joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x45632b
cmp eax, 0x271
jne 0x456278
push 0
call fcn.004a134c
push eax
call fcn.004a231a
add esp, 8
call fcn.004a232c
push eax
mov ecx, esi
call fcn.00456150
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [edx*4 + 0x512e70]
xor ecx, dword [esi + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [esi + eax*4 - 4], ecx
jl 0x456280
cmp eax, 0x26f
jge 0x4562f2
lea esp, [esp]
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [edx*4 + 0x512e70]
xor ecx, dword [esi + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [esi + eax*4 - 4], ecx
jl 0x4562c0
mov eax, dword [esi]
xor eax, dword [esi + 0x9bc]
and eax, 0x7fffffff
xor eax, dword [esi + 0x9bc]
mov ecx, eax
and ecx, 1
mov edx, dword [ecx*4 + 0x512e70]
xor edx, dword [esi + 0x630]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9bc], edx
mov dword [esi + 0x9c0], 0
mov eax, dword [esi + 0x9c0]
mov ecx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret
Function at 0x456370
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x45645b
cmp eax, 0x271
jne 0x4563a8
push 0
call fcn.004a134c
push eax
call fcn.004a231a
add esp, 8
call fcn.004a232c
push eax
mov ecx, esi
call fcn.00456150
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [edx*4 + 0x512e78]
xor ecx, dword [esi + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [esi + eax*4 - 4], ecx
jl 0x4563b0
cmp eax, 0x26f
jge 0x456422
lea esp, [esp]
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [edx*4 + 0x512e78]
xor ecx, dword [esi + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [esi + eax*4 - 4], ecx
jl 0x4563f0
mov eax, dword [esi]
xor eax, dword [esi + 0x9bc]
and eax, 0x7fffffff
xor eax, dword [esi + 0x9bc]
mov ecx, eax
and ecx, 1
mov edx, dword [ecx*4 + 0x512e78]
xor edx, dword [esi + 0x630]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9bc], edx
mov dword [esi + 0x9c0], 0
mov eax, dword [esi + 0x9c0]
mov ecx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov esi, dword [esp + 8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor ecx, edx
mov eax, ecx
cmp esi, ecx
jae 0x4564a7
xor edx, edx
div esi
imul eax, esi
sub ecx, eax
mov eax, ecx
pop esi
ret 4

Function at 0x457ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d898f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x51b260]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00457cf0
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call fcn.00457cf0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.00457cf0
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.00457cf0
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 3
call fcn.00457cf0
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 4
call fcn.00457cf0
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 5
call fcn.00457cf0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x45c2d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d8b43
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51b260]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x18]
mov dword [esi], 0x4dfd1c
call fcn.00457cf0
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
call fcn.00457cf0
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
call fcn.00457cf0
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 2
call fcn.00457cf0
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 3
call fcn.00457cf0
lea ecx, [esi + 0x90]
mov byte [esp + 0x18], 4
call fcn.00457cf0
lea ecx, [esi + 0xa8]
mov byte [esp + 0x18], 5
call fcn.00457cf0
lea ecx, [esi + 0xc0]
mov byte [esp + 0x18], 6
call fcn.00457cf0
mov ecx, esi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
call fcn.0045bce0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4617c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb8
mov eax, dword [0x51b260]
xor eax, esp
mov dword [esp + 0xb4], eax
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], ax
mov eax, dword [edi + 0xa4]
xor ecx, ecx
cmp byte [eax], 0x54
jne 0x4618a1
cmp byte [eax + 1], 0x69
jne 0x4618a1
cmp byte [eax + 2], 0x6e
jne 0x4618a1
cmp byte [eax + 3], 0x6b
jne 0x4618a1
push esi
mov esi, 4
mov edx, dword [edi + 0xec]
mov dl, byte [edx + ecx]
xor byte [eax + esi], dl
mov edx, ecx
sub edx, dword [edi + 0xf0]
inc esi
neg edx
sbb edx, edx
and edx, ecx
inc edx
cmp esi, 0xe1f
mov ecx, edx
jl 0x461834
mov cl, 0x67
mov byte [eax + 1], cl
mov byte [eax + 2], cl
mov byte [eax], 0x4f
mov byte [eax + 3], 0x53
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x28]
push eax
mov ecx, edi
call fcn.004606e0
pop esi
test eax, eax
jne 0x4618d8
pop edi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0049ef0f
add esp, 0xb8
ret 4
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.00460530
test eax, eax
jne 0x4618d8
pop edi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0049ef0f
add esp, 0xb8
ret 4
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ax, word [esp + 0x1a]
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
xor eax, eax
mov edx, 1
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov word [esp + 8], dx
mov dx, word [esp + 0x24]
lea eax, [esp + 8]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0xc], ecx
mov cx, word [esp + 0x26]
mov word [esp + 0x14], dx
mov edx, dword [esp + 0x64]
mov word [esp + 0x16], cx
mov dword [esp + 0x94], 0x24
mov dword [esp + 0x98], 0x18082
mov dword [esp + 0x9c], edx
cmp eax, 1
jne 0x4619af
mov ecx, edi
call fcn.00460ab0
lea ecx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x70]
jmp 0x461a06
test eax, eax
jne 0x4619d2
mov ecx, edi
call fcn.00460b10
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [edi + 0x74]
push edx
jmp 0x461a11
cmp eax, 2
jne 0x4619f6
mov ecx, edi
call fcn.00460b40
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [edi + 0x78]
push eax
jmp 0x461a11
cmp eax, 3
jne 0x461a18
lea ecx, [esp + 0x94]
push ecx
lea ecx, [edi + 0x7c]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.00460870
mov ecx, dword [esp + 0xb8]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0049ef0f
add esp, 0xb8
ret 4
Function at 0x46a2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d92e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x51b260]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00457cf0
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call fcn.00457cf0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.00457cf0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x48e61c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x51b260]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x48e6ba
push 0x4e339c
push 4
push eax
call fcn.0049f908
push eax
call fcn.004099f0
add esp, 0x10
push ebx
push edi
call fcn.004a28ca
mov edi, dword [eax]
call fcn.004a28ca
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0049fa0b
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.004a28ca
cmp dword [eax], ebx
je 0x48e6d1
call fcn.004a28ca
push dword [eax]
call fcn.0048de0f
pop ecx
jmp 0x48e6d8
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jne 0x48e662
jmp 0x48e75f
call fcn.004a28ca
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x48e75b
cmp dword [ebp - 0x11c], esi
jae 0x48e75b
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.shlwapi.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.0049e7a0
add esp, 0xc
push 0x4e3234
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x48e74a
push 0x4e3380
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, ebx
je 0x48e74a
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x48e74a
push ebx
push ebx
push esi
jmp 0x48e753
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
jmp 0x48e75d
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049ef0f
leave
ret

Function at 0x49912a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x499171
call fcn.0048f9f1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x499171
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x49918d
push ebx
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00498ca4
mov esi, eax
test edi, edi
je 0x49918b
test ebx, ebx
je 0x49918b
push ebx
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x49ef0f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x51b260]
jne 0x49ef19
repz ret
jmp fcn.004a784c
Function at 0x4b48cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004a64d2
and dword [ebp - 4], 0
cmp dword [0x5b846c], 0
mov ebx, eax
jne 0x4b497d
push 0x4ed398
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b4a2e
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x4ed38c
push edi
call esi
test eax, eax
je 0x4b4a2e
push eax
call fcn.004a6460
mov dword [esp], 0x4ed37c
push edi
mov dword [0x5b846c], eax
call esi
push eax
call fcn.004a6460
mov dword [esp], 0x4ed368
push edi
mov dword [0x5b8470], eax
call esi
push eax
call fcn.004a6460
mov dword [esp], 0x4ed34c
push edi
mov dword [0x5b8474], eax
call esi
push eax
call fcn.004a6460
pop ecx
mov dword [0x5b847c], eax
test eax, eax
je 0x4b497d
push 0x4ed334
push edi
call esi
push eax
call fcn.004a6460
pop ecx
mov dword [0x5b8478], eax
mov eax, dword [0x5b8478]
cmp eax, ebx
je 0x4b49d5
cmp dword [0x5b847c], ebx
je 0x4b49d5
push eax
call fcn.004a64db
push dword [0x5b847c]
mov esi, eax
call fcn.004a64db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b49d5
test edi, edi
je 0x4b49d5
call esi
test eax, eax
je 0x4b49cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b49cc
test byte [ebp - 0xc], 1
jne 0x4b49d5
or dword [ebp + 0x10], 0x200000
jmp 0x4b4a0e
mov eax, dword [0x5b8470]
cmp eax, ebx
je 0x4b4a0e
push eax
call fcn.004a64db
pop ecx
test eax, eax
je 0x4b4a0e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b4a0e
mov eax, dword [0x5b8474]
cmp eax, ebx
je 0x4b4a0e
push eax
call fcn.004a64db
pop ecx
test eax, eax
je 0x4b4a0e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5b846c]
call fcn.004a64db
pop ecx
test eax, eax
je 0x4b4a2e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b4a30
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c8c90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4c8d30
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x4c8ce2
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x52b2e8]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4c8cc3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x4c8d0b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x52b2e8]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4c8cee
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x4019eb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x412048]
test eax, eax
je 0x401a2a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a2a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a2a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a2a
cmp dword [ecx + 0x74], 0xe
jbe 0x401a2a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403370
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9d68
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x12
xor eax, eax
mov dword [ebp - 0x18], 0
push str.PdfConverterWidget
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00405050
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00405050
lea eax, [ebp - 0x4c]
push eax
push 0x403530
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x30]
xor esi, esi
mov ecx, dword [ebp - 0x34]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x403446
mov edi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0
push 0xbb8
push 3
push 0
push 0
push 0x10
push dword [ecx + esi*4]
call edi
mov eax, dword [ebp - 0x30]
inc esi
mov ecx, dword [ebp - 0x34]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x403422
lea ecx, [ebp - 0x34]
call fcn.00404f00
lea ecx, [ebp - 0x4c]
call fcn.00404fe0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x403497
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40348d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40351a
push edx
push ecx
call fcn.004c2dc6
add esp, 8
push 0x12
xor eax, eax
mov dword [ebp - 0x18], 0
push str.KeanPdfProcess.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00405050
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 2
call fcn.00478c80
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4034ff
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4034f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40351f
push edx
push ecx
call fcn.004c2dc6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2d85
mov esp, ebp
pop ebp
ret
call fcn.004cb4bf
call fcn.004cb4bf
int3
Function at 0x4072e0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x53a098]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, dword [esp + 0x148]
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.004c5400
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x407427
cmp dword [esi + 4], 6
push edi
ja 0x40733b
jne 0x4073c3
cmp dword [esi + 8], 2
jb 0x4073c3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x4073c3
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4073c3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4073c3
movups xmm0, xmmword [0x5119c0]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x5119d0]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4073c3
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4073c3
cmp word [edi + 2], ax
jbe 0x4073c3
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40740e
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004c5400
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x40740e
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.004c2d85
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.004c2d85
add esp, 0x140
ret

Function at 0x408d90
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea404
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00404d40
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00404d40
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00404d40
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00404d40
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.00404d40
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a4e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00404c10
test al, al
je 0x40a51d
xor al, al
jmp 0x40a6db
push edi
call fcn.00409cc0
add esp, 4
test al, al
je 0x40a531
mov al, 1
jmp 0x40a6db
push 0
mov ecx, edi
call fcn.00404c20
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x40a580
lea ecx, [ebp - 0x28]
call fcn.00404d40
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0041d9b0
test al, al
je 0x40a571
push 0
lea ecx, [ebp - 0x28]
call fcn.00404c20
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049a0
push edi
call fcn.00409cc0
add esp, 4
test al, al
jne 0x40a52a
mov ecx, edi
call fcn.00405040
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x40a67c
mov ecx, edi
call fcn.00404e90
mov ebx, eax
nop word [eax + eax]
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x40a5bc
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x40a5df
mov eax, ebx
cmp ecx, 8
jb 0x40a5d5
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x40a66c
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004084f0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00404c10
test al, al
jne 0x40a65d
lea eax, [ebp - 0x28]
push eax
call fcn.00409aa0
add esp, 4
test al, al
jne 0x40a65d
push 0
lea ecx, [ebp - 0x28]
call fcn.00404c20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40a65d
lea ecx, [ebp - 0x40]
call fcn.00404d40
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0041d9b0
test al, al
je 0x40a651
push 0
lea ecx, [ebp - 0x40]
call fcn.00404c20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004049a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049a0
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x40a5b0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
call fcn.00409aa0
add esp, 4
test al, al
jne 0x40a6d2
push 0
mov ecx, edi
call fcn.00404c20
push eax
call ebx
test eax, eax
jne 0x40a6d2
lea ecx, [ebp - 0x40]
call fcn.00404d40
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.0041d9b0
test al, al
je 0x40a6c3
push 0
lea ecx, [ebp - 0x40]
call fcn.00404c20
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004049a0
push edi
call fcn.00409cc0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2d85
mov esp, ebp
pop ebp
ret