joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fe00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43fe33
push esi
call fcn.00442f10
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43fe2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43feb9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43fea2
mov eax, dword [esi + 8]
test eax, eax
je 0x43fe57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43fe9e
cmp eax, 2
je 0x43fea2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43fe4a
cmp eax, 3
je 0x43fe7d
cmp eax, 1
jne 0x43fe4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43fe4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43fe4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043fee0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43fec8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043fee0
add esp, 4
pop esi
ret

Function at 0x4603a6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4603de
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045e45d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045e435
jmp 0x4603ea
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x461a99
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x461adb
call fcn.00467550
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x461adb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x461ad2
xor eax, eax
jmp 0x461ae3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00461ae9
pop edi
pop esi
pop ebx
ret 4

Function at 0x467a80
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x467aae
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x467acc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004679e6
jmp 0x467acc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x467acc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004679e6
test edi, edi
mov eax, edi
jne 0x467ab6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x404640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404659
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404694
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404690
lea ebx, [ebx]
cmp esi, eax
jae 0x404694
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404680
cmp esi, eax
jb 0x40469a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596df8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
lea ecx, [esp + 0x10]
call fcn.0046ec3e
mov dword [esp + 0x54], 0
test ebx, ebx
jne 0x404e52
xor eax, eax
jmp 0x404e55
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x14]
call fcn.0046f30e
mov ecx, dword [edi + 4]
lea eax, [esp + 0x30]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x20]
lea edx, [esp + 0x20]
push edx
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [edi + 4]
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.0046f695
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x20]
mov edx, dword [esi + 4]
mov esi, dword [esi]
push 0xff
push edi
mov edi, dword [esp + 0x3c]
push edi
mov edi, dword [esp + 0x20]
push 0
push 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x38]
push edi
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push esi
push eax
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x10]
call fcn.0046f377
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0xffffffff
call fcn.0046f38d
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x4c
ret 4
Function at 0x406520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x596dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.0046ec3e
mov dword [esp + 0x38], 0
test ebx, ebx
jne 0x40655c
xor eax, eax
jmp 0x40655f
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0xc]
call fcn.0046f30e
mov ecx, dword [edi + 4]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [edi + 4]
mov edx, dword [esp + 0xc]
push eax
push edx
call fcn.0046f695
mov edx, dword [esp + 0xc]
mov ecx, dword [esi]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
push edx
push eax
mov eax, dword [ebx + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 4]
call fcn.0046f638
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.0046f38d
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
add esp, 0x38
ret

Function at 0x406a10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00473246
Function at 0x407410
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x599772
mov eax, dword fs:[0]
push eax
sub esp, 0x194
push ebx
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x1a4]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x1b4]
mov dword [esp + 0x14], 0
mov eax, dword [esi]
push str.windowinit
push eax
call fcn.00566b08
add esp, 8
test eax, eax
je 0x40767b
mov eax, dword [esi]
push str.click
push eax
call fcn.00566b08
add esp, 8
test eax, eax
jne 0x40767b
mov ecx, dword [esi + 0x84]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x18]
push edx
call eax
mov eax, dword [eax]
push str.install
push eax
call fcn.00566b08
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
sete bl
cmp eax, ecx
je 0x4074b9
push eax
call fcn.005668e2
add esp, 4
test bl, bl
je 0x407503
lea ebx, [edi + 0x120]
mov eax, str.install_tab
call fcn.004175f0
test eax, eax
je 0x4074df
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1a8]
push 1
call eax
push 0
push 0
lea ecx, [edi - 0x74]
push ecx
push 0x408780
push 0
push 0
call fcn.00567132
add esp, 0x18
mov dword [edi + 0x3e8], eax
jmp 0x40767b
mov ecx, dword [esi + 0x84]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x18]
push eax
call edx
mov eax, dword [eax]
push str.finish
push eax
call fcn.00566b08
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
sete bl
cmp eax, ecx
je 0x40753f
push eax
call fcn.005668e2
add esp, 4
test bl, bl
je 0x407579
lea ebx, [edi + 0x120]
mov eax, str.start_atonce
call fcn.004175f0
test eax, eax
je 0x407568
cmp byte [eax + 0x64c], 0
je 0x407568
lea eax, [edi - 0x74]
call fcn.0040b4b0
mov edx, dword [edi - 0x74]
mov eax, dword [edx + 0x158]
lea ecx, [edi - 0x74]
jmp 0x407679
mov ecx, dword [esi + 0x84]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [esp + 0x120]
push eax
call edx
mov dword [esp + 0x1ac], 0
mov eax, dword [eax]
push str.cancel
mov ebx, 1
push eax
mov dword [esp + 0x1c], ebx
call fcn.00566b08
add esp, 8
test eax, eax
je 0x4075e9
mov ecx, dword [esi + 0x84]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x9c]
push edx
call eax
mov eax, dword [eax]
push str.closebtn
push eax
mov ebx, 3
call fcn.00566b08
add esp, 8
mov byte [esp + 0x13], 0
test eax, eax
jne 0x4075ee
mov byte [esp + 0x13], 1
test bl, 2
je 0x407611
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0xa0]
and ebx, 0xfffffffd
cmp eax, ecx
je 0x407611
push eax
call fcn.005668e2
add esp, 4
mov dword [esp + 0x1ac], 0xffffffff
test bl, 1
je 0x40763c
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x124]
cmp eax, edx
je 0x40763c
push eax
call fcn.005668e2
add esp, 4
cmp byte [esp + 0x13], 0
je 0x40767b
mov eax, dword [edi + 0x3e8]
test eax, eax
je 0x40766d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [edi + 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x3e8], 0
mov edx, dword [edi - 0x74]
mov eax, dword [edx + 0x15c]
lea ecx, [edi - 0x74]
call eax
mov ecx, dword [esp + 0x1a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1a0
ret 4
Function at 0x407900
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x598ea8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push eax
call fcn.0040a750
lea esi, [ebp + 0x424]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.004044b0
or ebx, 0xffffffff
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407971
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.install.data.zip
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00404340
add esp, 0xc
lea edi, [ebp + 0x428]
push eax
mov ecx, edi
mov dword [esp + 0x28], 1
call fcn.004044b0
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4079bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.INSTALLDATA
lea ecx, [esp + 0x18]
call fcn.00404a60
push 0xea
push edi
lea eax, [esp + 0x1c]
call fcn.0040b8d0
test al, al
mov eax, dword [esp + 0x14]
sete byte [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407a00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x2c], 0
je 0x407a1b
push 0x5cddb4
call fcn.0040bcf0
add esp, 4
xor al, al
jmp 0x407aa6
push 0x5cddc4
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.00404340
add esp, 0xc
lea esi, [ebp + 0x430]
push eax
mov ecx, esi
mov dword [esp + 0x28], 2
call fcn.004044b0
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x407a65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407a81
mov ecx, dword [esi]
push 0
push 0
push ecx
call fcn.00465cf0
add esp, 0xc
push esi
mov ecx, edi
call fcn.0040ba00
test al, al
jne 0x407aa4
mov edx, dword [esi]
mov eax, dword [edi]
push edx
push eax
push 0x5cddd0
call fcn.0040bcf0
add esp, 0xc
xor al, al
jmp 0x407aa6
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x408aa0
Capabilities:
Get file size
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x598d46
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5fd890]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x234]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.0056b700
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.00404a60
push 0
push 0x80
push 3
push 0
push 1
mov dword [esp + 0x240], 0
mov ecx, dword [esp + 0x24]
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x408c77
cmp esi, 0xffffffff
je 0x408c77
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
shr edi, 0x14
call fcn.00470afc
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408b85
push 0x80004005
call fcn.004020b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push edi
lea ecx, [esp + 0x18]
push str.nFolerM_is_:_d
push ecx
mov byte [esp + 0x238], 1
call fcn.00402180
mov esi, dword [esp + 0x20]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp edi, 0xa
ja 0x408bc8
fld dword [0x5d8154]
jmp 0x408c3b
cmp edi, 0x14
ja 0x408bd5
fld dword [0x5d81a0]
jmp 0x408c3b
cmp edi, 0x1e
ja 0x408be2
fld dword [0x5d8158]
jmp 0x408c3b
cmp edi, 0x28
ja 0x408bef
fld dword [0x5d819c]
jmp 0x408c3b
cmp edi, 0x32
ja 0x408bf8
fld1
jmp 0x408c3b
cmp edi, 0x64
ja 0x408c05
fld dword [0x5d8198]
jmp 0x408c3b
cmp edi, 0xc8
ja 0x408c15
fld dword [0x5d8194]
jmp 0x408c3b
cmp edi, 0x12c
ja 0x408c25
fld dword [0x5d8190]
jmp 0x408c3b
cmp edi, 0x190
ja 0x408c35
fld dword [0x5d818c]
jmp 0x408c3b
fld dword [0x5d8188]
fstp dword [ebp + 0x458]
lea eax, [esi - 0x10]
fld dword [ebp + 0x458]
lea edx, [eax + 0xc]
fmul qword [0x5d8168]
mov byte [esp + 0x22c], 0
or ecx, 0xffffffff
fstp dword [ebp + 0x458]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408c77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x22c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ca2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00565f92
add esp, 0x220
ret 4
Function at 0x408cd0
Capabilities:
Access peb ldr_data
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x598d10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x5ce144
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [esp + 0x2c]
push str._site.ico
add esi, 0x430
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00404340
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or ebp, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.SITE_ICO
lea ecx, [esp + 0x30]
call fcn.00404a60
push str._site.zip
lea ecx, [esp + 0x14]
push esi
push ecx
mov dword [esp + 0x30], 0
call fcn.00404340
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x2c], 1
call fcn.00408e80
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408da6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408dc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str._site
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.00404340
mov edi, eax
push str._site.zip
lea edx, [esp + 0x24]
push esi
push edx
mov dword [esp + 0x3c], 2
call fcn.00404340
add esp, 0x18
push edi
mov ecx, eax
mov byte [esp + 0x28], 3
call fcn.0040ba00
test al, al
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0x14]
sete byte [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408e2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x408e4f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x2c], 0
je 0x408e63
push 0x5ce19c
call fcn.0040bcf0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 4
Function at 0x408e80
Capabilities:
Extract resource via kernel32 functions
Print debug messages
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x597d38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
push eax
push 0x89
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x408f76
test edi, edi
je 0x408f76
push str.LockResource_is_called.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x408f8d
call fcn.00470afc
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408f16
push 0x80004005
call fcn.004020b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x2c]
push str.extractSetup::NULL__lpData_dwLastError_d.
push ecx
call fcn.00402180
mov esi, dword [esp + 0x34]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408f76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], 0
test esi, esi
je 0x408f76
cmp esi, 0xffffffff
je 0x408f76
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x14]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x409650
Capabilities:
Check if file exists
Create process on windows
Print debug messages
Terminate process

Disassembly:
mov eax, dword [esi]
sub esp, 0x3c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4096d3
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call fcn.0056b700
mov ecx, dword [esi]
add esp, 0xc
lea edx, [esp]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x8040
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push str.WaitForSingleObject_shellExeInfo.hProcess_1000060_is_called.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x38]
push 0x927c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4096c8
mov ecx, dword [esp + 0x38]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x3c
ret
Function at 0x40a5b0
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x597d08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5fd890]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc]
push eax
push 0x5cca3c
push 1
push 0
push 0x5cca2c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x40a733
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x5cca7c
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x5cca1c
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jl 0x40a727
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0xc]
push ecx
call eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a66d
mov eax, dword [esp + 0x10]
mov edi, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0xffffffffffffffff
push edi
push eax
call edx
mov esi, eax
jmp 0x40a6e3
call fcn.00470afc
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a687
push 0x80004005
call fcn.004020b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 0
mov ecx, dword [edi]
push ecx
lea edx, [esp + 0x2c]
push str.file:_s_is_not_exist.SetIconLocation_failed.
push edx
call fcn.00402180
mov edi, dword [esp + 0x34]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a6e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jl 0x40a70f
mov eax, dword [ebx]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x1c]
push ecx
call eax
mov esi, eax
test esi, esi
jl 0x40a70f
mov eax, dword [ebx]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push 1
push eax
mov eax, dword [edx + 0x18]
push ecx
call eax
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 4