joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b9bf
Capabilities:
Persist via run registry key

Disassembly:
push 0x64
mov eax, 0x440c3b
call fcn.0042dbe5
mov eax, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x6c], eax
je 0x41baf9
push 7
pop edi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], si
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x4059c8
lea eax, [ebp - 0x48]
push 0x405b28
push eax
call fcn.0042445a
add esp, 0x10
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], si
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], esi
mov word [ebp - 0x60], si
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.004269f3
cmp dword [ebp - 0x4c], 8
mov ecx, dword [ebp - 0x60]
jae 0x41ba38
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x2c]
push esi
push eax
xor edi, edi
call fcn.00427113
cmp dword [ebp - 0x6c], esi
pop ecx
pop ecx
je 0x41ba57
push dword [ebp - 0x6c]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ac06
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x4059e8
push 0x80000001
call dword [0x449760]
xor edi, edi
inc edi
cmp eax, esi
je 0x41ba87
push eax
push 0x405b38
jmp 0x41babc
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x41ba93
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x41ba9f
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x18]
add edx, edx
push edx
push ecx
push edi
push esi
push eax
push dword [ebp - 0x68]
call dword [0x449770]
cmp eax, esi
je 0x41bacb
push eax
push 0x405b80
mov esi, dword [0x449634]
call fcn.0040883c
pop ecx
xor esi, esi
pop ecx
cmp dword [ebp - 0x68], esi
je 0x41bad9
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
lea esi, [ebp - 0x64]
call fcn.00408d21
push 0
push edi
lea esi, [ebp - 0x2c]
call fcn.00408d21
push 0
push edi
lea esi, [ebp - 0x48]
call fcn.00408d21
xor al, al
call fcn.0042dc68
ret
Function at 0x41bb01
Capabilities:
Hide graphical window
Shutdown system

Disassembly:
push 0x20
mov eax, 0x44008d
call fcn.0042dbe5
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00408384
and dword [ebp - 4], 0
xor al, al
mov ebx, edi
call fcn.00421da8
push 5
push 0x40d
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
inc ebx
push ebx
mov al, bl
mov ecx, edi
call fcn.00421e46
mov byte [edi + 0x99], bl
mov dword [edi + 0xa8], ebx
call fcn.00423c04
test al, al
lea esi, [ebp - 0x2c]
je 0x41bc21
push 0x3f0
call fcn.00422d33
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x41bb82
lea eax, [ebp - 0x28]
push eax
mov eax, edi
call fcn.00421fff
push 0x3ee
lea esi, [ebp - 0x2c]
call fcn.00422d33
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x41bba4
lea eax, [ebp - 0x28]
push eax
mov eax, ebx
mov ecx, edi
call fcn.00421ea6
push ebx
mov eax, ebx
mov ecx, edi
call fcn.00421e78
push 0x3ed
lea esi, [ebp - 0x2c]
call fcn.00422d33
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x41bbd2
lea eax, [ebp - 0x28]
push eax
push 2
pop esi
mov eax, esi
mov ecx, edi
call fcn.00421ea6
push esi
mov al, bl
mov ecx, edi
call fcn.00421e46
push ebx
mov eax, esi
mov ecx, edi
call fcn.00421e78
mov ebx, edi
call fcn.00421bee
cmp eax, esi
jne 0x41bc75
mov eax, dword [0x449634]
mov ebx, eax
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41bc13
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx], 0xffffffff
push 0
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x41bc75
push 0x3f1
call fcn.00422d33
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x41bc38
lea eax, [ebp - 0x28]
push eax
mov eax, edi
call fcn.00421fff
push 0x3ea
lea esi, [ebp - 0x2c]
call fcn.00422d33
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x41bc5a
lea eax, [ebp - 0x28]
push eax
mov eax, ebx
mov ecx, edi
call fcn.00421ea6
push ebx
mov eax, ebx
mov ecx, edi
call fcn.00421e78
mov ebx, edi
call fcn.00421bee
or dword [edi + 0xa8], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [edi + 0x99], 0
call fcn.00408339
call fcn.0042dc68
ret
Function at 0x41bc95
Capabilities:
Get disk size

Disassembly:
push 0xe0
mov eax, 0x440bfb
call fcn.0042dbe5
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x18], 0xf
call fcn.00408384
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x405bc4
mov dword [ebp - 4], ebx
call fcn.00424aa3
test al, al
pop ecx
jne 0x41bcf0
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00408339
mov al, 1
call fcn.0042dc68
ret
lea esi, [ebp - 0x30]
call fcn.00422f95
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41bd04
lea eax, [ebp - 0x2c]
push ebx
push ebx
lea ecx, [ebp - 0xec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x41bd2a
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00408339
mov al, bl
jmp 0x41bcea
and dword [ebp - 0xd4], 0
lea eax, [edi + 0xc]
mov dword [ebp - 0xdc], ebx
call fcn.0041a89d
test eax, eax
jle 0x41bd18
push 0
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x6c], 0xf
call fcn.00408384
lea edi, [ebp - 0xcc]
call fcn.004154d1
mov eax, edi
mov edi, dword [ebp - 0xd0]
push eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0xd4]
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00415f22
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
add ecx, eax
add dword [ebp - 0xdc], ecx
lea esi, [ebp - 0xcc]
adc ebx, 0
call fcn.004154f7
push 0
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0
call fcn.00408339
inc dword [ebp - 0xd4]
lea eax, [edi + 0xc]
call fcn.0041a89d
cmp dword [ebp - 0xd4], eax
jl 0x41bd43
mov eax, dword [ebp - 0xe8]
cmp ebx, eax
jb 0x41bd18
mov ecx, dword [ebp - 0xec]
ja 0x41bdf4
cmp dword [ebp - 0xdc], ecx
jbe 0x41bd18
mov edx, dword [ebp - 0xdc]
shrd edx, ebx, 0x14
shrd ecx, eax, 0x14
push 0xf
pop esi
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0xd0], ecx
xor edi, edi
shr ebx, 0x14
push edi
lea ecx, [ebp - 0x4c]
mov ebx, edx
shr eax, 0x14
mov dword [ebp - 0x34], esi
call fcn.00408384
push edi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x50], esi
call fcn.00408384
mov eax, dword [ebp - 0xe0]
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 0x10
jb 0x41be48
mov eax, dword [eax + 4]
jmp 0x41be4b
add eax, 4
push eax
push 0x3f4
lea esi, [ebp - 0x4c]
call fcn.00422d33
push dword [ebp - 0xd0]
lea esi, [ebp - 0x68]
push ebx
push 0x421
call fcn.00422d33
mov ecx, dword [ebp - 0x48]
add esp, 0x14
cmp dword [ebp - 0x34], 0x10
jae 0x41be7c
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
jae 0x41be88
lea eax, [ebp - 0x64]
push 0x31
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
push edi
lea ecx, [ebp - 0x68]
push 1
jne 0x41beb5
call fcn.00408339
push edi
push 1
lea ecx, [ebp - 0x4c]
call fcn.00408339
xor bl, bl
jmp 0x41bd1a
call fcn.00408339
push edi
push 1
lea ecx, [ebp - 0x4c]
call fcn.00408339
jmp 0x41bd18
Function at 0x421249
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44032c
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x448138]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x448138]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
push ebx
push 1
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_ShowScrollBar]
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
sub edi, dword [esp + 0x20]
sub esi, dword [esp + 0x24]
sub edi, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
push dword [esp + 0x10]
lea ecx, [esp + 0x38]
mov dword [esp + 0x9c], ebx
call fcn.00424478
pop ecx
lea eax, [esp + 0x34]
call fcn.00414f8d
cmp eax, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
jbe 0x421389
push dword [esp + 0x14]
lea esi, [esp + 0x38]
call fcn.00408184
mov ecx, dword [eax + 0x14]
cmp ecx, ebx
je 0x42136c
cmp dword [esp + 0x18], ebx
je 0x42136c
cmp edi, ebx
jle 0x42136c
cmp dword [eax + 0x18], 0x10
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
jb 0x42134b
mov eax, dword [eax + 4]
jmp 0x42134e
add eax, 4
lea edx, [esp + 0x44]
push edx
push ecx
push eax
push dword [esp + 0x24]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
test eax, eax
je 0x42136c
mov eax, dword [esp + 0x44]
cdq
idiv edi
jmp 0x42136e
xor eax, eax
add dword [esp + 0x10], eax
inc dword [esp + 0x14]
lea eax, [esp + 0x34]
call fcn.00414f8d
cmp dword [esp + 0x14], eax
jb 0x42131a
mov esi, dword [esp + 0x30]
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push ebx
push 0x31
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
jne 0x4213b5
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp eax, ebx
je 0x4213d9
lea ecx, [esp + 0x4c]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x4c]
cdq
xor eax, edx
sub eax, edx
inc eax
inc eax
je 0x4213d9
imul eax, dword [esp + 0x10]
cmp eax, esi
jle 0x4213e7
push 1
push 1
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_ShowScrollBar]
lea esi, [esp + 0x34]
call fcn.00415483
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0042acb7
mov esp, ebp
pop ebp
ret
Function at 0x42201a
Capabilities:
Get graphical window text

Disassembly:
push 0x14
mov eax, 0x43fd0c
call fcn.0042db7c
mov eax, dword [ebp + 8]
push 0x40b
push dword [eax + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor esi, esi
push esi
push esi
push 0xe
push eax
mov dword [ebp - 0x10], eax
call edi
lea ebx, [eax + 1]
lea eax, [ebp + 0xb]
push eax
mov eax, ebx
lea ecx, [ebp - 0x20]
mov byte [ebp + 0xb], 0
call fcn.004081bc
mov dword [ebp - 4], esi
lea esi, [ebp - 0x20]
call fcn.004081a3
push eax
push ebx
push 0xd
push dword [ebp - 0x10]
call edi
call fcn.004081a3
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00408773
call fcn.00420b6d
call fcn.0042dc54
ret 8

Function at 0x4221e5
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x4210a0
push dword [esp + 0xc]
mov ecx, esi
call fcn.0042148e
test al, al
je 0x422260
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x422260
cmp dword [ebx + 0x18], 0x10
jb 0x42220c
mov eax, dword [ebx + 4]
jmp 0x42220f
lea eax, [ebx + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [edi + 0x18], 0x10
jb 0x422222
mov eax, dword [edi + 4]
jmp 0x422225
lea eax, [edi + 4]
push eax
push 0x40f
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov al, 1
jmp 0x422262
xor al, al
ret 4
Function at 0x4226c4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
mov esi, eax
push 0x42f
push dword [esi + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x430
push dword [esi + 8]
call edi
push eax
call ebx
push 0
push 0x42c
push dword [esi + 8]
call edi
push eax
call ebx
push 0
push 0x431
push dword [esi + 8]
call edi
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push 0x42f
push dword [esi + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x432
push dword [esi + 8]
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call ebx
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x2c]
mov ebx, edi
neg ebx
push ebx
push 0x432
call fcn.004227cf
push ebx
push 0x433
call fcn.004227cf
push ebx
push 0x42a
call fcn.004227cf
push ebx
push 0x42b
call fcn.004227cf
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
cdq
xor eax, edx
sub eax, edx
sub eax, edi
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4228d5
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x440afd
call fcn.0042dbe5
cmp ecx, 3
mov eax, dword [0x44a458]
mov dword [ebp - 0x50], eax
jne 0x422a2b
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], cx
lea esi, [eax + 0x88]
mov dword [ebp - 4], ecx
cmp dword [esi + 0x18], 8
jb 0x422916
mov ebx, dword [esi + 4]
jmp 0x422919
lea ebx, [esi + 4]
push ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x40616c
xor edi, edi
call fcn.00427113
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
jae 0x422938
lea eax, [ebp - 0x28]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push eax
call dword [0x449734]
cmp eax, 0xffffffff
mov dword [ebp - 0x4c], eax
jne 0x4229bb
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.00408384
push 0x59e
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00422d33
pop ecx
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + 0xa4]
cmp dword [eax + 0x18], 0x10
jb 0x42298f
mov eax, dword [eax + 4]
jmp 0x422992
add eax, 4
cmp dword [ebp - 0x30], 0x10
mov edx, dword [ebp - 0x44]
jae 0x42299e
lea edx, [ebp - 0x44]
push 0x10
push eax
push edx
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00408339
push 0
jmp 0x422a1f
mov edi, dword [ebp - 0x50]
cmp dword [edi + 0x84], 0x10
mov ecx, dword [edi + 0x80]
mov dword [ebp - 0x54], ebx
jb 0x4229d5
mov eax, dword [edi + 0x70]
jmp 0x4229d8
lea eax, [edi + 0x70]
push ebx
lea edx, [ebp - 0x54]
push edx
push ecx
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x18], 8
jb 0x4229fc
mov esi, dword [esi + 4]
jmp 0x4229ff
add esi, 4
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x422a0b
lea eax, [ebp - 0x28]
push 1
push esi
push ebx
push eax
push 0x406180
push dword [edi + 8]
call dword [0x449774]
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00408d21
jmp 0x422a3c
mov dword [eax + 0x68], ecx
mov eax, dword [eax + 0x64]
test eax, eax
je 0x422a3c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0042dc68
ret
Function at 0x422aa1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
push edi
mov edi, dword [esi]
jne 0x422ab7
test edi, edi
jbe 0x422ab7
push 0x57
pop eax
jmp 0x422b31
movzx eax, word [ebp + 8]
push ebx
push eax
push dword [ebp + 0xc]
push dword [0x44a45c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x422b2b
push ebx
push dword [0x44a45c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x422b2b
push ebx
push dword [0x44a45c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, edi
jbe 0x422afd
mov dword [esi], ebx
jmp 0x422b24
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x422b1b
push ebx
push eax
push dword [ebp + 0x10]
call fcn.0042ff10
add esp, 0xc
xor eax, eax
jmp 0x422b30
xor eax, eax
inc eax
cmp dword [esi], eax
mov dword [esi], eax
jae 0x422b17
mov eax, 0xea
jmp 0x422b30
mov eax, 0x716
pop ebx
pop edi
leave
ret

Function at 0x422b34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x18
mov eax, 0x4400ba
call fcn.0042db7c
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x422bfb
cmp byte [eax], bl
je 0x422bfb
movzx ecx, word [ebp + 8]
push ecx
push eax
push dword [0x44a45c]
xor esi, esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x422bfb
push edi
push dword [0x44a45c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x422bfb
push edi
push dword [0x44a45c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jbe 0x422ba1
mov esi, edi
jmp 0x422bbe
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x422bbb
push edi
push eax
push ebx
call fcn.0042ff10
add esp, 0xc
jmp 0x422bc1
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x14]
shr esi, 1
mov eax, esi
push ecx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
call fcn.0040ad7a
mov esi, edi
mov dword [ebp - 4], ebx
call fcn.0040ac2f
push eax
push dword [ebp + 0xc]
lea esi, [ebp - 0x10]
push dword [ebp + 8]
call fcn.00422aa1
add esp, 0xc
test eax, eax
mov esi, edi
je 0x422c03
call fcn.00420b6d
xor al, al
call fcn.0042dc54
ret
push dword [ebp + 0x10]
call fcn.0040ac2f
push eax
call fcn.00424680
pop ecx
pop ecx
lea esi, [ebp - 0x24]
mov bl, al
call fcn.00420b6d
mov al, bl
jmp 0x422bfd
Function at 0x422db0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00432e00
mov dword [ebp - 0x58], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x4000000
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x2c], 1
push dword [ebp + 8]
mov word [ebp - 0x28], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x422e0a
xor al, al
jmp 0x422e1c
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x42355b
Capabilities:
Get file version info

Disassembly:
push 0x130
mov eax, 0x43fc59
call fcn.0042dbe5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x115]
mov esi, ecx
push eax
xor ebx, ebx
xor eax, eax
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x11c], esi
mov byte [ebp - 0x115], bl
call fcn.004081bc
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
je 0x4236d7
mov eax, esi
call fcn.00423cd0
test al, al
je 0x4236d7
mov eax, esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4235c8
sub eax, esi
lea edi, [eax + 1]
push edi
lea eax, [ebp - 0x13c]
call fcn.004258af
lea esi, [ebp - 0x13c]
call fcn.004081a3
push 0xffffffffffffffff
push dword [ebp - 0x11c]
push edi
push eax
call fcn.0042b7ba
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
call fcn.004081a3
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x4236c8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x11c], edi
je 0x4236c8
push edi
push esi
push dword [ebp - 0x124]
lea esi, [ebp - 0x13c]
call fcn.004081a3
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4236bc
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x120]
push eax
push 0x4061ac
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4236bc
cmp dword [ebp - 0x128], ebx
je 0x4236bc
mov ecx, dword [ebp - 0x120]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x4061b0
mov eax, 0xff
lea edi, [ebp - 0x114]
call fcn.00422a42
add esp, 0x14
test eax, eax
jl 0x4236bc
mov ecx, dword [ebp - 0x12c]
mov eax, edi
push eax
call fcn.00408773
mov bl, 1
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea esi, [ebp - 0x13c]
call fcn.00420b6d
mov al, bl
jmp 0x4236e4
lea esi, [ebp - 0x13c]
call fcn.00420b6d
xor al, al
call fcn.0042dc68
ret
Function at 0x42387a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4401e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x448138]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
push edi
mov eax, dword [0x448138]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov edi, ecx
call fcn.0040af48
and dword [esp + 0x160], 0
push 0x4061bc
lea edx, [esp + 0x10]
mov ecx, 0x4061f8
call fcn.00423231
test al, al
pop ecx
je 0x423909
cmp dword [esp + 0xc], 1
jne 0x423909
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.004083a0
lea edi, [esp + 0xc]
call fcn.0040a540
mov al, 1
jmp 0x42393b
mov esi, 0x104
push esi
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x423930
cmp eax, esi
ja 0x423930
lea eax, [esp + 0x44]
push eax
mov ecx, edi
call fcn.00408773
jmp 0x4238fc
lea edi, [esp + 0xc]
call fcn.0040a540
xor al, al
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042acb7
mov esp, ebp
pop ebp
ret

Function at 0x423cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x423cf0
cmp byte [eax], 0
je 0x423cf0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x423ced
test al, 0x10
jne 0x423ced
xor eax, eax
inc eax
ret
xor eax, eax
ret
xor al, al
ret

Function at 0x423cf3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x423d13
cmp byte [eax], 0
je 0x423d13
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x423d10
test al, 0x10
jbe 0x423d10
xor eax, eax
inc eax
ret
xor eax, eax
ret
xor al, al
ret

Function at 0x423d16
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x448138]
xor eax, ebp
mov dword [ebp + 0x188], eax
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
lea eax, [ebp - 0x7f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x80], bl
call fcn.00432e00
push edi
lea eax, [ebp + 0x85]
push ebx
push eax
mov byte [ebp + 0x84], bl
call fcn.00432e00
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, ebx
je 0x423dd3
cmp eax, edi
jae 0x423dd3
lea eax, [ebp + 0x84]
push eax
push ebx
push 0x4062d0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x423dd3
lea eax, [ebp + 0x84]
call fcn.00423cd0
test al, al
je 0x423dbc
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp + 0x84]
call fcn.00423cd0
test al, al
jne 0x423dd3
lea eax, [ebp + 0x84]
push eax
mov ecx, esi
call fcn.00408773
call fcn.00422f95
mov al, 1
jmp 0x423dd5
xor al, al
mov ecx, dword [ebp + 0x188]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042acb7
add ebp, 0x18c
leave
ret