joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b10
Capabilities:
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
sub esp, 0x34c
mov eax, dword [0x432fc8]
xor eax, esp
mov dword [esp + 0x348], eax
push 0x104
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401c44
push 0x104
lea ecx, [esp + 0x40]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x401c44
push 0x104
lea eax, [esp + 0x248]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401c44
push esi
push str._c_del
lea ecx, [esp + 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x148]
push eax
call esi
push str.___nul
lea ecx, [esp + 0x148]
push ecx
call esi
lea ecx, [esp + 4]
lea edx, [esp + 0x248]
lea eax, [esp + 0x144]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], str.Open
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x401c43
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [esp + 0x44]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.00417168
add esp, 0x34c
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x408e12
test esi, esi
je 0x408e41
cmp edi, 1
jne 0x408e1b
test esi, esi
je 0x408e3a
lea eax, [esp + 0xc]
push eax
call fcn.00417d88
mov ecx, dword [esp + 0x14]
add esp, 4
cmp ecx, esi
jl 0x408e41
jg 0x408e3a
mov edx, dword [esp + 0xc]
cmp edx, edi
jbe 0x408e41
pop edi
pop esi
jmp 0x401b10
pop edi
pop esi
ret
Function at 0x4037e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
movzx ecx, word [esp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x403805
pop edi
xor eax, eax
pop esi
ret 0xc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esi + 4]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test edi, edi
ja 0x40382c
test eax, eax
je 0x4037fe
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x4062f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, di
shr edi, 0x10
test esi, esi
mov ebx, eax
jne 0x40630c
pop edi
pop esi
mov eax, 1
pop ebx
ret
test ebx, ebx
jbe 0x40640c
push ebp
cmp ebx, 0x15b0
mov eax, ebx
jb 0x406324
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x4063cb
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
lea ecx, [ecx]
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x406340
test eax, eax
je 0x4063df
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x4063d0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x406315
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret

Function at 0x4068e0
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4068e7
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.004068f0
Function at 0x4068f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x406922
lea esp, [esp]
test cl, 3
je 0x406922
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42ade0]
add ecx, 1
sub esi, 1
jne 0x406900
cmp esi, 0x20
push ebx
push edi
jb 0x406b0c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42b1e0]
xor edx, dword [ebx*4 + 0x42b5e0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42ade0]
add ecx, 4
xor edx, dword [eax*4 + 0x42b9e0]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42b1e0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x42b5e0]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42ade0]
add ecx, 4
xor eax, dword [edx*4 + 0x42b9e0]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42b1e0]
xor edx, dword [ebx*4 + 0x42b5e0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42ade0]
xor edx, dword [eax*4 + 0x42b9e0]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42b1e0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x42b5e0]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42ade0]
xor eax, dword [edx*4 + 0x42b9e0]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42b1e0]
xor edx, dword [ebx*4 + 0x42b5e0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42ade0]
xor edx, dword [eax*4 + 0x42b9e0]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42b1e0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x42b5e0]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42ade0]
and edx, 0xff
xor eax, dword [edx*4 + 0x42b9e0]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x42b1e0]
xor edx, dword [ebx*4 + 0x42b5e0]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x42ade0]
add ecx, 4
xor edx, dword [eax*4 + 0x42b9e0]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x42b1e0]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x42b5e0]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x42ade0]
and edx, 0xff
xor eax, dword [edx*4 + 0x42b9e0]
sub edi, 1
jne 0x406932
cmp esi, 4
jb 0x406b59
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x42b1e0]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x42b5e0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x42ade0]
and eax, 0xff
xor edi, dword [eax*4 + 0x42b9e0]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x406b16
test esi, esi
pop edi
pop ebx
je 0x406b7d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42ade0]
add ecx, 1
sub esi, 1
jne 0x406b60
not eax
pop esi
ret
Function at 0x4081d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [0x4344fc]
push edi
push 0x428460
push 0xcb
push esi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x408241
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test esi, esi
ja 0x408219
test eax, eax
je 0x408240
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00408250
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.00407fe0
lea ecx, [esp + 0x10]
call fcn.004082b0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x408e00
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
sub esp, 0x34c
mov eax, dword [0x432fc8]
xor eax, esp
mov dword [esp + 0x348], eax
push 0x104
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401c44
push 0x104
lea ecx, [esp + 0x40]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x401c44
push 0x104
lea eax, [esp + 0x248]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401c44
push esi
push str._c_del
lea ecx, [esp + 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x148]
push eax
call esi
push str.___nul
lea ecx, [esp + 0x148]
push ecx
call esi
lea ecx, [esp + 4]
lea edx, [esp + 0x248]
lea eax, [esp + 0x144]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], str.Open
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x401c43
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [esp + 0x44]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop esi
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.00417168
add esp, 0x34c
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x408e12
test esi, esi
je 0x408e41
cmp edi, 1
jne 0x408e1b
test esi, esi
je 0x408e3a
lea eax, [esp + 0xc]
push eax
call fcn.00417d88
mov ecx, dword [esp + 0x14]
add esp, 4
cmp ecx, esi
jl 0x408e41
jg 0x408e3a
mov edx, dword [esp + 0xc]
cmp edx, edi
jbe 0x408e41
pop edi
pop esi
jmp 0x401b10
pop edi
pop esi
ret
Function at 0x409e10
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x409e30
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x409e46
push 0x80004005
call fcn.00408300
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x409e70
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x409e88
push 0x80004005
call fcn.00408300
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
add esi, eax
add edi, eax
cmp eax, 1
jne 0x409e95
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x40a450
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x432fc8]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x40a4be
test ecx, ecx
je 0x40a4b0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40a4cc
test ecx, ecx
je 0x40a571
push ecx
jmp 0x40a56b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x40a53e
jmp 0x40a500
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.0040a450
mov edi, eax
test edi, edi
jne 0x40a58d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x40a500
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a555
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a571
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00417168
add esp, 0x11c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a59c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40a573
Function at 0x40bfa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
call fcn.0040bd60
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 5
push edi
push esi
mov dword [esp + 0x20], 0
call ebx
mov ebp, eax
test ebp, ebp
je 0x40c07f
push pe_nt_image_headers32
push edi
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
test eax, eax
je 0x40bff4
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebp
push esi
mov dword [esp + 0x18], 0
call edi
test eax, eax
je 0x40c058
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40c058
push ebx
push edi
call fcn.00409110
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
add esp, 8
mov ebx, eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push edx
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov esi, eax
test esi, esi
jne 0x40c044
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x40c066
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40c066
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40c075
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x411640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x432fc8]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x3b0]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x74], ecx
call dword [0x432f44]
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x68], esi
je 0x4116f8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
add eax, 1
cdq
push 2
push edx
push eax
call fcn.00418490
mov edi, eax
add eax, 0x80000000
adc edx, esi
test edx, edx
ja 0x4116f8
jb 0x4116bc
cmp eax, 0xffffffff
ja 0x4116f8
cmp edi, 0x400
jg 0x4116dc
push edi
call fcn.004094c0
add esp, 4
test al, al
je 0x4116dc
mov eax, edi
call fcn.00418410
mov eax, esp
jmp 0x4116e8
push edi
lea ecx, [ebp - 0x6c]
call fcn.00409980
mov esi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
push edx
push edi
push ebx
push eax
call fcn.00409c20
test eax, eax
jne 0x41172b
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x411708
lea ecx, [ebp - 0x68]
call fcn.0040a3f0
test esi, esi
je 0x411721
lea esp, [esp]
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.00417cfa
add esp, 4
test esi, esi
jne 0x411710
mov eax, 0x8007000e
jmp 0x411823
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x411748
call fcn.00409c90
mov edi, eax
jmp 0x4117f6
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x70]
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x411767
call fcn.00409c90
jmp 0x4117ed
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x70], eax
jne 0x41177d
call fcn.00409c90
jmp 0x4117ed
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x4117ad
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x41179e
lea ecx, [ebp - 0x68]
call fcn.0040a3f0
lea ecx, [ebp - 0x6c]
call fcn.00409390
mov eax, 0x8007000e
jmp 0x411823
push eax
lea ecx, [ebp - 0x68]
call fcn.0040b000
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x4117c4
mov edi, 0x8007000e
jmp 0x4117ef
mov ecx, dword [ebp - 0x70]
push edi
push ecx
push edi
push eax
call fcn.004083d0
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp + 0x3b4]
add esp, 0x10
mov byte [edx + edi], 0
mov ecx, dword [ebp - 0x68]
push eax
push ecx
lea ecx, [ebp - 0x80]
call fcn.0040c0f0
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x64]
cmp dword [ebp - 0x68], edx
je 0x411806
lea ecx, [ebp - 0x68]
call fcn.0040a3f0
test esi, esi
je 0x411821
lea ebx, [ebx]
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.00417cfa
add esp, 4
test esi, esi
jne 0x411810
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.00417168
add ebp, 0x3a0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413303
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x94], 0
je 0x4133b0
mov eax, dword [esi + 4]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffff0
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, eax
or ecx, 0x800000
cmp eax, ecx
je 0x41333e
push ecx
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call ebx
mov edx, dword [esi + 4]
push 0xffffffffffffffec
push edx
call edi
mov ecx, eax
and ecx, 0xffffff7f
or ecx, 8
cmp eax, ecx
je 0x41335e
mov eax, dword [esi + 4]
push ecx
push 0xffffffffffffffec
push eax
call ebx
mov ecx, dword [esi + 4]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x14]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x6c]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop ebx
mov byte [esi + 0x94], 0
mov eax, 1
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x41610a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x432fc8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041609f
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00417180
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x416159
cmp dword [ebp - 0x1c], 5
jb 0x416171
jmp 0x41616d
cmp dword [ebp - 0x10], 1
jne 0x416171
cmp dword [ebp - 0x1c], 4
ja 0x41616d
jne 0x416171
cmp dword [ebp - 0x18], 0
jbe 0x416171
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4290f4
call fcn.00408ea0
test eax, eax
jge 0x416192
mov byte [0x434424], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00417168
add ebp, 0x78
leave
ret
Function at 0x416498
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x434584], 0
push esi
jne 0x41640b
call fcn.00416336
test eax, eax
je 0x41644e
mov eax, dword [0x434584]
cmp eax, 1
jne 0x41642c
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41644e
pop esi
ret
push eax
call dword [0x43458c]
test eax, eax
jne 0x416496
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x416452
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x434584]
call dword [0x43458c]
mov edi, eax
test edi, edi
je 0x416479
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x416495
lea edi, [esi + 0xff0]
push esi
push dword [0x434584]
call dword [0x434588]
add esi, 0x10
cmp esi, edi
jb 0x41647f
mov eax, esi
pop edi
pop esi
ret
jmp 0x4163f8

Function at 0x417168
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432fc8]
jne 0x417172
repz ret
jmp fcn.0041ad9c