joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cac1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4498ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
mov dword [edi], vtable.Updater.0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea esi, [edi + 0xc]
mov byte [ebp - 4], 1
push 0
mov ecx, esi
call fcn.0041bd30
lea ecx, [edi + 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x28]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x2c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [edi + 0x30]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
push 0
push str.1onRequestFinished_RequestResult_
push edi
push str.2finished_RequestResult_
lea eax, [ebp + 8]
mov byte [ebp - 4], 7
push esi
push eax
mov dword [edi + 0x34], 0
call dword [sym.imp.Qt5Core.dll_public:_static_class_QMetaObject::Connection___cdecl_QObject::connect_class_QObject_const___char_const___class_QObject_const___char_const___enum_Qt::ConnectionType_]
add esp, 0x18
lea ecx, [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMetaObject::Connection::destructor_void_]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x423d20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x44a840], ecx
inc eax
cmp eax, 0x100
jb 0x423d22
cmp eax, 0x800
jae 0x423df3
nop word [eax + eax]
mov edx, dword [eax*4 + 0x44a440]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x44a840]
mov dword [eax*4 + 0x44a840], edx
inc eax
cmp eax, 0x800
jb 0x423dd0
mov dword [0x44a488], 0x424d50
call fcn.00424b60
mov ecx, dword [0x44a488]
test eax, eax
mov edx, 0x424d50
cmove ecx, edx
mov dword [0x44a488], ecx
ret

Function at 0x423f20
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [edi]
test esi, esi
je 0x423f81
mov ebp, dword [esp + 0x14]
mov ecx, 0x400000
mov ebx, dword [esp + 0x18]
mov dword [edi], 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, ecx
push eax
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x423f88
test ecx, ecx
je 0x423f81
mov ecx, 0x400000
test esi, esi
jne 0x423f41
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x423fa0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [edi]
test esi, esi
je 0x424001
mov ebp, dword [esp + 0x14]
mov ecx, 0x400000
mov ebx, dword [esp + 0x18]
mov dword [edi], 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, ecx
push eax
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x424008
test ecx, ecx
je 0x424001
mov ecx, 0x400000
test esi, esi
jne 0x423fc1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4250c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x4250df
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esp + 0x1c], 5
lea edx, [ecx - 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
or ebp, 0xffffffff
add edx, edi
mov dword [esp + 0x24], edx
lea esi, [ebx + edi]
mov dword [esp + 0x10], esi
cmp esi, edx
jae 0x425115
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x425111
inc esi
cmp esi, edx
jb 0x425102
mov dword [esp + 0x10], esi
mov ebx, esi
sub ebx, edi
mov ecx, ebx
sub ecx, ebp
cmp esi, edx
jae 0x42523c
cmp ecx, 3
jbe 0x425153
xor eax, eax
mov cl, byte [esi + 4]
mov ebp, ebx
mov dword [esp + 0x18], ebp
test cl, cl
je 0x42518f
cmp cl, 0xff
je 0x42518f
mov edx, dword [esp + 0x24]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x4250f7
dec ecx
shl eax, cl
and eax, 7
je 0x42512c
cmp byte [eax + 0x437164], 0
je 0x42517f
movzx ecx, byte [eax + 0x43716c]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x42517b
cmp cl, 0xff
jne 0x42512c
mov edx, dword [esp + 0x24]
and eax, 3
mov ebp, ebx
add eax, eax
or eax, 1
inc ebx
jmp 0x4250f7
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [esp + 0x28]
shl edi, 8
or edi, ecx
cmp dword [esp + 0x30], 0
je 0x4251bf
lea edx, [edi + ebx]
add edx, esi
jmp 0x4251c5
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x425200
movzx ebp, byte [eax + 0x43716c]
mov ecx, 0x18
shl ebp, 3
mov edi, edx
sub ecx, ebp
shr edi, cl
mov ecx, edi
mov dword [esp + 0x14], edi
test cl, cl
je 0x4251ed
cmp cl, 0xff
jne 0x425200
mov ecx, 0x20
mov edi, 1
sub ecx, ebp
shl edi, cl
dec edi
xor edi, edx
jmp 0x4251b1
mov esi, dword [esp + 0x10]
mov ecx, edx
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], dl
neg cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [esp + 0x24]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add ebx, ecx
jmp 0x4250f7
pop edi
pop esi
pop ebp
cmp ecx, 3
jbe 0x425253
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
add esp, 0xc
ret
dec ecx
shl eax, cl
mov ecx, dword [esp + 0x20]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x428980
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x4289b2
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebp
push esi
seto cl
neg ecx
or ecx, eax
push edi
push ecx
call fcn.00427fba
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x14], 0
mov ebp, eax
mov dword [esp + 0x20], ebp
test ecx, ecx
je 0x428a4c
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [eax + ebp]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.00427fba
add esp, 4
mov edi, eax
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [ebp - 4], edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
jne 0x4289f1
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push ebx
mov dword [ebp + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push dword [esp + 0x14]
call fcn.00404f80
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x428a8a
mov ecx, dword [ebp + esi*4]
test ecx, ecx
je 0x428a8a
push ecx
call fcn.00427fc3
inc esi
add esp, 4
cmp esi, dword [esp + 0x10]
jne 0x428a72
push ebp
call fcn.00427fc3
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x402ca4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov eax, dword [0x41d8e4]
and edi, dword [ebp - 0x10]
mov edi, 8
mov eax, dword [ebp - 0x64]
cmp dword [0x41d844], 0x10
jae 0x402ce2
mov eax, dword [0x41d8f4]
mov esi, dword [ebp - 0x54]
mov edi, 4
mov eax, dword [0x41d8e0]
sub esi, ecx
mov dword [ebp - 0x4c], edx
mov dword [0x41d9cc], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], ecx
push dword [0x41d60c]
call sub.USER32.DLL_EnumWindows
mov eax, dword [0x41d848]
mov eax, dword [ebp - 0x64]
mov ecx, 0x10
sub edx, edi
cmp dword [0x41d6a0], eax
ja 0x402d21
mov eax, dword [ebp - 0x34]
mov eax, dword [0x41d644]
mov eax, dword [ebp - 0x34]
add edi, edi
mov eax, dword [ebp - 0x34]
add eax, edi
mov dword [ebp - 0x48], eax
mov dword [0x41d8ec], eax
mov esi, dword [ebp - 0x78]
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x38]
push edx
mov dword [0x41d72c], edx
lea eax, [ebp - 8]
push eax
push 4
push dword [0x41d9d0]
call sub.USER32.DLL_EnumChildWindows
mov eax, dword [0x41d6e8]
mov edx, dword [ebp - 0x5c]
add eax, eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [0x41d85c]
add eax, eax
cmp eax, 1
jl 0x402d7e
mov eax, dword [0x41d988]
mov eax, dword [0x41d97c]
mov eax, dword [ebp - 0xc]
sub eax, ecx
sub eax, eax
mov dword [ebp - 0x48], esi
mov dword [0x41d600], eax
mov dword [0x41d73c], eax
mov dword [0x41d990], eax
mov edx, dword [0x41d7f8]
mov edi, dword [0x41d77c]
mov eax, dword [0x41d89c]
mov esi, dword [ebp - 0x1c]
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov ecx, dword [0x41d8e0]
cmp dword [0x41d754], 1
jg 0x402dc7
mov eax, dword [0x41d9cc]
sbb esi, dword [ebp - 8]
mov eax, 8
mov edx, dword [ebp - 0x68]
mov eax, dword [0x41d8e4]
mov dword [ebp - 0x40], edi
mov dword [0x41d8b4], esi
mov dword [ebp - 0x30], eax
mov dword [0x41d868], eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4021d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004082f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004082f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402230
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d06c]
test esi, esi
jle 0x402350
mov eax, dword [0x40d070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402264
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4022e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402250
mov dword [esp], ebx
call fcn.00402c30
mov edi, eax
test eax, eax
je 0x402377
mov eax, dword [0x40d070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402d70
mov edx, dword [0x40d070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402357
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4022e0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4022f0
add dword [0x40d06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4022e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004021d0
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40226e
mov eax, dword [0x40d070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004021d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004021d0
lea esi, cs:[esi]
nop
Function at 0x401500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str._windir_explorer.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call eax
sub esp, 0x18
leave
ret

Function at 0x401541
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x10000000
mov dword [esp], str..PhysicalDrive0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0x405500
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
leave
ret

Function at 0x4015bc
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], str.Shell_TrayWnd
mov eax, dword [sym.imp.USER32.dll_FindWindowA]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
leave
ret
Function at 0x4022d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x402330
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x40f050]
test esi, esi
jle 0x40241d
mov edi, dword [0x40f054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x402364
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402416
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x402350
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x40245a
lea ebx, [esi + esi*2]
mov esi, dword [0x40f054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x40f054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40243a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40240f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40240f
mov eax, dword [esp + 0x20]
add ebx, dword [0x40f054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x402424
add dword [0x40f050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40236e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x40f054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402920
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40f408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40f400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402975
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40296e
test esi, esi
je 0x40296e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402950
mov dword [esp], 0x40f408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402b90
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402bc8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x402bbe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402bca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402bb0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x408941
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
push 0x83444278
pop eax
call fcn.00408965
mov ebx, 0xc6691fa9
xor dword [edi], ecx
inc edi
cmp edi, esi
jne fcn.00408941
sub eax, ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6eed78e5
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x43f32fe7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001af9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x10001b0d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001b2e
cmp esi, eax
jae 0x10001b07
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001b20
cmp esi, eax
jae 0x10001b07
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10002870
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, ecx
jne 0x100028a6
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10002916
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
mov ecx, esi
call fcn.10001a00
pop esi
ret 8
mov edx, dword [esi]
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push edx
call edi
test eax, eax
jne 0x100028c2
mov eax, dword [esp + 0xc]
push eax
mov ecx, esi
call fcn.10002670
mov ecx, dword [esi]
push ecx
call edi
test eax, eax
pop edi
je 0x10002916
mov edx, dword [esi + 0x80]
mov eax, dword [edx - 0xc]
test eax, eax
jle 0x10002916
mov eax, dword [0x1002c014]
mov cl, byte [eax + 0x24]
test cl, cl
jne 0x100028f6
mov ecx, dword [esi]
push 0x57
push 0
push 0
push 0
push 0
push 0
push ecx
jmp 0x10002905
mov edx, dword [esi]
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
mov ecx, esi
call fcn.10001a00
pop esi
ret 8

Function at 0x10002e10
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push esi
push 0x7f00
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esp + 0x18]
cmp eax, 0x201
jne 0x10002e6d
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
push 0
mov ecx, esi
call fcn.10002350
mov eax, 1
pop esi
add esp, 8
ret 0xc
cmp eax, 0x204
jne 0x10002ea0
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push edx
push eax
push 0
mov ecx, esi
call fcn.10002a30
mov eax, 1
pop esi
add esp, 8
ret 0xc