joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f029
Capabilities:
Read .ini file

Disassembly:
push 0x294
mov eax, 0x45ed1c
call fcn.00446e42
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x480074
lea ecx, [ebp - 0x2a0]
call fcn.0040c2ac
lea eax, [ebp - 0x29c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.DuiLib.dll_public:_static_class_DuiLib::CDuiString___cdecl_DuiLib::CPaintManagerUI::GetInstancePath_void_]
mov ecx, eax
mov byte [ebp - 4], 1
mov dword [esp], str.config.ini
call dword [sym.imp.DuiLib.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
lea eax, [ebp - 0x2a0]
push str._s_s
push eax
call fcn.0040e462
add esp, 0x10
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], bl
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004468a0
mov ebx, dword [ebp - 0x2a0]
add esp, 0xc
push ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [esi]
push edi
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0040c71c
lea ecx, [ebx - 0x10]
call fcn.0040be22
call fcn.00446ec5
ret 8

Function at 0x40f0f4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x1c
mov eax, 0x45ed65
call fcn.00446dd9
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov dword [ebp - 4], eax
mov byte [edi], bl
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, ebx
je 0x40f1f4
push 4
lea eax, [ebp - 0x20]
push eax
push 2
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push 0x4001000
push ebx
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x40f1eb
mov esi, 0x100000
push esi
mov dword [ebp - 0x14], ebx
call fcn.0041c7f0
push esi
push ebx
push eax
mov dword [ebp - 0x10], eax
call fcn.004468a0
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40f1d9
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x40f1d9
lea esi, [eax + 1]
push esi
mov dword [ebp - 0x24], eax
call fcn.0041c7f0
push esi
mov edi, eax
push ebx
push edi
call fcn.004468a0
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push edi
call fcn.004461c0
add esp, 0x1c
cmp edi, ebx
je 0x40f1d6
push edi
call fcn.00446130
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.004059a3
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00446ee3
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040be22
mov eax, edi
call fcn.00446eb1
ret 8
Function at 0x40f717
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.0044691a
mov esi, eax
mov eax, dword [edi + 0x58]
mov dword [esi], eax
mov eax, dword [ebp + 8]
push 8
mov dword [esi + 4], eax
call fcn.0044691a
pop ecx
pop ecx
xor ecx, ecx
lea edx, [ebp - 4]
push edx
push ecx
push eax
push 0x40f6e2
push ecx
mov dword [eax + 4], edi
mov dword [eax], esi
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret 4

Function at 0x416343
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0
push 0x46659c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4162e3
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x481f18], eax
ret
Function at 0x41693c
Capabilities:
Link many functions at runtime

Disassembly:
push 0x210
mov eax, 0x45f985
call fcn.00446e42
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [edi + 0x58], eax
lea eax, [edi + 0x5c]
push eax
xor esi, esi
lea ebx, [edi + 0x60]
push str.ComPort
mov dword [eax], esi
mov dword [ebx], 0x1f4
call fcn.0040e49c
push ebx
push str.ReadTime
mov ecx, edi
call fcn.0040e49c
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.004468a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
call dword [sym.imp.DuiLib.dll_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetInstance_void_]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040c78b
push 0x5c
push dword [ebp - 0x21c]
mov dword [ebp - 4], esi
call fcn.0044a1ba
pop ecx
pop ecx
cmp eax, esi
jne 0x4169df
or eax, 0xffffffff
jmp 0x4169e7
sub eax, dword [ebp - 0x21c]
sar eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x216], cx
push str.termb.dll
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push str._s_s
push eax
call fcn.0040e462
add esp, 0x10
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x416b14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CVR_InitComm
push ebx
call esi
push str.CVR_CloseComm
push ebx
mov dword [edi + 4], eax
call esi
push str.CVR_Authenticate
push ebx
mov dword [edi + 8], eax
call esi
push str.CVR_Read_FPContent
push ebx
mov dword [edi + 0xc], eax
call esi
push str.GetPeopleNameU
push ebx
mov dword [edi + 0x10], eax
call esi
push str.GetPeopleSexU
push ebx
mov dword [edi + 0x20], eax
call esi
push str.GetPeopleNationU
push ebx
mov dword [edi + 0x24], eax
call esi
push str.GetPeopleBirthdayU
push ebx
mov dword [edi + 0x28], eax
call esi
push str.GetPeopleAddressU
push ebx
mov dword [edi + 0x2c], eax
call esi
push str.GetPeopleIDCodeU
push ebx
mov dword [edi + 0x30], eax
call esi
push str.GetDepartmentU
push ebx
mov dword [edi + 0x34], eax
call esi
push str.GetStartDateU
push ebx
mov dword [edi + 0x38], eax
call esi
push str.GetEndDateU
push ebx
mov dword [edi + 0x3c], eax
call esi
push str.CVR_GetSAMIDU
push ebx
mov dword [edi + 0x40], eax
call esi
push str.GetPeopleChineseNameU
push ebx
mov dword [edi + 0x14], eax
call esi
push str.GetPeopleCertVersionU
push ebx
mov dword [edi + 0x18], eax
call esi
push str.GetNationCodeU
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.GetNewAppMsgU
push ebx
mov dword [edi + 0x48], eax
call esi
push str.GetCertTypeU
push ebx
mov dword [edi + 0x4c], eax
call esi
push str.GetBMPData
push ebx
mov dword [edi + 0x50], eax
call esi
mov dword [edi + 0x54], eax
push str.GetNationCodeU
push ebx
call esi
mov dword [edi + 0x44], eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040be22
call fcn.00446ec5
ret 4
Function at 0x418217
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x418225
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x4182e0
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x467fd0]
add edx, 8
sub edi, 8
dec esi
jne 0x418243
pop ebx
test edi, edi
je 0x4182f9
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x467fd0]
inc edx
dec edi
jne 0x4182e4
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x4182ff
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
movsx edx, byte [ebp + 0xc]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x467fd0]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x467fd0]
pop esi
mov dword [ecx + 8], eax
pop ebp
ret

Function at 0x4187c6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4187fa
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4187f5
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x418822
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x41880b
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004461c0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret
Function at 0x41964f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x480450]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x419683
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x419683
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
test cx, cx
je 0x41972d
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x41969f
cmp cx, 0x5c
jne 0x4196a1
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x419693
cmp eax, esi
je 0x4196e1
sub eax, esi
push edi
sar eax, 1
lea edi, [eax + eax]
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004461c0
xor eax, eax
mov word [ebp + edi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.0041964f
add esp, 0x14
pop edi
xor eax, eax
mov word [ebp - 0x20c], ax
test ebx, ebx
je 0x4196fd
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0044a359
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044a328
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41972d
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00446dca
leave
ret

Function at 0x41acd4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x41ad7f
cmp dword [esi + 4], 0xffffffff
jne 0x41ad7f
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00446eee
movzx eax, word [esi + eax*2 + 0x242]
pop ecx
cmp eax, 0x5c
je 0x41ad26
cmp eax, 0x2f
je 0x41ad26
push 0x4684f4
push edi
call fcn.0044a328
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
pop edi
jne 0x41ad48
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41ad48
mov eax, 0x2000000
jmp 0x41ad84
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004185eb
add esp, 0x10
test eax, eax
jne 0x41ad66
mov eax, dword [ebp + 0x10]
jmp 0x41ad84
push eax
call fcn.0041a7a9
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x41ad84
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x41c02a
Capabilities:
Print debug messages

Disassembly:
push 0xd0
mov eax, 0x45fd79
call fcn.00446e42
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x80]
push esi
xor ebx, ebx
push eax
mov byte [ebp - 0xd5], bl
call fcn.0041b49e
sub esp, 0x14
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 0xdc], esp
push eax
mov dword [ebp - 4], ebx
call fcn.0040623f
call fcn.0041bee9
add esp, 0x1c
cmp al, bl
je 0x41c078
push str._________________________1
jmp 0x41c08b
lea eax, [ebp - 0x80]
push eax
call fcn.0041bfb1
pop ecx
test al, al
je 0x41c09d
push str._________________________2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 0xd5], 1
jmp 0x41c1bb
cmp dword [esi + 0x4c], ebx
jbe 0x41c1bb
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], cx
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x2c]
push eax
add esi, 0x3c
push esi
mov byte [ebp - 4], 3
call fcn.0041b3c9
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.0041b410
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.0041b457
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0041b49e
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 4
call fcn.0041b49e
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 5
call fcn.0041b49e
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 6
call fcn.0041bfe5
add esp, 0x34
test al, al
jne 0x41c161
lea eax, [ebp - 0xd4]
push eax
call fcn.0041bfe5
pop ecx
test al, al
jne 0x41c161
lea eax, [ebp - 0x9c]
push eax
call fcn.0041bfe5
pop ecx
test al, al
je 0x41c173
push str._________________________3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 0xd5], 1
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x9c]
call fcn.0040118d
push ebx
push esi
lea ecx, [ebp - 0xd4]
call fcn.0040118d
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.0040118d
push ebx
push esi
lea ecx, [ebp - 0x64]
call fcn.004017bc
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.004017bc
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004017bc
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.0040118d
mov al, byte [ebp - 0xd5]
call fcn.00446ec5
ret
Function at 0x41df40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ff97
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x480450]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00429f00
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea esi, [edi + 0x14]
mov dword [edi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x14], esi
mov byte [esi], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x28]
push ebx
mov byte [ebp - 4], 5
call fcn.0041d890
push ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
call fcn.0041d890
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446dca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x480450]
jne 0x446dd4
repz ret
jmp fcn.0044d86c
Function at 0x457887
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x480450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0044d309
and dword [ebp - 0x14], 0
cmp dword [0x483974], 0
mov dword [ebp - 0x18], eax
jne 0x45793a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4579e2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4579e2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x483974], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x483978], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x48397c], eax
call edi
push eax
call esi
mov dword [0x483984], eax
test eax, eax
je 0x45793a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x483980], eax
mov eax, dword [0x483980]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x457993
cmp dword [0x483984], ecx
je 0x457993
push eax
call esi
push dword [0x483984]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x457993
test ebx, ebx
je 0x457993
call edi
test eax, eax
je 0x45798a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45798a
test byte [ebp - 8], 1
jne 0x457993
or dword [ebp + 0x10], 0x200000
jmp 0x4579c6
mov eax, dword [0x483978]
cmp eax, dword [ebp - 0x18]
je 0x4579c6
push eax
call esi
test eax, eax
je 0x4579c6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4579c6
mov eax, dword [0x48397c]
cmp eax, dword [ebp - 0x18]
je 0x4579c6
push eax
call esi
test eax, eax
je 0x4579c6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x483974]
call esi
test eax, eax
je 0x4579e2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4579e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00446dca
leave
ret
Function at 0x10542000
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov al, byte [0x1052d158]
test eax, eax
je 0x1054201d
mov cl, byte [0x1052d608]
or cl, 1
mov byte [0x1052d608], cl
cmp dword [0x1052d130], 0
je 0x10542035
mov dl, byte [0x1052d608]
or dl, 8
mov byte [0x1052d608], dl
xor eax, eax
mov al, byte [0x1052d608]
test eax, eax
je 0x1054209f
cmp dword [0x1052d13c], 0
je 0x10542059
push 0x1052fdfc
push 0x1052fe00
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [0x1053c454]
push ecx
mov dl, byte [0x1052d608]
push edx
push 0x1052d3b0
push 0x1052d158
mov eax, dword [0x1052d140]
push eax
mov ecx, dword [0x1052d13c]
push ecx
mov edx, dword [0x1052d138]
push edx
mov eax, dword [0x1052d134]
push eax
mov ecx, dword [0x1052d130]
push ecx
push 0x1052d128
call fcn.10545498
add esp, 0x28
pop ebp
ret
Function at 0x1054375f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 8], 0
call fcn.10544a78
mov word [ebp - 4], ax
cmp dword [0x1053c570], 0
je 0x10543789
mov dword [0x1053cb44], 0
jmp 0x10543793
mov dword [0x1053cb44], 1
cmp dword [0x1053cb44], 0
je 0x10543993
cmp dword [0x1052fdf8], 1
je 0x105437ba
mov eax, dword [0x1052fdf4]
cmp eax, dword [0x1052fdf0]
jne 0x1054392c
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 5
idiv ecx
add edx, 1
mov dword [0x1052fdf0], edx
mov dword [0x1052fdf4], 1
mov edx, dword [0x1053e818]
and edx, 0x1f3
mov dword [0x1053c550], edx
mov eax, dword [0x1053c550]
mov ecx, dword [eax*4 + 0x1052c010]
xor ecx, 0xfd0699d6
mov dword [0x1053c540], ecx
mov dword [0x1053c544], 0
push 4
push 0
push 0x1053c544
push 0x1053c540
movzx dx, byte [0x1052c00d]
push edx
push 0x1053c6ac
call fcn.10546480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x10543876
mov ecx, dword [0x1053c544]
xor ecx, 0x7b2309a7
mov edx, dword [0x1053c550]
xor ecx, dword [edx*4 + 0x1052c7e0]
test ecx, ecx
je 0x10543920
xor eax, eax
mov al, byte [0x1052ef6a]
cmp eax, 0x31
jne 0x10543888
mov word [ebp - 4], 3
xor ecx, ecx
mov cl, byte [0x1052ef6a]
cmp ecx, 0x32
je 0x105438a2
xor edx, edx
mov dl, byte [0x1052ef6a]
cmp edx, 0x33
jne 0x105438a8
mov word [ebp - 4], 0
mov dword [0x1052fdf8], 1
cmp dword [0x1053c594], 0
jne 0x1054391e
xor eax, eax
mov al, byte [0x1052ef6a]
cmp eax, 0x32
je 0x105438d4
xor ecx, ecx
mov cl, byte [0x1052ef6a]
cmp ecx, 0x33
jne 0x1054391e
mov edx, dword [0x1053c69c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x1053c54c], 0xc
push 0x2010
call fcn.105420a1
push eax
call fcn.105448db
add esp, 8
mov dword [0x1053c54c], 0
mov eax, dword [0x1053c69c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x1053c594], 1
jmp 0x1054392a
mov dword [0x1052fdf8], 0
jmp 0x10543991
mov ecx, dword [0x1052fdf4]
add ecx, 1
mov dword [0x1052fdf4], ecx
mov edx, dword [0x1053e818]
mov dword [0x1053c540], edx
mov dword [0x1053c544], 0
push 4
push 0
push 0x1053c544
push 0x1053c540
push 0
push 0x1053c6ac
call fcn.10546480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x1054398b
mov ecx, dword [0x1053c544]
xor ecx, dword [0x1053e818]
test ecx, ecx
je 0x10543991
mov word [ebp - 4], 3
jmp 0x105439f7
mov edx, dword [0x1052fdf4]
add edx, 1
mov dword [0x1052fdf4], edx
mov eax, dword [0x1053e818]
mov dword [0x1053c540], eax
mov dword [0x1053c544], 0
push 4
push 0
push 0x1053c544
push 0x1053c540
push 0
push 0x1053c6ac
call fcn.10546480
mov word [ebp - 4], ax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
test ecx, ecx
jne 0x105439f1
mov edx, dword [0x1053c544]
xor edx, dword [0x1053e818]
test edx, edx
je 0x105439f7
mov word [ebp - 4], 3
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10543ec1
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1053e800
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x10543f3e
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x1053e820], 0
je 0x10543f2d
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1053e820]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10543f2d
cmp dword [ebp - 4], 0x103
je 0x10543f2d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x1053e820]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x1053e820], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10544116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x10543ed9
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x10543f7a
mov edx, dword [ebp - 8]
cmp dword [edx*4 + 0x1053e820], 0
je 0x10543f69
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x1053e820]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp - 8]
push edx
call fcn.10544116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x10543f45
mov esp, ebp
pop ebp
ret

Function at 0x10543f7e
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0x64
jge 0x10543fbe
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x1053e820], 0
je 0x10543fad
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x1053e820]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call fcn.10544116
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10543f89
push 0x1053e800
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret

Function at 0x10545cf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x10545d65
mov eax, dword [esp + 0x10]
mov ecx, 2
sub eax, ecx
je 0x10545d3c
mov word [0x1053cb50], cx
call fcn.105481a0
add esp, 0x94
ret
cmp dword [esp + 4], 5
jne 0x10545d29
mov edx, dword [esp + 8]
mov eax, 1
cmp edx, eax
jb 0x10545d29
mov word [0x1053cb50], ax
call fcn.10545a40
call fcn.10545bd0
call fcn.105481a0
add esp, 0x94
ret