joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4535ce
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4535fb
call fcn.00454540
mov dword [eax], esi
call fcn.0045452d
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00452ba6
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x453619
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00454553
pop ecx
jmp 0x4535f6
test byte [esp + 0xc], 0x80
je 0x453625
and eax, 0xfffffffe
jmp 0x453628
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x45360a
xor eax, eax
pop esi
ret

Function at 0x46596b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004595c6
xor ebx, ebx
cmp dword [0x49ffb8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x465a40
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4659ab
xor eax, eax
jmp 0x465b04
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4659a4
push eax
call fcn.00459563
mov dword [esp], 0x47d788
push edi
mov dword [0x49ffb8], eax
call esi
push eax
call fcn.00459563
mov dword [esp], 0x47d774
push edi
mov dword [0x49ffbc], eax
call esi
push eax
call fcn.00459563
mov dword [0x49ffc0], eax
lea eax, [ebp - 8]
push eax
call fcn.00453712
test eax, eax
pop ecx
pop ecx
je 0x465a0e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00452aaa
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x465a40
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00459563
cmp eax, ebx
pop ecx
mov dword [0x49ffc8], eax
je 0x465a40
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00459563
pop ecx
mov dword [0x49ffc4], eax
mov eax, dword [0x49ffc4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x465ab9
cmp dword [0x49ffc8], esi
je 0x465ab9
push eax
call fcn.004595cf
pop ecx
call eax
cmp eax, ebx
je 0x465a86
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x49ffc8]
call fcn.004595cf
pop ecx
call eax
test eax, eax
je 0x465a86
test byte [ebp - 0x18], 1
jne 0x465ab9
lea eax, [ebp - 0xc]
push eax
call fcn.00453749
test eax, eax
pop ecx
je 0x465aa1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00452aaa
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x465ab0
or dword [ebp + 0x10], 0x200000
jmp 0x465aea
or dword [ebp + 0x10], 0x40000
jmp 0x465aea
mov eax, dword [0x49ffbc]
cmp eax, esi
je 0x465aea
push eax
call fcn.004595cf
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x465aea
mov eax, dword [0x49ffc0]
cmp eax, esi
je 0x465aea
push dword [ebp - 4]
push eax
call fcn.004595cf
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x49ffb8]
call fcn.004595cf
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46f220
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x49b7f0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0046f1b5
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004557d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x46f26f
cmp dword [ebp - 0x1c], 5
jb 0x46f287
jmp 0x46f283
cmp dword [ebp - 0x10], 1
jne 0x46f287
cmp dword [ebp - 0x1c], 4
ja 0x46f283
jne 0x46f287
cmp dword [ebp - 0x18], 0
jbe 0x46f287
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x47f84c
call fcn.00418a30
test eax, eax
jge 0x46f2a8
mov byte [0x4a141c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004511c3
add ebp, 0x78
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1421497
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edi*4]
mov dx, 0xd98f
mov dh, ch
mov dh, 8
neg dx
jmp 0x14221ee
xchg dword [esp], ecx

Function at 0x1421971
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, ax
xchg dword [esp + 8], edx
lea eax, [esp + edi]
bswap eax
bswap eax
mov eax, 0x364766dc
jmp 0x14219b5
sets al
push edx
push word [esp + 1]
push word [esp + 5]
jmp 0x1421950
lea eax, [ebx*4]
lea edx, [edx + 0x28]
mov al, 0x66
lea eax, [eax + edi]
mov al, byte [esp]
call fcn.0142199e

Function at 0x142199e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [esp + 1]
jmp 0x1421a37
xchg dword [esp + 0xc], edx
sub esp, 0xa
setbe ah
mov eax, dword [esp + 7]
call 0x14219fa

Function at 0x1421aa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
fild word [edi - 0x7cf3dbac]
in al, dx
or cl, byte [edi]
xchg esi, eax
les ecx, [ebx - 0x17f8dbbc]
mov al, 0xff
invalid
not dh
mov eax, dword [esp + 1]
push dword [esp]
rcl dx, cl
jnp 0x1421aab
jp 0x1421b12
idiv byte [edi - 0x11]
mov bh, byte [ecx + 0x34]
fcom qword [eax - 0x3a]
mov eax, dword [reloc.kernel32.dll_DeleteCriticalSection]
jmp 0x1421a8c
invalid
jmp 0x1421a8c
mov al, ah
btr edx, edi
les ecx, [edi]
mov bl, 0xfa
mov word [esp + 2], bx
pop dx
jmp 0x1421ae2
lea eax, [esi + 0x85]
pop dx
mov al, ah
btr edx, edi
mov word [esp + 2], bx
jmp 0x1421af9

Function at 0x1590cd7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0158f646
mov word [esp + 1], dx
lea esp, [esp + 1]
jmp 0x1590d7a
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x158f641
mov eax, dword [eax + 0x1c]
jmp 0x1590d45
mov dword [esp + 0x80], edi
lea esp, [esp + 0x80]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x1590d63

Function at 0x1590db4
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 1]
push word [esp + 1]
push dword [esp]
lea esp, [esp + 7]
call fcn.01590cd7
leave
dec eax
fidivr word [ecx - 0x1a9e55b8]
jne 0x1590d2a
out dx, eax
add al, 0x94
pop es
scasb al, byte es:[edi]
mov byte [esp], ah
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x80], esi
push esp
lea esp, [esp + 1]
jmp 0x1590cef
add ebx, ebp
ret 0x6658
pop dword [esp]
jmp 0x1590d13
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x40515c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405195
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40519e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4051a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4051c9
mov al, byte [esp]
jmp 0x4051cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4067c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406808
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040675c
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40680f
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406ab8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404d30
add esp, 0x104
pop ebx
ret
Function at 0x197c7dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esp + 4]
lea esi, [ebp + 0x550d2fad]
pushal
lea esi, [ebx*2 - 0x22eb635f]
mov esi, dword [esp + 0x28]
jmp 0x19d293b

Function at 0x197d5cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x30]
jbe 0x19d311b
bsf si, cx
lea edi, [ecx*8 - 0x2f7bbca]
and di, 0xe8f5
btc si, 3
mov edi, dword [edx + 0x24]
sal esi, cl
adc si, 0xe2f3
add edi, eax
or esi, edx
cmp ch, ch
mov esi, dword [edx + 0x20]
jge 0x197acf3
push ebx
mov byte [esp], 0xc3
stc
add esi, eax
cmp ebx, eax
cmc
sub ecx, ecx
sub esp, 0xfffffffc
clc
sub ecx, dword [edx + 0x10]
test al, bh
test dx, dx
cmp ah, 0x1b
cmp ax, bx
cmp ecx, dword [edx + 0x14]
pushfd
lea esp, [esp + 4]
jae 0xf3673d
push eax
push 0xa55792ec
mov word [esp + 4], sp
mov word [esp], 0x83eb
lea esp, [esp + 8]
jmp 0x19d4161
neg di
mov edi, dword [edx + 0x1c]
push 0x6385ba17
clc
cmp ax, bp
add edi, eax
test dh, 0x80
mov edi, dword [edi + ecx*4]
stc
clc
test edi, edi
jmp 0x19d47a9
pushal
pushfd
lea esp, [esp + 0x28]
je 0xf3673d
test ch, 0xd9
call fcn.019d589e
push es
xchg edi, eax
pcmpeqd mm7, qword [edx - 0x71]
ljmp 0x6d43

Function at 0x19cbe8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x19d414d
lea esp, [esp + 0x28]
jne 0x197cb39
cmc
clc
pushal
movzx ecx, word [edi + ecx*2]
sub esp, 0xffffffe0

Function at 0x19d79e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], ch
lea esp, [esp + 4]
jne 0x197d66a
Function at 0x19d87ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
add eax, edi
stc
call fcn.019d6d12
add bh, byte [ebx]
dec edx
invalid
add eax, edi
stc
cmc
jmp 0x197a2a6
pushfd
lea esp, [esp + 4]
je 0xf3673d
pushfd
test bp, 0x7bef
jmp 0xf34310
stc
test al, dh
movzx ecx, word [edi + ecx*2]
pushal
push ecx
mov edi, dword [edx + 0x1c]
mov byte [esp], 0x93
jmp 0x19d27fa
arpl word [ecx + 0x6c], sp
imul edi, dword [edx + 0x65], 0x416c7255
add byte [eax - 0x2a], ch
inc dword [eax]
daa
adc eax, 0xb0bbc669
cmp ebx, dword [0xd6b41b1e]
les ecx, [ebp - 0x5f797afa]
jecxz 0x19d27e1
push ebp
jge 0x19d27d8
leave
pop eax
fcmovb st(0), st(7)
jp 0x19d274e
and cl, byte [edi + ebx]
sub dword [esi + edx*2 + 0x2f], esp
jle 0x19d280f
adc al, 0xaf
mov eax, 0x70ab9dc9
int 0xc2
loope 0x19d2790
xchg byte [ebp - 5], bl
cdq
into
dec ebp
dec edx
cmp dl, dh
push es
mov dword [0xac5d50b5], eax
rol esp, 1
out 0x84, eax
cdq
pushfd
pop esi
loopne 0x19d27af
salc
pop ebx
add eax, 0xd9fc4ac4
in al, 0xa5
cld
ftst
movsd dword es:[edi], dword [esi]
punpckhbw mm5, mm2
push edx
mov al, byte [eax + 0x8000e8]
add byte [edx + 0x68], bh
ljmp 0x84c2
add edi, eax
clc
mov edi, dword [edi + ecx*4]
test cl, 0x73
pushal
test edi, edi
call fcn.00f3616c
loope 0x19d27d2
shr byte [0x315829b0], 1
xor al, 0xf4
mov al, 0x29
pop eax
xor dword [esp + esi*8], esi
aam 0x35
loopne 0x19d2873
mov dl, 0xa6
add eax, 0x2a1e838c
jnp 0x19d2804
pop edx
stc
sub al, dh
pop ds
cmp edi, edi
jecxz 0x19d27dd
cdq
pop eax
sahf
push esi
inc ecx
and byte [edx + 0x2be97497], 0xf8
jns 0x19d28b8
invalid
push edx
test edx, 0xbb87e9ab
xor esp, eax
xor byte [edx + ebx + 0x332bf87d], 0xcb
xchg ecx, eax
add eax, 0xc1662b25
adc eax, 0x6436141
add dword [edi + 0x6b628d29], 0x52
pop es
pushal
pushfd
lea esp, [esp + 0x28]
jne 0x197cb39
jae 0x19cb9e7
pushfd
bt bp, sp
cmc
movzx ecx, word [edi + ecx*2]
bsf di, di
ror di, cl
mov edi, dword [edx + 0x1c]
mov word [esp], si
clc
bt sp, 0xa
test ch, 0xa4
add edi, eax
pushal
clc
test ebx, 0xa8b2a9e1
mov edi, dword [edi + ecx*4]
pushfd
pushfd
mov byte [esp + 8], 0x9a
clc
test edi, edi
mov byte [esp], 0x8c
lea esp, [esp + 0x2c]
jne 0x197cf7b
pushfd
lea esp, [esp + 4]
je 0xf3673d
test ch, 3
bt ax, dx
stc
jmp 0xf37b66
Function at 0x401560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b308
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x451550]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x543090]
push eax
push 0x4527f0
call fcn.00401520
add esp, 8
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp + 8]
call fcn.00403210
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4015e1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403db0
jmp 0x401616
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x543090]
push edx
push 0x4527f0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403db0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4024f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b5a1
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x451550]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x118]
call fcn.00403c10
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.00428830
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x118]
call fcn.00404740
push 0x446fcc
lea ecx, [ebp - 0x118]
call fcn.00403900
push 0x446fd0
lea ecx, [ebp - 0x118]
call fcn.00403900
lea eax, [ebp - 0x138]
push eax
call fcn.00413210
add esp, 4
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x134], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x134]
push edx
lea ecx, [ebp - 0x118]
call fcn.00403bf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.00403db0
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
lea eax, [ebp - 0x118]
push eax
call fcn.00403a50
mov dword [ebp - 0x140], eax
call fcn.00413b20
add esp, 4
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x120]
mov dword [ecx], edx
push 0x446fd4
lea ecx, [ebp - 0x118]
call fcn.00403900
lea eax, [ebp - 0x128]
push eax
call fcn.00413210
add esp, 4
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x124], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x124]
push edx
lea ecx, [ebp - 0x118]
call fcn.00403bf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x128]
call fcn.00403db0
push str..ini
lea ecx, [ebp - 0x118]
call fcn.00403900
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
call fcn.00403a50
mov ecx, dword [ebp - 0x11c]
or ecx, 1
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.00403db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426ce7
mov esp, ebp
pop ebp
ret
Function at 0x4026d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b5fc
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x451550]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea eax, [ebp - 0x113]
push eax
call fcn.00428830
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x118]
call fcn.00404760
mov dword [ebp - 4], 0
push 0x5c
lea ecx, [ebp - 0x118]
call fcn.00402c30
push eax
push 0
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x118]
call fcn.00402c80
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x13c]
push edx
lea ecx, [ebp - 0x118]
call fcn.00403d90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.00403db0
push 0x5c
lea ecx, [ebp - 0x118]
call fcn.00402c30
push eax
push 0
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x118]
call fcn.00402c80
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x120], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x120]
push edx
lea ecx, [ebp - 0x118]
call fcn.00403d90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.00403db0
push str.__
lea ecx, [ebp - 0x118]
call fcn.00403900
lea eax, [ebp - 0x130]
push eax
call fcn.00413210
add esp, 4
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x128]
push edx
lea ecx, [ebp - 0x118]
call fcn.00403bf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.00403db0
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
lea eax, [ebp - 0x118]
push eax
call fcn.00403a50
mov dword [ebp - 0x148], eax
call fcn.00413b20
add esp, 4
push 0x446fe4
lea ecx, [ebp - 0x118]
call fcn.00403900
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403a50
mov edx, dword [ebp - 0x11c]
or edx, 1
mov dword [ebp - 0x11c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.00403db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426ce7
mov esp, ebp
pop ebp
ret
Function at 0x4028e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x451550]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], 0
push 0x128
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00428830
add esp, 0xc
mov dword [ebp - 0x12c], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40297e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x124], eax
jne 0x402966
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x134], eax
jmp 0x40297e
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x40294a
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426ce7
mov esp, ebp
pop ebp
ret

Function at 0x4029a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b63b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x451550]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x144], 0
push 0x446d93
lea ecx, [ebp - 0x13c]
call fcn.00404760
mov dword [ebp - 4], 0
push 0x128
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00428830
add esp, 0xc
mov dword [ebp - 0x138], 0x128
call fcn.004028e0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_Process32First]
call fcn.004028e0
cmp dword [ebp - 0x130], eax
jne 0x402a55
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00404740
jmp 0x402a6d
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x402a34
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x13c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403a50
mov edx, dword [ebp - 0x144]
or edx, 1
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00403db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426ce7
mov esp, ebp
pop ebp
ret
Function at 0x402ad0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x451550]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], 0
push 0x128
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00428830
add esp, 0xc
mov dword [ebp - 0x12c], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x134], eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x402b47
mov dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
jmp 0x402b97
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0043578f
add esp, 8
test eax, eax
jne 0x402b6c
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x130], edx
jmp 0x402b84
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x402b47
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426ce7
mov esp, ebp
pop ebp
ret

Function at 0x403e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403ea4
xor eax, eax
jmp 0x403f24
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403ebb
xor eax, eax
jmp 0x403f24
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x403f07
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x403f07
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x403ede
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x403f13
xor eax, eax
jmp 0x403f24
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x403f21
xor eax, eax
jmp 0x403f24
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret