joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406460
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f5d0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4575e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
test edx, edx
je 0x4064e9
mov eax, edx
lea esi, [eax + 2]
jmp 0x4064a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4064a0
sub eax, esi
sar eax, 1
je 0x4064e9
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x14], eax
cmp eax, 0x50
je 0x4064cb
cmp eax, 0xb7
jne 0x4064d0
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a2c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.0042cb20
push 0xffffffffffffffff
push 0x43f330
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4575e0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x14], esi
push 0x800
push esi
lea eax, [ebp]
push eax
call fcn.0042a280
add esp, 0xc
mov dword [ebp - 4], esi
push str.__Get_Required_Directory_Paths__
mov ecx, 0x45c218
call fcn.004055f0
add esp, 4
lea ecx, [ebp]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40a402
lea edx, [ebp + 0x800]
push edx
push esi
push str.7zipTemp
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40a393
push str.Get_Temp_File_Name_fail__
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, 0x45c218
call fcn.004054b0
push str.7zipTemp
lea ecx, [ebp]
push ecx
push str._s_s000
lea edx, [ebp + 0x800]
call fcn.004052a0
add esp, 0x10
push 0x2e
lea edx, [ebp + 0x800]
push edx
call fcn.00429887
add esp, 8
cmp eax, esi
je 0x40a3ab
mov word [eax], si
lea eax, [ebp + 0x800]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a3b4
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 0x7fe], 0x5c
jne 0x40a3ee
lea eax, [ebp + 0x800]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a3d7
sub eax, edx
sar eax, 1
mov word [ebp + eax*2 + 0x7fe], si
lea eax, [ebp + 0x800]
push eax
push 0x400
push edi
call fcn.0042909f
jmp 0x40a41b
push 0x800
push esi
lea ecx, [ebp + 0x800]
push ecx
call fcn.0042a280
mov dword [ebp - 0x14], 3
add esp, 0xc
lea edx, [ebp + 0x800]
push edx
push str.Temparary_Directory_Path_:___s_
mov ecx, 0x45c218
call fcn.004055f0
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0042955b
add ebp, 0x1004
mov esp, ebp
pop ebp
ret
Function at 0x40ad90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f070
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4575e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov esi, edx
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x40aed4
cmp ebx, edi
je 0x40aed4
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40ade3
sub eax, edx
sar eax, 1
je 0x40aed4
cmp dword [ebp + 0xc], edi
je 0x40aed4
cmp dword [ebp + 0x10], edi
je 0x40aed4
cmp esi, edi
je 0x40ae51
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40ae13
sub eax, edx
sar eax, 1
je 0x40ae51
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push esi
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x40ae57
mov dword [ebp - 0x24], eax
push 0x4520b8
lea edx, [ebp - 0x24]
push edx
call fcn.0042c6a6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040da02
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, edi
jne 0x40ae81
mov dword [ebp - 0x28], 0xe
push 0x4520b8
lea edx, [ebp - 0x28]
push edx
call fcn.0042c6a6
lea eax, [ebp + 0x10]
push eax
push esi
lea ecx, [ebp - 0x1c]
push ecx
push edi
push ebx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0x14]
je 0x40aeb6
mov dword [ebp - 0x2c], 0x57
push 0x4520b8
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0042c6a6
mov eax, dword [ebp + 0x10]
push eax
push esi
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00429241
add esp, 0x10
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
jmp 0x40af12
mov dword [ebp - 0x30], 0x57
push 0x4520b8
lea eax, [ebp - 0x30]
push eax
call fcn.0042c6a6
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, 0x40af10
ret
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x40af25
cmp eax, dword [ebp + 8]
je 0x40af25
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
cmp eax, edi
je 0x40af35
push eax
call fcn.0040d9fd
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eb85
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x43df93
call fcn.0042a8aa
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0040e34b
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x40ebd0
call fcn.0040e34b
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x40ebe1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x40ebee
or eax, 0xffffffff
jmp 0x40ed4a
mov ecx, esi
call fcn.0040e6aa
mov dword [ebp - 0x14], eax
call fcn.004159be
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x40ec6c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x40ec6c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40ec6c
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0040e539
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x40ec6c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x40ec6c
mov ecx, ebx
call fcn.00418969
test eax, eax
je 0x40ec6c
push 0
mov ecx, ebx
call fcn.00418984
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.00417323
push dword [ebp - 0x14]
call fcn.00415916
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0040e98d
xor edi, edi
cmp eax, edi
je 0x40ecc9
test byte [esi + 0x3c], 0x10
je 0x40ecb3
push 4
pop edi
mov ecx, esi
call fcn.00418850
test ax, 0x100
je 0x40eca9
push 5
pop edi
push edi
mov ecx, esi
call fcn.004154ac
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x40ecc9
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00418b57
or dword [ebp - 4], 0xffffffff
jmp 0x40ecf4
cmp dword [ebp - 0x28], edi
je 0x40ed02
push 1
mov ecx, ebx
call fcn.00418984
cmp dword [ebp - 0x2c], edi
je 0x40ed12
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x40ed2b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x40ed2b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0040e6e4
cmp dword [esi + 0x58], edi
je 0x40ed47
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0042a94f
ret
Function at 0x40f3fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4575e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x40f439
push 0x445418
push 4
push eax
call fcn.0042909f
push eax
call fcn.00401820
add esp, 0x10
jmp 0x40f44b
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40f4b6
push edi
call fcn.0042ad0a
mov edi, dword [eax]
call fcn.0042ad0a
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00429868
add esp, 0x18
mov ebx, eax
call fcn.0042ad0a
cmp dword [eax], 0
je 0x40f496
call fcn.0042ad0a
push dword [eax]
call fcn.0040f36c
pop ecx
jmp 0x40f49d
call fcn.0042ad0a
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x40f4b6
cmp ebx, esi
jae 0x40f4b6
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x40f4b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042955b
leave
ret
Function at 0x4127ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x412832
call fcn.0040e34b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412832
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x412875
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x41285e
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41285e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x412872
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41843d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x418480
call fcn.0040e34b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x418480
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41849b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00417ff7
test ebx, ebx
mov esi, eax
je 0x418499
test edi, edi
je 0x418499
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4198d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4198fe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41991c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041983a
jmp 0x41991c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41991c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0041983a
test edi, edi
mov eax, edi
jne 0x419906
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x45a810]
test ecx, ecx
je 0x4199df
jmp 0x4198cf
ret 8

Function at 0x42955b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4575e0]
jne 0x429565
repz ret
jmp fcn.00430235
Function at 0x42daf7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x457770]
je 0x42db12
inc edi
cmp edi, 0x17
jb 0x42db03
cmp edi, 0x17
jae 0x42dc92
push ebp
push 3
call fcn.00436440
cmp eax, 1
pop ecx
je 0x42dc5e
push 3
call fcn.00436440
test eax, eax
pop ecx
jne 0x42db46
cmp dword [0x4575c0], 1
je 0x42dc5e
cmp ebx, 0xfc
je 0x42dc91
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x45ab70
push ebp
call fcn.004363db
add esp, 0xc
test eax, eax
je 0x42db7c
push esi
push esi
push esi
push esi
push esi
call fcn.0042ecf0
add esp, 0x14
push 0x104
mov esi, 0x45ab89
push esi
push 0
mov byte [0x45ac8d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42dbc0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004363db
add esp, 0xc
test eax, eax
je 0x42dbc0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042ecf0
add esp, 0x14
push esi
call fcn.00436350
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42dc05
push esi
call fcn.00436350
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45ae84
push 0x448434
sub ecx, eax
push ecx
push eax
call fcn.00429bd0
add esp, 0x14
test eax, eax
je 0x42dc05
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0042ecf0
add esp, 0x14
jmp 0x42dc07
xor esi, esi
push 0x448430
push ebx
push ebp
call fcn.004362df
add esp, 0xc
test eax, eax
je 0x42dc27
push esi
push esi
push esi
push esi
push esi
call fcn.0042ecf0
add esp, 0x14
push dword [edi*8 + 0x457774]
push ebx
push ebp
call fcn.004362df
add esp, 0xc
test eax, eax
je 0x42dc49
push esi
push esi
push esi
push esi
push esi
call fcn.0042ecf0
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00436122
add esp, 0xc
jmp 0x42dc91
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42dc91
cmp ebp, 0xffffffff
je 0x42dc91
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x457774]
push dword [esi]
call fcn.00436350
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x436122
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042e6bb
xor ebx, ebx
cmp dword [0x45b670], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4361f8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4362d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4362d8
push eax
call fcn.0042e64d
mov dword [esp], 0x44874c
push edi
mov dword [0x45b670], eax
call esi
push eax
call fcn.0042e64d
mov dword [esp], 0x448738
push edi
mov dword [0x45b674], eax
call esi
push eax
call fcn.0042e64d
mov dword [0x45b678], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042aa5c
test eax, eax
pop ecx
pop ecx
je 0x4361c6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042ecf0
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4361f8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042e64d
cmp eax, ebx
pop ecx
mov dword [0x45b680], eax
je 0x4361f8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042e64d
pop ecx
mov dword [0x45b67c], eax
mov eax, dword [0x45b67c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43627d
cmp dword [0x45b680], ecx
je 0x43627d
push eax
call fcn.0042e6c4
push dword [0x45b680]
mov esi, eax
call fcn.0042e6c4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43627d
cmp edi, ebx
je 0x43627d
call esi
cmp eax, ebx
je 0x43624a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43624a
test byte [ebp - 0x18], 1
jne 0x43627d
lea eax, [ebp - 0x10]
push eax
call fcn.0042aa93
test eax, eax
pop ecx
je 0x436265
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042ecf0
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x436274
or dword [ebp + 0x10], 0x200000
jmp 0x4362b8
or dword [ebp + 0x10], 0x40000
jmp 0x4362b8
mov eax, dword [0x45b674]
cmp eax, dword [ebp - 8]
je 0x4362b8
push eax
call fcn.0042e6c4
cmp eax, ebx
pop ecx
je 0x4362b8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4362b8
mov eax, dword [0x45b678]
cmp eax, dword [ebp - 8]
je 0x4362b8
push eax
call fcn.0042e6c4
cmp eax, ebx
pop ecx
je 0x4362b8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45b670]
call fcn.0042e6c4
cmp eax, ebx
pop ecx
je 0x4362d8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4362da
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43dac3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4575e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043da58
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042a280
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43db12
cmp dword [ebp - 0x1c], 5
jb 0x43db2a
jmp 0x43db26
cmp dword [ebp - 0x10], 1
jne 0x43db2a
cmp dword [ebp - 0x1c], 4
ja 0x43db26
jne 0x43db2a
cmp dword [ebp - 0x18], 0
jbe 0x43db2a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44a06c
call fcn.0043d949
test eax, eax
jge 0x43db4b
mov byte [0x45c440], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042955b
add ebp, 0x78
leave
ret

Function at 0x4635cf
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41d4d8
call fcn.0047afc4
push ecx
push ebx
push esi
mov esi, ecx
push 4
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.00463396
mov dword [ebx], 0x420480
xor ebx, ebx
mov dword [esi + 0x28], 4
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], 0x420498
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], 1
call fcn.004636d3
lea ecx, [esi + 0x80]
mov byte [esi + 0x7c], bl
push 3
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0x90]
mov byte [esi + 0x8c], bl
mov byte [esi + 0x8d], bl
push 3
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0xa0]
mov byte [esi + 0x9c], bl
mov byte [esi + 0x9d], bl
mov byte [esi + 0x9e], bl
push 3
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0xac]
push 3
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xb8]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 8
mov dword [eax], 0x420490
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4636d3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41d518
call fcn.0047afc4
push ecx
push ebx
push esi
push edi
push 3
mov esi, ecx
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0x24]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], bl
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0045fca2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x46ea0b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41e67c
call fcn.0047afc4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004617bd
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004617bd
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004617bd
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.004617bd
mov al, byte [edi + 0x30]
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], al
lea eax, [edi + 0x34]
push eax
mov byte [ebp - 4], 3
call fcn.004617bd
add edi, 0x40
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 4
call fcn.004617bd
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x473dca
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x473df7
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x428820]
xor eax, edi
inc esi
cmp esi, edx
jb 0x473dd6
pop edi
pop ebx
not eax
pop esi
ret