joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432601
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x432836
call fcn.0040a088
sub esp, 0x128
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
push esi
push edi
call fcn.0042360c
mov dword [ebp - 0x24], eax
test eax, eax
je 0x432711
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00423621
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0041ca88
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041ca88
push 5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov eax, dword [esi]
push ecx
mov ecx, esi
mov edi, dword [eax + 0x6c]
call edi
push 4
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x4326b4
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
push eax
push 0x80000000
call fcn.00432848
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x134]
push eax
push ecx
push dword [ebp - 0x10]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4326b4
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0
je 0x4326f2
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push eax
push 0x80000000
call fcn.00432848
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x134]
push eax
push ecx
push dword [ebp - 0x14]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4326f2
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 0
call fcn.00432816
mov dword [ebp - 4], 0xffffffff
call fcn.0043281e
cmp dword [ebp - 0x24], 0
jne 0x432634
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x7c], 0
je 0x432803
push str.Software_
lea ecx, [ebp - 0x10]
call fcn.0041cc5b
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
push dword [eax + 0x7c]
call fcn.0041cf1b
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push dword [ecx + 0x90]
push 0x44180c
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0041ce28
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
push ecx
call fcn.0041ce28
mov byte [ebp - 4], 5
call fcn.00432826
lea ecx, [ebp - 0x14]
mov esi, 0x80000001
push ecx
push esi
mov ecx, dword [ebp - 0x18]
call fcn.00432848
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4327ca
push 0x104
lea eax, [ebp - 0x134]
push eax
push 0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
jne 0x4327c1
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
push eax
push esi
call fcn.00432848
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x134]
push eax
push ecx
push dword [ebp - 0x14]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4327ee
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 2
call fcn.0043282e
mov dword [ebp - 4], 0xffffffff
call fcn.00432840
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432848
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x432908
call fcn.0040a088
sub esp, 0x110
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
push eax
mov ecx, dword [ebp + 0xc]
push dword [ecx]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4328ec
push 0xff
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4328c9
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0041cc5b
push eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call fcn.00432848
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], eax
call fcn.00432912
cmp dword [ebp - 0x10], 0
je 0x432874
cmp dword [ebp - 0x10], 0x103
je 0x4328db
cmp dword [ebp - 0x10], 0x3f2
jne 0x4328ec
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x432ad1
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx + 0x7c], 0
push esi
push edi
je 0x432b28
push dword [ebp + 8]
call fcn.00432a83
mov esi, eax
test esi, esi
jne 0x432af2
mov eax, dword [ebp + 0x10]
jmp 0x432b3d
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
mov dword [ebp - 8], 4
push ecx
push edx
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x432b23
mov eax, dword [ebp - 4]
jmp 0x432b3d
mov eax, dword [ebp + 0x10]
jmp 0x432b3d
push dword [ecx + 0x90]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433968
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 4], ecx
push esi
push edi
call fcn.00432499
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x433996
xor eax, eax
jmp 0x433a39
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4339a9
xor eax, eax
jmp 0x433a39
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4339ba
xor eax, eax
jmp 0x433a39
movzx eax, word [esi + 6]
shl eax, 2
push eax
call fcn.0041941f
mov ecx, eax
add esp, 4
mov edi, eax
lea edx, [esi + 8]
xor eax, eax
movzx ebx, word [esi + 6]
cmp ebx, eax
jle 0x4339e9
movzx ebx, word [edx]
add edx, 2
inc eax
mov dword [ecx], ebx
add ecx, 4
jmp 0x4339d3
movzx eax, word [esi + 6]
push eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00433b2f
mov ebx, eax
push edi
call fcn.0041945f
add esp, 4
test ebx, ebx
je 0x433a37
movzx ecx, word [esi + 2]
movzx eax, word [esi + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
add ecx, 7
add eax, 7
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.00433915
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00433a42
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x434120
Capabilities:
Allocate thread local storage

Disassembly:
push esi
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x18], 4
mov dword [ecx + 8], 1
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x434151
call fcn.00416c82
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x4342ca
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x43436f
call fcn.0040a088
sub esp, 4
push ebx
push esi
push edi
mov edi, ecx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x434304
mov edx, dword [ebp + 8]
cmp dword [ebx + 8], edx
jg 0x4343c9
cmp dword [ebp + 0xc], 0
je 0x4343c9
test ebx, ebx
jne 0x434355
push 0x10
call fcn.004340f0
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x43433b
mov ebx, esi
mov dword [esi], vtable.CNoTrackObject.0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
mov dword [esi], vtable.CThreadData.0
jmp 0x43433d
xor ebx, ebx
xor eax, eax
push ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
call fcn.00434090
mov eax, dword [ebx + 0xc]
lea esi, [edi + 0xc]
test eax, eax
jne 0x434382
mov eax, dword [esi]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x434391
push 2
mov ecx, dword [esi]
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0xc], 0
jne 0x43439f
call fcn.00416c82
mov eax, dword [ebx + 8]
mov ecx, dword [esi]
sub ecx, eax
shl ecx, 2
shl eax, 2
push ecx
push 0
add eax, dword [ebx + 0xc]
push eax
call fcn.0040a030
add esp, 0xc
mov ecx, dword [esi]
mov dword [ebx + 8], ecx
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0xc]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret 8

Function at 0x434436
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, ecx
cmp dword [esi + 8], 1
jle 0x4344b7
mov dword [ebp - 0xc], 8
mov ebx, 4
cmp dword [ebp + 0xc], 0
je 0x43448b
mov eax, dword [ebp - 0xc]
mov edx, dword [edi + 0x10]
mov ecx, dword [ebp + 0xc]
cmp dword [edx + eax + 4], ecx
je 0x43448b
mov eax, dword [esi + 0xc]
cmp dword [eax + ebx], 0
je 0x4344a5
mov dword [ebp - 4], 0
jmp 0x4344a5
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + ebx]
test ecx, ecx
je 0x43449b
push 1
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [esi + 0xc]
mov dword [eax + ebx], 0
add ebx, 4
inc dword [ebp - 8]
add dword [ebp - 0xc], 8
mov eax, dword [ebp - 8]
cmp dword [esi + 8], eax
jg 0x434464
cmp dword [ebp - 4], 0
je 0x4344e5
push esi
lea ecx, [edi + 0x14]
call fcn.004340a3
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x4344db
push 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434547
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
cmp dword [ecx], 0
mov esi, ecx
jne 0x434585
cmp dword [0x446030], 0
jne 0x434578
mov ecx, 0x446038
test ecx, ecx
je 0x43456e
call fcn.00434120
mov dword [0x446030], eax
jmp 0x434578
mov dword [0x446030], 0
mov ecx, dword [0x446030]
call fcn.0043415f
mov dword [esi], eax
mov edi, dword [esi]
mov eax, dword [0x446030]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4345a5
cmp dword [eax + 8], edi
jle 0x4345a5
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4345a7
xor edi, edi
test edi, edi
jne 0x4345bf
call dword [esp + 0xc]
push eax
mov edi, eax
push dword [esi]
mov ecx, dword [0x446030]
call fcn.004342ca
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x434f4c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x434f80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
cmp eax, 1
sbb eax, eax
neg eax
jmp 0x434fcc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x434fca
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x434fca
mov eax, 1
test esi, esi
je 0x434fcc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6b9563
Capabilities:
Encode data using xor

Disassembly:
call fcn.006b9504
popal
jmp 0x6b959c
inc dword [esp + 8]
call fcn.006b9586
movzx ebx, byte [eax]
add ebx, 0x659a3922
jmp 0x6b95d9
cmp ebx, 0x659a39ee
je 0x6b963d
je 0x6b963d
jne 0x6b83e5
and al, 0xbb
sub ecx, dword [esi - 0x43]
or byte [edx], cl
pushfd
xor dl, byte [ebp - 0x5c]
push ss
jl 0x6b95de
jns 0x6b960f
jmp 0x6b9655
push ecx
mov ecx, 0xaf3d46eb
aas
pop edx
test eax, 0x56c05572
xor eax, eax
jg 0x6b961d
sar byte [edi - 3], 0xcc
pop edi
cmpsb byte [esi], byte es:[edi]
call 0x6b9635
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
pop ecx
inc esi
into
inc ebx
test eax, eax
int3
jmp 0x6b969c
rol byte [ebx - 0x15], 1
retf 0x90ff
call 0x6b968e
dec esp
outsd dx, dword [esi]
popal
dec esp
imul esp, dword [edx + 0x72], 0x57797261
add bl, ch
xor dword [eax - 0x22], eax
dec esp
sub esp, esi
push ebp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0x6b96be
pop edx
je 0x6b839f
jne 0x6b967c
pushal
pushal
push word [esp + 1]
lea esp, [esp + 0x42]
call fcn.006b97aa
test al, 0x35
movsd dword es:[edi], dword [esi]
int3
in al, dx
xlatb
pushal
push word [esp + 0xf]
mov word [esp + 0x1a], dx
lea esp, [esp + 2]
mov dword [esp + 0x1c], eax
jmp 0x6b96a4

Function at 0x6d0354
Capabilities:
Encrypt data using aes

Disassembly:
shl edx, 8
jmp 0x6d038a
xor edx, esi
mov edi, 0x45dddb50
mov esi, dword [esp]
bsr di, cx
jmp 0x6d0327
setg bl
mov ebx, ecx
inc di
jmp 0x6d033d
mov eax, edx
cmc
mov di, word [esp]
btr esi, esp
jmp 0x6d03ff
mov dword [ecx + 0xc], edx
jmp 0x6d035d
xor edx, eax
mov eax, dword [esp]
mov bx, word [esp]
bswap edi
jmp 0x6d0373
mov ecx, eax
lea ecx, [ecx*4]
lea ecx, reloc.KERNEL32.dll_SetEndOfFile
mov eax, dword [ecx]
jmp 0x6d03a9
and eax, esi
mov ebx, 0x5d0be5ba
xchg bp, di
push ecx
jmp 0x6d03c2
shr eax, 0x10
lea esp, [esp + 4]
mov esi, 0xff
lea edi, reloc.KERNEL32.dll_SetEndOfFile
jmp 0x6d03de

Function at 0x6d5ef3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
push word [esp + 0x17]
jmp 0x6d5f33
or edx, ebp
jmp 0x6d5f61
push edx
lea esp, [esp + 2]
shl edx, 8
clc
pushal
jmp 0x6d5f1c
mov byte [esp], ah
sub esp, 0x16
or edx, ebp
lea ebp, [edx*4]
jmp 0x6d5f71
lea esp, [esp + 0x48]
movzx ebp, byte [eax + 6]
shl edx, 8
sub esp, 2
jmp 0x6d5f3f
lea esp, [esp + 0x18]
movzx ebp, byte [eax + 0xc]
sub esp, 0x10
mov dword [esp + 1], ecx
jmp 0x6d6033
movzx ebp, byte [eax + 0xb]
clc
shl edx, 8
push esp
pop word [esp]
jmp 0x6d5fd7
or edx, ebp
sub esp, 0xe
lea esp, [esp + 2]
lea esp, [esp + 0x2c]
jmp 0x6d5fa5
stc
lea esp, [esp + 2]
jmp 0x6d640e
lea esp, [esp + 3]
shl edx, 8
cmc
pushal
jmp 0x6d5fc8
movzx edx, byte [eax + 0xd]
push esp
mov byte [esp], ah
lea esp, [esp + 1]
mov word [esp], bx
jmp 0x6d5fef
lea esp, [esp + 0x10]
mov dword [esp + ecx*4 + 0x14], edx
mov dx, 0x7ba3
mov edx, 0x83055128
mov dh, ch
jmp 0x6d600c
or edx, ebp
movzx ebp, byte [eax + 0xa]
call fcn.006d61cf
mov edx, dword [esp + 8]
call 0x6d6423
mov cl, byte [ebp - 0x39fbdb9c]
add byte [eax], al
call fcn.006d6447
movsd dword es:[edi], dword ds:[esi]
xor eax, 0x486caf5c
salc
inc esp
and ebx, esi
insd dword es:[edi], dx
invalid
Function at 0x4056f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454ba2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x46f940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.00406330
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.00406330
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.00406330
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00406330
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.00406330
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.00406330
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.00405650
push 0x462cd8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.00406110
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 7
push eax
mov ecx, esi
mov byte [esi + 7], 1
call fcn.00405c30
mov byte [ebp - 4], 6
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4057b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4063e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4063f5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406434
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406430
lea ebx, [ebx]
cmp esi, edx
jae 0x406434
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x406420
cmp esi, edx
jb 0x406439
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40e030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4558f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46f940]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x475cb0], 0
je 0x40e0ab
push str.CCrashHandler::TerminateProcess
lea ecx, [ebp - 0x10]
call fcn.00405a70
push str.CrashHandler:_TerminateProcess
mov dword [ebp - 4], 0
push dword [eax]
mov ecx, dword [0x475cb0]
push 0
call fcn.00408740
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40e0ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4129b0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x455e18
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x46f940]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x46f940]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00407680
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.004128d0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x412a2d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.0042341e
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x412a56
push dword [esp + 0x10]
call fcn.00413987
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00420375
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43322d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46f940]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042bb95
mov dword [ebp - 0x14], eax
cmp dword [0x475880], esi
jne 0x433320
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4332ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x433400
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x433400
push 0x45d908
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433400
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x475880], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x45d924
push edi
mov dword [0x475884], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x475888], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x475890], eax
test eax, eax
je 0x43331d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47588c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x433345
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433338
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43335a
push 4
pop eax
jmp 0x433402
cmp dword [ebp - 0x14], esi
je 0x43335a
push dword [0x475880]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43333f
mov eax, dword [0x47588c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4333b8
cmp dword [0x475890], edi
je 0x4333b8
push eax
call ebx
push dword [0x475890]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4333b8
test eax, eax
je 0x4333b8
call ecx
test eax, eax
je 0x4333ad
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4333ad
test byte [ebp - 8], 1
jne 0x4333b8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4333e8
mov eax, dword [0x475884]
cmp eax, edi
je 0x4333e5
push eax
call ebx
test eax, eax
je 0x4333e5
call eax
mov esi, eax
test esi, esi
je 0x4333e5
mov eax, dword [0x475888]
cmp eax, edi
je 0x4333e5
push eax
call ebx
test eax, eax
je 0x4333e5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x475880]
call ebx
test eax, eax
je 0x433400
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x433402
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420375
mov esp, ebp
pop ebp
ret
Function at 0x43c2ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret