joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001752
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb18
mov eax, dword [0x1003018]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.WS2_32.dll_recv]
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x80c], 2
inc esi
mov ebx, 0x800
jmp 0x1001792
xor ecx, ecx
cmp dword [ebp - 0x808], ecx
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0xb18], ecx
mov dword [ebp - 0xa14], ecx
jne 0x10017c9
mov eax, dword [0x1003004]
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x910], esi
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa14], esi
cmp dword [ebp - 0x80c], 2
jne 0x100184b
cmp dword [ebp - 0x910], ecx
mov eax, dword [0x1003008]
jbe 0x10017f1
cmp dword [ebp + ecx*4 - 0x90c], eax
je 0x10017f1
inc ecx
cmp ecx, dword [ebp - 0x910]
jb 0x10017df
cmp ecx, dword [ebp - 0x910]
jne 0x100180f
cmp dword [ebp - 0x910], 0x40
jae 0x100180f
mov dword [ebp + ecx*4 - 0x90c], eax
inc dword [ebp - 0x910]
xor ecx, ecx
cmp dword [ebp - 0xa14], ecx
jbe 0x100182b
cmp dword [ebp + ecx*4 - 0xa10], eax
je 0x100182b
inc ecx
cmp ecx, dword [ebp - 0xa14]
jb 0x1001819
cmp ecx, dword [ebp - 0xa14]
jne 0x1001849
cmp dword [ebp - 0xa14], 0x40
jae 0x1001849
mov dword [ebp + ecx*4 - 0xa10], eax
inc dword [ebp - 0xa14]
xor ecx, ecx
push ecx
lea eax, [ebp - 0xa14]
push eax
lea eax, [ebp - 0xb18]
push eax
lea eax, [ebp - 0x910]
push eax
push 2
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x1001968
lea eax, [ebp - 0x910]
push eax
push dword [0x1003004]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10018b1
push 0
push ebx
lea eax, [ebp - 0x804]
push eax
push dword [0x1003004]
call edi
cmp eax, 0xffffffff
je 0x100197c
test eax, eax
je 0x1001919
push eax
lea eax, [ebp - 0x804]
push eax
push esi
jmp 0x10018f0
lea eax, [ebp - 0x910]
push eax
push dword [0x1003008]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1001903
push 0
push ebx
lea eax, [ebp - 0x804]
push eax
push dword [0x1003008]
call edi
cmp eax, 0xffffffff
je 0x100197c
test eax, eax
je 0x10018fb
push eax
lea eax, [ebp - 0x804]
push eax
push 2
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
jmp 0x100194f
cmp dword [ebp + 8], 0
jne 0x100194f
jmp 0x1001949
lea eax, [ebp - 0xa14]
push eax
push dword [0x1003004]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1001927
cmp dword [ebp + 8], 0
mov dword [ebp - 0x808], esi
je 0x100194f
jmp 0x1001949
lea eax, [ebp - 0xa14]
push eax
push dword [0x1003008]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100194f
cmp dword [ebp + 8], 0
je 0x1001949
mov dword [ebp - 0x808], esi
mov dword [ebp - 0x80c], esi
mov eax, dword [ebp - 0x80c]
cmp dword [ebp - 0x808], eax
jne 0x1001790
push 0
call fcn.01001589
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3ef
call fcn.01001fce
push esi
jmp 0x1001963
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3f0
jmp 0x1001974
Function at 0x10a90144
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10a9014e
pushal
call 0x10a90154
pop ebp
sub ebp, 0x10
sub ebp, 0xa90144
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10a90178
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10a90181
add ch, al
mov esp, 0x44b839d9
mov eax, 0xa90144
add eax, ebp
add eax, 0x63
mov ecx, 0x5c3
add dword [ecx - 0x7e3afd00], ebp
shl byte [ebx], 0
add byte [ecx + 0x5c3], bh
mov edx, 0x25e8e35b
xor byte [eax], dl
inc eax
dec ecx
jne 0x10a90198
jmp 0x10a901ab
rcl byte [esi + 0x5b67d2d0]
pop ebx
pop ebx
ficomp dword [edx + 0x5b5b5ba3]
pop eax
xchg esi, eax
jecxz 0x10a9021a
pop ebx
pop ebx
pop ebx
loope 0x10a90235
pop ebx
pop ebx
pop ebx
lodsb al, byte [esi]
mov ecx, 0xdad09358
push edi
pop ebx
pop ebx
pop ebx
pop eax
sahf
salc
aas
jg 0x10a9017c
rcr byte [edi + 0x7f], cl
salc
aas
jg 0x10a90183
rcr byte [edi + 0x7f], cl
xor esi, dword [edi - 0x73]
jns 0x10a9023f
xor ecx, dword [ebp + 0x70]
fstp qword [ebx + 0x5a]
pop ebx
pop edx
ja 0x10a9026b
xor edx, eax
xchg edi, eax
stosb byte es:[edi], al
lds esi, [ebx + 0x5b5b5b5e]
mov dl, 0x75
pop ebx
pop ebx
pop ebx
push cs
sal byte [edi + 0x5b53ded0], 1
pop ebx
pop ebx
ror dh, 1
push edi
pop ebx
pop ebx
pop ebx
rcl dh, 1
dec ebx
pop ebx
pop ebx
pop ebx
lcall 0x99d8, 0x596a59b2
pop edi
adc dl, byte [esi + ebx*8 - 0x51]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
sal byte [edi + 0x7f], 1
fisubr word [edi - 0x2f5b5b5c]
ja 0x10a902a1
salc
aas
jg 0x10a90285
cdq
push edi
pop ebx
rcl bh, 1
jg 0x10a9028c
pop ebx
pop ebx
pop ebx
xor esi, dword [edi - 0x73]
jns 0x10a90290
xor ecx, dword [ebp + 0x70]
fstp qword [ebx + 0x5a]
ja 0x10a902bc
salc
aas
jg 0x10a901e8
rcl byte [edi + 0x7f], cl
mov bl, 0x5e
pop ebx
pop ebx
pop ebx
mov dl, 0x1a
pop ecx
pop ebx
pop ebx
push cs
salc
aaa
jg 0x10a902ae
movsb byte es:[edi], byte [esi]
push edi
movsb byte es:[edi], byte [esi]
push ebx
mov bl, 0x29
pop ebx
pop ebx
pop ebx
shl dh, 1
push ebx
pop ebx
pop ebx
pop ebx
fisubr dword [edx - 0x14efc44e]
fisubr dword [edx - 0x14efc44e]
stosb byte es:[edi], al
mov dl, 0x3b
adc bl, ch
push 0xd8896892
mov bl, 0x5e
adc edx, dword [edi + ebx*8 + 0x15]
pop ebx
pop ebx
pop ebx
push esp
rcl dword [ebx], cl
pop ebx
pop ebx
pop ebx
cmp eax, 0xdb6247d0
mov al, byte [0x41df54b3]
pop ebx
rol byte [edi + 0x62], 1
invalid
fild word [ecx + 0x5b]
pop ebx
pop ebx
invalid
dec esi
pop ebx
pop ebx
pop ebx
sbb dh, byte [edx - 0x5b5b5b69]
jb 0x10a902c4
bound ebx, qword [edx - 0x28]
lcall 0xe6b2, 0x5fb3d85e
pop edx
fcomp dword [edx + 0x5fb3d85e]
mov dl, 0xe6
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
jb 0x10a902cb
bound ebx, qword [ecx - 0x28]
lcall 0xb3d8, 0x5fb1d85d
pop esi
mov dl, 0xf0
movsb byte es:[edi], byte [esi]
fdiv dword [ebx - 0x5b0f4da2]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
push es
cdq
push edi
pop ebx
push cs
sal byte [edi - 0x2ff1f3f3], 1
push edi
shl byte [esi], 1
push ebx
cmpsd dword [esi], dword es:[edi]
jmp 0xeb06d4bd
Function at 0x4011a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4011f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011e0
cmp esi, eax
jb 0x4011fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4018a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x4483d0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
lea edx, [esp]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4018c0
lea eax, [esp]
push 0x5c
push eax
call fcn.00421ec0
add esp, 8
push 0
lea ecx, [esp + 4]
push ecx
push 0
mov byte [eax], 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x401913
cmp eax, 0x50
je 0x401913
cmp eax, 0xb7
je 0x401913
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00420b57
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
mov eax, 1
call fcn.00420b57
add esp, 0x108
ret
Function at 0x401930
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x4483d0]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
push 0x103
lea eax, [esp + 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x20]
push 0x43ea1c
push ecx
call fcn.00421768
mov esi, eax
add esp, 8
test esi, esi
jne 0x401985
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00420b57
add esp, 0x124
ret
push ebx
push 2
push 0
push esi
call fcn.0042217a
push esi
call fcn.00422085
push 0
push 0
push esi
mov ebx, eax
call fcn.0042217a
add esp, 0x1c
cmp ebx, 0xd1e28
jl 0x401aac
push 0
lea edx, [ebx - 0x28]
push edx
push esi
call fcn.0042217a
xor eax, eax
push esi
push 8
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push 1
push eax
call fcn.00421c3a
lea ecx, [esp + 0x28]
push ecx
call fcn.004211b1
mov ecx, eax
lea edx, [ecx + 0xd1e28]
add esp, 0x20
cmp ebx, edx
mov dword [esp + 8], ecx
jl 0x401aac
and eax, 0x8000001f
jns 0x401a13
dec eax
or eax, 0xffffffe0
inc eax
jne 0x401aac
mov eax, ecx
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
test eax, eax
jle 0x401a80
push ebp
push edi
mov edi, 0xffffffb8
mov ebp, eax
push 2
push edi
push esi
call fcn.0042217a
push esi
xor eax, eax
push 9
lea ecx, [esp + 0x28]
push 1
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call fcn.00421c3a
lea edx, [esp + 0x30]
push edx
call fcn.004211b1
add esp, 0x20
sub ebx, eax
sub edi, 0x20
sub ebp, 1
jne 0x401a31
mov ecx, dword [esp + 0x10]
pop edi
pop ebp
add ecx, 0x28
cmp ebx, ecx
jne 0x401aac
push esi
call fcn.00422323
add esp, 4
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00420b57
add esp, 0x124
ret
push esi
call fcn.00422323
mov ecx, dword [esp + 0x12c]
add esp, 4
pop ebx
pop esi
xor ecx, esp
xor eax, eax
call fcn.00420b57
add esp, 0x124
ret

Function at 0x401ad0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x124
mov eax, dword [0x4483d0]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
push 0x103
lea eax, [esp + 0x24]
push eax
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x20]
push 0x43ea1c
push ecx
call fcn.00421768
mov esi, eax
add esp, 8
test esi, esi
jne 0x401b1e
push str.ERROR_SN
jmp 0x401b5f
push 2
push 0xffffffffffffffe0
push esi
call fcn.0042217a
push esi
xor eax, eax
push 0x10
lea edx, [esp + 0x1c]
push 1
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.00421c3a
push esi
call fcn.00422323
add esp, 0x20
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.00401270
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
mov eax, edi
call fcn.00420b57
add esp, 0x124
ret
Function at 0x4028c0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows

Disassembly:
sub esp, 0x178
mov eax, dword [0x4483d0]
xor eax, esp
mov dword [esp + 0x170], eax
push esi
push 0
lea eax, [esp + 0x10]
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xc
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x40299f
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00423af0
mov eax, dword [esp + 0x10]
push 0x44c368
push edi
push esi
lea ecx, [esp + 0x88]
push str.__s__x__y___s___o_s
push ecx
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x74], 0x101
mov word [esp + 0x78], 0
mov dword [esp + 0x88], eax
mov dword [esp + 0x84], eax
call fcn.00420bc1
add esp, 0x20
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [esp + 0x90]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4029b7
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 4]
push eax
call esi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.00420b57
add esp, 0x178
ret
mov ecx, dword [esp + 8]
add dword [0x44c58c], 1
push 0
push 0
push 0
push 0
push ecx
push 0x402700
call fcn.004078b3
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push edx
push 0x401b80
call fcn.004078b3
mov ecx, dword [esp + 0x174]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00420b57
add esp, 0x178
ret

Function at 0x402a10
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
push eax
push 0x20
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402a7e
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push esi
push esi
push 0x10
lea edx, [esp + 0x14]
push edx
push esi
push eax
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push ecx
add esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x402a90
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
sub esp, 0x110
mov eax, dword [0x4483d0]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [str._unknown_]
mov ecx, dword [0x43eae8]
mov dx, word [0x43eaec]
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push 0xfa
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1e]
push 0
push eax
mov dword [esp + 0x20], ecx
mov word [esp + 0x24], dx
call fcn.00423af0
add esp, 0xc
push ebp
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x402b58
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x10]
push edx
push ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x402b58
mov ecx, dword [esp + 8]
push esi
push edi
push 0x104
lea eax, [esp + 0x1c]
push eax
push ecx
push ebx
call sub.PSAPI.DLL_GetModuleBaseNameA
lea edi, [esp + 0x18]
mov esi, str.7z.exe
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
jne 0x402b58
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x402b58
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x114]
pop ebp
pop ebx
xor ecx, esp
call fcn.00420b57
add esp, 0x110
ret

Function at 0x402b80
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1004
call fcn.00425b90
lea eax, [esp]
push eax
push 0x1000
lea ecx, [esp + 0xc]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x402bcc
push esi
push edi
call fcn.00402a10
mov edi, dword [esp + 8]
shr edi, 2
mov esi, 0
je 0x402bca
mov edx, dword [esp + esi*4 + 0xc]
push edx
call fcn.00402a90
add esi, 1
add esp, 4
cmp esi, edi
jb 0x402bb6
pop edi
pop esi
add esp, 0x1004
ret
Function at 0x408a48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x408a8e
call fcn.00406a98
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x408a8e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x408ad1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x408aba
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x408aba
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x408ace
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40e0ee
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40e127
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00405991
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0040596c
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x40fcaa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40fced
call fcn.00406a98
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40fced
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40fd08
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040f861
test ebx, ebx
mov esi, eax
je 0x40fd06
test edi, edi
je 0x40fd06
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x420b57
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4483d0]
jne 0x420b61
repz ret
jmp fcn.0042673f
Function at 0x43191e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042904f
xor ebx, ebx
cmp dword [0x44c27c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4319f3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x43195e
xor eax, eax
jmp 0x431ab7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43d110
push edi
call esi
cmp eax, ebx
je 0x431957
push eax
call fcn.00428fec
mov dword [esp], 0x43d100
push edi
mov dword [0x44c27c], eax
call esi
push eax
call fcn.00428fec
mov dword [esp], 0x43d0ec
push edi
mov dword [0x44c280], eax
call esi
push eax
call fcn.00428fec
mov dword [0x44c284], eax
lea eax, [ebp - 8]
push eax
call fcn.00423c13
test eax, eax
pop ecx
pop ecx
je 0x4319c1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00422775
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4319f3
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00428fec
cmp eax, ebx
pop ecx
mov dword [0x44c28c], eax
je 0x4319f3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00428fec
pop ecx
mov dword [0x44c288], eax
mov eax, dword [0x44c288]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x431a6c
cmp dword [0x44c28c], esi
je 0x431a6c
push eax
call fcn.00429058
pop ecx
call eax
cmp eax, ebx
je 0x431a39
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x44c28c]
call fcn.00429058
pop ecx
call eax
test eax, eax
je 0x431a39
test byte [ebp - 0x18], 1
jne 0x431a6c
lea eax, [ebp - 0xc]
push eax
call fcn.00423c4a
test eax, eax
pop ecx
je 0x431a54
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00422775
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x431a63
or dword [ebp + 0x10], 0x200000
jmp 0x431a9d
or dword [ebp + 0x10], 0x40000
jmp 0x431a9d
mov eax, dword [0x44c280]
cmp eax, esi
je 0x431a9d
push eax
call fcn.00429058
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x431a9d
mov eax, dword [0x44c284]
cmp eax, esi
je 0x431a9d
push dword [ebp - 4]
push eax
call fcn.00429058
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x44c27c]
call fcn.00429058
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4363ac
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4483d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00436341
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00423af0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4363fb
cmp dword [ebp - 0x1c], 5
jb 0x436413
jmp 0x43640f
cmp dword [ebp - 0x10], 1
jne 0x436413
cmp dword [ebp - 0x1c], 4
ja 0x43640f
jne 0x436413
cmp dword [ebp - 0x18], 0
jbe 0x436413
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43e9ec
call fcn.00436232
test eax, eax
jge 0x436434
mov byte [0x44c63c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420b57
add ebp, 0x78
leave
ret
Function at 0x100085c7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10008609
push 6
call fcn.1001283c
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push str.CallWindowProcA
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10008633
push 6
call fcn.1001283c
add esp, 4
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.100086d5
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [0x10037686]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10008680
push 6
call fcn.1001283c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x100086b9
mov dword [ebp - 0x10], esp
push 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100086b4
push 6
call fcn.1001283c
add esp, 4
call fcn.1000880d
call fcn.1000880d
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x100086cf
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000879c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x100087bd
mov dword [ebp + 8], 0x400
mov eax, dword [ebp + 8]
mov dword [0x1003768e], eax
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
push dword [0x10037686]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100087fc
push 6
call fcn.1001283c
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10008807
mov esp, ebp
pop ebp
ret 8

Function at 0x10012fa0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10027e1d
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1001300a
push esi
lea edi, [eax + 0x400]
call fcn.10027e46
push edi
call fcn.10027e1d
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x10012fda
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10013026
push ecx
push esi
call fcn.10015340
add esp, 8
mov ebx, eax
push esi
call fcn.10027e46
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret