joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71389f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
jmp 0x71386a
add esp, 1
bswap eax
lea esp, [esp + 1]
push edx
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
bswap eax
jmp 0x713890
xchg ah, al
mov edx, 0x911d4e3a
dec dx
call 0x71389f
cmp al, 0x83
les eax, [ecx]
lea esp, [esp + 3]
push edi
jmp 0x713b3b
cld
lea edx, [ecx*4]
sete al
lea edi, [eax + ebx]
jmp 0x7139bb
rdtsc
mov edx, esp
inc dx
bswap edi
cmc
bswap edi
jmp 0x7138cd
mov ah, 0x24
dec ax
rdtsc
bswap eax
bsf ax, cx
mov eax, 0x871f3e9f
call fcn.00713960
lea edi, [eax + eax]
xchg dx, ax
xchg dh, ah
cmc
rcr dh, cl
xchg di, ax
jmp 0x7139e3
mov eax, esp
xchg edi, edx
mov ax, bp
setl dh
pop dx
push ecx
jmp 0x713a24
neg edi
mov word [esp + 1], ax
mov dx, word [esp + 4]
jmp 0x713ad1
push word [esp + 1]
push word [esp + 2]
pop edx
mov edx, 0x8245451d
neg dl
mov dx, word [esp + 1]
jmp 0x713a0e
btc ax, di
lea eax, [eax*4]
setg ah
shr eax, cl
jmp 0x713aa6
mov ax, cx
bt edx, ebx
bts eax, ebx
xchg al, ah
mov ax, 0x44ec
bswap eax
jmp 0x713a62
xor di, dx
pop dx
sub esp, 5
pop eax
sub esp, 0x1f
mov dx, cx
jmp 0x713a78
xchg dword [esp + 3], edi
mov edx, 0x4d7fb435
lea edx, [ebx + ebx]
inc dh
pop word [esp + 0x1e]
pop dword [esp + 0xf]
jmp 0x713b08
lea edx, [eax*4]
inc dx
setbe dh
push dword [esp + 1]
rdtsc
pop eax
jmp 0x713a95
neg dx
push dword [esp + 0xc]
mov byte [esp], cl
mov ah, byte [esp + 0xa]
pop word [esp + 0xd]
lea esp, [esp + 0xc]
jmp 0x713b17
mov byte [esp + 1], al
mov dword [esp], ebx
pop eax
pop di
cmc
mov al, ch
jmp 0x713ae6
shl ax, cl
lea edx, [esp + ecx]
mov ax, 0xa7c
lea esp, [esp]
xchg dword [esp + 3], eax
inc al
jmp 0x713b72
clc
mov dl, bl
xchg di, dx
xchg edi, eax
mov dh, 0x69
mov eax, 0x7ecbc384
jmp 0x7138e3
pop ax
lea edx, [esi - 0xe5]
mov al, 0x17
mov edi, esi
bswap edx
xchg word [esp], di
jmp 0x713bd2
lea eax, [esi*4]
mov ah, byte [esp]
lea edi, reloc.WSOCK32.dll___WSAFDIsSet
pop eax
pop edi
not ah
jmp 0x713b4f
bswap eax
dec al
mov dh, 0xff
xchg di, ax
mov ax, 0x6fcf
mov edx, dword [esp]
jmp 0x713bb2
mov edx, ebp
mov ah, 0x67
lea edx, [edi*4]
mov edx, ecx
lea edx, [ecx + edi]
pop dx
jmp 0x713b88
mov eax, dword [esp]
not al
sub esp, 1
mov dl, 0x22
and eax, 0x5436d2d2
and edi, 0xa2970edb
jmp 0x713bff
bswap eax
mov edx, 0x8e935873
mov edx, 0x4304daa9
add esp, 1
not ax
xchg byte [esp], dh
jmp 0x713b9e
xchg byte [esp], ah
call fcn.00713be9
mov dl, ah
mov dl, 0x1a
xchg byte [esp], ah
mov edi, 0xf11ed3f8
xchg di, ax
jmp 0x713c2e
mov word [esp], ax
mov word [esp], di
lea edx, [esp + eax]
mov ax, 0xc72
jmp 0x713c8e
mov dx, word [esp + 1]
mov dl, dh
add esp, 0
mov dx, si
bswap edx
bsr edi, esi
jmp 0x713c4a
add esp, 0
mov dx, 0x841f
dec edx
xchg edi, eax
btr di, ax
xchg dh, al
jmp 0x713c61
Function at 0x713960
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
btc eax, ecx
neg edx
mov ah, byte [esp + 6]
neg di
jmp 0x71393b
sub esp, 0x13
lea esp, [esp + 0x15]
not edx
rcr di, 1
pushfd
mov eax, dword [esp + 1]
jmp 0x7138f0
mov edi, dword [esp + 3]
lea esp, [esp + 1]
mov ax, 0xa055
mov edi, dword [esp]
xchg al, dh
rdtsc
jmp 0x713906
ror dx, 1
add di, 0x72c5
mov dh, 0x14
neg edi
or di, 0xcfb0
xchg dword [esp + 1], eax
jmp 0x71397d
jmp 0x713926
mov di, dx
lea edi, [edi*4]
mov byte [esp + 3], bh
mov ax, 0x14b3
sub esp, 0
jmp 0x713996
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
rdtsc
mov byte [esp + 2], ah
add esp, 2
pop word [esp + 2]
bsr eax, ebx
jmp 0x713962
xchg edx, eax
setl ah
pop word [esp]
bswap edx
std
bsf edx, ebx
jmp 0x713a4c
mov byte [esp + 1], al
mov byte [esp], cl
mov ax, 0x14b0
add di, bx
neg dl
neg dh
jmp 0x7139d1
adc eax, 0xfb14229b
mov di, dx
adc dx, 0x977b
rdtsc
xchg dh, dl
not dx
jmp 0x7139fa
Function at 0x718496
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x10], esi
bswap eax
bswap eax
mov cl, byte [esp + 0xb]
jmp 0x718512
cpuid
lea ebp, [eax + edi]
shl ebx, cl
mov ecx, ebx
push word [esp + 0x15]
neg esi
jmp 0x7184ec
bswap ebx
push dword [esp + 0x19]
xchg word [esp + 0x2e], cx
pop ax
lea edi, reloc.WSOCK32.dll___WSAFDIsSet
mov di, 0x1e3e
jmp 0x7184b8
cpuid
setae al
xchg dword [esp + 0x18], eax
lea esp, [esp + 2]
mov dx, word [esp + 0x32]
not edi
jmp 0x71853c
xchg cl, al
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
mov bl, cl
pop cx
inc al
mov eax, ecx
jmp 0x7184d2
mov cx, si
shr bp, 0xe
push sp
mov byte [esp + 0x20], dh
std
mov dh, al
jmp 0x718566
mov dl, byte [esp + 0xd]
mov word [esp + 0x15], dx
xchg byte [esp + 4], bh
rdtsc
mov esi, ebx
cmc
jmp 0x718524
bswap eax
mov dl, byte [esp + 8]
neg al
lea esp, [esp + 5]
jmp 0x7185a4
rdtsc
add esp, 0x23
std
bswap ebp
rdtsc
mov dh, 0x6f
jmp 0x718550
mov word [esp + 5], bx
setle bl
xchg word [esp + 6], dx
xchg word [esp + 7], dx
mov ebx, 0x3285d66a
jmp 0x7185ee
pop word [esp + 1]
shl edx, cl
lea esp, [esp + 3]
bsf cx, bp
jmp 0x718730
mov di, 0xdbcf
mov dword [esp + 7], edi
not esi
lea ecx, [eax + esi]
add esp, 2
std
jmp 0x7185d8
lea esi, [ecx + ebx]
bt eax, ecx
mov byte [esp], al
xchg ebp, edi
bswap edi
call fcn.00718638
lea esp, [esp + 2]
neg esi
sub esp, 0x13
rdtsc
std
jmp 0x7186d5
mov edi, 0x93842294
push cx
add esp, 0
mov ax, word [esp + 2]
clc
rcr esi, cl
jmp 0x718662
sub esp, 5
mov edi, 0xefb16169
mov bp, 0x2487
xor edi, edi
jmp 0x718717
push word [esp + 0x14]
shr bl, 1
mov ax, 0x9db6
std
add esp, 0xd
pop dx
jmp 0x7186bf
xchg esi, ecx
add esp, 3
lea edi, [ebp*4]
xchg esi, edi
dec edx
lea eax, [ebp - 0x6c]
jmp 0x7186ab
mov word [esp + 4], sp
add esp, 8
mov edi, dword [esp + 3]
push dword [esp + 4]
jmp 0x718756
lea esi, reloc.WSOCK32.dll___WSAFDIsSet
mov dword [esp + 9], ecx
mov bx, word [esp + 9]
jmp 0x718701
cpuid
mov ah, cl
xchg edi, esi
lea esp, [esp + 2]
mov bh, 0xdc
rdtsc
jmp 0x7186ed
neg esi
push dword [esp]
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
mov ah, byte [esp + 5]
jmp 0x71898b
pop dword [esp]
xchg dh, ah
add esp, 0
dec bp
shr bx, 0xb
not dx
jmp 0x718740
lea esp, [esp + 2]
mov bx, word [esp + 3]
call fcn.0071888d
xchg bh, ch
mov bx, si
xchg bl, ah
setge ah
rdtsc
sub esp, 9
call fcn.00718926
push ecx
setp dh
neg dl
setp dl
xchg word [esp], di
bsf bx, si
add esp, 2
jmp 0x7188e1
mov byte [esp + 2], dh
neg si
push word [esp + 8]
mov byte [esp + 2], bh
sbb bh, 0xdf
mov byte [esp], ch
jmp 0x7188d3
Function at 0x7187a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
bsf ecx, edx
sub esp, 0x1b
rdtsc
xchg dword [esp + 0x1c], edx
lea edx, [eax + ebp]
jmp 0x7187c7
lea esp, [esp + 0xe]
mov ebp, dword [esp + 2]
jmp 0x718791
pop word [esp + 0xd]
mov cx, bp
or ebx, ebx
bsr si, ax
rdtsc
jmp 0x7187f4
mov al, byte [esp + 0xc]
cld
cpuid
push word [esp + 0x1a]
xchg al, bh
mov cl, ah
jmp 0x7187b1
pushal
mov edi, 0xa4ebe433
call fcn.00718827
add eax, dword [edx + ebx - reloc.WSOCK32.dll___WSAFDIsSet]
xor dword [ecx - reloc.WSOCK32.dll___WSAFDIsSet], esp
mov bl, 0xaa
lds esp, [esi - 0x71]
inc esp
and al, 9
pop word [esp + 9]
xchg dx, cx
bsr bp, bx
lea esp, [esp + 0x1b]
mov bp, 0x9f0a
lea eax, [ebp*4]
jmp 0x7187d9

Function at 0x71889f
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb dh
push word [esp + 2]
jmp 0x718952
rdtsc
push si
cld
shr ebx, 0xa
lea esp, [esp + 9]
mov ax, bx
setns dh
cpuid
mov bp, 0xf93a
xchg bp, cx
xchg esi, ecx
jmp 0x718915

Function at 0x718da3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 2]
pushal
mov al, byte [esp + 0x2a]
sub esp, 1
xchg dword [esp + 0x15], ebp
jmp 0x718d3c
neg bh
xchg si, di
inc eax
mov ax, word [esp + 3]
mov cx, bx
bswap eax
jmp 0x718cfa
bsf ax, bp
neg dl
xchg byte [esp + 0x31], ah
shl al, cl
lea eax, [esi*4]
jmp 0x718d67
lea ecx, [eax*4]
sub esp, 0x12
neg bl
mov ah, 0xf5
mov dl, al
xchg cx, si
jmp 0x718d22
mov di, word [esp + 0x24]
cld
push dword [esp + 9]
push dword [esp + 0xc]
jmp 0x718d82
lea ebp, [edi*4]
rdtsc
pop dword [esp + 0xc]
pop dword [esp + 0x1a]
mov word [esp + 0x28], sp
mov cx, dx
jmp 0x718d51
mov dword [esp + 0x20], eax
mov bx, sp
mov edi, dword [esp + 0x39]
xchg ebx, eax
mov word [esp + 0x2d], bp
xchg dword [esp + 0x13], ebx
jmp 0x718df9
jmp 0x718d10
lea esp, [esp + 0x51]
bsr ecx, ebp
mov edi, esi
rdtsc
mov edx, dword [esp]
bsf ecx, ebx
jmp 0x718dda
dec ebp
mov ecx, 0x5ded0561
inc cx
pop edx
btc di, bp
sub esp, 0x17
jmp 0x718da8
mov si, 0x8889
mov eax, 0xa0b29416
call 0x718e29
mov ch, 0x34
stosb byte es:[edi], al
int 0x3c
mov ah, byte [ebp + 0x23d0b121]
xchg esp, eax
loopne 0x718e19
pop edx
mov ch, 0xa4
xchg byte [esp + 0x21], ch
mov bh, byte [esp + 0x26]
lea ebp, [eax*4]
mov edi, esp
mov word [esp + 0x2b], ax
mov ecx, esp
jmp 0x718dc8
lea edi, [ebx*4]
pop bp
add byte [esi + 0x5d], ah
call fcn.00718e4d
rcr byte [ebx - 0x35], cl
scasb al, byte es:[edi]
pop ebp
out dx, eax
or dword ds:[edi], ecx
enter 0xffffffffffffeb87, 0xffffffffffffff8a
push esp
and al, 3
mov word [esp], si
jmp 0x718e13

Function at 0x7190f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
jmp 0x719191
mov edi, eax
lea edi, [edi + 0xc]
mov eax, dword [edi]
pop edi
jmp 0x719139
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
mov eax, dword fs:[0x30]
push edi
jmp 0x71915a
Function at 0x401150
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401179
pop esi
pop ebp
add esp, 0x108
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40118f
pop esi
pop ebp
add esp, 0x108
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x4011a5
pop esi
pop ebp
add esp, 0x108
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405810]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x405214
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x28]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40126d
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret
Function at 0x401280
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4012a9
pop esi
pop ebp
add esp, 0x108
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4012bf
pop esi
pop ebp
add esp, 0x108
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x4012d5
pop esi
pop ebp
add esp, 0x108
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405810]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.32drivers_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x28]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40139d
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4013d9
pop esi
pop ebp
add esp, 0x108
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4013ef
pop esi
pop ebp
add esp, 0x108
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x401405
pop esi
pop ebp
add esp, 0x108
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405810]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.inf_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 3
lea eax, [esp + 0x28]
push 0xc0000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4014cd
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret

Function at 0x401850
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push 0x9c
push 1
push str.SYUNEW6A.DLL
call fcn.00401a40
push 0x9d
push 0
push str.SYUNEW6D.DLL
call fcn.00401a40
push str.SYUNEW6A.DLL
call fcn.00403730
add esp, 0x1c
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 1
jne 0x401914
cmp dword [esp + 8], 0xa
jne 0x401914
push 0x84
push str.HIDCI.DLL
call fcn.00401150
push 0x88
push str.HIDCLASS.SYS
call fcn.00401280
push 0x86
push str.HIDDEV.INF
call fcn.004013b0
push 0x89
push str.HIDPARSE.SYS
call fcn.00401280
push 0x8a
push str.HIDUSB.SYS
call fcn.00401280
push 0x8e
push 0
push str.Setup98.ex_
call fcn.00401a40
add esp, 0x34
call fcn.00401c20
call fcn.00402680
call fcn.00401930
push str.CLSID83B77157_0860_42D6_917E_1C16BA081713
call fcn.00403530
mov eax, 1
add esp, 0x98
ret
Function at 0x40185b
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push 0x9c
push 1
push str.SYUNEW6A.DLL
call fcn.00401a40
push 0x9d
push 0
push str.SYUNEW6D.DLL
call fcn.00401a40
push str.SYUNEW6A.DLL
call fcn.00403730
add esp, 0x1c
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 1
jne 0x401914
cmp dword [esp + 8], 0xa
jne 0x401914
push 0x84
push str.HIDCI.DLL
call fcn.00401150
push 0x88
push str.HIDCLASS.SYS
call fcn.00401280
push 0x86
push str.HIDDEV.INF
call fcn.004013b0
push 0x89
push str.HIDPARSE.SYS
call fcn.00401280
push 0x8a
push str.HIDUSB.SYS
call fcn.00401280
push 0x8e
push 0
push str.Setup98.ex_
call fcn.00401a40
add esp, 0x34
call fcn.00401c20
call fcn.00402680
call fcn.00401930
push str.CLSID83B77157_0860_42D6_917E_1C16BA081713
call fcn.00403530
mov eax, 1
add esp, 0x98
ret

Function at 0x401930
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x15c
push ebx
push ebp
push esi
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
push 0x104
rep stosd dword es:[edi], eax
mov al, byte [0x405810]
mov ecx, 0x40
mov byte [esp + 0x6c], al
xor eax, eax
lea edi, [esp + 0x6d]
mov dword [esp + 0x28], 0x44
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x54], 1
push ecx
mov word [esp + 0x5c], 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str._setup98.ex_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x7f02
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], eax
mov esi, 6
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push 0
push 0x20
push 1
push 0
lea edx, [esp + 0x84]
push 0
push edx
push 0
call edi
mov eax, dword [esp + 0x14]
push 0xbb8
push eax
call ebx
push 0x1f4
call ebp
dec esi
jne 0x4019e3
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret
Function at 0x401a40
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x108
push ebp
push esi
push 0x405218
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401b8a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401b8a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x401b8a
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov cl, byte [0x405810]
mov ebx, eax
mov byte [esp + 0x14], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x405214
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004038b0
add esp, 4
test eax, eax
je 0x401b70
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea edx, [esp + 0x14]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401b70
lea eax, [esp + 0x10]
push 0
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x120]
pop edi
test eax, eax
pop ebx
je 0x401b8a
lea ecx, [esp + 0xc]
push ecx
call fcn.00401ba0
add esp, 4
pop esi
xor eax, eax
pop ebp
add esp, 0x108
ret
Function at 0x403730
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov al, byte [0x405810]
push ebx
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x405214
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x114]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401ba0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4037e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x80c
push ebx
mov ebx, dword [esp + 0x814]
push esi
push edi
push 0
push ebx
mov dword [esp + 0x14], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jle 0x4038a0
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403897
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403897
mov eax, dword [esp + 0x10]
xor edx, edx
xor ecx, ecx
mov dx, word [eax + 2]
mov cx, word [eax]
push edx
push ecx
lea edx, [esp + 0x20]
push str.StringFileInfo_04x_04xFileVersion
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push eax
push ecx
push edx
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403897
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x820]
pop edi
pop esi
mov cl, byte [eax]
mov eax, 1
mov byte [edx], cl
pop ebx
add esp, 0x80c
ret
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x80c
ret