edi + eax*4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], esi
jmp 0x100fea84
mov al, byte [ebp - 0x2e]
test al, 1
jne 0x100feb12
jmp 0x100feada
mov eax, 0xffffeebe
xor ecx, ecx
mov dword [0x101f5e74], 0x10da
mov edx, dword [ebp - 0x4c]
add edx, 2
mov esi, dword [ebp - 0x48]
add esi, 1
mov edi, dword [ebp - 0x1c]
cmp esi, edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x28], ecx
jb 0x100feaaf
jmp 0x100feb3e
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x50]
mov dword [0x101f5e78], edx
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add esi, dword [esi + edi + 0x1c]
mov ebx, dword [ebp - 0x14]
add ebx, dword [esi + ecx*4]
mov dword [0x101f5e74], 0x1a69
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ff265
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [0x101f5e78], 0x26bd
mov dword [0x101f5e74], 0xe95
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0xc8
mov edi, edx
add edi, esi
add edi, 0x84
mov esi, dword [edi]
imul edi, eax, 0xc8
add edx, edi
add edx, 0x3c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x1ac
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x100ff292
lea eax, [0x10100867]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x101f5e78], 0x130b
mov dword [0x101f5e74], 0x1346
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.100fe5e0
mov dword [0x101f5e78], 0xb5d
mov dword [0x101f5e74], 0x6c2
call fcn.100fedf1
mov dword [esp], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
call fcn.100fe434
mov ecx, eax
mov dword [0x101f5e94], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0xc8
mov edi, edx
add edi, esi
add edi, 0x84
mov esi, dword [edi]
imul edi, eax, 0xc8
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0xc8
add edx, ebx
add edx, 0x3c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.100ff481
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x1ac
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x100ff375
mov dword [0x101f5e78], 0x9b1
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
call fcn.100feb49
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x5d446
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov ecx, dword [0x101f5e74]
add ecx, 0x183c
mov dword [0x101f5e74], ecx
mov dword [edx + 4], 0x152000
mov dword [0x101f5e78], 0x13e1
mov ecx, dword [ebp - 0x48]
add ecx, 0x2becd
mov dword [edx + 8], ecx
mov ecx, dword [0x101f5e74]
add ecx, 0x1510
mov dword [0x101f5e74], ecx
mov dword [edx + 0xc], 0x20c0
mov ecx, dword [0x101f5e78]
add ecx, 0xfffff7d7
mov dword [0x101f5e78], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ff733
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101f5e7c], 0
mov dword [0x101f5e80], 0
mov dword [0x101f5e8c], 0
mov dword [0x101f5e78], 0x222c
mov dword [0x101f5e74], 0x4207
cmp eax, 0
sete bl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
xor eax, eax
mov ecx, 0x4207
mov dl, byte [ebp - 0x1d]
test dl, 1
mov esi, eax
mov edi, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
jne 0x100ff8f7
jmp 0x100ff7b6
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
add ecx, 0xfffff351
mov dword [0x101f5e74], ecx
add edx, 1
mov dword [ebp - 0x34], eax
mov eax, edx
cdq
idiv edi
mov dword [0x101f5e7c], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x101f5e80], edx
mov dword [0x101f5e74], 0x1bda
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101f5e84], cl
mov dword [0x101f5e74], 0x297
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101f5e74], 0x2f0
mov cl, byte [0x101f5e84]
mov edx, dword [0x101f5e80]
mov byte [edi + edx], cl
mov edx, dword [0x101f5e7c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101f5e80]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x101f5e78], 0xffffe4ab
and ebx, 0xff
mov dword [0x101f5e8c], ebx
mov dword [0x101f5e74], 0x1696
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov byte [0x101f5e91], ch
mov byte [0x101f5e92], cl
xor ch, cl
mov byte [0x101f5e90], ch
mov dword [0x101f5e78], 0xffffef26
mov dword [0x101f5e74], 0x15f1
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
je 0x100ff8f7
mov eax, dword [0x101f5e74]
mov ecx, dword [0x101f5e7c]
mov edx, dword [0x101f5e80]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], esi
jmp 0x100ff7b6
mov dword [0x101f5e78], 0x23ec
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ff909
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000106e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x100ffa62
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x20], ecx
call fcn.100ff265
lea ecx, [0x100fec84]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x60], edx
mov dword [0x101f5e78], 0x1082
mov dword [esp + 0x50], 0x152000
mov edx, dword [0x101f5e60]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101f5e64]
mov dword [esp + 0x5c], edx
mov edx, dword [0x101f5e68]
mov dword [esp + 0x64], edx
mov edx, dword [0x101f5e6c]
mov dword [esp + 0x58], edx
mov edx, dword [0x101f5e70]
mov dword [esp + 0x48], edx
mov dword [0x101f5e74], 0xffffe113
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x100ff9c6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x100ff9da
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x100ff9a3
mov eax, dword [esp + 0x10]
add eax, 0x50
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x94], ecx
mov dword [0x101f5e74], 0x1516
add ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [esp + 0x38], ecx
mov dword [0x101f5e78], 0x3a6
call fcn.100fe25f
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x100ffa5a
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.100fe7fa
mov dword [0x101f5e78], 0x2491
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 8], eax
jmp 0x100ffa5a
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x41c9e2
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x41ca8e
sub ecx, 1
je 0x41ca80
sub ecx, 1
je 0x41ca72
sub ecx, 1
je 0x41ca3f
sub ecx, 1
jne 0x41cad0
push 1
sub esp, 0x18
mov ecx, esp
push 0x46611c
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x466118
jmp 0x41cabc
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c5f0
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x46611c
jmp 0x41cabc
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c9f8
jmp 0x41ca4b
push 1
sub esp, 0x18
mov ecx, esp
push 0x466104
jmp 0x41ca4b
push 1
sub esp, 0x18
mov ebx, 0x46611c
mov ecx, esp
push ebx
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402093
push str.TileWallpaper
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x41cd9b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [0x474b18]
test bl, bl
mov dword [0x474b34], eax
pop ebx
jne 0x41cdc3
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0043c1b8
push eax
push 0x46ce14
push str.CONOUT_
call fcn.00441c22
add esp, 0x10
push 0x4e4
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call fcn.0041cd58
push 0x64
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00436e90
lea eax, [ebp - 0x64]
push str._n_tRemcos_v
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push str.5.1.0_Pro
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push 0x46cf18
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push eax
call fcn.00407200
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x401400
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x588e70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x68], 0
call fcn.005144f0
add esp, 0xc
push str.WNASPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x401458
push str.LoadLibrary:_nWNASPI32.DLL_not_found.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005144d7
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetASPI32SupportInfo
push eax
call edi
mov dword [esi + 0x128], eax
test eax, eax
jne 0x40147b
push str.GetProcAddress:_nGetASPI32SupportInfo_not_fount.
jmp 0x40152c
mov ecx, dword [esi + 0x114]
push str.SendASPI32Command
push ecx
call edi
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x40149d
push str.GetProcAddress:_ngpfnSendASPI32Command_not_found.
jmp 0x40152c
mov edx, dword [esi + 0x128]
call edx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
lea edx, [ecx - 1]
cmp edx, 0xe2
ja case.0x4014bf.2
movzx edx, byte [edx + 0x401558]
jmp dword [edx*4 + 0x401544]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
jne 0x4014df
push str.Could_not_create_the_event_object.
jmp 0x40152c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005144d7
mov esp, ebp
pop ebp
ret
push str.Could_not_find_the_ASPI_manager.
jmp 0x40152c
push str.ASPI_for_Windows_does_not_support_real_mode.
jmp 0x40152c
push str.Old_ASPI_manager.
jmp 0x40152c
push ecx
movzx eax, al
push eax
push str.Error_initializing_ASPI__x__x
lea ecx, [ebp - 0x68]
push 0x64
push ecx
call fcn.00514498
add esp, 0x14
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.005144d7
mov esp, ebp
pop ebp
ret
Function at 0x4019f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x588e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 8]
push esi
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x68], 0
call fcn.005144f0
mov eax, dword [0x58a340]
add esp, 0xc
test eax, eax
je 0x401a33
cmp byte [0x58301c], bl
je 0x401a70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx ecx, bl
movsx edx, byte [ecx + esi + 0x10c]
push edx
push str.._c:
lea eax, [ebp - 0x68]
push 0x64
push eax
call fcn.00514498
add esp, 0x10
push 0
push 0
push 3
push 0
push 3
push 0x80
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x58a340], eax
cmp eax, 0xffffffff
jne 0x401ac1
mov dword [0x58a340], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_occur_during_getting_the_handle_of_Device_nError_Code__d
lea edx, [ebp - 0x68]
push 0x64
push edx
mov dword [ebp - 0x6c], eax
call fcn.00514498
add esp, 0x10
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov byte [0x58301c], 0xff
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005144d7
mov esp, ebp
pop ebp
ret 8
push 0
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0
push 1
lea edx, [ebp + 0xc]
push edx
push 0x2d0944
push eax
mov byte [0x58301c], bl
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x401b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceIoControl_Error:_Error_Code__d_nI_cant_stop_or_do__issuing_GESN_from_Window
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
push 0x64
push eax
call fcn.00514498
add esp, 0x10
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005144d7
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.005144d7
mov esp, ebp
pop ebp
ret 8

Function at 0x4025c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4025db
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402612
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40260e
jmp 0x402600
cmp esi, eax
jae 0x402612
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402600
cmp esi, eax
jb 0x402619
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dx, word [ebp - 4]
mov dword [ebp - 8], eax
mov si, word [ebp - 8]
lea eax, [edi + 5]
mov ecx, 0x1f
movzx ebx, byte [eax - 1]
add dx, bx
movzx ebx, byte [eax]
add si, bx
add eax, 2
dec ecx
jne 0x402c93
mov cx, word [edi + 0x42]
mov word [ebp - 8], si
mov eax, dword [ebp - 8]
mov word [ebp - 4], dx
add dword [ebp - 4], eax
cmp cx, word [ebp - 4]
je 0x402cf1
push 0x25
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.Invalid_F_W___Header_Checksum_Error
call fcn.00402bb0
lea ecx, [edi + 0x68]
call fcn.00403dd0
mov edx, dword [edi + 0x68]
mov eax, dword [edx + 0x170]
lea ecx, [edi + 0x68]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi + 0x3a]
add esi, dword [edi + 0x34]
push 1
lea ecx, [esi + 1]
push ecx
call fcn.00514e17
mov ebx, dword [ebp + 8]
add esp, 8
push 0
push 0
push 0x40
push ebx
mov dword [edi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 0x44]
push 0
lea edx, [ebp + 8]
push edx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0x34]
lea ecx, [esi - 2]
mov dword [ebp - 8], 0
mov dx, word [ebp - 8]
mov dword [ebp + 8], eax
cmp eax, ecx
jae 0x402d54
mov esi, dword [edi + 0x44]
movzx ebx, byte [esi + eax]
inc eax
add dx, bx
mov dword [ebp + 8], eax
cmp eax, ecx
jb 0x402d45
cmp dx, word [edi + 0x40]
je 0x402d6c
push 0x25
push ecx
mov ecx, esp
mov dword [ebp - 8], esp
push str.Invalid_F_W___Data_Checksum_Error
jmp 0x402ccb
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 0xc]
push ebx
dec eax
push esi
push edi
mov dword [ebp - 8], ecx
cmp eax, 0xb
ja case.default.0x402d9a
jmp dword [eax*4 + 0x402f50]
mov esi, 0xe0000
mov dword [ebp - 4], 0xe706a
jmp 0x402e3d
mov edi, 0xe000
mov esi, 0xe0000
mov dword [ebp - 4], 0xe706a
jmp 0x402e42
mov edi, 0x10000
mov esi, 0x1e0000
mov dword [ebp - 4], 0x1e706a
mov ebx, 0x200000
jmp 0x402e47
xor edi, edi
mov esi, 0x1d8000
mov dword [ebp - 4], 0x1ec054
mov ebx, 0x200000
jmp 0x402e47
cmp dword [ecx + 0x60], 0
mov ebx, 0x100000
je 0x402e10
mov edi, 0xb000
mov esi, 0xef000
mov dword [ebp - 4], 0xf906a
jmp 0x402e47
mov edi, 0xe000
mov esi, 0xe0000
mov dword [ebp - 4], 0xe706a
jmp 0x402e47
mov esi, 0xe7000
mov dword [ebp - 4], 0xe706a
jmp 0x402e3d
mov esi, 0xee000
mov dword [ebp - 4], 0xee06a
mov edi, 0x7000
mov ebx, 0x100000
push 1
push ebx
call fcn.00514e17
mov ecx, dword [ebp - 8]
add esp, 8
cmp dword [ebp + 0x10], 1
push 0
mov dword [ecx + 0x44], eax
push 0
jne 0x402e6a
mov edx, dword [ebp + 8]
push 4
push edx
jmp 0x402e70
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push ebx
mov ebx, dword [ebp - 8]
mov edx, dword [ebx + 0x44]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, edi
mov dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
cmp edi, esi
jae 0x402ed9
mov ecx, dword [ebx + 0x44]
mov dx, word [ebp + 8]
jmp 0x402eb0
movzx edi, byte [ecx + eax + 1]
mov ebx, 0x100
imul di, bx
movzx ebx, byte [ecx + eax]
add di, bx
add eax, 2
add dx, di
mov dword [ebp + 0x10], eax
cmp eax, esi
jb 0x402eb0
mov ebx, dword [ebp - 8]
mov word [ebp + 8], dx
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebp - 4]
lea eax, [ecx + edx]
mov cl, byte [eax]
cmp cl, byte [ebp + 8]
jne 0x402f02
mov edx, dword [ebp + 8]
shr edx, 8
cmp byte [eax + 1], dl
jne 0x402f02
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [ebp + 0xc], 4
jne 0x402f1a
mov edx, dword [ebp + 8]
shr edx, 8
cmp cl, dl
jne 0x402f1a
mov cl, byte [ebp + 8]
cmp byte [eax + 1], cl
je 0x402ef4
push 0x25
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.Invalid_F_W___Checksum_is_NOT_matched___
call fcn.00402bb0
lea ecx, [ebx + 0x68]
call fcn.00403dd0
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0x170]
lea ecx, [ebx + 0x68]
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406b20
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x588e70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.lgfwup.txt
lea ecx, [ebp - 0x308]
push 0x104
push ecx
call fcn.005156ec
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x308]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406bbb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406baa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005144d7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push ecx
push str.MODEL_s_r_n
lea edx, [ebp - 0x104]
push 0xff
push edx
call fcn.00514498
add esp, 0x10
cmp dword [ebp + 0xc], 1
jne 0x406bf1
push str.STATUSOK_r_n
push 0xff
lea eax, [ebp - 0x204]
push eax
jmp 0x406c02
push str.STATUSNG_r_n
push 0xff
lea ecx, [ebp - 0x204]
push ecx
call fcn.00514498
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x104]
push 0xff
push eax
call fcn.005156ec
lea eax, [ebp - 0x104]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c30
push 0
lea ecx, [ebp - 0x30c]
push ecx
sub eax, edx
push eax
lea edx, [ebp - 0x104]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.005144d7
mov esp, ebp
pop ebp
ret