joyce8/EMBER2024-capa huggingface dataset:
Function at 0x700de90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700def4
cmp byte [esi + 0x10], 0
je 0x700deb2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700dee2
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700defb
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700def6
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.07003e2a
int3

Function at 0x700e170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700e1c3
cmp dword [esi + 0xc], 0
je 0x700e1be
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700e1b1
push str.stream_write_error
jmp 0x700e1c8
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.07003e2a
int3

Function at 0x343f19f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x343f6b04]
jne 0x34415a46
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34419cd8], eax
mov dword [0x34419cd4], ecx
mov dword [0x34419cd0], edx
mov dword [0x34419ccc], ebx
mov dword [0x34419cc8], esi
mov dword [0x34419cc4], edi
mov word [0x34419cf0], ss
mov word [0x34419ce4], cs
mov word [0x34419cc0], ds
mov word [0x34419cbc], es
mov word [0x34419cb8], fs
mov word [0x34419cb4], gs
pushfd
pop dword [0x34419ce8]
mov eax, dword [ebp]
mov dword [0x34419cdc], eax
mov eax, dword [ebp + 4]
mov dword [0x34419ce0], eax
lea eax, [ebp + 8]
mov dword [0x34419cec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x34419c28], 0x10001
mov eax, dword [0x34419ce0]
mov dword [0x34419bdc], eax
mov dword [0x34419bd0], 0xc0000409
mov dword [0x34419bd4], 1
mov eax, dword [0x343f6b04]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34417ca0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x34419c20], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34415b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x34419c20], 0
jne 0x34415b36
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10008843
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10008882
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008882
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008882
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10008882
cmp dword [ecx + 0x74], 0xe
jbe 0x10008882
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000b4ff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b59c
push ebx
push esi
call fcn.1000b4c8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000b45c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b549
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b59b
push edi
push eax
call fcn.1000c4ba
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b569
call fcn.10009fa4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b59a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000b45c
add esp, 0x20
test eax, eax
jne 0x1000b588
push edi
call fcn.10009fa4
jmp 0x1000b590
push ebx
call fcn.10009fa4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000b809
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013668
push 0x10013660
push str.FlsAlloc
push 0x1f
call fcn.1000b725
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b83d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10012140]
call esi
jmp 0x1000b843
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000b887
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013678
push 0x10013670
push str.FlsGetValue
push 0x21
call fcn.1000b725
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b8be
push dword [ebp + 8]
mov ecx, esi
call dword [0x10012140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000b8c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013680
push 0x10013678
push str.FlsSetValue
push 0x22
call fcn.1000b725
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b900
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10012140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10010f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x421f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4233c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x423413
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x42f098
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.00402454
push eax
call fcn.00401d5b
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4233d9
pop ebx
pop esi
pop ebp
ret

Function at 0x423416
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401f47
push 0xc
call fcn.0040626e
pop ecx
test eax, eax
je 0x42344d
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call section..bss
jmp 0x42344f
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x47ca20
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.0042339a
mov edx, 0x47ca20
add edx, 0x188
mov esi, 0x430020
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00403359
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004062ac
leave
ret
Function at 0x1000655b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi - 0x6c]
mov ecx, esi
call fcn.10008e5c
test eax, eax
jne 0x1000657b
mov eax, 0x80070005
jmp 0x100065ec
push esi
mov ecx, esi
call fcn.10008e5c
test eax, eax
js 0x100065ea
cmp dword [edi + 0x44], 0
je 0x100065ea
and dword [ebp + 8], 0
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call esi
lea eax, [ebp - 8]
push eax
call esi
push 0x14
pop ecx
call fcn.100099b8
test eax, eax
je 0x100065c7
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and dword [eax + 8], 0
mov dword [eax], vtable.CNameShowContactCardJob.0
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
jmp 0x100065c9
xor eax, eax
push eax
lea ecx, [ebp + 8]
call fcn.10008e5c
mov esi, dword [ebp + 8]
test esi, esi
je 0x100065ea
mov ecx, dword [edi + 0x44]
push esi
call fcn.10008e5c
test eax, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x10008e5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10008e6b
pop dword [ebp - 0x40]
mov eax, 0xc478ba1d
add eax, 0x4b87d44e
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x38665
push 0
mov eax, 0xbbad4738
add eax, 0x545389a4
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x488b
xor esi, esi
add esi, eax
mov edx, 0x10015200
add edx, dword [ebp - 0x40]
mov ebx, 0xe6891318
sub ebx, 0xa8c5654c
xor dword [ebp - 4], esi
mov edi, dword [edx]
xor dword [ebp - 0x14], eax
sub edi, ebx
mov dword [esi], edi
add dword [ebp - 8], esi
add esi, 4
add edx, 0x762a41b0
sub edx, 0x762a41ac
loop 0x10008ec0
add eax, 0x7f02ec5e
add eax, 0x80fe28a1
xor ebx, ebx
add ebx, eax
add eax, 0xad599c27
add eax, 0x52a663de
mov ecx, 0xee87cc4e
add ecx, 0x217833b2
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x402a90
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebx
push esi
push 0xf003f
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x402adb
push 1
push str.2345PackageStatService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x402ac4
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x402ae1
call fcn.00402c30
pop esi
pop ebx
jmp fcn.00402af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
jmp fcn.00402af0

Function at 0x402af0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4f55dc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x402b30
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00402c30
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
push esi
push 0x24
push str.2345PackageStatService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x402b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.00402c30
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
xorps xmm0, xmm0
push 1
push esi
movdqu xmmword [ebp - 0x24], xmm0
movdqu xmmword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x402bad
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
call fcn.00402c30
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], eax
je 0x402bff
nop
push dword [ebp - 0x10]
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x402bff
cmp dword [ebp - 0x24], 1
je 0x402bff
call ebx
sub eax, dword [ebp - 0x2c]
cmp eax, 0xbb8
ja 0x402bff
cmp dword [ebp - 0x24], 1
jne 0x402bc0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
call fcn.00402c30
mov ecx, dword [ebp - 4]
pop ebx
pop esi
xor ecx, ebp
pop edi
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
Function at 0x402c90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f55dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.004a1910
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402cfa
mov eax, dword [ebp - 0x114]
cmp eax, 5
jbe 0x402cef
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
jne 0x402cfa
cmp dword [ebp - 0x110], 0
ja 0x402cdf
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret

Function at 0x402d10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f55dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.004a1910
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402d6d
cmp dword [ebp - 0x114], 6
jb 0x402d6d
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
Function at 0x402dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bb529
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
push 0x18
call fcn.0049c7b6
add esp, 4
mov dword [edi + 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x38], 0
lea esi, [edi + 0x24]
mov dword [esi], 0
xor eax, eax
mov byte [esi + 4], 0
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov dword [esp + 0x14], esi
mov word [esi + 8], ax
mov byte [esp + 0x38], 2
lea ecx, [esp + 0x18]
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push 0x4d5fa4
mov byte [edi + 8], al
mov dword [edi + 0x18], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], ax
call fcn.004024a0
mov byte [esp + 0x38], 3
mov eax, dword [esi]
test eax, eax
je 0x402e8a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
mov dword [esi], 0
jne 0x402e9b
xor eax, eax
jmp 0x402ea9
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea ecx, [esi + 8]
sete al
mov byte [esi + 4], al
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x402ede
push 0xffffffffffffffff
push 0
push eax
call fcn.00401fd0
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], 8
jb 0x402ef6
push dword [esp + 0x18]
call fcn.0049c766
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x403370
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4bb638
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x4033b2
xor al, al
jmp 0x403477
add edi, 0x20
mov dword [esp + 0x14], edi
je 0x4033c8
mov eax, dword [edi]
test eax, eax
je 0x4033c8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x24], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x403452
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ebx, [esi + 4]
push 1
push ebx
call ebp
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x402f30
push 0
push 0
call fcn.0049c988
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
je 0x40343b
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x403426
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x40343b
mov bl, 1
jmp 0x403454
push 0xffffffffffffffff
push ebx
call ebp
dec eax
jne 0x40344a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.004030e0
xor bl, bl
mov dword [esp + 0x24], 0xffffffff
test edi, edi
je 0x403475
mov eax, dword [edi]
test eax, eax
je 0x40346d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x14
ret
Function at 0x4069a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4e2350
push 0x4a45c0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4f55dc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x406a09
xor eax, eax
jmp 0x406b7f
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b4a
push 1
push dword [ebp - 0x38]
call eax
test eax, eax
je 0x406b4a
push 0x4d61d0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b4a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x406b4a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b4a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x406b4a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b4a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x406b4a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b4a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x406b4a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x406b4a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x406b33
push 0
push ecx
push 1
push dword [ebp - 0x38]
call eax
test eax, eax
je 0x406b20
mov ebx, 1
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x2c], 0
je 0x406b30
jmp 0x406b4a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x38]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00406ba6
test ebx, ebx
jne 0x406b7d
test esi, esi
je 0x406b6f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x406b7d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408880
Capabilities:
Check os version

Disassembly:
sub esp, 0x10
push esi
push 0x11c
mov esi, ecx
push 0
push esi
call fcn.004a1910
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40894d
mov eax, dword [esi + 4]
cmp eax, 6
ja 0x4088bb
jne 0x40890e
cmp dword [esi + 8], 2
jb 0x40890e
lea eax, [esp + 0x10]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
lea edx, [esp + 0x10]
mov dword [esp + 0x14], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.00408d50
add esp, 8
test al, al
je 0x40890e
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.00408760
add esp, 4
test al, al
je 0x408946
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov al, 1
pop esi
add esp, 0x10
ret
xor al, al
pop esi
add esp, 0x10
ret

Function at 0x408d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x28
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
mov ebp, dword [esp + 0x34]
mov ebx, edx
push esi
push edi
push str.kernel32.dll
mov edi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x408e1a
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x408e1a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408e1a
movdqu xmm0, xmmword [str.VS_VERSION_INFO]
push eax
movdqu xmmword [esp + 0x18], xmm0
movdqu xmm0, xmmword [0x4d6638]
movdqu xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408e1a
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408e1a
cmp word [esi + 2], ax
jbe 0x408e1a
movzx eax, word [esi + 0x32]
mov ecx, dword [esp + 0x10]
mov dword [edi], eax
movzx eax, word [esi + 0x30]
mov dword [ebx], eax
movzx eax, word [esi + 0x36]
mov dword [ebp], eax
movzx eax, word [esi + 0x34]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov al, 1
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049bfa3
add esp, 0x28
ret