joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487000
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5a7e4c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x487013
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x487054
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5a7ef4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x487086
mov bl, byte [esp + ecx + 0x4c]
jmp 0x48708a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x48707b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4870a8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4870ac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x48709d
xor ecx, ecx
mov eax, 0x5a7e5c
xor ebx, ebx
mov bl, byte [ecx + 0x5a7f04]
cmp byte [esp + ebx + 0x14], 0
je 0x4870d7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5a7f1c]
cmp byte [esp + ebx + 0x14], 0
je 0x4870ee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4870be
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x487047
lea edx, [esp + 0x84]
push edx
call fcn.00487130
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x48cfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x48d0e1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x48d0c5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x48d017
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x48cff5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x48db29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x48db80
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x48db80
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x48db80
xor eax, eax
inc eax
jmp 0x48db82
xor eax, eax
leave
ret 0x10
Function at 0x48dbab
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x48dc19
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x580d7c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48dc10
cmp dword [ebp - 0xc], 4
jne 0x48dc10
cmp dword [ebp - 0x10], edi
je 0x48dc10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ab1e0], edi
xor eax, eax
jmp 0x48dc58
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5ab1e0], edi
jge 0x48dc53
lea eax, [ebp - 0x34]
push eax
mov dword [0x5ab1e0], edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x48dc53
cmp word [ebp - 0x14], 5
jb 0x48dc53
call fcn.0048db86
test eax, eax
je 0x48dc53
emms
mov dword [0x5ab1e0], 1
mov eax, dword [0x5ab1e0]
pop edi
leave
ret

Function at 0x4b7687
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b76bf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b5701
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b56d9
jmp 0x4b76cb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b8d79
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b8dbb
call fcn.004bed32
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x4b8dbb
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, edi
jne 0x4b8db2
xor eax, eax
jmp 0x4b8dc3
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b8dc9
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bf262
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bf290
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4bf2ae
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bf1c8
jmp 0x4bf2ae
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bf2ae
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bf1c8
test edi, edi
mov eax, edi
jne 0x4bf298
pop edi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5c58e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 2], edx
jmp 0x5c58ea
mov byte [esp + 3], ah
cpuid
add al, dh
mov byte [esp + 5], bh
xchg byte [esp + 0xe], dl
jmp 0x5c5962
mov bl, bh
rdtsc
push dword [esp + 0xd]
lea ebx, [edi + ebp]
jmp 0x5c5990
setl ch
xchg ch, dl
not edx
mov dword [esp + 8], eax
xchg di, ax
setge dh
jmp 0x5c592f
mov bl, 0x58
lea ebp, [edx + ebx]
lea eax, [ecx + edi]
pop dx
rdtsc
mov word [esp + 0xc], dx
jmp 0x5c5945

Function at 0x5c5b79
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
lea eax, reloc.WS2_32.dll_ioctlsocket
clc
mov byte [esp + 5], dh
xchg byte [esp], bl
jmp 0x5c5ba8
cmc
jmp 0x5c5b60

Function at 0x5c617a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
mov dword [esp + 7], eax
push edx
mov cl, ch
pushal
lea esp, [esp + 0x41]
jmp 0x5c618c
mov bx, di
pushal
bsf si, si
mov cx, 0xc371
pushal
lea edi, [esp + ebp]
jmp 0x5c6305
xchg word [esp + 3], si
push word [esp]
cpuid
rdtsc
xchg si, di
jmp 0x5c6153
lea edi, [edx + ebp]
btr eax, edx
mov ax, 0x2a5f
neg edi
mov ax, word [esp]
stc
jmp 0x5c6163
mov di, word [esp + 0x12]
rcr ch, 5
xchg ebp, eax
not cx
xchg ah, bl
bsf cx, si
jmp 0x5c61b0
pop esi
rdtsc
mov byte [esp + 0x36], ah
pop edi
mov edx, dword [esp + 7]
stc
jmp 0x5c61da
mov word [esp + 0x3a], di
shl bx, cl
lea ebx, [ebx + edi]
mov ebp, 0x3d40fa16
cpuid
mov dword [esp + 0x35], ecx
jmp 0x5c6203
mov ebx, 0x39d5d06e
mov al, 0xf6
mov dl, 0xe4
bsf dx, ax
jmp 0x5c625b
lea eax, reloc.WS2_32.dll_ioctlsocket
xchg byte [esp + 0x31], al
setnp ah
mov ax, 0x7f3d
mov al, 0xe6
and bx, 0x248a
jmp 0x5c62ee
Function at 0x5c62bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, cx
lea ebx, [edi + edi]
mov dx, 0xb77d
xchg dh, al
and cl, bh
stc
jmp 0x5c641c
mov dx, word [esp + 2]
xor dl, ch
setg ah
jmp 0x5c62a5
xchg byte [esp + 0x22], dl
mov dword [esp + 4], esi
mov edi, 0xa875224a
xchg byte [esp + 0xa], dl
bswap ebx
jmp 0x5c6355
xchg word [esp + 0x1a], bp
btc edi, edi
xchg word [esp + 0x10], dx
cld
lea esi, [eax*4]
mov dword [esp + 5], ecx
jmp 0x5c631f
push dword [esp + 0x1d]
mov byte [esp + 3], ah
mov esi, 0x39800a3e
cpuid
sub esp, 2
xchg ch, dl
jmp 0x5c639a
xchg dx, si
mov cl, ch
btr edi, esp
mov cx, 0x55e3
mov dl, 0x64
not ecx
jmp 0x5c633a
xchg ecx, ebx
bsf di, si
clc
mov al, 0x6e
mov edi, dword [esp]
xor edx, esi
jmp 0x5c63ff
push word [esp + 0x18]
pushal
lea esp, [esp + 0x4d]
mov dl, dh
mov di, word [esp]
jmp 0x5c6384
neg esi
mov word [esp + 7], bx
mov byte [esp + 1], dh
mov ebp, ecx
sub esp, 4
shr ebp, 9
jmp 0x5c6372
and edx, ecx
mov ebx, esi
rcl di, cl
btc edx, edi
mov al, ah
xchg bh, cl
jmp 0x5c6453
cpuid
bswap ebx
mov ebx, dword [esp]
not ebp
mov dl, 0xdc
mov esi, dword [esp]
jmp 0x5c63c6
inc ax
and ax, 0x9aa2
inc dl
neg ebp
xchg cx, ax
lea edx, [esi - 0x95]
jmp 0x5c63e7
sub esp, 0x18
push dword [esp + 0xe]
bswap edx
lea ebp, [ebp - 0x57]
neg si
setnp ch
jmp 0x5c63b1
inc edx
mov si, di
mov dl, 0xf4
bsf bp, ax
mov di, word [esp]
sub bl, ah
jmp 0x5c64b2
mov dl, dh
inc ebx
rdtsc
sub bl, ah
mov edx, 0xa277fd1c
bswap ebx
jmp 0x5c6430
pop dword [esp]
call fcn.005c6463
xchg byte [esp + 0xd], al
push dword [esp + 0x20]
xchg dx, ax
mov cx, word [esp + 2]
xchg cx, bp
jmp 0x5c657f
inc di
mov dl, dh
rdtsc
pushal
xchg word [esp + 0xf], cx
cpuid
jmp 0x5c648f
mov byte [esp + 0x1d], ch
call fcn.005c6533
xchg ah, bl
inc edi
mov eax, dword [esp]
lea edx, [esi*4]
jmp 0x5c660f
mov ecx, esi
lea edi, [esi + edi]
mov cx, word [esp]
mov byte [esp], bh
mov dl, 0x94
neg esi
jmp 0x5c66b7
lea ebp, reloc.WS2_32.dll_ioctlsocket
lea ecx, [ebx + ebx]
add al, dh
bswap ebp
mov ebp, 0xd0276674
xchg ah, bl
jmp 0x5c65f9
lea eax, [edi*4]
cld
xchg ebx, edi
add esp, 2
neg ch
mov si, word [esp + 2]
jmp 0x5c6697
inc bp
cpuid
btr edx, esp
mov cl, 2
cpuid
mov ax, word [esp + 1]
jmp 0x5c6643
mov ebx, 0x1c37f522
inc eax
mov ch, byte [esp + 2]
btc ebx, ebx
mov dl, 0x84
call fcn.005c667a
cwde
push ss
test bl, ah
push ds
invalid
rdtsc
lea ecx, [esi*4]
lea ebx, reloc.WS2_32.dll_ioctlsocket
mov bl, 0x28
push esp
xchg cx, ax
jmp 0x5c6668
Function at 0x5cb0fe
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get number of processors
Parse pe header

Disassembly:
call fcn.005c5624
push eax
jmp 0x5c561f
call 0x5cb046
jmp 0x5cb13a
movzx ebx, word [eax + 0x3c]
jmp 0x5cb164
lea esp, [esp + 2]
mov dword [esp + 0xc], ebx
call fcn.005cb08e
push word [esp + 1]
push dword [esp + 4]
pushal
pop word [esp + 9]
lea esp, [esp + 1]
jmp 0x5cb117
pop word [esp + 1]
mov byte [esp + 2], bh
mov dword [esp], eax
call 0x5cb0fe
or dword [eax + reloc.WS2_32.dll_ioctlsocket], 0xffffff89
jl 0x5cb12a
push esp
jmp 0x5cb155
mov word [esp + 2], sp
lea esp, [esp + 3]
mov dword [esp + 0x4c], esi
push edx
push word [esp + 1]
mov byte [esp + 2], bh
jmp 0x5cb0ec
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x5cb184
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x5cb2c6
lea esp, [esp + 0x54]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x5cb130
add ebx, eax
cmp word [ebx], 0x4550
je 0x5c59af
jne 0x5cb2cc
and ch, byte [edi + 0x10a95a3f]
dec eax
rcl byte [esi + 0x31], 0xc0
adc al, 0xfd
push eax
jmp 0x5cb041
push dword [esp + 2]
mov byte [esp + 6], bh
pop word [esp + 1]
mov dword [esp], eax
push dword [esp + 4]
push dword [esp + 8]
jmp 0x5cb0ab
je 0x5cb09d
sub eax, 0x10000
jmp 0x5cb13e
mov byte [esp + 2], ch
jmp 0x5cb19d
Function at 0x401409
Capabilities:
Set registry value

Disassembly:
push dword [esp + 8]
call fcn.00413230
pop ecx
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x14]
push dword [0x445558]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
ret

Function at 0x401430
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push 0
push dword [esp + 0x14]
push dword [0x445558]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
ret

Function at 0x40144f
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [0x445558]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
ret

Function at 0x40498f
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x432c12
call fcn.00413e08
sub esp, 0x20
mov eax, dword [0x444480]
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xf
call fcn.00401c78
and dword [ebp - 4], 0
push str.SoftwareSpiral_MonkeyDream_Aquarium_
lea ecx, [ebp - 0x2c]
call fcn.004031ba
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.0040319d
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4049dd
lea eax, [ebp - 0x28]
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
push 1
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00401fa8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.004130de
leave
ret

Function at 0x40629d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4062b2
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4062c4
xor eax, eax
jmp 0x4062f6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4062e8
cmp esi, eax
jae 0x4062c0
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4062da
cmp esi, eax
jae 0x4062c0
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x4077e9
Capabilities:
Get common file path

Disassembly:
mov eax, 0x432e92
call fcn.00413e08
sub esp, 0x40c
mov eax, dword [0x444480]
and dword [ebp - 0x418], 0
push esi
mov esi, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
call fcn.004047ff
and dword [ebp - 4], 0
push 5
push str._WIN_
push esi
call fcn.00415070
add esp, 0xc
test eax, eax
jne 0x407841
push 0x3e7
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x407867
push 5
push str._SYS_
push esi
call fcn.00415070
add esp, 0xc
test eax, eax
jne 0x40788e
push 0x3e7
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004031ba
push 0x5c
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402ce2
add esi, 5
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040319d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00405885
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401fa8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.004130de
leave
ret
Function at 0x409ad9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x409b2c
call fcn.0042f7b6
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x409b2c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x409b22
xor eax, eax
jmp 0x409c45
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x409b5c
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x409b5c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x409c42
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x409b89
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.004096d2
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x409c42
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x409bd2
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x409bd2
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x409bcc
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.004096d2
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x409c32
and dword [ebp + 0xc], 0
jmp 0x409c32
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x409c32
push 0xc
call fcn.0042488f
mov esi, eax
test esi, esi
pop ecx
je 0x409c14
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x409c16
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x409c2d
push dword [ebp - 8]
call fcn.0042406d
jmp 0x409c32
call fcn.00424044
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x409b97
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x412e28
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00413070
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x412ec3
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4476e8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x412ec3
cmp eax, 1
je 0x412ee4
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x412ec3
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x412e90
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x412ebf
xor eax, eax
inc eax
jmp 0x412f03
cmp edi, eax
jae 0x412ec7
xor eax, eax
jmp 0x412f03
cmp eax, esi
jae 0x412ece
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4476e8]
jmp 0x412ee7
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414a5c
Capabilities:
Terminate process

Disassembly:
push 8
push 0x439578
call fcn.00412f0c
push 8
call fcn.004172b8
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x447728], esi
jne 0x414a90
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x447724], esi
mov al, byte [ebp + 0x10]
mov byte [0x447720], al
cmp dword [ebp + 0xc], edi
jne 0x414ada
cmp dword [0x44910c], edi
je 0x414aca
mov eax, dword [0x449108]
sub eax, 4
mov dword [0x449108], eax
cmp eax, dword [0x44910c]
jb 0x414aca
mov eax, dword [eax]
cmp eax, edi
je 0x414aab
call eax
jmp 0x414aab
push 0x4430dc
mov eax, 0x4430d4
call fcn.004149da
pop ecx
push 0x4430e8
mov eax, 0x4430e0
call fcn.004149da
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x414b0b
cmp dword [ebp + 0x10], edi
jne 0x414b19
mov dword [0x447728], esi
push dword [ebp + 8]
call fcn.00414998
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x414b18
push 8
call fcn.00417203
pop ecx
ret
call fcn.00412f47
ret
Function at 0x4151b7
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x439598
call fcn.00412f0c
mov edi, 0x94
mov eax, edi
call fcn.00413070
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4476e8], ecx
mov eax, dword [esi + 4]
mov dword [0x4476f4], eax
mov edx, dword [esi + 8]
mov dword [0x4476f8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4476ec], esi
cmp ecx, 2
je 0x415217
or esi, 0x8000
mov dword [0x4476ec], esi
shl eax, 8
add eax, edx
mov dword [0x4476f0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x415252
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415252
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41526a
cmp eax, 0x20b
je 0x415257
mov dword [ebp - 0x1c], esi
jmp 0x41527e
cmp dword [ecx + 0x84], 0xe
jbe 0x415252
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x415278
cmp dword [ecx + 0x74], 0xe
jbe 0x415252
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00417303
pop ecx
test eax, eax
jne 0x415292
push 0x1c
call fcn.00415193
pop ecx
call fcn.00418d04
test eax, eax
jne 0x4152a3
push 0x10
call fcn.00415193
pop ecx
call fcn.0041a813
mov dword [ebp - 4], esi
call fcn.0041c5b6
test eax, eax
jge 0x4152bc
push 0x1b
call fcn.0041516e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x449100], eax
call fcn.0041c494
mov dword [0x44772c], eax
call fcn.0041c3f2
test eax, eax
jge 0x4152e2
push 8
call fcn.0041516e
pop ecx
call fcn.0041c1bf
test eax, eax
jge 0x4152f3
push 9
call fcn.0041516e
pop ecx
push 1
call fcn.004149f2
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x415309
push eax
call fcn.0041516e
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0041c162
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x41532a
movzx eax, word [ebp - 0x40]
jmp 0x41532d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0042349a
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x41534b
push edi
call fcn.00414b1f
call fcn.00414b41
jmp 0x41537d
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00412f47
ret