joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e350
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4df7c8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
push eax
xor ebx, ebx
push esi
mov ecx, ebp
mov dword [esp + 0x34], ebx
call fcn.0041e7c0
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x20], ebx
lea edx, [esp + 0x30]
lea edi, [esi + 0x54]
push edx
lea eax, [esi + 0x64]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov byte [edi + 8], bl
push eax
mov dword [esi + 0x60], ebx
call fcn.0041ed20
mov eax, esi
cmp dword [esi + 8], ebx
je 0x41e3c5
call fcn.004308a0
mov dword [esi + 0x50], eax
jmp 0x41e3e3
call fcn.0041e750
test al, al
je 0x41e3e0
mov ecx, dword [esp + 0x28]
mov dword [edi], ecx
mov dword [esi + 0x58], ebp
mov byte [esi + 0x5c], 1
mov dword [esi + 0x50], edi
jmp 0x41e3e3
mov dword [esi + 0x50], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x423b50
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4e001b
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x504f68]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x28], edi
cmp edi, ebp
je 0x423d01
cmp word [edi], bp
je 0x423d01
lea esi, [esp + 0x44]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
call fcn.00459550
mov ebx, esi
mov dword [esp + 0x118], ebp
call fcn.004595c0
call fcn.00459550
push 0x4f373c
push edi
call fcn.004b6e1d
mov ecx, esi
push ecx
lea edi, [esp + 0x44]
call fcn.00458d10
add esp, 0xc
cmp dword [esp + 0x38], ebp
jne 0x423ced
mov ebx, str.UpdateLog
lea eax, [esp + 0x1c]
mov ecx, esi
call fcn.00458f10
mov ecx, eax
mov ebx, str.ObsoleteFiles
lea eax, [esp + 0x24]
call fcn.00458f10
mov ecx, eax
mov ebx, str.File
lea eax, [esp + 0x18]
call fcn.00458f10
mov ebp, dword [esp + 0x18]
mov edx, ebp
neg edx
sbb edx, edx
test edx, fcn.0042ce20
je 0x423cd0
mov edi, ebp
mov ebx, str.File
lea eax, [esp + 0x34]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], edi
call fcn.00458ff0
mov ebp, dword [eax]
mov ebx, str.path
lea eax, [esp + 0x30]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebp
call fcn.00458f80
mov eax, dword [eax]
test eax, eax
je 0x423c8e
mov esi, dword [eax + 8]
test esi, esi
je 0x423c8e
cmp word [esi], 0
je 0x423c8e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x423c8e
push eax
push esi
call fcn.004b8f69
add esp, 8
test eax, eax
je 0x423cbe
test edi, edi
je 0x423c9f
mov eax, dword [edi + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
jmp 0x423cab
mov dword [esp + 0x24], 0
lea eax, [esp + 0x24]
mov ecx, dword [eax]
lea esi, [esp + 0x20]
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call fcn.004593b0
mov edx, ebp
neg edx
sbb edx, edx
test edx, fcn.0042ce20
jne 0x423c32
mov eax, dword [esp + 0x28]
push 0x4f3790
push eax
call fcn.004b6e1d
add esp, 8
mov edi, eax
lea ecx, [esp + 0x44]
call fcn.00458df0
lea ebx, [esp + 0x44]
mov dword [esp + 0x118], 0xffffffff
call fcn.004595c0
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.004b3721
add esp, 0x108
ret
Function at 0x423d30
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4dffe8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x504f68]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
test edi, edi
je 0x423d7d
cmp word [edi], 0
je 0x423d7d
push 0
push edi
call fcn.004b8f69
add esp, 8
test eax, eax
jne 0x423da1
test esi, esi
je 0x423e33
push 0
push esi
call fcn.004b8f69
add esp, 8
test eax, eax
jne 0x423da8
call fcn.00423e70
test eax, eax
jne 0x423e33
xor eax, eax
jmp 0x423e4e
push esi
lea ecx, [esp + 0x14]
call fcn.00401d10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x74], 0
call fcn.00489700
mov bl, 2
mov byte [esp + 0x70], bl
cmp dword [esp + 0x28], 8
jb 0x423de2
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004b3716
add esp, 4
lea eax, [esp + 0x2c]
xor edx, edx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], dx
call fcn.00489930
push eax
mov byte [esp + 0x74], 3
call fcn.00492320
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], bl
call fcn.004896d0
lea ecx, [esp + 0x48]
mov dword [esp + 0x70], 0xffffffff
call fcn.004896d0
test edi, edi
je 0x423e49
cmp word [edi], 0
je 0x423e49
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x423e4e
mov eax, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004b3721
add esp, 0x68
ret

Function at 0x423e70
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x218
mov eax, dword [0x504f68]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 4]
push edx
push 0
push str.tmp
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, eax
test edi, edi
je 0x423ee0
lea eax, [esp + 4]
push eax
push esi
mov ecx, ebx
call fcn.00423f00
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
xor ecx, esp
call fcn.004b3721
add esp, 0x218
ret
Function at 0x424610
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x504f68]
xor eax, esp
mov dword [esp + 0x20c], eax
test esi, esi
je 0x42469e
cmp word [esi], 0
je 0x42469e
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x42467c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea ecx, [esp + 4]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004b3721
add esp, 0x210
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004b3721
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov al, 1
call fcn.004b3721
add esp, 0x210
ret
Function at 0x424cb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x424cc1
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x424cdf
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x424d16
test ecx, ecx
je 0x424d0f
test esi, esi
ja 0x424cd0
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x424d30
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x424d41
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x424d5f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x424d96
test ecx, ecx
je 0x424d8f
test esi, esi
ja 0x424d50
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4277f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x5110a0], ecx
inc edx
cmp edx, 0x100
jb 0x4277f3
cmp edx, 0x800
jae 0x4278c9
lea ecx, [ecx]
mov eax, dword [edx*4 + 0x510ca0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x5110a0]
inc edx
mov dword [edx*4 + 0x51109c], eax
cmp edx, 0x800
jb 0x4278a0
mov dword [fcn.0050f08c], 0x428340
call fcn.00428520
test eax, eax
jne 0x4278e6
mov dword [fcn.0050f08c], 0x4283f0
pop ecx
ret
Function at 0x427ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x504f68]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xb4]
push ebx
push ebp
mov ebp, dword [esp + 0xc8]
push esi
push edi
xor ebx, ebx
mov edi, 1
mov esi, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
cmp dword [eax + 0x14], edi
je 0x427b27
mov eax, edi
jmp 0x427c7d
mov eax, dword [eax + 0x10]
push ecx
movzx ecx, byte [eax]
push ecx
lea ecx, [esp + 0x30]
call fcn.004285b0
add esp, 8
cmp eax, ebx
jne 0x427c7d
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x78], edi
lea ecx, [ecx]
mov eax, 0x40000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
cmp dword [esp + 0xcc], ebx
ja 0x427bbc
jb 0x427bb1
cmp dword [esp + 0xc8], eax
jae 0x427bbc
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
call eax
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x427c69
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xd8]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
lea esi, [esp + 0x38]
call fcn.004287a0
mov esi, eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x24], eax
add esp, 0x10
sub dword [esp + 0xc8], eax
sbb dword [esp + 0xcc], ebx
cmp esi, ebx
jne 0x427c69
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x4c], ecx
je 0x427c4e
cmp eax, ebx
jne 0x427c38
cmp edi, dword [esp + 0x4c]
je 0x427c4e
push eax
mov eax, dword [ebp + 4]
push ebp
call eax
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x427b90
jmp 0x427c69
cmp ecx, dword [esp + 0xd4]
jne 0x427c64
cmp dword [esp + 0x14], ebx
jne 0x427c64
cmp dword [esp + 0x20], 1
je 0x427c69
mov esi, 1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
push ecx
push eax
call edx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b3721
add esp, 0xb0
ret
Function at 0x428a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x428aad
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x428add
lea ebx, [ebx]
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x428add
inc edi
cmp edi, ebx
jb 0x428ad0
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x428be5
cmp eax, 3
jbe 0x428b10
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x428b4b
cmp al, 0xff
je 0x428b4b
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x428ac3
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x428af6
movzx ecx, byte [esi + 0x4ed7a8]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x4ed7a0], 0
mov al, byte [eax + 4]
je 0x428b39
test al, al
je 0x428b39
cmp al, 0xff
jne 0x428af6
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x428ac3
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
lea esp, [esp]
sub edx, ebp
sub edx, 5
mov eax, edx
test esi, esi
je 0x428bb7
movzx edx, byte [esi + 0x4ed7a8]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x428b9c
cmp bl, 0xff
jne 0x428bb3
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x428b70
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x428ac3
pop edi
pop ebx
cmp eax, 3
jbe 0x428bfc
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x18]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x42a7d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dbdd8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esp + 0x14], ebx
mov dword [esi], 0x4ef8f8
mov eax, 0xfffe7960
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x18], 2
call fcn.0042d570
lea ecx, [esi + 0x6c]
push ecx
mov byte [esp + 0x18], 3
call fcn.0042d570
lea edx, [esi + 0x84]
push edx
mov byte [esp + 0x18], 4
call fcn.0042d570
mov byte [esp + 0x14], 5
mov eax, dword [0x50e150]
mov edx, dword [eax + 0xc]
mov ecx, 0x50e150
call edx
add eax, 0x10
mov dword [esi + 0xa4], eax
mov byte [esp + 0x14], 6
mov eax, dword [0x50e150]
mov edx, dword [eax + 0xc]
mov ecx, 0x50e150
call edx
add eax, 0x10
mov dword [esi + 0xa8], eax
mov byte [esp + 0x14], 7
mov eax, dword [0x50e150]
mov edx, dword [eax + 0xc]
mov ecx, 0x50e150
call edx
add eax, 0x10
mov dword [esi + 0xac], eax
mov byte [esp + 0x14], 8
mov eax, dword [0x50e150]
mov edx, dword [eax + 0xc]
mov ecx, 0x50e150
call edx
add eax, 0x10
mov dword [esi + 0xb0], eax
mov byte [esp + 0x14], 9
mov eax, dword [0x50e150]
mov edx, dword [eax + 0xc]
mov ecx, 0x50e150
call edx
add eax, 0x10
mov dword [esi + 0xb4], eax
lea eax, [esi + 0xd0]
push eax
mov byte [esp + 0x18], 0xa
call fcn.00470090
mov eax, dword [0x50f6c0]
mov ecx, 1
add eax, ecx
mov dword [0x50f6c0], eax
mov dword [esi + 8], eax
or eax, 0xffffffff
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ebx
mov byte [esi + 0x9c], cl
mov byte [esi + 0x9d], cl
mov byte [esi + 0x9e], bl
mov byte [esi + 0x9f], cl
mov byte [esi + 0xa0], cl
mov byte [esi + 0xa1], bl
mov dword [esi + 0xc0], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0xcc], bl
mov byte [esi + 0xcd], bl
mov byte [esi + 0xce], bl
mov dword [esi + 0x100], ebx
mov dword [esi + 0xc8], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x42fa30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4dfca3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esi + 4], ebx
lea eax, [esi + 8]
mov dword [esp + 0x1c], ebx
push eax
mov dword [esi], 0x4efd54
call fcn.0043c2a0
push 0x4e9708
mov byte [esp + 0x20], 1
push 0x82
push edi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
cmp ebp, ebx
je 0x42faea
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x28], eax
cmp eax, ebx
je 0x42faea
cmp eax, 0x1c
jbe 0x42faea
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x42faea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x2c], eax
cmp eax, ebx
je 0x42faea
cmp dword [eax], 0x53495544
jne 0x42faea
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x14]
lea edi, [edx + ecx]
cmp edi, dword [esi + 0x28]
jb 0x42faea
push ecx
lea ecx, [edx + eax]
lea edi, [esi + 8]
call fcn.0043bb70
mov byte [esi + 0x30], al
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x4304e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4dd4a8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x14]
xor ebx, ebx
push eax
mov dword [esi + 8], ebx
call fcn.0041ec30
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x64]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov byte [esi + 0x5c], bl
call fcn.0040b390
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x430560
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4df7c8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
push eax
xor ebx, ebx
push esi
mov ecx, ebp
mov dword [esp + 0x34], ebx
call fcn.004308f0
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x20], ebx
lea edx, [esp + 0x30]
lea edi, [esi + 0x54]
push edx
lea eax, [esi + 0x64]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov byte [edi + 8], bl
push eax
mov dword [esi + 0x60], ebx
call fcn.0041ed20
mov eax, esi
cmp dword [esi + 8], ebx
je 0x4305d5
call fcn.004308a0
mov dword [esi + 0x50], eax
jmp 0x4305f3
call fcn.0041e750
test al, al
je 0x4305f0
mov ecx, dword [esp + 0x28]
mov dword [edi], ecx
mov dword [esi + 0x58], ebp
mov byte [esi + 0x5c], 1
mov dword [esi + 0x50], edi
jmp 0x4305f3
mov dword [esi + 0x50], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x439640
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x4d9ed3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi], 0x4eff1c
mov dword [esi + 4], ebx
mov byte [esp + 0x18], 1
push 0xd
mov dword [esi + 8], ebx
mov dword [esi + 0x44], ebx
call fcn.004b383b
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4396c0
lea ecx, [esp + 0x20]
push ecx
push 0x40
mov eax, 0x4397c0
sub eax, edi
push 0xd
sub eax, 0xd
push edi
mov dword [edi], 0x42444c7
mov dword [edi + 4], esi
mov byte [edi + 8], 0xe9
mov dword [edi + 9], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esi + 0x10], edi
jmp 0x4396c3
mov dword [esi + 0x10], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x43b610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e0558
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x504f68]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [0x50e150]
mov edx, dword [eax + 0xc]
mov ecx, 0x50e150
mov dword [esp + 0x30], 0x4f0338
call edx
add eax, 0x10
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x60]
push str._skin_template
lea ecx, [esp + 0x40]
push ecx
xor ebx, ebx
push edx
mov dword [esp + 0x64], ebx
call fcn.0045fc40
mov byte [esp + 0x58], 1
mov eax, dword [esp + 0x48]
mov esi, eax
cmp eax, dword [esp + 0x4c]
je 0x43b797
jmp 0x43b690
mov eax, dword [esi + 4]
neg eax
sbb eax, eax
test eax, fcn.0042ce20
je 0x43b6a8
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
jmp 0x43b6aa
mov eax, esi
mov eax, dword [eax]
mov dword [esp + 0x24], eax
cmp eax, ebx
je 0x43b6c1
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
jmp 0x43b6c9
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
neg eax
sbb eax, eax
test eax, fcn.0042ce20
je 0x43b784
mov ebx, str.name
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x24]
call fcn.00458f80
mov eax, dword [eax]
test eax, eax
je 0x43b6ff
mov eax, dword [eax + 8]
mov ecx, eax
test eax, eax
jne 0x43b704
mov ecx, 0x4ed9d8
lea edx, [esp + 0x14]
push edx
call fcn.00408670
lea ebx, [esp + 0x14]
mov byte [esp + 0x58], 2
call fcn.00408790
mov ebx, eax
call fcn.00408810
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x43b744
add eax, 0xfffffff0
mov byte [esp + 0x58], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x43b778
lea eax, [esp + 0x14]
lea edi, [esp + 0x34]
call fcn.0040a150
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x34]
call fcn.00459420
mov byte [esp + 0x58], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43b784
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 8
xor ebx, ebx
cmp esi, dword [esp + 0x4c]
jne 0x43b690
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x40]
mov byte [esp + 0x58], bl
cmp eax, ecx
je 0x43b7ad
push eax
call dword [fcn.0050d140]
add esp, 4
mov dword [esp + 0x58], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43b7d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret