joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46025d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x47b870]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 8], 0
je 0x443538
cmp dword [ebp + 8], 1
jne 0x4435ba
mov ecx, dword [ebp - 0x30]
add ecx, 0xdc8
call fcn.00408430
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x443569
push 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xdc8
call fcn.00408430
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0xa44
call fcn.00407b90
mov dword [ebp - 0x34], eax
push 0x46a9d8
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004082d0
add esp, 8
mov byte [ebp - 0x15], al
lea ecx, [ebp - 0x1c]
call fcn.004012e0
movzx edx, byte [ebp - 0x15]
test edx, edx
je 0x4435b5
push 0x46a9e4
mov ecx, dword [ebp - 0x30]
add ecx, 0xa44
call fcn.00407b60
jmp 0x4436bc
cmp dword [ebp + 8], 2
jne 0x4436bc
mov ecx, dword [ebp - 0x30]
add ecx, 0xdc8
call fcn.00408430
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4435f4
push 5
mov ecx, dword [ebp - 0x30]
add ecx, 0xdc8
call fcn.00408430
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0xa44
call fcn.00407b90
mov dword [ebp - 0x38], eax
push 0x46a9f0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004082d0
add esp, 8
mov byte [ebp - 0x1d], al
lea ecx, [ebp - 0x24]
call fcn.004012e0
movzx edx, byte [ebp - 0x1d]
test edx, edx
je 0x4436bc
mov ecx, dword [ebp - 0x30]
add ecx, 0xa44
call fcn.00407980
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44369b
push 8
call fcn.0040852b
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0
je 0x443673
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00408170
mov dword [ebp - 0x3c], eax
jmp 0x44367a
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x44369b
mov ecx, dword [ebp - 0x14]
call fcn.00408140
mov ecx, dword [ebp - 0x30]
add ecx, 0xa44
call fcn.00404df0
push 0x46aa04
mov ecx, dword [ebp - 0x30]
add ecx, 0xa44
call fcn.00407b60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x44a380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.00401170
mov dword [ebp - 8], eax
push 2
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x44a3ac
xor eax, eax
jmp 0x44a414
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44a3c7
xor eax, eax
jmp 0x44a414
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44a3de
xor eax, eax
jmp 0x44a414
mov edx, dword [ebp - 0xc]
push edx
call fcn.00449f30
add esp, 4
mov word [ebp - 4], ax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
movzx ecx, word [ebp - 4]
cmp ecx, 0x10
je 0x44a405
xor eax, eax
jmp 0x44a414
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0041b568
mov esp, ebp
pop ebp
ret
Function at 0x4555c0
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x47b870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp - 0x134]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x4555ee
mov al, 1
jmp 0x4557fd
push 0x46be84
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edx, dword [ebp - 0x134]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x134]
cmp dword [eax + 0x18], 0
jne 0x455615
xor al, al
jmp 0x4557fd
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x455628
xor al, al
jmp 0x4557fd
mov dword [ebp - 0x128], 0
push 0x118
push 0
lea ecx, [ebp - 0x124]
push ecx
call fcn.0042c7d0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x455688
cmp dword [ebp - 0x118], 2
jne 0x455688
cmp dword [ebp - 0x124], 5
jb 0x455688
cmp dword [ebp - 0x120], 1
jb 0x455688
mov eax, dword [ebp - 0x134]
mov byte [eax + 0x1c], 1
push 0x46be8c
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x4556ac
jmp 0x4557ca
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x134]
movzx edx, byte [ecx + 0x1c]
test edx, edx
je 0x4556eb
cmp dword [ebp - 0x12c], 0
jge 0x4556eb
jmp 0x4557ca
mov eax, dword [ebp - 0x134]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
je 0x455727
mov edx, dword [ebp - 0x134]
add edx, 8
push edx
push 0x46a300
push 5
push 0
push 0x46a540
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x455725
jmp 0x4557ca
jmp 0x45574d
mov eax, dword [ebp - 0x134]
add eax, 8
push eax
push 0x46a300
push 1
push 0
push 0x46a3d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x45574d
jmp 0x4557ca
mov ecx, dword [ebp - 0x134]
add ecx, 0xc
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x134]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 8]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0xc]
call edx
test eax, eax
jge 0x45578c
jmp 0x4557ca
mov eax, dword [ebp - 0x134]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
jne 0x4557c0
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x4557c0
jmp 0x4557ca
mov ecx, dword [ebp - 0x134]
mov byte [ecx + 4], 1
cmp dword [ebp - 0x130], 0
je 0x4557e0
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x134]
movzx ecx, byte [eax + 4]
test ecx, ecx
jne 0x4557f4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c3c9
mov esp, ebp
pop ebp
ret
Function at 0x45aa40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x47b870]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042c7d0
add esp, 0xc
mov dword [ebp - 4], 0
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45ab42
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x46c93c
call fcn.0042c8a7
add esp, 4
push eax
push 0x46c958
lea eax, [ebp - 0x210]
push eax
call fcn.0042c8c1
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x218], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x218], 0
je 0x45ab42
push 0x6a
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x45ab22
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebp - 0x220], eax
jmp 0x45ab2c
mov dword [ebp - 0x220], 0
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042c3c9
mov esp, ebp
pop ebp
ret
Function at 0x45b010
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460461
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x47b870]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
push 0x46c9e8
lea ecx, [ebp - 0x1a8]
call fcn.00402bd0
mov dword [ebp - 4], 0
mov eax, 2
mov word [ebp - 0x1ac], ax
lea ecx, [ebp - 0x1a4]
push ecx
movzx edx, word [ebp - 0x1ac]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x45b1dc
push 0x80
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x45b1d6
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x234], eax
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x1a8]
call fcn.004026d0
push 0x46c9ec
lea ecx, [ebp - 0x1a8]
call fcn.00401ea0
mov dword [ebp - 0x230], 0
jmp 0x45b0ef
mov eax, dword [ebp - 0x230]
add eax, 1
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x234], 0
je 0x45b1d6
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x230]
cmp dword [edx + eax*4], 0
je 0x45b1d6
mov dword [ebp - 0x238], 0
jmp 0x45b130
mov ecx, dword [ebp - 0x238]
add ecx, 1
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x234]
movsx eax, word [edx + 0xa]
cmp dword [ebp - 0x238], eax
jge 0x45b1c1
lea ecx, [ebp - 0x23c]
call fcn.004012a0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x238], 0
jle 0x45b16a
push 0x46c9f0
lea ecx, [ebp - 0x1a8]
call fcn.00401ec0
mov ecx, dword [ebp - 0x234]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x230]
mov ecx, dword [edx + eax*4]
mov edx, dword [ebp - 0x238]
movzx eax, byte [ecx + edx]
push eax
push 0x46c9f4
lea ecx, [ebp - 0x23c]
push ecx
call fcn.00401780
add esp, 0xc
lea edx, [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x1a8]
call fcn.00401e80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x23c]
call fcn.004012e0
jmp 0x45b121
push 0x46c9fc
lea ecx, [ebp - 0x1a8]
call fcn.00401ec0
jmp 0x45b0e0
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp - 0x1a8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00403060
mov ecx, dword [ebp - 0x240]
or ecx, 1
mov dword [ebp - 0x240], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a8]
call fcn.004012e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c3c9
mov esp, ebp
pop ebp
ret
Function at 0x403420
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x4d32f0], 0x594
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
jne 0x40345a
push 0x402b70
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x422d28]
mov edi, dword [0x422d2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
call fcn.00403419
mov eax, dword [0x422d30]
add dword [ebp - 0x14], 0x23f
mov ebx, dword [0x422d34]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl ecx, 4
cmp dword [0x4d32f0], 0xc
mov dword [ebp - 4], ecx
jne 0x4034f7
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x440]
push eax
push esi
push 0x402b90
push 0x402bb0
push 0x402bd0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 4], ecx
mov ecx, dword [0x4d32f0]
cmp ecx, 0xfa9
jne 0x403515
mov dword [0x4d288c], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x403523
mov dword [0x4d223c], esi
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov dword [0x4d2888], 0xf4ea3dee
add eax, ebx
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x4d32f0], 0x213
mov dword [ebp - 0x18], ecx
jne 0x403562
push esi
push 0x402be8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x4d32f0], 0xc
jne 0x403595
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0xc40]
push eax
push 0x402c40
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
add eax, edi
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
call fcn.00403412
dec dword [ebp - 0x1c]
jne 0x40348f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4035e5
Capabilities:
Create pipe
Get common file path
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d32f0]
mov ecx, dword [0x4d2240]
sub esp, 0x42c
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4036da
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x4d32f0], 0x959
jne 0x4036c6
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402c14
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x402cf8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402d08
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00403420
add ebx, 8
dec dword [ebp - 4]
jne 0x40360e
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4037ac
Capabilities:
Get common file path

Disassembly:
mov eax, 0x420a24
call fcn.00420928
mov eax, 0x1828
call fcn.0040bb70
push ebx
push esi
xor esi, esi
cmp dword [0x4d32f0], 0x5b1
push edi
jne 0x403856
push esi
lea eax, [ebp - 0x834]
push eax
push esi
push 0x402d94
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
push esi
call sub.KERNEL32.dll_GetSystemTimes
lea eax, [ebp - 0x34]
call fcn.00403abc
push esi
mov dword [ebp - 4], esi
call fcn.00404657
call fcn.004045f5
lea ecx, [ebp - 0x18]
mov dword [esp], 0x402dfc
call fcn.004032f0
lea ecx, [ebp - 0x18]
call fcn.0040330c
lea ecx, [ebp - 0x18]
call fcn.00403352
lea ecx, [ebp - 0x18]
call fcn.0040336b
push esi
push esi
call fcn.00404974
push esi
call fcn.00404945
push esi
call fcn.0040492e
push esi
call fcn.00404aed
push esi
call fcn.0040492e
add esp, 0x18
call fcn.00404a07
add dword [0x4d32f0], 0x1134b
push dword [0x4d32f0]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4d2240], eax
call fcn.004036f7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x40389f
inc edi
cmp edi, 0x4f6a4
jl 0x40387f
mov eax, dword [0x4d32f0]
xor ecx, ecx
cmp eax, esi
jbe 0x4038c5
mov edx, dword [0x4d32f4]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x4d2240]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x4038aa
xor edi, edi
lea ecx, [eax + edi]
cmp ecx, 0xe
jne 0x403914
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [ebp - 0x834]
push eax
push esi
push 0x402e10
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402e9c
push 0x402eb8
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov eax, dword [0x4d32f0]
inc edi
cmp edi, 0x39621
jl 0x4038c7
call fcn.004035e5
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403930
call fcn.004036dd
inc edi
cmp edi, 0x6753f
jl 0x403924
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x7b
pop ebx
cmp dword [0x4d32f0], 0x86
jne 0x40398b
push 0x402ec8
push 0x402f00
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push esi
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [0x4d32f0], 0xf
jne 0x4039b3
push esi
push esi
call edi
push esi
lea eax, [ebp - 0x1834]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0x402f20
push 0x402f58
call edi
dec ebx
jne 0x403942
push 0x402fac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4051eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42233c]
jne 0x4051f5
repz ret
jmp fcn.0040878c
Function at 0x40ab6b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004067b6
and dword [ebp - 4], 0
cmp dword [0x423e64], 0
mov ebx, eax
jne 0x40ac1c
push 0x4021ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40accd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021a0
push edi
call esi
test eax, eax
je 0x40accd
push eax
call fcn.00406744
mov dword [esp], 0x402190
push edi
mov dword [0x423e64], eax
call esi
push eax
call fcn.00406744
mov dword [esp], 0x40217c
push edi
mov dword [0x423e68], eax
call esi
push eax
call fcn.00406744
mov dword [esp], 0x402160
push edi
mov dword [0x423e6c], eax
call esi
push eax
call fcn.00406744
pop ecx
mov dword [0x423e74], eax
test eax, eax
je 0x40ac1c
push 0x402148
push edi
call esi
push eax
call fcn.00406744
pop ecx
mov dword [0x423e70], eax
mov eax, dword [0x423e70]
cmp eax, ebx
je 0x40ac74
cmp dword [0x423e74], ebx
je 0x40ac74
push eax
call fcn.004067bf
push dword [0x423e74]
mov esi, eax
call fcn.004067bf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ac74
test edi, edi
je 0x40ac74
call esi
test eax, eax
je 0x40ac6b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ac6b
test byte [ebp - 0xc], 1
jne 0x40ac74
or dword [ebp + 0x10], 0x200000
jmp 0x40acad
mov eax, dword [0x423e68]
cmp eax, ebx
je 0x40acad
push eax
call fcn.004067bf
pop ecx
test eax, eax
je 0x40acad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40acad
mov eax, dword [0x423e6c]
cmp eax, ebx
je 0x40acad
push eax
call fcn.004067bf
pop ecx
test eax, eax
je 0x40acad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e64]
call fcn.004067bf
pop ecx
test eax, eax
je 0x40accd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40accf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003bdd4
Capabilities:
Encode data using xor

Disassembly:
bswap eax
lea eax, [ecx*4]
mov al, 0x90
jmp 0x1003be46
mov dword [esp + 5], ebx
lea esp, [esp + 2]
mov dword [esp + 0x28], eax
not al
jmp 0x1003bd65
push dx
mov byte [esp], ah
lea esp, [esp]
mov word [esp], ax
push word [esp]
push dword [esp + 1]
mov byte [esp + 6], ch
push dword [esp + 6]
pop word [esp + 6]
push ebx
pushal
jmp 0x1003bd82
pushal
mov dh, 0x8a
popal
pushfd
mov word [esp + 1], di
mov word [esp], di
pushfd
mov dword [esp], esi
push dword [esp + 7]
mov dword [esp + 6], esp
lea esp, [esp + 1]
pop word [esp + 5]
mov byte [esp + 3], ah
mov word [esp + 2], cx
lea esp, [esp + 1]
lea esp, [esp + 8]
lea esp, [esp + 4]
jmp 0x1003bda0
mov dword [esp + 0x24], ecx
mov ecx, ebx
mov eax, 0xfb93223
xchg ch, cl
mov ch, byte [esp]
xchg cx, ax
jmp 0x1003bebd
bswap ax
bswap eax
mov ax, word [esp]
mov ah, 0x84
mov al, byte [esp]
jmp 0x1003be21
bswap bx
mov dword [esp + 0x10], esi
mov cx, 0x5f22
bswap eax
mov bp, word [esp]
xchg bx, bp
mov dl, 0x63
jmp 0x1003c147
mov eax, 0x4f565292
mov bh, bl
sets ah
lea ecx, [ecx*4]
jmp 0x1003be74
lea ecx, [eax + esi]
not ah
mov ax, 0x57d7
mov ecx, eax
mov dword [esp + 0x20], edx
bswap ax
mov ecx, dword [esp]
mov dx, 0x85a
bswap ecx
xchg al, ch
mov dword [esp + 0x1c], ebx
mov bx, si
mov ebx, 0x387c2e3b
not ax
lea eax, [edi*4]
mov ecx, dword [esp]
mov edx, dword [esp]
mov dword [esp + 0x18], esp
bswap cx
mov cl, byte [esp]
xchg cl, dl
mov bx, word [esp]
lea ecx, [edi + ebp]
mov ax, 0x2efd
mov dx, word [esp]
xchg ebx, eax
setno dl
not ch
lea edx, [edx + ebp]
xchg dh, al
mov bx, cx
mov edx, 0x79b41b6c
mov dword [esp + 0x14], ebp
mov dl, 0xda
xchg al, ah
mov edx, 0x148d6c57
mov dh, 0x33
lea edx, [ebx - 0xdd]
mov dh, byte [esp]
lea ebp, [0x4b426182]
jmp 0x1003be9b
ret
mov bl, 0x2a
bswap ebp
not dl
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
xchg dx, cx
popal
push edi
pushal
mov byte [esp + 0x13], bh
push dword [esp + 0x1e]
push word [esp + 0x13]
mov word [esp + 0x1d], di
push di
pop dword [esp + 6]
mov dword [esp + 0x19], edx
lea esp, [esp + 7]
push dword [esp + 0xb]
mov word [esp + 0x10], si
push word [esp + 4]
mov dword [esp + 0x15], ebx
lea esp, [esp + 3]
lea esp, [esp + 0x24]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x1003c0f5
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
pushal
push cx
pop dword [esp + 0xe]
mov word [esp + 0x1a], si
mov word [esp + 4], bx
push word [esp + 0x15]
pop word [esp + 0x14]
push word [esp + 0xf]
rol eax, 7
je 0x1003c1ed
xadd eax, eax
pop es
push ebp
mov word [esp], di
push dword [esp + 1]
pop dword [esp]
pop word [esp]
pushal
lea esp, [esp + 2]
lea esp, [esp + 0x40]
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1003c1a2
jae 0x1003c0f5
sbb eax, 0x996a0f9f
adc byte [esi], ah
mov eax, dword [0x64a35031]
dec ecx
rcl dword [ecx + 0x30], 0xc3
jo 0x1003c1c7
xor al, 0xaa
int 0x3c
cli
or dword [edi], 0xd209fa9f
outsd dx, dword [esi]
out 0x74, al
adc ebp, esi
pop eax
add bl, byte [esi]
invalid