joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c420c
Capabilities:
Get system information on windows

Disassembly:
push 0xd4
mov eax, 0x100ee616
call fcn.100d393a
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x38]
and dword [ebp - 4], 0
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x16]
or dword [ebp - 4], 0xffffffff
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.10042e1e
movzx eax, word [ebp - 0x18]
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 4], 2
push eax
call fcn.10042e1e
movzx eax, word [ebp - 0x38]
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 3
push eax
call fcn.10042e1e
add esp, 0x18
cmp dword [0x101ad2b4], 8
lea ecx, [ebp - 0x80]
push dword [0x101ad2b0]
mov esi, 0x101ad2a0
mov byte [ebp - 4], 4
mov eax, esi
cmovae eax, dword [0x101ad2a0]
push eax
call fcn.10042e1e
push eax
lea ecx, [ebp - 0x68]
call fcn.10042e1e
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.10042e1e
add esp, 0xc
cmp dword [0x101ad2b4], 8
mov ecx, eax
push dword [0x101ad2b0]
cmovae esi, dword [0x101ad2a0]
push esi
mov byte [ebp - 4], 6
call fcn.10042e1e
push eax
lea ecx, [ebp - 0x50]
call fcn.10042e1e
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.10042e1e
add esp, 0xc
mov ecx, edi
push eax
call fcn.10042e1e
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 8
call fcn.10042e1e
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 9
call fcn.10042e1e
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0xa
call fcn.10042e1e
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xb
call fcn.10042e1e
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.10042e1e
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xd
call fcn.10042e1e
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0xe
call fcn.10042e1e
cmp dword [edi + 0x10], 0
je 0x100c437f
mov al, 1
jmp 0x100c4381
xor al, al
call fcn.100d3887
ret

Function at 0x100c4387
Capabilities:
Get common file path

Disassembly:
push 0x3c
mov eax, 0x100ee646
call fcn.100d393a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov ecx, eax
mov dword [ebp - 0x2c], 0xff
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x100c43af
mov ecx, dword [eax]
xor eax, eax
mov dword [ebp - 4], ebx
mov word [ecx], ax
lea edi, [ebp - 0x24]
mov esi, 0x1016661c
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x28]
push eax
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x100c4419
cmp dword [ebp - 0x28], 0
je 0x100c4419
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
call fcn.10042e1e
push dword [ebp - 0x30]
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
call fcn.10042e1e
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10042e1e
push dword [ebp - 0x28]
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100c4427
xor ebx, ebx
inc ebx
jmp 0x100c4427
mov eax, ebx
call fcn.100d3887
ret
Function at 0x100c473a
Capabilities:
Get hostname

Disassembly:
push 0x224
mov eax, 0x100ee6a3
call fcn.100d38cc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x214]
xor ebx, ebx
xor esi, esi
push 0x202
push ebx
push eax
inc esi
mov byte [edi], bl
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x218], 0x100
add esp, 0xc
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x214]
push eax
push 2
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x100c47c7
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x230]
call fcn.10042e1e
cmp dword [ebp - 0x220], ebx
je 0x100c47c7
mov byte [edi], 1
mov esi, ebx
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.10042e1e
mov eax, esi
call fcn.100d3876
ret

Function at 0x100c4f55
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x100ee746
call fcn.100d393a
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x20]
push edx
push ebx
lea edx, [ebp - 0x18]
push edx
push ebx
lea edx, [ebp - 0x1c]
push edx
push ebx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100c505d
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10042e1e
pop ecx
push dword [ebp - 0x20]
mov esi, eax
call fcn.10042e1e
pop ecx
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x2c]
push esi
push dword [ebp - 0x24]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100c503a
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov word [esi + eax*2], cx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x64]
call fcn.10056c65
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.10042e1e
push esi
call fcn.100d3a96
push edi
call fcn.100d3a96
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100c4f80
xor ebx, ebx
push esi
inc ebx
call fcn.100d3a96
push edi
call fcn.100d3a96
pop ecx
pop ecx
jmp 0x100c505d
mov eax, ebx
call fcn.100d3887
ret
Function at 0x100c5108
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x100ee790
call fcn.100d393a
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x10]
inc edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x20], ecx
jb 0x100c5130
mov eax, dword [esi]
lea edx, [ebp - 0x18]
xor ebx, ebx
push edx
push ebx
push ebx
push ebx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c51a9
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
inc eax
mov dword [ebp - 4], ebx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10042e1e
cmp dword [esi + 0x14], 8
mov ebx, eax
pop ecx
jb 0x100c516c
mov esi, dword [esi]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
push ebx
push 0
push 0
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c5190
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.10042e1e
xor edi, edi
push ebx
call fcn.100d3a96
pop ecx
jmp 0x100c51a9
mov eax, edi
call fcn.100d3887
ret

Function at 0x100c5259
Capabilities:
Set registry value

Disassembly:
push 0x40
mov eax, 0x100ee7e2
call fcn.100d393a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp esi, edi
je 0x100c52e3
push esi
lea ecx, [ebp - 0x44]
call fcn.10034f1b
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x44]
cmovae edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 8
mov byte [ebp - 4], 1
cmovae ecx, dword [ebp - 0x44]
add eax, eax
push eax
mov eax, dword [ebp - 0x4c]
push edx
push 1
push ebx
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.10042e1e
cmp dword [ebp - 0x48], 0
je 0x100c52cb
xor ebx, ebx
inc ebx
jmp 0x100c52e3
mov byte [ebp - 4], bl
add esi, 0x30
jmp 0x100c5278
mov eax, ebx
call fcn.100d3887
ret
Function at 0x100c90c9
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x100ef14b
call fcn.100d38cc
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
push eax
call fcn.10042e1e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 1
push 0x1011b41c
call fcn.10042e1e
push 2
push 0x10166fdc
lea ecx, [ebp - 0x28]
call fcn.10042e1e
push 1
push 0x1011b41c
lea ecx, [ebp - 0x28]
call fcn.10042e1e
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x100c912d
mov eax, dword [ebx]
push dword [ebx + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10042e1e
push 1
push 0x10118228
lea ecx, [ebp - 0x28]
call fcn.10042e1e
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x100c9152
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10042e1e
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10042e1e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
pop ecx
cmovae eax, dword [ebp - 0x40]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
jne 0x100c91b9
push 0x10114fdc
call fcn.10042e1e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.10042e1e
mov dword [ebp - 4], 3
jmp 0x100c91d5
lea eax, [ebp - 0x28]
push eax
call fcn.10042e1e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.10042e1e
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.10042e1e
mov eax, esi
call fcn.100d3876
ret
Function at 0x100d179a
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x100f090d
call fcn.100d38cc
and dword [ebp - 4], 0
lea eax, [ebp - 0x78]
push 0x50
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.1004d380
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, ecx
mov byte [ebp - 4], 1
push eax
push ecx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.100c163c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.10042e1e
lea ecx, [ebp - 0x78]
call fcn.10042e1e
lea ecx, [ebp + 8]
mov dword [ebp - 4], 4
call fcn.10042e1e
mov al, bl
call fcn.100d3876
ret
Function at 0x100d2ab4
Capabilities:
Get file size

Disassembly:
push 0x74
mov eax, 0x100f0bba
call fcn.100d38cc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x80]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x50
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.1004d380
push esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x80]
call fcn.10042e1e
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
push ebx
cmovae eax, dword [ebp - 0x30]
push 0x80
push 3
push ebx
push 3
push SysReAllocStringLen
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100d2b3f
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
je 0x100d2b38
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], eax
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.10042e1e
lea ecx, [ebp - 0x80]
call fcn.10042e1e
mov al, bl
call fcn.100d3876
ret

Function at 0x100d2b5b
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x100f0bf2
call fcn.100d38cc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x78]
push 0x50
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.1004d380
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push esi
push eax
lea ecx, [ebp - 0x78]
call fcn.10042e1e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10042e1e
lea ecx, [ebp - 0x78]
call fcn.10042e1e
mov al, bl
call fcn.100d3876
ret
Function at 0x40169d
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x1d4
call sym.___main
call sym._GetConsoleWindow_0
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 5
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._SetWindowPos_28
sub esp, 0x1c
mov dword [esp + 4], str.Hello__mortal__You_cannot_escape_me.
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], 0x3e8
call sym._Sleep_4
sub esp, 4
jmp 0x401712
Function at 0x401e70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x401ebb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401eb4
test esi, esi
je 0x401eb4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e90
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4020a0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4020f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4021c8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40212e
cmp eax, 4
jne 0x402150
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40213e
cmp edx, 4
je 0x40213e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004020a0
Function at 0x40ef35
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x482910]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x70
mov eax, 0x45ce40
call fcn.00444bf4
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x38
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 0x4631ec
call fcn.00445180
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.00445180
add esp, 0x18
call fcn.0041e1d0
mov eax, dword [eax + 4]
push 0x104
lea ecx, [ebp]
push ecx
push dword [eax + 0x44]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x464f80
push esi
lea ecx, [ebp - 0x20]
call fcn.00403312
mov edi, eax
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x28]
call fcn.00403312
mov byte [ebp - 4], 2
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040dffc
mov byte [ebp - 4], 3
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040dfa5
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x214]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040dfa5
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00402594
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c]
call fcn.00402594
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.00402594
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x20]
call fcn.00402594
mov ecx, dword [ebp - 0x18]
push 0xb
lea eax, [ebp - 0x10]
push eax
call fcn.0040a2b5
test eax, eax
jne 0x40f064
mov ecx, dword [ebp - 0x18]
push 0xb
lea eax, [ebp - 0x10]
push eax
call fcn.0040e7e9
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.004016f5
push eax
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40f09e
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x10]
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004019dd
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402594
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x214]
call fcn.00402594
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00444be5
add ebp, 0x20c
leave
ret 4
Function at 0x430b0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x430b54
call fcn.0041e1d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x430b54
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x430b97
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x430b80
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x430b80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x430b94
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x441302
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx - 0x80]
movsd dword es:[edi], dword [esi]
psubw mm7, mm7
inc dword [eax]
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
dec esi
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.0043f9cc
inc edi
insb byte es:[edi], dx
xchg edx, eax
out dx, al
lea eax, [ebp - 0x6f4]
push eax
call fcn.0043f9dc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0043f991
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x441a72
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x441547
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0

Function at 0x444be5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x482910]
jne 0x444bef
repz ret
jmp fcn.0044d9bc
Function at 0x453930
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044a877
and dword [ebp - 4], 0
cmp dword [0x486bac], 0
mov ebx, eax
jne 0x4539e1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x453a92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x453a92
push eax
call fcn.0044a805
mov dword [esp], 0x46e998
push edi
mov dword [0x486bac], eax
call esi
push eax
call fcn.0044a805
mov dword [esp], 0x46e984
push edi
mov dword [0x486bb0], eax
call esi
push eax
call fcn.0044a805
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x486bb4], eax
call esi
push eax
call fcn.0044a805
pop ecx
mov dword [0x486bbc], eax
test eax, eax
je 0x4539e1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044a805
pop ecx
mov dword [0x486bb8], eax
mov eax, dword [0x486bb8]
cmp eax, ebx
je 0x453a39
cmp dword [0x486bbc], ebx
je 0x453a39
push eax
call fcn.0044a880
push dword [0x486bbc]
mov esi, eax
call fcn.0044a880
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x453a39
test edi, edi
je 0x453a39
call esi
test eax, eax
je 0x453a30
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x453a30
test byte [ebp - 0xc], 1
jne 0x453a39
or dword [ebp + 0x10], 0x200000
jmp 0x453a72
mov eax, dword [0x486bb0]
cmp eax, ebx
je 0x453a72
push eax
call fcn.0044a880
pop ecx
test eax, eax
je 0x453a72
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x453a72
mov eax, dword [0x486bb4]
cmp eax, ebx
je 0x453a72
push eax
call fcn.0044a880
pop ecx
test eax, eax
je 0x453a72
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x486bac]
call fcn.0044a880
pop ecx
test eax, eax
je 0x453a92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x453a94
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx