joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010c09
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x1003a86c], edi
je 0x10010c1c
mov eax, 0x10dd
jmp 0x10010c77
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x1003a86c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x10010c15
push esi
mov esi, dword [0x1003a860]
mov dword [0x1003a868], edi
mov dword [0x1003a87c], edi
mov dword [0x1003a878], edi
mov dword [0x1003a870], edi
mov dword [0x1003a874], edi
jmp 0x10010c70
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x10010c5a
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x10010c7a
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1003a86c], eax
je 0x10010c90
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x1003a87c]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x10010cdb
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x10010ccc
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x10010ccc
call fcn.10010b85
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.10011a0e
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x10010c9f
mov dword [0x1003a87c], ebx
call fcn.10010980
mov esi, dword [0x1003a878]
cmp esi, ebx
je 0x10010d08
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.10011a0e
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x10010cf0
pop edi
pop esi
mov dword [0x1003a878], ebx
mov dword [0x1003a86c], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10010f5f
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1003a870]
test eax, eax
jne 0x10010fcf
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x10010f7b
xor eax, eax
jmp 0x10010fce
push esi
push 8
call fcn.10011ba5
mov esi, eax
pop ecx
test esi, esi
jne 0x10010f8f
push 8
pop edi
jmp 0x10010faa
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10010fbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.10011a0e
pop ecx
and dword [0x1003a874], 0
mov dword [0x1003a870], edi
mov eax, edi
jmp 0x10010fcd
mov eax, dword [0x1003a878]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x1003a878], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x10011223
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1003a86c], eax
je 0x1001123f
mov eax, 0x10dd
jmp 0x10011322
mov eax, dword [0x1003a870]
test eax, eax
jne 0x10011322
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1001125c
push 6
pop eax
jmp 0x10011321
cmp dword [edi], 0
jne 0x10011274
push 6
pop eax
mov dword [0x1003a870], eax
mov dword [0x1003a874], edi
jmp 0x10011321
push ebx
push esi
push 0x18
call fcn.10011ba5
mov esi, eax
pop ecx
test esi, esi
jne 0x10011289
push 8
pop edi
jmp 0x10011304
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.100108dd
mov ebx, dword [edi + 0x18]
pop ecx
pop ecx
movzx ecx, byte [edi + 0x17]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x100112f9
cmp ecx, 0x17
ja 0x100112f9
cmp dword [edi + 0x1c], eax
jne 0x100112f9
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push ebx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100112cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10011304
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x1003a87c]
mov dword [esi], eax
mov dword [0x1003a87c], esi
xor eax, eax
jmp 0x1001131f
push 9
pop edi
cmp dword [0x1003a868], edx
jne 0x1001130a
mov dword [0x1003a870], edi
test esi, esi
je 0x10011315
push esi
call fcn.10011a0e
pop ecx
mov eax, dword [ebp + 8]
mov dword [0x1003a874], eax
mov eax, edi
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x100119ff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100376d0]
jne 0x10011a09
repz ret
jmp fcn.1001609d
Function at 0x1001fcd3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100376d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10013ece
and dword [ebp - 0x14], 0
cmp dword [0x1003b55c], 0
mov dword [ebp - 0x18], eax
jne 0x1001fd86
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001fe2e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1001fe2e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1003b55c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1003b560], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1003b564], eax
call edi
push eax
call esi
mov dword [0x1003b56c], eax
test eax, eax
je 0x1001fd86
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1003b568], eax
mov eax, dword [0x1003b568]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1001fddf
cmp dword [0x1003b56c], ecx
je 0x1001fddf
push eax
call esi
push dword [0x1003b56c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1001fddf
test ebx, ebx
je 0x1001fddf
call edi
test eax, eax
je 0x1001fdd6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1001fdd6
test byte [ebp - 8], 1
jne 0x1001fddf
or dword [ebp + 0x10], 0x200000
jmp 0x1001fe12
mov eax, dword [0x1003b560]
cmp eax, dword [ebp - 0x18]
je 0x1001fe12
push eax
call esi
test eax, eax
je 0x1001fe12
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001fe12
mov eax, dword [0x1003b564]
cmp eax, dword [ebp - 0x18]
je 0x1001fe12
push eax
call esi
test eax, eax
je 0x1001fe12
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1003b55c]
call esi
test eax, eax
je 0x1001fe2e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1001fe30
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100119ff
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4016eb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403040], eax
mov ecx, 9
xor eax, eax
inc ecx
push eax
loop 0x401710
lea eax, [ebp - 0x4c]
mov ecx, str.homer
push eax
mov eax, dword [0x403040]
mov dword [ebp - 0x3c], eax
inc eax
mov dword [ebp - 0x28], ecx
mov edx, 0x401879
xor eax, eax
mov dword [ebp - 0x48], edx
jmp 0x40175c
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push dword [0x403040]
push 0
push 0
mov eax, 0x80000000
push eax
push eax
jmp 0x4017b1
push eax
push eax
mov eax, 0x40000
push eax
lea eax, str.litleapp
push eax
lea eax, str.homer
push eax
push pe_nt_image_headers32
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403050], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403050]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401849
lea eax, [ebp - 0x40]
push eax
call esi
lea ecx, [ebp - 0x40]
push ecx
call edi
jmp 0x401849
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x40]
push eax
call ebx
test eax, eax
jne 0x401800
pop ebp
ret 0x10
Function at 0x407f90
Capabilities:
Create directory

Disassembly:
push esi
push ebx
push eax
mov eax, 0x2010
call fcn.0040f1bc
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov eax, dword [0x42c0a0]
test eax, eax
je 0x408030
xor ebx, ebx
test eax, eax
jg 0x407fcb
jmp 0x407fe8
add ebx, 1
cmp dword [0x42c0a0], ebx
jle 0x407fe8
mov eax, dword [ebx*4 + 0x42b0a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407fc0
jmp 0x408022
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jne 0x407ffc
cmp word [esi + 2], 0x3a
je 0x408022
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x408078
mov ebx, dword [0x42c0a0]
cmp ebx, 0x3ff
jle 0x408090
mov eax, 1
add esp, 0x2014
pop ebx
pop esi
ret
mov ecx, 0x1000
mov edx, str.HOME
lea eax, [esp + 0x10]
call fcn.00407710
test al, al
je 0x4080ab
lea eax, [esp + 0x10]
mov ebx, dword [0x42c0a0]
mov dword [esp], eax
call sub.msvcrt.dll__wcsdup
mov dword [ebx*4 + 0x42b0a0], eax
mov eax, dword [0x42c0a0]
add eax, 1
mov dword [0x42c0a0], eax
jmp 0x407fb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x408014
xor eax, eax
jmp 0x408027
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add dword [0x42c0a0], 1
mov dword [ebx*4 + 0x42b0a0], eax
jmp 0x408022
mov eax, str.HOME
call fcn.00407ec0
lea esi, [esi]
lea esi, [esi]

Function at 0x408240
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x424040]
test eax, eax
je 0x408279
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x408290
mov eax, dword [0x424040]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp byte [0x429080], 0
jne 0x4082b0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x424040]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x408268
mov edx, 0x414
lea edi, [esp + 0x12]
mov dword [esp + 0x12], 0
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x16], 3
mov ebx, 0x14
mov dword [esp + 0x1a], 0x4290a0
mov dword [esp + 0x1e], 0x417190
mov word [esp + 0x22], dx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x417190
mov dword [esp], edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
jmp 0x408383
test al, 0x10
je 0x408282
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x414
sub esp, 4
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 3
mov dword [esp + 0x1a], 0x4290a0
mov dword [esp + 0x1e], 0x417190
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x417190
mov dword [esp], edi
call esi
sub esp, 4
sub ebx, 1
je 0x408282
mov dword [esp], 0x4290a0
call ebp
sub esp, 4
cmp eax, 0xffffffff
jne 0x408318
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40e20c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00414610
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00414610
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40ede0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40edff
mov eax, 0
jmp 0x40ee43
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40ee22
mov eax, 0
jmp 0x40ee43
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40ee3e
mov eax, 0
jmp 0x40ee43
mov eax, 1
leave
ret

Function at 0x40ee45
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40eea4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40ee9c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40ee9c
mov eax, dword [ebp - 4]
jmp 0x40eeb8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40ee79
mov eax, 0
leave
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x57e8af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x59b54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x59b54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x59a378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57e8b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x10006ad0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10124abd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10194008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10004ac0
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.10004ac0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x30]
call fcn.10004ac0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x4c]
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
call fcn.10004ac0
lea eax, [esi + 0x64]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x64]
call fcn.10004ac0
lea eax, [esi + 0x7c]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x7c]
call fcn.10004ac0
lea eax, [esi + 0x94]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x94]
call fcn.10004ac0
lea eax, [esi + 0xac]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0xac]
call fcn.10004ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10007c00
Capabilities:
Read file on windows

Disassembly:
call fcn.100046b0
mov ecx, eax
jmp fcn.10011b40
Function at 0x1000c220
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x64]
test edi, edi
je 0x1000c240
nop dword [eax + eax]
push 0x2710
mov ecx, edi
call fcn.1005f9d0
test al, al
je 0x1000c230
mov eax, dword [esi]
test eax, eax
je 0x1000c266
push str.UnInitialize
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c258
call eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
cmp byte [esi + 0x6c], 0
je 0x1000c282
lea ecx, [esi + 4]
call fcn.1005e6d0
test al, al
je 0x1000c282
pop edi
lea ecx, [esi + 4]
pop esi
jmp fcn.10070fd0
pop edi
pop esi
ret

Function at 0x1000d300
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1000d37c
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000d37c
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d900
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10125558
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10194008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10158158
push 0xc8
push dword [0x10199450]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000d95a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push dword [0x10199450]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x1000d944
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [0x10199450]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1005fb60
push 0x80
push 2
push 0
push 0x40000000
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.1005fc10
mov byte [ebp + 0xb], al
test al, al
je 0x1000da56
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
call fcn.1005fd40
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp - 0x10]
je 0x1000da3a
and ebx, 0x1ff
mov edi, 0x400
push 0
sub edi, ebx
call fcn.101069c6
add esp, 4
push eax
call fcn.1010a445
shr edi, 2
add esp, 4
test edi, edi
je 0x1000da37
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [eax]
call fcn.1010a424
mov dword [ebp - 0x20], eax
test esi, esi
je 0x1000da32
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1000da32
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
lea ecx, [ebp - 0x20]
push ecx
push eax
call ebx
sub edi, 1
jne 0x1000da10
mov edi, dword [ebp - 0x18]
test esi, esi
je 0x1000da56
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1000da56
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000da56
mov dword [esi], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.1005fbd0
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000e4d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x10194008]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 8]
push 0x208
push 0
push eax
call fcn.100fe280
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1000e530
xor al, al
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.100fc499
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e537
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10004c10
mov edx, 0x10
mov ecx, esi
call fcn.1005f180
push 7
push str.2345Pic
mov ecx, esi
call fcn.10005850
mov edx, 0x10
mov ecx, esi
call fcn.1005f180
mov ecx, esi
call fcn.1005ed30
push 0x15
push str.2345PicInstaller.data
mov ecx, esi
call fcn.10005850
mov ecx, dword [esp + 0x214]
mov al, 1
pop esi
xor ecx, esp
call fcn.100fc499
mov esp, ebp
pop ebp
ret 4