joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4103b0
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x41364c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push esi
lea eax, [esp + 8]
push 0x41a4b4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x234]
lea ecx, [esp + 8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [esp + 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0x230]
mov edx, dword [esp + 0x228]
push 0
push eax
lea ecx, [esp + 0x10]
push 0x1024
push ecx
push esi
push edx
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CFileDialog::CFileDialog
mov eax, dword [esp + 0x240]
mov dword [esp + 0x220], 0
mov dword [esp + 0xac], eax
call fcn.00406830
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileDialog::DoModal
mov esi, eax
call fcn.00406820
cmp esi, 1
pop esi
je 0x410499
lea ecx, [esp + 0xc8]
mov dword [esp + 0x21c], 1
call fcn.004113dc
lea ecx, [esp + 0x18]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0041136a
xor eax, eax
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
add esp, 0x220
ret
lea ecx, [esp]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileDialog::GetPathName
mov ecx, dword [esp + 0x234]
push eax
mov byte [esp + 0x220], 2
call fcn.004113e2
lea ecx, [esp]
mov byte [esp + 0x21c], 0
call fcn.004113dc
lea ecx, [esp + 0xc8]
mov dword [esp + 0x21c], 3
call fcn.004113dc
lea ecx, [esp + 0x18]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0041136a
mov ecx, dword [esp + 0x214]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x401260
Capabilities:
Hide graphical window

Disassembly:
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x403100], eax
push esp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4030f4], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x40128d
push esp
mov dword [ebp - 0x24], 0x401330
mov eax, dword [0x4030f4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.wookernof
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4030f4]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.tofkol
push str.wookernof
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403104], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40132c
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40130d
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000588e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [fcn.1000588e]
mov dword [0x102d63a0], 0x1060
mov ecx, dword [0x102d639c]
mov edx, ecx
add edx, 0x1bd4
add ecx, 0xc29
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jmp 0x100058eb
mov eax, dword [ebp - 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
jmp 0x100058eb
mov eax, dword [ebp - 0x14]
mov dword [0x102d63a0], eax
mov eax, dword [ebp - 0x10]
add esp, 0x14
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x100058c3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x100058db
jmp 0x100058c3

Function at 0x10005924
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102d639c], 0x13a8
mov dword [0x102d63a8], 0
mov byte [0x102d63ac], 0
mov edi, dword [0x102d63a0]
add edi, 0xffffea5b
mov dword [0x102d63a0], edi
mov dword [0x102d63a4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102d63a0]
add eax, 0xfffff29d
mov dword [0x102d639c], eax
mov eax, dword [0x102d63a4]
add eax, 1
mov dword [0x102d63a4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000597b
xor eax, eax
mov dword [0x102d639c], 0x119a
mov dword [0x102d63a4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x102d63b0], 0
mov dword [0x102d639c], 0x21a0
mov edi, dword [0x102d63a8]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x102d63b0], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x102d63a8], edx
mov dword [0x102d63a0], 0xd15
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x102d63ac], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x102d639c], 0x18ab
mov cl, byte [0x102d63ac]
mov esi, dword [0x102d63a8]
mov byte [ebx + esi], cl
mov esi, dword [0x102d63a4]
add esi, 1
mov dword [0x102d63a4], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x100059c9
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10005b0b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x102cf6ad]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x102d63a0], 0x780
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.10005a7c
mov eax, dword [0x102d639c]
add eax, 0x23bd
mov dword [0x102d639c], eax
call fcn.10006438
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.100055d6
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x10005c2f
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x102d639c], 0x1a85
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.10005789
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x102d63a0], 0xffffea19
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x3c], ecx
mov dword [0x102d639c], 0x24ae
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x10005c2f
mov eax, dword [0x102d63a0]
mov ecx, dword [ebp - 0x44]
add ecx, 0x1e9a
add eax, 0xffffec01
mov dword [0x102d63a0], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
Function at 0x10005cda
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x102d639c], 0xacb
mov dword [ebp - 0x10], eax
call fcn.100067de
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10005d20
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x102d63a0], 0x6ce
mov esi, dword [edx + eax + 0x24]
mov dword [0x102d639c], 0xfffffca0
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10005e57
jmp 0x10005def
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x102d639c], 0x1919
mov dword [ebp - 0x34], edi
jmp 0x10005e57
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
jne 0x10005e01
mov al, byte [ebp - 0x46]
test al, 1
jne 0x10005d6f
jmp 0x10005e2f
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x102d639c], 0xacb
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edx
jmp 0x10005d97
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
jmp 0x10005dc9
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x10005d97
jmp 0x10005dc0
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x54]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x34], eax
jb 0x10005dc9
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000655c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x102d63a0], 0x1a0e
mov dword [ebp - 4], 0
mov dword [0x102d639c], 0x7d0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [0x102d639c]
add edx, 0xfffffa13
mov dword [0x102d639c], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102d63a0], 0x19a
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x100065de
mov eax, 0x1137
mov dword [0x102d639c], 0x2760
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
je 0x10006653
jmp 0x100066d7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1000660b
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x100065de
mov eax, dword [ebp - 0x20]
mov ecx, 0xffffec88
mov dword [0x102d639c], 0x2b1
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x100066d7
mov eax, 0xffffec88
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
je 0x100065b8
jmp 0x100066d7
mov eax, 0x1137
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
jne 0x100066d7
mov eax, 0xfffff83a
mov dword [0x102d639c], 0xe63
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
jne 0x100066d7
mov eax, 0xffffee12
mov dword [0x102d639c], 0x43b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
jne 0x100066d7
mov eax, 0xffffee12
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
jne 0x100066d7
mov eax, 1
mov dword [0x102d639c], 0x26a1
mov dword [ebp - 0x24], eax
jmp 0x100066e4
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [0x102d63a0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x1000695e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1541
xor ebx, ebx
mov dword [0x102d63a4], 0
mov dword [0x102d63a8], 0
mov dword [0x102d63b4], 0
mov dword [0x102d639c], 0x1541
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
je 0x10006af5
jmp 0x100069eb
mov eax, dword [0x102d63a8]
mov ecx, dword [0x102d63a4]
mov edx, dword [0x102d639c]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add eax, 1
mov ebx, ecx
add ebx, 1
add esi, 0xffffe50f
mov dword [0x102d639c], esi
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x102d63a4], edx
mov dword [0x102d63a0], 0x1c5a
mov esi, dword [ebp - 0x24]
movzx esi, byte [esi + edx]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x102d63a8], edx
mov dword [0x102d639c], 0xe53
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x102d63ac], cl
mov dword [0x102d63a0], 0x1303
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x102d63ac]
mov edx, dword [0x102d63a8]
mov byte [edi + edx], cl
mov edx, dword [0x102d639c]
mov ecx, edx
add ecx, 0x1414
mov dword [0x102d639c], ecx
mov ecx, dword [0x102d63a4]
movzx ecx, byte [edi + ecx]
mov esi, dword [0x102d63a8]
movzx esi, byte [edi + esi]
add esi, ecx
mov ecx, edx
add ecx, 0xfffff366
mov dword [0x102d639c], ecx
and esi, 0xff
mov dword [0x102d63b4], esi
mov cl, byte [edi + esi]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x38]
mov ch, byte [esi + edi]
add edx, 0xffffe34d
mov dword [0x102d639c], edx
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + edi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x30], ebx
jne 0x100069cb
mov dword [0x102d63a0], 0xaeb
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x402d70
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x402c94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402d15
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x402c80
mov dword [esp], eax
mov ebx, eax
call fcn.00403550
test eax, eax
mov edi, eax
je 0x402d97
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00403650
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402d77
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402d0e
sub eax, 4
and eax, 0xfffffffb
jne 0x402d20
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402d0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00403a70
lea esi, [esi]
xor esi, esi
jmp 0x402c9e
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00403a70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00403a70
mov esi, esi
lea edi, [edi]

Function at 0x4031d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x403225
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40321e
test esi, esi
je 0x40321e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403200
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403a70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00403a40
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00403a40
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x40215b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00423579
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4021a6
push 0x80004005
call 0x400f2b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00423579
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4021d6
push 0x80004005
call 0x400f2b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00423579
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402203
push 0x80004005
call 0x400f2b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0040195b
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0040195b
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410b1b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov bh, byte [edi]
sub dword [esi], eax
salc
xor dword gs:[edx + 0x1eaafabd], ebp
mov ecx, 0x35665142
out 0x82, eax
and al, 0x36
aad 0x70
sahf
mov ecx, 0xf88731f7
dec ebx
xchg ebx, eax
test al, 0x15
in al, 0x14
jns 0x410bb5
mov eax, dword [0xfff75aed]
cdq
pop es
enter 0xfffffffffffff015, 0x51
cmc
out 0xf4, eax
add edi, dword [esi + 0x1ce56fff]
or byte [ebx], dh
cmp esi, dword [edi]
invalid
jno 0x410bcd
adc esi, dword [ebp + ebx*8 - 0x4f]
lodsd eax, dword [esi]
into
xor al, 0xa2
out 0x33, al
aaa
cwde
and esp, dword [ecx + 0x42]
movhps xmm7, qword [esi + 0x44]
test dword [ecx - 0x36da51eb], edx
xchg esp, eax
adc eax, 0x94c925ae
and al, 0
cmc
cmp eax, esp
mov ch, 0xab
retf 0xd897

Function at 0x417e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x210]
push ecx
call edi
push str.system.ini
lea edx, [esp + 0xc]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea edx, [esp + 8]
push edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x417f2d
push str.install.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417f2d
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
Function at 0x4194db
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0043a8f9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419526
push 0x80004005
call fcn.004182ab
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0043a8f9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419556
push 0x80004005
call fcn.004182ab
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0043a8f9
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419583
push 0x80004005
call fcn.004182ab
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.00418cdb
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.00418cdb
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret