joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd70
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x425030]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x222]
xor ebx, ebx
push ecx
mov dword [esp + 0x20], ebx
mov word [esp + 0x224], ax
call fcn.004122f0
add esp, 0xc
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.004122f0
xor ecx, ecx
xor edx, edx
add esp, 0xc
mov word [esp + 0x10], cx
mov word [esp + 0x12], dx
test esi, esi
je 0x40df41
call fcn.0040dc90
test al, al
je 0x40de06
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0040f70c
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x21c]
push 0x104
push eax
call fcn.0040fa3a
lea eax, [esp + 0x224]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40de26
sub eax, edx
sar eax, 1
lea ecx, [esp + eax*2 + 0x216]
movzx eax, word [ecx]
cmp ax, 0x5c
je 0x40de4b
cmp ax, 0x2f
jne 0x40de50
xor edx, edx
mov word [ecx], dx
lea eax, [esp + 0x218]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40de60
sub eax, edx
sar eax, 1
push 0x100
mov edi, eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004122f0
add esp, 0xc
xor esi, esi
test edi, edi
jle 0x40df2f
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40dea0
movzx eax, word [esp + esi*2 + 0x218]
cmp ax, 0x5c
jne 0x40ded7
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40decf
push 0x80
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ax, word [esp + esi*2 + 0x218]
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x14], ax
lea eax, [esp + 0x1c]
push 0x100
xor ecx, ecx
push eax
mov word [esp + 0x1e], cx
call fcn.0040fe07
lea eax, [edi - 1]
add esp, 0xc
cmp esi, eax
jne 0x40df22
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40df22
push 0x80
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, edi
jl 0x40dea0
mov ebx, dword [esp + 0x14]
lea esi, [esp + 0x18]
call fcn.0040dc90
test al, al
mov eax, 1
jne 0x40df43
mov eax, ebx
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040f70c
mov esp, ebp
pop ebp
ret

Function at 0x40f70c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425030]
jne 0x40f716
repz ret
jmp fcn.00410e5a
Function at 0x418822
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041170e
and dword [ebp - 4], 0
cmp dword [0x426d70], 0
mov ebx, eax
jne 0x4188d3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x418984
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x418984
push eax
call fcn.0041169c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426d70], eax
call esi
push eax
call fcn.0041169c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426d74], eax
call esi
push eax
call fcn.0041169c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426d78], eax
call esi
push eax
call fcn.0041169c
pop ecx
mov dword [0x426d80], eax
test eax, eax
je 0x4188d3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041169c
pop ecx
mov dword [0x426d7c], eax
mov eax, dword [0x426d7c]
cmp eax, ebx
je 0x41892b
cmp dword [0x426d80], ebx
je 0x41892b
push eax
call fcn.00411717
push dword [0x426d80]
mov esi, eax
call fcn.00411717
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41892b
test edi, edi
je 0x41892b
call esi
test eax, eax
je 0x418922
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x418922
test byte [ebp - 0xc], 1
jne 0x41892b
or dword [ebp + 0x10], 0x200000
jmp 0x418964
mov eax, dword [0x426d74]
cmp eax, ebx
je 0x418964
push eax
call fcn.00411717
pop ecx
test eax, eax
je 0x418964
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x418964
mov eax, dword [0x426d78]
cmp eax, ebx
je 0x418964
push eax
call fcn.00411717
pop ecx
test eax, eax
je 0x418964
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426d70]
call fcn.00411717
pop ecx
test eax, eax
je 0x418984
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x418986
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43fd2d
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
addps xmm7, xmm4
mov cl, 0x92
sub ebx, dword [edx + 0x2092af2b]
pop eax
cld
mov cl, 0x92
adc bl, byte [edx + 0x1192af2b]
cmp edx, dword [edi - 0x54]
xchg edx, eax
cmp ah, dl
popal
mov bh, 0xe5
ja 0x43fcf2
cwde
mov ecx, 0x49d68700
sbb esi, ebp
cwde
add byte [ecx], cl
or al, 0x73
add byte [eax], al
add byte [eax], al
ljmp 0x848b
mov dword [esp], eax
push eax
invalid
invalid
push 0xbca1635a
push ecx
push edx
push ebx
push eax
call fcn.00496f01
jno 0x43fd93
push esi
pushfd
push ebp
call fcn.0046383d
jbe 0x43fce2
push ebp
push edi
jmp fcn.0045ef79
or byte [esi + 0x1a], dl
lcall 0xd2e2, 0xb2f540e0
push es
test eax, 0xa08016ab
loopne 0x43fd3c
imul byte [edi + eax*4 - 0x53cd73bb]
cdq
adc esi, esi
cwde
pop es
rol byte [edx + 0x35e8d57a], 0xac
inc edi
push cs
mov ah, 0xc8
or al, ch
mov bl, byte [eax - 0x47f28c20]
xchg dword [0x7bac31a3], eax
insb byte es:[edi], dx
out dx, eax
cwde
sub al, byte [eax]
clc
cmp byte [edx - 0x2b], 0xe8
xor eax, 0xb40e47ac
enter 0xffffffffffffe808, 0xffffffffffffff8a
cwde
loopne 0x43fe35
or eax, 0xa30587b8
xor dword [ebx + edi*2 + 0x2a98ef6c], ebp
add al, bh
ja 0x43fdb2
cmpsb byte [esi], byte es:[edi]
cmp byte [ebp + eax*2 - 0x153777e8], ch
push edi
scasd eax, dword es:[edi]
xchg edx, eax
or byte [ecx + 0x7db73448], al
pop dword [edx - 0x1ec51645]
mov bh, 0xc8
or byte [esi - 0xd], al
invalid
cwde
xlatb
cmpsd dword [esi], dword es:[edi]
adc esp, dword [ebx - 0x670e3f98]
cmp byte [edi], 0xb5
push ds
lahf
dec esp
out dx, eax
cwde
mov dword [edi], 0x43ecb920
popfd
loopne 0x43fddc
mov al, byte [ebx - 0x46656a45]
mov ecx, 0x896d27c8
jge 0x43feca
or ecx, dword [ecx - 0x7f]
enter 0x28f5, 0xffffffffffffff9f
loopne 0x43febd
loope 0x43feae
ret
sub dh, 0x46
xchg dword [esp], edi
mov edi, dword [esp]
mov edi, dword [esp]
xor dword [esp], edi
mov edi, dword [esp + 8]
add dword [esp], edi
add dword [esp], 0x91fab4c8
enter 0xfffffffffffffab4, 0xffffffffffffff91
add dword [esp], 0x6e053b40
push 0x55863d92
push 0x2953df10
lea esp, [esp - 0xe]
mov edi, dword [esp + 0x16]
push ecx
call 0x43fef4
jmp 0x8ecd8c51
Function at 0x408000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00407d79
push es
or eax, 0x458de39d
test al, 0x50
call fcn.00407d89
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00407d3e
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x408067
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00407d79
test al, 0xd7
into
sub al, 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0xe28348
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe28352
pushal
call 0xe28358
pop ebp
sub ebp, 0x10
sub ebp, 0xa28348
jmp 0xe2836e
mov eax, 0xa28348
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x13b79fae
xor byte [eax], dl
inc eax
dec ecx
jne 0xe28385
jmp 0xe28398
and eax, 0x92272563
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
das
outsd dx, dword [esi]
push esi
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
lodsd eax, dword [esi]
arpl word [esi], dx
movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
adc al, 0x86
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
pop ecx
dec esp
lodsd eax, dword [esi]
and ax, 0xa22f
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
lodsd eax, dword [esi]
imul esp, dword [ebx], 0xffffffca
mov dl, byte [edx + 0x27]
stosb byte es:[edi], al
mov ah, byte [ebx]
retf 0x528a
Function at 0x401240
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x148
mov eax, dword [0x442594]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push esi
push edi
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
movsw word es:[edi], word [esi]
mov ecx, 7
mov esi, str.SYSTEMCurrentControlSetEnum
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, str.sbser
lea esp, [esp]
push esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push str._s_sEnum
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x50]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push str._s_sParameters
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x50]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push str._s_sSecurity
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x50]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push str._s_s
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x50]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
add esi, 9
cmp esi, 0x4410fd
jl 0x401290
mov esi, str.sbmf
push esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x58]
push str._s_s
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x50]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
add esi, 7
cmp esi, 0x44111c
jl 0x401328
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041d5ba
add esp, 0x148
ret
Function at 0x401370
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
sub esp, 0x2c8
mov eax, dword [0x442594]
xor eax, esp
mov dword [esp + 0x2c4], eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push 0x80
lea eax, [esp + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x1cc]
push ecx
lea edx, [esp + 0x150]
push str._sinfoem.
push edx
call esi
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
je 0x4014ee
push ebx
push edi
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x1d8]
push eax
lea ecx, [esp + 0x15c]
push str._sinf_s
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0x10
push 0x80
lea edx, [esp + 0x158]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x154]
push eax
call ebx
test eax, eax
jne 0x401457
push ebp
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x25c]
push str.Delete__s_0x_x
push edx
call esi
add esp, 0x10
push 0
push 0
lea eax, [esp + 0x25c]
push eax
call fcn.004044e3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4014ec
nop
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1d8]
push ecx
lea edx, [esp + 0x15c]
push str._sinf_s
push edx
call esi
add esp, 0x10
push 0x80
lea eax, [esp + 0x158]
push eax
call edi
lea ecx, [esp + 0x154]
push ecx
call ebx
test eax, eax
jne 0x4014d8
push ebp
lea edx, [esp + 0x158]
push edx
lea eax, [esp + 0x25c]
push str.Delete__s_0x_x
push eax
call esi
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0x25c]
push ecx
call fcn.004044e3
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401470
pop edi
pop ebx
mov ecx, dword [esp + 0x2cc]
pop esi
pop ebp
xor ecx, esp
call fcn.0041d5ba
add esp, 0x2c8
ret

Function at 0x4016d0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
call fcn.00401510
cmp eax, 2
mov ecx, esi
je 0x4016f7
push 0x10
push 0x433abc
push str.This_program_must_be_executed_on_WINDOWS_2000_XP
call fcn.00407d43
push 0xffffffffffffffff
call fcn.0041d9f6
push edi
call fcn.004049c7
mov eax, dword [esi + 0xc8]
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 1
push 0x80
push ecx
call edi
mov edx, dword [esi + 0xc8]
mov eax, dword [esi + 0x20]
push edx
push 0
push 0x80
push eax
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x401a8e
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x38
mov eax, dword [0x442594]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, ecx
call fcn.00401810
mov ecx, esi
call fcn.00401240
mov ecx, esi
call fcn.00401370
lea eax, [esp + 0x18]
push str.Remove_success
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x74]
call fcn.0040bba2
mov ecx, esi
call fcn.004046a5
push 0x30
push 0x433abc
push str.Success_remove_MPCI_driver
mov ecx, esi
call fcn.00407d43
push 0x34
push 0x433abc
push str.Uninstall_will_shut_down_your_system_to_finish_this_process._nContinue_
mov ecx, esi
call fcn.00407d43
cmp eax, 6
pop esi
jne 0x401b75
lea edx, [esp]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401b1a
push eax
push eax
push str.Failed_in_OpenProcessToken
call fcn.004044e3
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp]
push 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push edx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401b6b
push 0
push 0
push str.Failed_in_AdjustTokenPrivileges
call fcn.004044e3
push 0
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0041d5ba
add esp, 0x38
ret

Function at 0x4054e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40552b
call fcn.004067fa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40552b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40556e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x405557
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x405557
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40556b
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40ba33
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40ba76
call fcn.004067fa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40ba76
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40ba91
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040b5ea
test ebx, ebx
mov esi, eax
je 0x40ba8f
test edi, edi
je 0x40ba8f
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40e0c8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40e0f6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e114
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040e032
jmp 0x40e114
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40e114
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0040e032
test edi, edi
mov eax, edi
jne 0x40e0fe
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x445560]
test ecx, ecx
je 0x40e1d7
jmp 0x40e0c7
ret 8

Function at 0x41d5ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442594]
jne 0x41d5c4
repz ret
jmp fcn.00422d9c
Function at 0x42a560
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004227e5
xor ebx, ebx
cmp dword [0x446314], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42a635
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42a5a0
xor eax, eax
jmp 0x42a6f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x437810
push edi
call esi
cmp eax, ebx
je 0x42a599
push eax
call fcn.00422782
mov dword [esp], 0x437800
push edi
mov dword [0x446314], eax
call esi
push eax
call fcn.00422782
mov dword [esp], 0x4377ec
push edi
mov dword [0x446318], eax
call esi
push eax
call fcn.00422782
mov dword [0x44631c], eax
lea eax, [ebp - 8]
push eax
call fcn.0041d823
test eax, eax
pop ecx
pop ecx
je 0x42a603
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423447
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42a635
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00422782
cmp eax, ebx
pop ecx
mov dword [0x446324], eax
je 0x42a635
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00422782
pop ecx
mov dword [0x446320], eax
mov eax, dword [0x446320]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42a6ae
cmp dword [0x446324], esi
je 0x42a6ae
push eax
call fcn.004227ee
pop ecx
call eax
cmp eax, ebx
je 0x42a67b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x446324]
call fcn.004227ee
pop ecx
call eax
test eax, eax
je 0x42a67b
test byte [ebp - 0x18], 1
jne 0x42a6ae
lea eax, [ebp - 0xc]
push eax
call fcn.0041d85a
test eax, eax
pop ecx
je 0x42a696
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423447
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42a6a5
or dword [ebp + 0x10], 0x200000
jmp 0x42a6df
or dword [ebp + 0x10], 0x40000
jmp 0x42a6df
mov eax, dword [0x446318]
cmp eax, esi
je 0x42a6df
push eax
call fcn.004227ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42a6df
mov eax, dword [0x44631c]
cmp eax, esi
je 0x42a6df
push dword [ebp - 4]
push eax
call fcn.004227ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x446314]
call fcn.004227ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430584
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x442594]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00430519
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041d700
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4305d3
cmp dword [ebp - 0x1c], 5
jb 0x4305eb
jmp 0x4305e7
cmp dword [ebp - 0x10], 1
jne 0x4305eb
cmp dword [ebp - 0x1c], 4
ja 0x4305e7
jne 0x4305eb
cmp dword [ebp - 0x18], 0
jbe 0x4305eb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x438938
call fcn.004303ed
test eax, eax
jge 0x43060c
mov byte [0x443a44], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041d5ba
add ebp, 0x78
leave
ret
Function at 0x1002540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push esi
lea eax, [ebp + 0x10]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x100128c
push 0x80000001
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1002580
mov eax, ebx
jmp 0x10025ca
push 0x20
push dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
push eax
call fcn.010023f8
cmp dword [ebp + 0x10], esi
je 0x10025c7
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x10025c4
cmp dword [ebp - 8], 4
je 0x10025c7
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x100322f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100320f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100322d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100328b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1003272
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100327b
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1003285
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1003267
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10031f1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10032d8
dec eax
je 0x10032cf
sub eax, 3
je 0x10032c6
mov dword [ebp - 4], 0x40
jmp 0x10032f5
mov dword [ebp - 4], 4
jmp 0x10032db
mov dword [ebp - 4], 0x20
jmp 0x10032db
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1003327
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10032a7
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.01002b38
cmpsd dword [esi], dword es:[edi]
add byte [eax], ch
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret