joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16832a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [str.D__j]
mov dword [ebp - 0x20], 0xffe22
mov dword [ebp - 0x1c], 0x4743a
mov dword [ebp - 0x18], 0x243fa
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x14], 0x1ce53
test ecx, ecx
je 0x168406
push esi
push edi
mov esi, dword [ecx + 0x58]
xor edx, edx
mov dword [ebp - 0xc], 0x1052a0
shr dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0xc]
push 0x69
pop edi
div edi
push 0x18
mov dword [ebp - 0xc], eax
xor edx, edx
add dword [ebp - 0xc], 0xffffee98
xor dword [ebp - 0xc], 0xfff8c12f
mov dword [ebp - 8], 0xbbf961
add dword [ebp - 8], 0x8e60
or dword [ebp - 8], 0x256b88ac
mov eax, dword [ebp - 8]
pop edi
div edi
mov dword [ebp - 8], eax
xor dword [ebp - 8], 0x197516b
mov dword [ebp - 0x10], 0xc6a333
shl dword [ebp - 0x10], 8
xor dword [ebp - 0x10], 0xc6aa6a84
mov dword [ebp - 4], 0x1844a7
add dword [ebp - 4], 0xffff3bf3
add dword [ebp - 4], 0xffff3f1d
or dword [ebp - 4], 0xc103db53
xor dword [ebp - 4], 0xc11efce0
push dword [ebp - 4]
push ecx
push dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.001685d0
add esp, 0xc
mov ecx, esi
test esi, esi
jne 0x16835e
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x16840a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
push ebp
push dword [esp + 0x24]
mov ebx, ecx
push dword [esp + 0x24]
push edx
push ebx
call fcn.00163128
mov ecx, dword [ebx + 0x3c]
add esp, 0x10
mov dword [esp + 0x14], 0x6cfee
add ecx, ebx
mov dword [esp + 0x18], 0x5a0b4
mov dword [esp + 8], 0x211d7
add dword [esp + 8], 0xffff361b
add dword [esp + 8], 0xffff4a52
shl dword [esp + 8], 3
xor dword [esp + 8], 0x49225
mov eax, dword [esp + 8]
sub edx, dword [ecx + 0x34]
mov dword [esp + 8], edx
mov edx, dword [ecx + eax*8 + 0x78]
mov ebp, dword [ecx + eax*8 + 0x7c]
add edx, ebx
add ebp, edx
mov dword [esp + 0x14], ebp
cmp edx, ebp
jae 0x1684c7
push esi
push edi
mov edi, dword [edx + 4]
lea esi, [edx + 8]
add edi, edx
cmp esi, edi
jae 0x1684be
mov ebp, dword [esp + 0x10]
movzx eax, word [esi]
mov ecx, eax
mov dword [esp + 0x18], 0x3000
and ecx, 0xfff
and eax, 0xf000
add ecx, dword [edx]
add ecx, ebx
cmp ax, word [esp + 0x18]
jne 0x1684b3
add dword [ecx], ebp
add esi, 2
cmp esi, edi
jb 0x16848e
mov ebp, dword [esp + 0x1c]
add edx, dword [edx + 4]
cmp edx, ebp
jb 0x16847e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x16bb67
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x8c
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x98]
push esi
push edi
push dword [esp + 0xb0]
mov edi, edx
push dword [esp + 0xb0]
mov dword [esp + 0x20], edi
push ebx
push dword [esp + 0xb0]
push ebp
push edi
push ecx
call fcn.00163128
mov dword [esp + 0x30], 0xe3392
add esp, 0x1c
mov dword [esp + 0x10], 0x3c6960
xor esi, esi
shl dword [esp + 0x10], 3
xor dword [esp + 0x10], 0xa04b5811
xor dword [esp + 0x10], 0xa1a81310
mov eax, dword [esp + 0x10]
test edi, eax
je 0x16bbe5
push 0x61
pop eax
mov word [esp + esi*2 + 0x1c], ax
inc esi
inc eax
cmp ax, 0x7a
jbe 0x16bbd8
mov dword [esp + 0x10], 0xe4264c
xor edx, edx
mov eax, dword [esp + 0x10]
push 0x2f
pop ecx
div ecx
mov dword [esp + 0x10], eax
shl dword [esp + 0x10], 6
add dword [esp + 0x10], 0x4bf0
xor dword [esp + 0x10], 0x136f7b2
mov eax, dword [esp + 0x10]
test edi, eax
je 0x16bc29
push 0x41
pop eax
mov word [esp + esi*2 + 0x1c], ax
inc esi
inc eax
cmp ax, 0x5a
jbe 0x16bc1c
mov dword [esp + 0x14], 0x155561
add dword [esp + 0x14], 0x7bbe
xor dword [esp + 0x14], 0x15d11b
mov eax, dword [esp + 0x14]
test edi, eax
je 0x16bc59
push 0x30
pop eax
mov word [esp + esi*2 + 0x1c], ax
inc esi
inc eax
cmp ax, 0x39
jbe 0x16bc4c
test ebx, ebx
je 0x16bcbd
xor edi, edi
mov dword [esp + 0x14], 0x4f7c14
shl dword [esp + 0x14], 0xe
shl dword [esp + 0x14], 0xd
xor dword [esp + 0x14], 0xa000ffdd
mov dword [esp + 0x10], 0xe642ab
add dword [esp + 0x10], 0xffffdcba
add dword [esp + 0x10], 0xffff9cfb
xor dword [esp + 0x10], 0xed9354
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
call fcn.001662b4
xor edx, edx
div esi
mov ax, word [esp + edx*2 + 0x1c]
mov word [ebp + edi*2], ax
inc edi
cmp edi, ebx
jb 0x16bc5f
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], 0x63859e
add dword [esp + 0x10], 0xffff9ab0
imul eax, dword [esp + 0x10], 9
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0x8094
xor dword [esp + 0x10], 0x37ca35a
mov eax, dword [esp + 0x10]
test edi, eax
je 0x16bcf5
xor eax, eax
mov word [ebp + ebx*2], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret
Function at 0x16e533
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
push dword [esp + 0x38]
push eax
push edx
push ecx
call fcn.00163128
mov ecx, dword [eax]
lea ebx, [eax + 4]
mov edi, dword [ebx]
add esp, 0x14
mov dword [esp + 0x20], 0x5b432
xor edi, ecx
mov dword [esp + 0x24], 0x9483d
add ebx, 4
mov dword [esp + 0x28], 0xfdb95
mov dword [esp + 0x30], 0x95b014
imul eax, dword [esp + 0x30], 0x76
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], eax
shr dword [esp + 0x30], 0xd
shl dword [esp + 0x30], 0x10
xor dword [esp + 0x30], 0x27f90001
mov dword [esp + 0x10], 0xc896a5
shl dword [esp + 0x10], 0xb
xor dword [esp + 0x10], 0x44b52804
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
add ecx, edi
mov esi, dword [esp + 0x30]
dec eax
add esi, edi
test eax, ecx
je 0x16e5d7
mov eax, dword [esp + 0x10]
dec eax
not eax
and esi, eax
add esi, dword [esp + 0x10]
mov dword [esp + 0x10], 0x6b9d86
xor edx, edx
add dword [esp + 0x10], 0xe3e2
add dword [esp + 0x10], 0x594f
xor dword [esp + 0x10], 0x6a4f7d
mov dword [esp + 0x30], 0x986aa6
xor dword [esp + 0x30], 0x12a06023
mov eax, dword [esp + 0x30]
push 0x22
pop ecx
div ecx
push ecx
mov dword [esp + 0x34], eax
lea edx, [esi + esi]
shr dword [esp + 0x34], 1
xor dword [esp + 0x34], 0x4ccf50
mov dword [esp + 0x18], 0xc62b31
shr dword [esp + 0x18], 9
xor dword [esp + 0x18], 0x55c15
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
push ecx
call fcn.00169952
mov ebp, eax
mov dword [esp + 0x38], ebp
pop ecx
pop ecx
test ebp, ebp
je 0x16e6c0
shr esi, 2
xor eax, eax
lea ecx, [ebx + esi*4]
mov esi, ebp
mov edx, ecx
sub edx, ebx
add edx, 3
shr edx, 2
cmp ebx, ecx
cmova edx, eax
test edx, edx
je 0x16e6b9
mov ebp, dword [esp + 0x18]
xor edi, edi
mov ecx, dword [ebx]
lea ebx, [ebx + 4]
xor ecx, ebp
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc edi
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp edi, edx
jb 0x16e67c
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x30]
xor eax, eax
mov word [ebp + edi*2], ax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x16f68c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
push dword [esp + 0x28]
mov edi, edx
push edi
push ecx
call fcn.00163128
and dword [esp + 0x28], 0
xor edx, edx
and dword [esp + 0x2c], 0
mov eax, edi
mov dword [esp + 0x20], 0xf3fbe
add esp, 0x10
mov dword [esp + 0x14], 0xcaae2
mov dword [esp + 0x28], 0x92ae39
add dword [esp + 0x28], 0xffff0cc7
add dword [esp + 0x28], 0xffffd1da
add dword [esp + 0x28], 0xffff92f4
xor dword [esp + 0x28], 0x911fca
mov ecx, dword [esp + 0x28]
div ecx
mov ebx, eax
test ebx, ebx
je 0x16f74a
push ebp
mov ebp, ebx
mov dword [esp + 0x10], 0x29f227
xor edx, edx
mov eax, dword [esp + 0x10]
push 0x5a
pop ecx
div ecx
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x8d2d3
mov dword [esp + 0x2c], 0x3a4d07
imul eax, dword [esp + 0x2c], 0x74
mov dword [esp + 0x2c], eax
xor dword [esp + 0x2c], 0x1a69793d
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
call fcn.001662b4
mov dword [esi], eax
add esi, 4
dec ebp
jne 0x16f6fc
pop ebp
mov dword [esp + 0x28], 0xd41dfb
add dword [esp + 0x28], 0xffff0cd2
shr dword [esp + 0x28], 0xf
add dword [esp + 0x28], 0x2702
xor dword [esp + 0x28], 0x28ac
mov eax, dword [esp + 0x28]
imul eax, ebx
sub edi, eax
je 0x16f856
mov dword [esp + 0xc], 0xc8f9b0
xor edx, edx
imul eax, dword [esp + 0xc], 0x79
push 9
pop ecx
mov dword [esp + 0xc], eax
shl dword [esp + 0xc], 0x10
xor dword [esp + 0xc], 0x437ca1c
mov dword [esp + 0x28], 0x881707
shl dword [esp + 0x28], 7
shl dword [esp + 0x28], 4
mov eax, dword [esp + 0x28]
div ecx
mov dword [esp + 0x28], eax
xor dword [esp + 0x28], 0x73af135
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
call fcn.001662b4
mov ebx, eax
mov edx, ebx
shr edx, 0x10
mov ecx, edx
shr ecx, 8
mov byte [esi], cl
inc esi
mov dword [esp + 0x28], 0x1ff7b1
imul ecx, dword [esp + 0x28], 0x34
mov dword [esp + 0x28], ecx
imul eax, dword [esp + 0x28], 0x7a
mov dword [esp + 0x28], eax
shr dword [esp + 0x28], 0xe
xor dword [esp + 0x28], 0x60c9
mov eax, dword [esp + 0x28]
cmp edi, eax
jbe 0x16f813
mov byte [esi], dl
inc esi
mov dword [esp + 0x28], 0x3a7a22
xor edx, edx
add dword [esp + 0x28], 0xffff9e72
mov eax, dword [esp + 0x28]
push 0x71
pop ecx
div ecx
push 0x6b
mov dword [esp + 0x2c], eax
xor edx, edx
mov eax, dword [esp + 0x2c]
pop ecx
div ecx
mov dword [esp + 0x28], eax
xor dword [esp + 0x28], 0x138
mov eax, dword [esp + 0x28]
cmp edi, eax
jbe 0x16f856
shr ebx, 8
mov byte [esi], bl
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x180171
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push dword [esp + 0x38]
mov ebp, edx
push dword [esp + 0x38]
mov dword [esp + 0x28], ebp
push ebp
push ecx
call fcn.00163128
mov eax, dword [ecx]
lea edi, [ecx + 4]
and dword [esp + 0x3c], 0
add esp, 0x10
mov ebx, dword [edi]
add edi, 4
mov dword [esp + 0x24], 0xfa3d3
xor ebx, eax
mov dword [esp + 0x28], 0xf328
mov dword [esp + 0x10], 0x30e68a
or dword [esp + 0x10], 0x2e68c038
xor dword [esp + 0x10], 0x2e78e6be
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
dec eax
test ebx, eax
je 0x1801e5
mov esi, dword [esp + 0x10]
dec esi
not esi
and esi, ebx
add esi, dword [esp + 0x10]
jmp 0x1801e7
mov esi, ebx
mov dword [esp + 0x10], 0xc2314d
xor edx, edx
shr dword [esp + 0x10], 6
add dword [esp + 0x10], 0xab45
add dword [esp + 0x10], 0x7540
xor dword [esp + 0x10], 0xc581f
mov dword [esp + 0x18], 0xe802ba
mov eax, dword [esp + 0x18]
push 0x4c
pop ecx
div ecx
push ecx
mov dword [esp + 0x1c], eax
mov edx, esi
xor dword [esp + 0x1c], 0x8677c
mov dword [esp + 0x18], 0xda41bc
imul eax, dword [esp + 0x18], 0x4b
push ecx
mov dword [esp + 0x1c], eax
xor dword [esp + 0x1c], 0x3ffe9165
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
call fcn.00169952
mov dword [esp + 0x20], eax
pop ecx
pop ecx
test eax, eax
je 0x1802a6
shr esi, 2
lea ecx, [edi + esi*4]
xor esi, esi
mov edx, ecx
sub edx, edi
add edx, 3
shr edx, 2
cmp edi, ecx
cmova edx, esi
test edx, edx
je 0x18029f
mov esi, dword [esp + 0x1c]
mov ecx, eax
sub ecx, edi
xor ebp, ebp
mov eax, dword [edi]
xor eax, esi
inc ebp
mov dword [ecx + edi], eax
lea edi, [edi + 4]
cmp ebp, edx
jb 0x180288
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
test ebp, ebp
je 0x1802a6
mov dword [ebp], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x402c12
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [0x4474d0]
xor edi, edi
or eax, 8
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ca4
mov ebx, 0x105
jmp 0x402c5d
cmp dword [ebp + 0x10], edi
jne 0x402c98
push edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00402c12
test eax, eax
jne 0x402c73
push ebx
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x402c44
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00405ebe
test eax, eax
je 0x402cac
push edi
push dword [0x4474d0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ca4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x4474d0], edi
jne 0x402ca1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ca1
mov eax, edi
jmp 0x402ca4
Function at 0x402d63
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
sub esp, 0x50
mov ecx, dword [esp + 0x54]
mov eax, 0x4201a0
push ebp
push esi
push edi
mov edi, dword [esp + 0x68]
mov ebp, 0x8000
test edi, edi
cmovne ebp, dword [esp + 0x6c]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0xc], eax
test ecx, ecx
js 0x402d9e
mov eax, dword [0x447438]
add eax, ecx
push eax
call fcn.00402d4c
push 4
lea eax, [esp + 0x6c]
push eax
push dword [0x40a010]
call fcn.00405f21
test eax, eax
jne 0x402dbc
push 0xfffffffffffffffd
pop eax
jmp 0x402f01
mov eax, dword [esp + 0x68]
push ebx
test eax, eax
jns 0x402f1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x414118
mov dword [esp + 0x70], eax
call fcn.00407152
mov ecx, dword [esp + 0x6c]
and ecx, 0x7fffffff
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x64], ecx
jle 0x402efe
mov ebx, 0x4000
cmp ecx, ebx
cmovl ebx, ecx
push ebx
push 0x41c1a0
call fcn.00402d36
test eax, eax
je 0x402f7e
sub dword [esp + 0x6c], ebx
mov eax, dword [esp + 0x10]
mov dword [0x414130], 0x41c1a0
mov dword [0x414134], ebx
mov ecx, 0x414118
mov dword [0x414138], eax
mov dword [0x41413c], ebp
call fcn.00406362
mov dword [esp + 0x1c], eax
test eax, eax
js 0x402f18
mov ebx, dword [0x414138]
sub ebx, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x4474d4], 1
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
je 0x402eb7
sub eax, dword [esp + 0x70]
cmp eax, 0xc8
ja 0x402e7b
test ecx, ecx
jne 0x402eb7
mov eax, dword [esp + 0x64]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x24]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
call fcn.004055de
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x70], eax
test ebx, ebx
je 0x402f0a
test edi, edi
jne 0x402ee6
push edi
lea eax, [esp + 0x1c]
push eax
push ebx
push dword [esp + 0x1c]
push dword [esp + 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402f14
cmp dword [esp + 0x18], ebx
jne 0x402f14
mov eax, dword [esp + 0x10]
add esi, ebx
jmp 0x402ef3
mov eax, dword [0x414138]
add esi, ebx
sub ebp, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], 1
jne 0x402e2a
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x50
ret 0x10
test ecx, ecx
jg 0x402df5
jmp 0x402efe
push 0xfffffffffffffffe
jmp 0x402f80
push 0xfffffffffffffffc
jmp 0x402f80
test edi, edi
jne 0x402f6a
test eax, eax
jle 0x402efe
mov ebx, 0x41c1a0
cmp eax, ebp
mov edi, ebp
cmovl edi, eax
push edi
push ebx
call fcn.00402d36
test eax, eax
je 0x402f7e
push 0
lea eax, [esp + 0x74]
push eax
push edi
push ebx
push dword [esp + 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402f14
cmp edi, dword [esp + 0x70]
jne 0x402f14
mov eax, dword [esp + 0x6c]
add esi, edi
sub eax, edi
mov dword [esp + 0x6c], eax
test eax, eax
jg 0x402f29
jmp 0x402efe
mov esi, dword [esp + 0x70]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00402d36
test eax, eax
jne 0x402efe
push 0xfffffffffffffffd
pop eax
jmp 0x402f00
Function at 0x402f86
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x402fa5
mov eax, dword [0x414110]
test eax, eax
je 0x402f9d
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x414110], 0
ret
cmp dword [0x414110], 0
je 0x402fb6
push 0
call fcn.00405936
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x4473e0]
jbe 0x402fe9
push 0
push 0x403252
push 0
push 0x6f
push dword [0x4433d4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x414110], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x402fea
Capabilities:
Get file size

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x2000
mov esi, 0x47e000
add eax, 0x3e8
push esi
push ebx
mov dword [0x4473e0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x80000000
push esi
call fcn.00405ef4
mov ebp, eax
mov dword [0x40a010], ebp
cmp ebp, 0xffffffff
jne 0x403043
mov eax, str.Error_launching_installer
jmp 0x403239
push esi
mov esi, 0x476000
push esi
call fcn.004060a1
push esi
call fcn.00406207
push eax
push 0x480000
call fcn.004060a1
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [0x414108], esi
test esi, esi
jle 0x403177
mov ebx, dword [esp + 0x38]
cmp dword [0x4473e8], 0
mov eax, 0x8000
mov edi, 0x200
cmovne edi, eax
cmp esi, edi
cmovl edi, esi
push edi
push 0x4141a0
call fcn.00402d36
test eax, eax
je 0x403243
cmp dword [0x4473e8], 0
jne 0x403137
push 0x1c
push 0x4141a0
lea eax, [esp + 0x20]
push eax
call fcn.00405c6f
test dword [esp + 0x18], 0xfffffff0
jne 0x403144
cmp dword [esp + 0x1c], 0xdeadbeef
jne 0x403144
cmp dword [esp + 0x28], 0x46537349
jne 0x403144
cmp dword [esp + 0x24], 0x65724358
jne 0x403144
cmp dword [esp + 0x20], 0x726f7461
jne 0x403144
mov eax, dword [0x41410c]
or ebx, dword [esp + 0x18]
mov dword [0x4473e8], eax
mov eax, ebx
and eax, 2
or dword [0x4474c0], eax
mov eax, dword [esp + 0x30]
cmp eax, esi
jg 0x40324b
test bl, 8
jne 0x403128
test bl, 4
jne 0x40316f
inc dword [esp + 0x10]
lea esi, [eax - 4]
cmp edi, esi
jbe 0x403144
mov edi, esi
jmp 0x403144
test bl, 2
jne 0x403144
push 0
call fcn.00402f86
pop ecx
cmp esi, dword [0x414108]
jge 0x40315f
push edi
push 0x4141a0
push dword [esp + 0x1c]
call fcn.004062f8
mov dword [esp + 0x14], eax
add dword [0x41410c], edi
sub esi, edi
test esi, esi
jg 0x40307d
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 1
call fcn.00402f86
cmp dword [0x4473e8], 0
pop ecx
je 0x40324b
test ebx, ebx
je 0x4031bf
push dword [0x41410c]
call fcn.00402d4c
push 4
lea eax, [esp + 0x3c]
push eax
push dword [0x40a010]
call fcn.00405f21
test eax, eax
je 0x40324b
cmp edi, dword [esp + 0x38]
jne 0x40324b
push dword [esp + 0x2c]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [0x4473e8]
mov esi, eax
add ecx, 0x1c
push ecx
call fcn.00402d4c
push dword [esp + 0x2c]
xor ebx, ebx
push esi
push ebx
push 0xffffffffffffffff
call fcn.00402d63
cmp eax, dword [esp + 0x2c]
jne 0x40324b
test byte [esp + 0x18], 1
mov dword [0x4473f0], esi
mov eax, dword [esi]
mov dword [0x4473ec], eax
je 0x40320b
inc dword [0x4473e4]
push 8
pop ecx
lea eax, [esi + 0x44]
lea eax, [eax - 8]
add dword [eax], esi
dec ecx
jne 0x403211
push 1
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
lea eax, [esi + 4]
push 0x40
push eax
push 0x447400
call fcn.00405c6f
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
push 1
call fcn.00402f86
pop ecx
mov eax, 0x4082e0
jmp 0x403239
Function at 0x40599f
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
push 0x4086f4
push 0x43ea28
call ebp
mov esi, dword [esp + 0x1c]
mov ebx, 0x400
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
je 0x4059f3
push 1
push 0
push esi
call fcn.00405ef4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x43ea28
push esi
call edi
test eax, eax
je 0x405ae3
cmp eax, ebx
jg 0x405ae3
push ebx
mov esi, 0x43e628
push esi
push dword [esp + 0x20]
call edi
test eax, eax
je 0x405ae3
cmp eax, ebx
jg 0x405ae3
push esi
push 0x43ea28
push str._s_s_r_n
push 0x43e228
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4473f0]
add esp, 0x10
mov edi, eax
mov dword [esp + 0x1c], edi
push dword [ecx + 0x128]
push esi
call fcn.004056c3
push 4
push 0xc0000000
push esi
call fcn.00405ef4
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405ae3
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [edi + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x405adc
push esi
push edi
push ebx
call fcn.00405f21
test eax, eax
je 0x405adc
push str._Rename__r_n
push edi
call fcn.004060bd
test eax, eax
jne 0x405ae9
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call ebp
add esi, 0xa
mov ecx, esi
mov ebp, dword [esp + 0x1c]
lea eax, [ecx + edi]
push ebp
push 0x43e228
push eax
call fcn.00405c6f
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esi + ebp]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x408700
add eax, 0xa
push eax
call fcn.004060bd
mov ecx, eax
test ecx, ecx
je 0x405aa1
mov ebp, dword [esp + 0x1c]
lea edx, [edi + esi]
add ebp, edx
cmp edx, ecx
jbe 0x405b16
sub ebp, edx
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x405b0c
sub ecx, edi
inc ecx
jmp 0x405aa3

Function at 0x405b48
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406110
mov edi, eax
cmp edi, 0xffffffff
je 0x405b8b
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x405b73
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x405b7b
xor eax, eax
inc eax
jmp 0x405b8d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405b6a
test byte [ebp + 0xc], 4
jne 0x405b8b
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop ebp
ret 8
Function at 0x405bf6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x43c228
push ebx
call fcn.004060a1
push ebx
call fcn.00406138
mov esi, eax
test esi, esi
jne 0x405c17
xor eax, eax
jmp 0x405c6a
push esi
call fcn.00406232
test byte [0x4473ec], 0x80
je 0x405c30
mov al, byte [esi]
test al, al
je 0x405c13
cmp al, 0x5c
je 0x405c13
sub esi, ebx
jmp 0x405c48
call fcn.00405b92
test eax, eax
je 0x405c42
test byte [eax], 0x10
je 0x405c13
push ebx
call fcn.00406207
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
cmp eax, esi
jg 0x405c34
call fcn.00405b1b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
ret 4

Function at 0x405c8f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x43a1e0], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x43a1e0
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405cce
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4