joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440e30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440e63
push esi
call fcn.00443f20
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x440e5c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x440ee9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x440ed2
mov eax, dword [esi + 8]
test eax, eax
je 0x440e87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x440ece
cmp eax, 2
je 0x440ed2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x440e7a
cmp eax, 3
je 0x440ead
cmp eax, 1
jne 0x440e7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x440e7a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x440e7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00440f10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x440ef8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00440f10
add esp, 4
pop esi
ret

Function at 0x46874c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x468784
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00466803
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004667db
jmp 0x468790
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x469e3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x469e80
call fcn.0046fb2d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x469e80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x469e77
xor eax, eax
jmp 0x469e88
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00469e8e
pop edi
pop esi
pop ebx
ret 4

Function at 0x47005d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47008b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4700a9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046ffc3
jmp 0x4700a9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4700a9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046ffc3
test edi, edi
mov eax, edi
jne 0x470093
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10a3c43
Capabilities:
Get user security identifier

Disassembly:
push pe_nt_image_headers32
mov eax, 0x10dfdd3
call fcn.010a0bbf
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe0], eax
call fcn.0102df27
test ebx, ebx
je 0x10a3dcc
and dword [ebp - 0xd8], 0
and dword [ebp - 4], 0
mov esi, 0x80
push esi
lea ecx, [ebp - 0xd8]
call fcn.010a2554
mov ecx, dword [ebp - 0xd8]
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push ecx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0xe0]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xdc], 0x44
mov dword [ebp - 0xe8], esi
call ebx
test eax, eax
jne 0x10a3d49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10a3dac
cmp dword [ebp - 0xdc], 0x44
jbe 0x10a3cf7
push 0x80004005
call fcn.01027b0b
mov eax, dword [ebp - 0xe8]
cmp eax, esi
jbe 0x10a3d1b
add eax, eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.010a2578
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe4], eax
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xe4]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xe0]
call ebx
test eax, eax
je 0x10a3dac
lea eax, [ebp - 0x54]
push eax
lea eax, [edi + 4]
push eax
push dword [ebp - 0xdc]
mov byte [edi + 0x48], 1
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x10a3dac
push dword [ebp - 0xe4]
lea ecx, [edi + 0x54]
call fcn.01028b05
push dword [ebp - 0xec]
lea ecx, [edi + 0x50]
call fcn.01028b05
push dword [ebp - 0xe0]
lea ecx, [edi + 0x5c]
call fcn.01028b05
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x10a3da8
lea ecx, [ebp - 0xd8]
call fcn.010a2170
mov al, 1
jmp 0x10a3dce
mov ecx, edi
call fcn.0102df27
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x10a3dcc
lea ecx, [ebp - 0xd8]
call fcn.010a2170
xor al, al
call fcn.010a0c51
ret 8
Function at 0x40be90
Capabilities:
Resume thread

Disassembly:
mov eax, dword [0x412554]
test eax, eax
je 0x40beaa
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x412554], 0
mov esi, dword [0x412540]
xor edi, edi
test esi, esi
je 0x40bee9
mov dword [0x412540], edi
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
je 0x40bed5
mov ecx, dword [0x412548]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x40beef
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x412548]
cmp eax, edi
je 0x40bf01
push eax
call esi
mov dword [0x412548], edi
mov eax, dword [0x41255c]
cmp eax, edi
je 0x40bf13
push eax
call esi
mov dword [0x41255c], edi
mov eax, dword [0x412544]
cmp eax, edi
je 0x40bf25
push eax
call esi
mov dword [0x412544], edi
mov eax, dword [0x412588]
cmp eax, edi
je 0x40bf53
cmp dword [0x41258c], 1
jne 0x40bf44
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [0x41258c], edi
mov edx, dword [0x412588]
push edx
call esi
mov dword [0x412588], edi
mov eax, dword [0x412584]
cmp eax, edi
je 0x40bf65
push eax
call esi
mov dword [0x412584], edi
mov ebx, dword [ebp - 0x3c]
cmp ebx, edi
je 0x40bf76
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call esi
ret
Function at 0x401210
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x208
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push str.USBKeyTools.exe
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push str.cmd__C__s_tskill.exe__s
push ecx
stosb byte es:[edi], al
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0xc
lea edx, [esp + 0xc]
push 0
push edx
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
push str._HDZB_CommSrv_V2.0_for_CCB_
rep stosd dword es:[edi], eax
lea eax, [esp + 0x114]
lea ecx, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x18]
push str.cmd__C__s_sc.exe_create_HZ_CommSrv_binPath__sHZ_CommSrv.exe_type_own_type_interact_start_auto_DisplayName__s
push edx
call esi
add esp, 0x14
lea eax, [esp + 0xc]
push 0
push eax
call ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x110]
push ecx
push str.cmd__C__s_sc.exe_start_HZ_CommSrv
push edx
call esi
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call ebp
pop edi
pop esi
pop ebp
add esp, 0x208
ret
Function at 0x4013f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401409
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401444
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401440
lea ebx, [ebx]
cmp esi, eax
jae 0x401444
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401430
cmp esi, eax
jb 0x40144a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403ca0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x43595e
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x44a768]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
push edi
mov eax, dword [0x44a768]
xor eax, esp
push eax
lea eax, [esp + 0x1ac]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1bc]
xor ebx, ebx
mov dword [esp + 0x14], ebx
push str.0.0.0.0
lea ecx, [esp + 0x14]
mov dword [esp + 0x1b8], ebx
call fcn.00402870
lea eax, [esp + 0x18]
push eax
push 0x202
mov byte [esp + 0x1bc], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
je 0x403d5a
push str.0.0.0.0
mov ecx, esi
call fcn.00402870
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x1b4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403d4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c0]
add eax, 0xfffffff0
jmp 0x403dfd
mov edi, dword [esp + 0x1c0]
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x403dbe
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0x18]
call fcn.00402870
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1b8], 2
call fcn.00402000
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x1b4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403dbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00401a00
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x1b4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403dfa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x1b4], 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00421b0b
add esp, 0x1a8
ret
Function at 0x40c587
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40c5ca
call fcn.004180f4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40c5ca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40c5e5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040c13e
test ebx, ebx
mov esi, eax
je 0x40c5e3
test edi, edi
je 0x40c5e3
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40ca72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40cab8
call fcn.004180f4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40cab8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40cafb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40cae4
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40cae4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40caf8
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x419a48
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x419a71
call fcn.004180f4
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x419a94
push eax
push dword [esi + 4]
call fcn.004199d3
push esi
push eax
mov ecx, 0x44d7a8
call fcn.004196ad
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x41ed19
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x41ed22
xor eax, eax
jmp 0x41ed8b
cmp dword [esp + 8], 0
jne 0x41ed2e
call fcn.0041779c
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.004254c8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x41ed69
push dword [esi + 0x10]
call fcn.0042520d
test eax, eax
pop ecx
jne 0x41ed69
mov esi, dword [esi + 0xc]
call fcn.004231c4
push esi
push dword [eax]
push 1
call fcn.0041fb78
push dword [esi + 0x10]
call fcn.0042523c
test eax, eax
pop ecx
je 0x41ed88
push dword [esi + 0x10]
call fcn.00425161
push eax
call fcn.00404c40
pop ecx
pop ecx
jmp 0x41ed57
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x41ed94
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x41ed9e
call fcn.0041779c
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.004255fd
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x41edcb
mov esi, dword [esi + 0xc]
call fcn.004231c4
push esi
push dword [eax]
push 1
call fcn.0041fb78
pop esi
ret 8

Function at 0x421b0b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a768]
jne 0x421b15
repz ret
jmp fcn.0042752c
Function at 0x430a49
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00426ed5
xor ebx, ebx
cmp dword [0x44e554], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x430b1e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x430a89
xor eax, eax
jmp 0x430be2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43ed54
push edi
call esi
cmp eax, ebx
je 0x430a82
push eax
call fcn.00426e72
mov dword [esp], 0x43ed44
push edi
mov dword [0x44e554], eax
call esi
push eax
call fcn.00426e72
mov dword [esp], 0x43ed30
push edi
mov dword [0x44e558], eax
call esi
push eax
call fcn.00426e72
mov dword [0x44e55c], eax
lea eax, [ebp - 8]
push eax
call fcn.00422de6
test eax, eax
pop ecx
pop ecx
je 0x430aec
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004280f2
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x430b1e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00426e72
cmp eax, ebx
pop ecx
mov dword [0x44e564], eax
je 0x430b1e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00426e72
pop ecx
mov dword [0x44e560], eax
mov eax, dword [0x44e560]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x430b97
cmp dword [0x44e564], esi
je 0x430b97
push eax
call fcn.00426ede
pop ecx
call eax
cmp eax, ebx
je 0x430b64
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x44e564]
call fcn.00426ede
pop ecx
call eax
test eax, eax
je 0x430b64
test byte [ebp - 0x18], 1
jne 0x430b97
lea eax, [ebp - 0xc]
push eax
call fcn.00422e1d
test eax, eax
pop ecx
je 0x430b7f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004280f2
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x430b8e
or dword [ebp + 0x10], 0x200000
jmp 0x430bc8
or dword [ebp + 0x10], 0x40000
jmp 0x430bc8
mov eax, dword [0x44e558]
cmp eax, esi
je 0x430bc8
push eax
call fcn.00426ede
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x430bc8
mov eax, dword [0x44e55c]
cmp eax, esi
je 0x430bc8
push dword [ebp - 4]
push eax
call fcn.00426ede
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x44e554]
call fcn.00426ede
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435084
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44a768]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00435019
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00423200
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4350d3
cmp dword [ebp - 0x1c], 5
jb 0x4350eb
jmp 0x4350e7
cmp dword [ebp - 0x10], 1
jne 0x4350eb
cmp dword [ebp - 0x1c], 4
ja 0x4350e7
jne 0x4350eb
cmp dword [ebp - 0x18], 0
jbe 0x4350eb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43f610
call fcn.00434f0a
test eax, eax
jge 0x43510c
mov byte [0x44bc34], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00421b0b
add ebp, 0x78
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401bd7
pop dword [ebp - 0x10]
mov eax, 0x322febc0
sub eax, 0x31efcfe9
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x2eb82432
sub dword [ebp - 0x20], 0xe065dee7
mov dword [ebp - 0x1c], 0xc8a3b7ad
sub dword [ebp - 0x1c], 0x96706b68
mov dword [ebp - 0x18], 0xc0814f1b
sub dword [ebp - 0x18], 0x74350aed
mov dword [ebp - 0x14], 0x93b55b1d
sub dword [ebp - 0x14], 0x93b55b1d
lea eax, [ebp - 0x20]
push eax
mov eax, 0xfc8304ab
sub eax, 0xfc42944b
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x190cac2e
sub dword [ebp - 0x20], 0xa49a42d8
mov dword [ebp - 0x1c], 0xdf99ce98
add dword [ebp - 0x1c], 0x61d292dd
mov dword [ebp - 0x18], 0x13ba8b20
sub dword [ebp - 0x18], 0xb04b1eb4
mov dword [ebp - 0x14], 0xef977820
add dword [ebp - 0x14], 0x106887e0
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39c77
push 0
call eax
mov ecx, 0xe9d24ba1
add ecx, 0x162e0930
xor ebx, ebx
add ebx, eax
mov edi, 0x3ee231f2
add edi, 0xc15ece0e
add edi, dword [ebp - 0x10]
mov edx, 0x90ef1691
sub edx, 0xdc7532c1
sub dword [ebp - 0xc], eax
mov esi, dword [edi]
sub dword [ebp - 4], 0xd6e713e4
xor esi, edx
add dword [ebp - 8], 0x38839a23
mov dword [ebx], esi
add dword [ebp - 0xc], edx
add ebx, 0xc733c68
sub ebx, 0xc733c64
add edi, 4
loop 0x401cf6
add eax, 0x14617
xor ebx, ebx
add ebx, eax
add eax, 0x317ae93d
sub eax, 0x317ae938
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4010b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4010c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x401104
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401100
lea ebx, [ebx]
cmp esi, eax
jae 0x401104
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010f0
cmp esi, eax
jb 0x40110a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401400
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x47b518]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
test esi, esi
mov byte [esp + 4], 0xf0
mov byte [esp + 5], 0x25
mov byte [esp + 6], 0x37
mov byte [esp + 7], 0x40
mov byte [esp + 8], 0x84
mov byte [esp + 9], 0x14
mov byte [esp + 0xa], 0xc8
mov byte [esp + 0xb], 0x2a
mov byte [esp + 0xc], 0x77
mov byte [esp + 0xd], 0x47
mov byte [esp + 0xe], 0x90
mov byte [esp + 0xf], 0x94
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], 0x32
mov byte [esp + 0x12], 0xf1
mov byte [esp + 0x13], 0xdc
jle 0x401483
lea ecx, [ecx]
mov edx, eax
and edx, 0xf
mov dl, byte [esp + edx + 4]
xor byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jl 0x401470
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.0043ef93
add esp, 0x14
ret

Function at 0x40e230
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_ClearCommError]
push esi
mov esi, ecx
mov edx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jb 0x40e25b
mov eax, ecx
test eax, eax
mov dword [esp + 8], eax
jbe 0x40e2fb
mov edx, dword [esp + 0x20]
push edi
lea edi, [esi + 0x844]
push edi
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40e2f6
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebp
cmp eax, 0x3e5
jne 0x40e2dd
mov ebx, dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
mov edi, edi
mov edx, dword [esi + 4]
push 1
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x40e2f5
call ebp
cmp eax, 0x3e4
je 0x40e2a0
mov edx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ClearCommError]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
mov edx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x1c], 0
call ebx
pop ebp
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8