joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44106c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x180], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b64
xor eax, eax
push ebp
push 0x4411b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x44118f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 4]
call fcn.0040d0ec
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 4]
call fcn.0040474c
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.00403140
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.00404708
push 0x200
push 0x160
lea eax, [ebp - 0x17c]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404b74
mov esi, eax
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x441169
lea eax, [ebx + 0xc]
lea edx, [ebp - 0x170]
mov ecx, 0x104
call fcn.00404924
mov dword [ebx + 8], 8
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [0x461470]
mov eax, dword [eax]
call eax
test eax, eax
je 0x441169
push 0
push 0xf4240
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00405a50
mov dword [ebx + 4], eax
push 0
push 0xf4240
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405a50
mov dword [ebx], eax
mov edx, esi
lea eax, [ebx + 0x44]
mov ecx, 0x104
call fcn.004091c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441196
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x44397c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x160], edx
mov edi, eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x4075d0]
call fcn.00405468
xor eax, eax
push ebp
push 0x443a8a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4439c6
bt dword [ebp - 4], eax
jae 0x443a56
lea eax, [ebp - 0x164]
mov edx, ebx
add dl, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x168]
call fcn.00403024
mov edx, 0x443a98
lea eax, [ebp - 0x168]
mov cl, 2
call fcn.00402ff4
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x16c]
call fcn.00403024
mov edx, 0x443a9c
lea eax, [ebp - 0x16c]
mov cl, 3
call fcn.00402ff4
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x160]
call fcn.00404918
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.0044106c
lea edx, [ebp - 0x15c]
mov eax, edi
mov si, 0xfffd
call fcn.00403a84
inc ebx
cmp ebx, 0x1a
jne 0x4439bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a91
lea eax, [ebp - 0x160]
call fcn.004046b4
lea eax, [ebp - 0x15c]
mov edx, dword [0x4075d0]
call fcn.00405538
ret

Function at 0x45da00
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405090
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x45da22
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x45da74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405090
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x45da8d
test al, 0x10
jne 0x45da91
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x6e4ed2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
lea esp, [esp + 2]
mov dword [esp + 0xc], edx
setl ah
rdtsc
jmp 0x6e4e5e

Function at 0x705edc
Capabilities:
Encode data using base64

Disassembly:
jmp 0x705f2c
mov byte [esp + 1], bh
lea esp, [esp + 4]
popal
movzx eax, byte [edx]
pop edx
pushal
jmp 0x705ede

Function at 0x7c7001
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, edx
pop ebp
mov ah, al
rdtsc
mov eax, ebx
xchg edx, eax
jmp 0x7c700f
sete dh
pop edx
pop dword [esp]
push dword [esp]
rdtsc
jmp 0x7c6feb
rdtsc
pop edx
rdtsc
mov word [esp], si
mov bl, byte [esp]
xchg edx, ecx
jmp 0x7c7131
rdtsc
cmc
not al
mov ch, cl
mov dh, 1
xchg cx, bp
jmp 0x7c7067
mov word [esp], si
mov al, dh
setne cl
btc ebx, eax
dec ebp
mov dh, 0x13
jmp 0x7c703d
setle dl
mov cl, dl
cld
setb dl
dec cl
mov dl, 0xe1
jmp 0x7c70b2
xchg bx, cx
xchg word [esp], si
bswap ecx
mov word [esp], dx
mov ebx, esp
mov bh, 0xd4
jmp 0x7c7056
rdtsc
mov word [esp], di
mov ah, byte [esp]
mov cx, bp
mov byte [esp], ch
jmp 0x7c70dd
neg dh
lea esi, reloc.MSVCRT.dll_strncpy
ror eax, 0x1d
add esp, 0
stc
bswap ebp
jmp 0x7c709c
mov bl, bh
not edi
pushfd
xchg word [esp + 2], ax
not eax
mov edx, dword [esp + 1]
jmp 0x7c7102
bswap edx
sub esp, 0xe
add esp, 0x10
xchg edi, ebp
mov ecx, ebx
cld
jmp 0x7c70c6
lea esi, [edi*4]
xchg dx, ax
cpuid
xchg ebx, ebp
call fcn.007c7111
mov esp, dword [edx]
pop ebp
lodsb al, byte [esi]
setg bh
inc bp
setle ch
lea esi, [ebx + esi]
dec esi
cld
jmp 0x7c70ec
std
add esp, 0
stc
setnp al
bsr dx, bx
mov ebp, 0x50f1e0ab
jmp 0x7c7089
Function at 0x7c7799
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xc
mov dh, dl
mov di, si
mov dl, al
btr bx, di
mov edx, eax
jmp 0x7c779f
mov ebx, dword [esp + 4]
jmp 0x7c7783
xchg edi, esi
mov byte [esp], bl
rcr al, 4
bt ax, sp
dec cx
mov ecx, dword [esp]
jmp 0x7c77ce
neg bh
shr eax, cl
neg dl
bswap ebx
rdtsc
clc
jmp 0x7c782d
xchg ecx, eax
bt si, si
lea eax, [eax*4]
mov esi, dword [esp]
add ch, dh
cmc
jmp 0x7c77fb
inc cx
cmp bl, 0x44
stc
shl ah, cl
rdtsc
mov dh, byte [esp]
jmp 0x7c7811

Function at 0x7c77c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, ebp
mov edx, 0x46016a1c
mov word [esp + 2], sp
xchg ebx, eax
xchg dh, cl
call fcn.007c7799
ret 0x667d
mov di, word [esp + 0xb]
push dword [esp + 1]
std
pop dword [esp + 3]
seto dh
add esp, 3
jmp 0x7c7757
mov word [esp + 8], si
rdtsc
rdtsc
neg dl
jmp 0x7c776d

Function at 0x7c7a47
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bts di, bx
xchg dword [esp + 4], edi
jmp 0x7c7a7f
mov cl, 0x1b
cpuid
cpuid
mov ax, 0xe509
and cl, 0xe7
jmp 0x7c7ae8
lea ecx, [edx*4]
xchg dword [esp + 3], eax
std
setp bl
dec al
mov ah, 0xb4
jmp 0x7c7a69
setne al
cmc
xchg word [esp + 7], ax
bswap ebx
btr ax, bx
jmp 0x7c7b18
lea edi, [ebx + esi]
mov ebp, 0x8548d44d
mov word [esp + 2], di
rdtsc
xchg di, cx
mov cx, 0x8b3
jmp 0x7c7ab3
mov eax, dword [esp + 6]
xchg word [esp + 2], ax
lea ecx, [ebx*4]
and ebx, ebp
xchg word [esp + 3], ax
std
jmp 0x7c7ac9
xchg dword [esp + 4], edi
pop word [esp]
pushfd
lea esp, [esp + 4]
jmp 0x7c7ba4
mov eax, 0xc6e15a95
mov ch, byte [esp + 8]
mov ah, bl
ror esi, cl
lea esi, [esp + edx]
ror edi, cl
jmp 0x7c7b02
cmc
xchg dword [esp], edi
pop cx
setg bl
add esp, 0
mov dh, byte [esp]
jmp 0x7c7b82
xchg ecx, eax
lea eax, [eax + ecx]
mov edx, dword [esp + 3]
cpuid
mov dh, byte [esp + 2]
pop word [esp]
jmp 0x7c7b57
mov cx, bp
or esi, edi
rcr al, 6
xchg word [esp + 1], cx
pop esi
mov dl, 0xf2
jmp 0x7c7bd2
xchg byte [esp + 5], ah
cld
bsf edx, esp
std
bsr ebx, ecx
stc
jmp 0x7c7b6d
bt ax, sp
rdtsc
neg bx
lea edi, [eax + edi]
call 0x7c7bb3
xchg byte [esp + 1], al
shl ch, 6
add esp, 2
setg bh
std
lea ecx, [ebx + ebx]
jmp 0x7c7c7c
lea eax, reloc.MSVCRT.dll_strncpy
xchg word [esp], si
bsr ax, cx
lea ebx, [eax*4]
call fcn.007c7c64
sub eax, 0xbd4e2bbb
or al, 5
pushfd
xor dl, byte [ebp - 0x5c]
and ebp, dword [ecx - 0x78]
sub ecx, dword [edx - reloc.MSVCRT.dll_strncpy]
stc
mov cl, byte [esp]
bsf edi, ecx
mov word [esp], ax
shl di, 2
setp cl
stc
jmp 0x7c7c10
xchg bl, al
clc
rdtsc
or ax, 0x9ef4
mov esi, dword [esp]
mov edi, dword [esp]
jmp 0x7c7c3a
Function at 0x7c7c64
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
mov edi, ebx
mov word [esp], di
xchg di, si
rcl bp, 0xc
jmp 0x7c7cab
pop bx
mov bl, cl
jmp 0x7c7c4e
mov word [esp + 2], cx
lea eax, reloc.MSVCRT.dll_strncpy
lea edi, reloc.MSVCRT.dll_strncpy
mov ecx, 0x6452fcb2
jmp 0x7c7d39
sub esp, 9
neg bh
lea ebp, [esp + ecx]
neg bp
lea esi, [ebx + esi]
xchg byte [esp + 4], ch
jmp 0x7c7c8d
xchg byte [esp + 2], al
cpuid
xchg byte [esp], cl
stc
sub esp, 0x14
lea ecx, [ecx + ebp]
jmp 0x7c7d14
xchg bh, dl
inc ebp
setno al
mov cx, 0x8c2d
add esp, 3
mov esi, 0xed3e7507
jmp 0x7c7cfe
sub esp, 0x10
neg cx
add esp, 7
setb al
mov dword [esp + 3], ecx
neg dl
jmp 0x7c7cbf
inc cx
lea ebx, [ecx*4]
not ebx
dec ch
pop bp
jmp 0x7c7d4b
pop word [esp + 0x16]
cld
adc bh, dl
cpuid
rcl ax, 5
setne bh
jmp 0x7c7cd1
pop dword [esp]
mov bh, al
setl dl
mov di, 0xc43f
mov ch, 0xf7
cpuid
jmp 0x7c7cea
push word [esp + 4]
mov di, 0x990a
inc bp
std
setp bl
rdtsc
jmp 0x7c7d9d
mov ebp, 0xf90ab0d8
mov di, word [esp + 0x21]
pop dword [esp + 0xe]
mov edi, esi
jmp 0x7c7d87
pop word [esp + 0xc]
bswap ebx
xchg cl, bl
rdtsc
neg ah
jmp 0x7c837d
mov ch, byte [esp]
pop esi
rdtsc
lea esi, [ecx + edi]
sub esp, 8
lea ebx, [edx + edx]
jmp 0x7c7d5e
xchg word [esp + 4], dx
pop dword [esp]
lea esi, reloc.MSVCRT.dll_strncpy
jmp 0x7c7e1f
xchg edi, ecx
bsf ax, si
mov ah, 0x57
lea ebp, reloc.MSVCRT.dll_strncpy
sub esp, 0xa
lea esi, [edx*4]
jmp 0x7c7dae
ror bl, 2
push word [esp + 0x20]
rcl ch, cl
setne al
sub esp, 0x1d
lea esp, [esp + 0x58]
jmp 0x7c7dc4
mov bh, dh
mov edx, dword [esp + 2]
lea ebx, [ebp*4]
cmc
mov ecx, 0x29bc42bc
neg di
call fcn.007c7e09
mov di, 0x3d9f
xchg word [esp + 0xa], dx
or bh, al
lea eax, [eax + ecx]
jmp 0x7c7ee1
rdtsc
mov dword [esp + 0x18], ecx
bsr ecx, esp
sub esp, 0x1e
pop word [esp + 0xd]
dec dx
jmp 0x7c7df3
cpuid
clc
pop eax
lea ebp, [ebx*4]
pop di
adc ebp, 0x7f1cde7a
jmp 0x7c7ec9
lea esp, [esp + 3]
lea esp, [esp + 0x34]
popal
sub esp, 0x14
lea esp, [esp]
jmp 0x7c80bc
rdtsc
bt si, di
mov ch, byte [esp + 3]
sub esp, 0x1d
xchg bl, bh
xchg byte [esp + 0xb], bl
jmp 0x7c7e89
sub esp, 0xa
mov ch, byte [esp]
xchg dh, ch
mov ebx, 0x17c83d29
mov bx, cx
clc
jmp 0x7c7e9e
mov dx, si
pop dword [esp + 6]
clc
xchg dword [esp + 5], ebx
bts bp, si
stc
jmp 0x7c7eb4
push 0x8719807f
add dword [esp], reloc.MSVCRT.dll_strncpy
push edx
jmp 0x7c7f1a
push dword [esp + 1]
push dword [esp + 1]
push dword [esp + 8]
mov dword [esp + 0xa], ebp
mov word [esp + 7], cx
push word [esp + 3]
call fcn.007c7ff8
outsb dx, byte [esi]
jns 0x7c7f94
pop word [esp + 3]
pop word [esp + 4]
call fcn.007c7f4a
add byte [ebp + 0x7797641d], cl
xchg edx, eax
push ds
mov ebx, gs
int 0xef
mul cl
and byte [ebx - 0x66], ah
pop word [esp + 8]
pop word [esp + 1]
mov byte [esp + 8], al
pop dword [esp + 8]
pop dword [esp + 3]
inc esp
and al, 3
push bp
jmp 0x7c7f60
push dword [esp]
lea esp, [esp + 0xe]
lea esp, [esp + 2]
lea esp, [esp + 8]
popfd
jmp 0x7c7ef4
xchg byte [esp + 0xc], ch
mov bx, ax
mov esi, dword [esp + 0x16]
xchg bp, ax
xchg word [esp + 0xc], dx
mov di, 0xeb2d
jmp 0x7c7e71
Function at 0x401090
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 4]
xorps xmm0, xmm0
mov dword [esp + 4], 0
push edi
push eax
movlpd qword [esp + 0x14], xmm0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x10], 0x401000
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], str.DirectX9_Window
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push esi
push 0
push 0
push 0x258
push 0x320
push 0x64
push 0x64
push 0xcf0000
push str.DirectX_9_GUI_Example
push str.DirectX9_Window
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0x20
mov edi, eax
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov esi, eax
mov dword [0x4043d0], esi
test esi, esi
je 0x401273
push 0x38
lea eax, [esp + 0x58]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x74], 1
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], 1
mov dword [esp + 0x5c], 0
mov eax, dword [esi]
push 0x4043d4
push ecx
push 0x20
push edi
push 1
push 0
push esi
call dword [eax + 0x40]
test eax, eax
js 0x401273
push dword [ebp + 0x14]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
xorps xmm0, xmm0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
mov dword [esp + 0x48], 0
nop dword [eax]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
je 0x4011d7
lea eax, [esp + 0x30]
push eax
call edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40122e
mov ecx, dword [0x4043d4]
test ecx, ecx
je 0x401234
mov eax, dword [ecx]
push 0
push ecx
mov dword [esp], 0x3f800000
push 0xff000000
push 1
push 0
push 0
push ecx
call dword [eax + 0xac]
mov eax, dword [0x4043d4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
mov eax, dword [0x4043d4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [0x4043d4]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x44]
mov ecx, dword [0x4043d4]
cmp dword [esp + 0x34], 0x12
jne 0x4011b0
test ecx, ecx
je 0x401249
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [0x4043d0]
test ecx, ecx
je 0x401259
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esp + 0x38]
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0040129f
mov esp, ebp
pop ebp
ret 0x10
push 0
push str.Error
push str.Failed_to_initialize_Direct3D.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x8c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040129f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401ad0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b0f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b0f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b0f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b0f
cmp dword [ecx + 0x74], 0xe
jbe 0x401b0f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401f29
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401f64
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401f60
lea ebx, [ebx]
cmp esi, eax
jae 0x401f64
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401f50
cmp esi, eax
jb 0x401f6a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xffffffffffffffff
push 0x448d80
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4615e0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov eax, dword [esi]
cmp eax, edi
je 0x402cec
cmp eax, 0xffffffff
je 0x402cec
push 0x800
push edi
lea eax, [ebp]
push eax
call fcn.00431f30
add esp, 0xc
mov eax, dword [ebp + 0x80c]
sub eax, 2
je 0x402c79
sub eax, 1
je 0x402c72
lea edx, [ebp]
sub eax, 3
je 0x402c5a
push 0xff
jmp 0x402c7d
push 2
push str.Apply_Policy
push 1
push str.INDEX:_d_COMPONENT_NAME:_s_STATUS:_d
call fcn.00405ac0
add esp, 0x10
jmp 0x402c8a
push 0xff
jmp 0x402c7a
push edi
lea edx, [ebp]
push str.STATUS:_d
call fcn.00405ac0
add esp, 8
lea eax, [ebp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402c90
sub eax, edx
sar eax, 1
push edi
lea ecx, [ebp - 0x18]
push ecx
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402cc5
lea edx, [ebp]
push edx
push str.Write_File_:___s____
jmp 0x402cce
lea eax, [ebp]
push eax
push str.Fail_to_write_file_:___s____
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, 0x466208
call fcn.00405e40
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x402d2e
push str.Invalid_Parameter_in_WritePipeData___
mov ecx, 0x466208
call fcn.00405f80
add esp, 4
mov eax, 0x57
jmp 0x402d30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00430ff6
add ebp, 0x804
mov esp, ebp
pop ebp
ret 4
Function at 0x402ee0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.004351f0
push 0xffffffffffffffff
push 0x448d50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4615e0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x14], esi
push 0x800
push esi
lea eax, [ebp]
push eax
call fcn.00431f30
add esp, 0xc
mov dword [ebp - 4], esi
push str.__Get_Required_Directory_Paths__
mov ecx, 0x466208
call fcn.00405f80
add esp, 4
lea ecx, [ebp]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x403022
lea edx, [ebp + 0x800]
push edx
push esi
push str.Install
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x402fb3
push str.Get_Temp_File_Name_fail__
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, 0x466208
call fcn.00405e40
push str.Install
lea ecx, [ebp]
push ecx
push str._s_s000
lea edx, [ebp + 0x800]
call fcn.00405ac0
add esp, 0x10
push 0x2e
lea edx, [ebp + 0x800]
push edx
call fcn.0043160a
add esp, 8
cmp eax, esi
je 0x402fcb
mov word [eax], si
lea eax, [ebp + 0x800]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x402fd4
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 0x7fe], 0x5c
jne 0x40300e
lea eax, [ebp + 0x800]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x402ff7
sub eax, edx
sar eax, 1
mov word [ebp + eax*2 + 0x7fe], si
lea eax, [ebp + 0x800]
push eax
push 0x400
push edi
call fcn.00430ec1
jmp 0x40303b
push 0x800
push esi
lea ecx, [ebp + 0x800]
push ecx
call fcn.00431f30
mov dword [ebp - 0x14], 3
add esp, 0xc
lea edx, [ebp + 0x800]
push edx
push str.Temparary_Directory_Path_:___s_
mov ecx, 0x466208
call fcn.00405f80
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.00430ff6
add ebp, 0x1004
mov esp, ebp
pop ebp
ret