joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a9ee
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43aa39
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43aa2c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43aa2a
push 0x12a8
push 0
push 0x20d0
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x43aa37
push 0x1cb8
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
jmp 0x43aa55
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0043c576
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x43cc0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43cd42
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43cd38
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0x31f145ba
jge 0x43ccac
push 9
pop eax
test eax, eax
jne 0x43ccac
and dword [ebp - 0xc], 0
jmp 0x43ccb3
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx]
jne 0x43cccc
mov dword [ebp - 0x10], 1
jmp 0x43ccd0
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x10]
cmp eax, 1
jl 0x43cce7
mov dword [ebp - 0x50], 1
jmp 0x43cceb
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x43cd00
mov dword [ebp - 0x14], 1
jmp 0x43cd04
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0xffffffff
je 0x43cd13
mov dword [ebp - 0x18], 1
jmp 0x43cd17
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jge 0x43cd2a
mov dword [ebp - 0x1c], 1
jmp 0x43cd2e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x43cd40
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x43cd60
push 0x7cc2
push 0x6d02
push 0x4c1e
push 0x6bbc
push 0
call fcn.00439f75
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x44d0bd
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44d0e4
push 0x6bac
push 1
push 0x1e67
call fcn.0044d176
add esp, 0xc
jmp 0x44d172
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44d127
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b26
push 0x12ae
push 0x23ab
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x44d172
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44d155
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x44d172
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.0042182a
mov dword [eax], 0xa513e67d
jmp 0x44d14a
mov esp, ebp
pop ebp
ret
Function at 0x457cd4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x457d17
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x457d08
push 0x838
push 0x1514
push 0x1f89
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x457d15
push 0
push 0x2092
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x457d2f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0
push 0x5371
push dword [ebp - 8]
call fcn.0045c688
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x458171
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x4581c6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4e77
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
call fcn.00458e02
add esp, 0x20
jmp 0x4581fd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4581f5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4581fd
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret

Function at 0x458cdf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x458d5f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x458d34
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x458d32
push 0xd3f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x458d5d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.0042182a
mov ecx, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x458d77
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x1ec7
push 0
call fcn.00458d7b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x45951e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x4595dc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4595c4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4595b3
push 3
mov ecx, dword [ebp - 0x38]
call fcn.0042182a
mov eax, dword [eax]
sub eax, 0xf7e4
jne 0x4595b3
and dword [ebp - 0xc], 0
jmp 0x4595ba
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x4595da
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4595da
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x459602
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
push 0
push dword [ebp - 0x40]
push 0x2926
push 0x4105
push dword [ebp - 0x44]
call fcn.0045a8d4
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4596ad
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x45974d
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x459708
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b26
push 0x12ae
push 0x23ab
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x45974b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
push 3
mov ecx, dword [ebp - 0x28]
call fcn.0042182a
and dword [eax], 0
jmp 0x45977b
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.004594f6
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x45a620
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x45a656
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x184e
push 0x1f76
push 1
push dword [ebp - 0xc]
call fcn.0045a690
add esp, 0x14
jmp 0x45a68c
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45a678
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x45a68c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45a68c
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov esp, ebp
pop ebp
ret
Function at 0x45ba66
Capabilities:
Get common file path
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x45baba
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x45ba93
push 0
push 0x2092
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x45bab8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b26
push 0x12ae
push 0x23ab
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x45badb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 8]
push 0x3455
push dword [ebp - 0xc]
call fcn.0045934b
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x493360
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4ba4fc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x493384
jmp 0x4933f3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x493398
jmp 0x4933f3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x4933c4
jmp 0x4933f3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x4933e5
jmp 0x4933f3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1ab5
mov esp, ebp
pop ebp
ret

Function at 0x4991f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0xab07f3]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0xab0968
call fcn.00498410
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x4b4b92
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ba4fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004a5a87
mov dword [ebp - 0x14], eax
cmp dword [0xab1b18], esi
jne 0x4b4c85
push 0x800
push esi
push 0xaac83c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4b4c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4b4d65
push esi
push esi
push 0xaac83c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4b4d65
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b4d65
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xab1b18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xab1b1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xab1b20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xab1b28], eax
test eax, eax
je 0x4b4c82
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xab1b24], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4b4caa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b4c9d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4b4cbf
push 4
pop eax
jmp 0x4b4d67
cmp dword [ebp - 0x14], esi
je 0x4b4cbf
push dword [0xab1b18]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4b4ca4
mov eax, dword [0xab1b24]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4b4d1d
cmp dword [0xab1b28], edi
je 0x4b4d1d
push eax
call ebx
push dword [0xab1b28]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4b4d1d
test eax, eax
je 0x4b4d1d
call ecx
test eax, eax
je 0x4b4d12
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4b4d12
test byte [ebp - 8], 1
jne 0x4b4d1d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4b4d4d
mov eax, dword [0xab1b1c]
cmp eax, edi
je 0x4b4d4a
push eax
call ebx
test eax, eax
je 0x4b4d4a
call eax
mov esi, eax
test esi, esi
je 0x4b4d4a
mov eax, dword [0xab1b20]
cmp eax, edi
je 0x4b4d4a
push eax
call ebx
test eax, eax
je 0x4b4d4a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xab1b18]
call ebx
test eax, eax
je 0x4b4d65
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4b4d67
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1ab5
mov esp, ebp
pop ebp
ret
Function at 0x4021b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4391a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov edx, dword [esp + 0x30]
mov eax, edx
push esi
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021e7
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00401d70
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, 0x4512e0
mov dword [esp + 0x34], 0
call fcn.00401f10
mov eax, dword [esp + 0x20]
mov esi, 0x10
cmp eax, esi
jb 0x402231
mov edx, dword [esp + 0xc]
push edx
call fcn.0042ab43
add esp, 4
mov eax, dword [esp + 4]
cmp eax, dword [0x4512e4]
jne 0x40224f
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
cmp dword [eax + 0x40], esi
jb 0x402267
mov eax, dword [eax + 0x2c]
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x24]
add eax, 0x2c
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x402e80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push 0x43b870
push str.patchlog.txt
call fcn.0041c421
mov esi, eax
add esp, 8
test esi, esi
je 0x402eeb
lea eax, [esp + 4]
push eax
call fcn.0041c389
lea ecx, [esp + 8]
push ecx
call fcn.0041c370
push eax
push str.Log_start_:__s_n
push esi
call fcn.0041c312
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
push str.Current_Directory_:__s_n
push esi
call fcn.0041c312
push esi
call fcn.0041c2c1
add esp, 0x10
pop esi
add esp, 0x208
ret

Function at 0x403890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4038a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4038bd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4038de
cmp esi, eax
jae 0x4038b7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4038d0
cmp esi, eax
jae 0x4038b7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404b00
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.0041c5b0
push ebp
push esi
push edi
call fcn.004365bf
mov eax, dword [eax + 0xc]
push 0x43c2e4
push 0x8b
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x404c37
call fcn.004365bf
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404c37
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
call fcn.004365bf
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x43c2d8
mov edi, eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c2a
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, dword [esp + 0xc]
jne 0x404c16
push str._APP__Run_external_updater
call fcn.00402f00
mov byte [esp + 0x14], 0
xor eax, eax
mov ecx, 0x3ff
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040afa0
add eax, 0x400
push eax
push 0x43c2d8
lea ecx, [esp + 0x1c]
push str.._s___s_
push ecx
call fcn.0041b77b
add esp, 0x14
push 5
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
push str._APP__Invalid_updater_file
call fcn.00402f00
add esp, 4
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
push str._APP__Cannot_create_updater_file
call fcn.00402f00
add esp, 4
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x4055a0
Capabilities:
Get file version info
Identify system language via api

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4394e0
push eax
mov eax, dword [str.unknown]
mov dword fs:[0], esp
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
mov dword [ebp], eax
mov ecx, dword [0x43c44c]
push edx
push edi
mov dword [ebp + 4], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x405719
push ebx
push esi
call fcn.0042ab3e
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
push edi
mov dword [esp + 0x38], 0
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40570f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x38]
push edx
push str.VarFileInfoTranslation
push ebx
mov dword [esp + 0x44], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40570f
call fcn.0042ab48
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x30], eax
cmp dword [esp + 0x10], 4
mov byte [esp + 0x28], 1
jne 0x405694
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
push ecx
mov edx, eax
shr edx, 0x18
push edx
mov ecx, eax
movzx edx, ah
and ecx, 0xff
push ecx
push edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x40]
push str.StringFileInfo_02X_02X_02X_02XProductVersion
push eax
call fcn.00405220
add esp, 0x18
jmp 0x4056b0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
push ecx
lea edx, [esp + 0x34]
push str.StringFileInfo_04X04B0ProductVersion
push edx
call fcn.00405220
add esp, 0xc
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
push esi
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4056df
mov byte [esp + 0x28], al
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x405705
mov eax, dword [esp + 0x34]
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4056e7
lea eax, [esi - 0x10]
mov byte [esp + 0x28], cl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40570f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ebx
call fcn.0042ab43
add esp, 4
pop ebx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8