joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70e73250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [0x70ea1174]
push edi
test eax, eax
je 0x70e73390
test esi, esi
je 0x70e73390
mov edi, dword [esp + 0x34]
test edi, edi
je 0x70e73390
cmp byte [edi], 0
je 0x70e73390
push edi
lea ecx, [esp + 0x2c]
push ecx
call eax
mov edx, dword [esi + 0x3c]
lea eax, [edx + esi + 0x78]
test eax, eax
je 0x70e73390
mov ecx, dword [eax]
test ecx, ecx
je 0x70e73390
mov eax, dword [eax + 4]
mov ebx, dword [ecx + esi + 0x18]
lea ebp, [ecx + esi]
mov ecx, dword [ebp + 0x20]
add eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x24]
add eax, esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
add ecx, esi
add eax, esi
cmp ebx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 1
jl 0x70e73381
jmp 0x70e732e6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add eax, ebx
cdq
sub eax, edx
mov edx, dword [esp + 0x34]
mov edi, eax
sar edi, 1
mov ecx, dword [ecx + edi*4 - 4]
add ecx, esi
lea ecx, [ecx]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x70e73320
test al, al
je 0x70e7331c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x70e73320
add ecx, 2
add edx, 2
test al, al
jne 0x70e73300
xor eax, eax
jmp 0x70e73325
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x70e7335f
jge 0x70e7333d
cmp dword [esp + 0x14], edi
jne 0x70e73337
inc dword [esp + 0x14]
jmp 0x70e73346
mov dword [esp + 0x14], edi
jmp 0x70e73346
cmp ebx, edi
jne 0x70e73344
dec ebx
jmp 0x70e73346
mov ebx, edi
cmp dword [esp + 0x14], ebx
jle 0x70e732e2
mov edi, dword [esp + 0x34]
mov eax, edi
call fcn.70e731f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
movzx edx, word [ecx + edi*2 - 2]
mov eax, dword [esp + 0x20]
mov eax, dword [eax + edx*4]
add eax, esi
je 0x70e7337d
cmp eax, ebp
jb 0x70e73392
cmp eax, dword [esp + 0x24]
ja 0x70e73392
mov edi, dword [esp + 0x34]
mov eax, edi
call fcn.70e731f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x70e77b70
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x34
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call fcn.70e866e8
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
cmp edi, ebp
je 0x70e77cf3
push 0x34
push ebp
push edi
call fcn.70e899f0
add esp, 0xc
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [edi + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], eax
lea eax, [edi + 0x2c]
mov dword [edi + 0x28], ecx
push 0x7d4
mov dword [eax + 4], eax
mov dword [eax], eax
call fcn.70e866e8
mov esi, eax
add esp, 4
cmp esi, ebp
jne 0x70e77bf8
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x7d4
push ebp
push esi
call fcn.70e899f0
mov edx, dword [0x70ea13e4]
add esp, 0xc
cmp edx, ebp
je 0x70e77c18
call fcn.70e72da0
jmp 0x70e77c1d
mov eax, dword [0x70ea1664]
push esi
push 0x70e77e30
call eax
mov edx, dword [esi]
push edi
push edx
push str.Hooks_SetWindowsHookExAW__found__d_threads__pSWE__x__n
push 0x70ea0aa8
call dword [0x70ea11cc]
add esp, 0x10
push 0x70ea0aa8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi], ebp
jbe 0x70e77c7f
lea eax, [esi + 4]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov ebx, dword [ecx]
call fcn.70e77d00
test eax, eax
je 0x70e77c6b
mov dword [esp + 0x18], 1
jmp 0x70e77c75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
add dword [esp + 0x14], 4
inc ebp
cmp ebp, dword [esi]
jb 0x70e77c52
push esi
call fcn.70e867b2
add esp, 4
cmp dword [esp + 0x18], 0
je 0x70e77cdf
push 0x70ea0a78
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x70ea1744]
mov esi, dword [edx]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
call fcn.70e71ec0
mov edi, eax
call fcn.70e790a0
mov dword [esi + 4], edi
mov edx, dword [edi + 4]
push 0x70ea0a78
mov dword [edx], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push edi
call fcn.70e867b2
mov eax, dword [esp + 0x24]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x70e77d00
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x2c
push ebp
push esi
push ebx
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x70e77dc6
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + 4]
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x2c]
lea esi, [edi + 0x2c]
cmp eax, esi
je 0x70e77d79
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea esp, [esp]
cmp dword [eax + 8], ebx
jne 0x70e77d73
cmp dword [eax + 0x10], ecx
jne 0x70e77d73
cmp dword [eax + 0xc], edx
je 0x70e77e0e
mov eax, dword [eax]
cmp eax, esi
jne 0x70e77d60
cmp dword [edi + 0x28], 0
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push ebx
push ecx
push edx
mov edx, dword [0x70ea1440]
push eax
jne 0x70e77d98
mov edx, dword [0x70ea1444]
call fcn.70e72da0
call eax
mov ebp, eax
test ebp, ebp
je 0x70e77e0e
push 0x18
call fcn.70e866e8
add esp, 4
test eax, eax
jne 0x70e77dce
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebp
add esp, 0x2c
ret
mov dword [eax + 8], ebx
mov edx, dword [esp + 0x14]
mov dword [eax + 0x10], edx
mov ecx, dword [esp + 0x10]
push ebx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x14], ebp
mov ecx, dword [esi]
push edi
mov dword [eax], ecx
mov dword [eax + 4], esi
push str.Hooks_SetWindowsHookExAW_InsertThread__pSWE__x__threadId__x_n
mov dword [ecx + 4], eax
push 0x70ea0aa8
mov dword [esi], eax
call dword [0x70ea11cc]
add esp, 0x10
push 0x70ea0aa8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, 1
pop ebp
add esp, 0x2c
ret

Function at 0x70e78410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
push 0x40
push 0x3000
push 0x30
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x70e78499
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea edx, [esp + 0xc]
push edx
push 0x40
push 0xa
lea edi, [esi + 5]
push edi
mov dword [esi + 0x20], esi
mov dword [esi + 0x24], 0x70e784b0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov byte [esi], 0xb8
mov dword [esi + 1], esi
mov dword [esp + 0x1c], 0
call ebx
test eax, eax
je 0x70e78495
lea eax, [edi + 1]
mov ecx, 0x70e784b0
sub ecx, eax
sub ecx, 4
mov byte [edi], 0xe9
lea edx, [esp + 0x10]
push edx
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
push eax
push 0xa
push edi
mov dword [esp + 0x20], 0
call ebx
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret
Function at 0x70e797c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.70e76150
add esp, 4
push eax
push esi
push str.HFunc_CloseServiceHandle__h_x___bValid_d__n
push 0x70ea0aa8
call dword [0x70ea11cc]
add esp, 0x10
push 0x70ea0aa8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 0xee070000
jne 0x70e79810
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.70e76150
add esp, 4
test eax, eax
jne 0x70e7982e
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.70e75c50
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x70e7a2f0
Capabilities:
Print debug messages

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push eax
push edi
push esi
push str.HFunc_OpenServiceW__h_x__name_ws__access_x__n
push 0x70ea0aa8
call dword [0x70ea11cc]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0x14
push 0x70ea0aa8
call ebx
cmp esi, 0xee070000
je 0x70e7a33c
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
test edi, edi
je 0x70e7a3d0
cmp word [edi], 0
je 0x70e7a3d0
push edi
call fcn.70e76030
add esp, 4
test eax, eax
je 0x70e7a386
call fcn.70e75bc0
mov esi, eax
push esi
push str.___already_exist__got_h_x_n
push 0x70ea0aa8
call dword [0x70ea11cc]
add esp, 0xc
push 0x70ea0aa8
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
mov eax, edi
call fcn.70e75560
add esp, 0x20
test eax, eax
jne 0x70e7a3bc
cmp dword [esp + 0x1c], eax
je 0x70e7a3bc
call fcn.70e75bc0
mov esi, eax
push esi
push str.___got_h_x_n
jmp 0x70e7a368
push 0x424
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x70e80e90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x148
mov eax, dword [0x70e97050]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
sub eax, dword [0x70ea1768]
cmp eax, 0x1f4
jb 0x70e80ef2
mov ecx, 0x4e
mov esi, 0x70ea0fe8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x70ea0fe8
call fcn.70e85f30
test eax, eax
jne 0x70e80ef4
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x70ea0ff4]
je 0x70e80eeb
call fcn.70e71290
call ebx
mov dword [0x70ea1768], eax
xor eax, eax
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.70e8654c
add esp, 0x148
ret
Function at 0x70e8654c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x70e97050]
jne 0x70e86556
repz ret
jmp fcn.70e87cc6

Function at 0x70e8cbff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.70e87e3e
and dword [ebp - 4], 0
cmp dword [0x70ea07f0], 0
mov ebx, eax
jne 0x70e8ccb0
push 0x70e8fa54
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x70e8cd61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x70e8fa48
push edi
call esi
test eax, eax
je 0x70e8cd61
push eax
call fcn.70e87dcc
mov dword [esp], 0x70e8fa38
push edi
mov dword [0x70ea07f0], eax
call esi
push eax
call fcn.70e87dcc
mov dword [esp], 0x70e8fa24
push edi
mov dword [0x70ea07f4], eax
call esi
push eax
call fcn.70e87dcc
mov dword [esp], 0x70e8fa08
push edi
mov dword [0x70ea07f8], eax
call esi
push eax
call fcn.70e87dcc
pop ecx
mov dword [0x70ea0800], eax
test eax, eax
je 0x70e8ccb0
push 0x70e8f9f0
push edi
call esi
push eax
call fcn.70e87dcc
pop ecx
mov dword [0x70ea07fc], eax
mov eax, dword [0x70ea07fc]
cmp eax, ebx
je 0x70e8cd08
cmp dword [0x70ea0800], ebx
je 0x70e8cd08
push eax
call fcn.70e87e47
push dword [0x70ea0800]
mov esi, eax
call fcn.70e87e47
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x70e8cd08
test edi, edi
je 0x70e8cd08
call esi
test eax, eax
je 0x70e8ccff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x70e8ccff
test byte [ebp - 0xc], 1
jne 0x70e8cd08
or dword [ebp + 0x10], 0x200000
jmp 0x70e8cd41
mov eax, dword [0x70ea07f4]
cmp eax, ebx
je 0x70e8cd41
push eax
call fcn.70e87e47
pop ecx
test eax, eax
je 0x70e8cd41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x70e8cd41
mov eax, dword [0x70ea07f8]
cmp eax, ebx
je 0x70e8cd41
push eax
call fcn.70e87e47
pop ecx
test eax, eax
je 0x70e8cd41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x70ea07f0]
call fcn.70e87e47
pop ecx
test eax, eax
je 0x70e8cd61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x70e8cd63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10046a00
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10046bed
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b000]
push edi
or ebp, 0xffffffff
jmp 0x10046a2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10046a31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10046a20
mov eax, 1
add ebx, ebx
jne 0x10046a43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10046a54
jne 0x10046a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10046a73
dec eax
add ebx, ebx
jne 0x10046a60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10046a38
add ebx, ebx
jne 0x10046a6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10046ac5
xor ecx, ecx
sub eax, 3
jb 0x10046a8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10046afa
sar eax, 1
mov ebp, eax
jmp 0x10046a96
add ebx, ebx
jne 0x10046a96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10046a64
inc ecx
add ebx, ebx
jne 0x10046aa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10046a64
add ebx, ebx
jne 0x10046ab1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10046aa6
jne 0x10046ac2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10046aa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10046ae4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10046ad6
jmp 0x10046a26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10046ae4
add edi, ecx
jmp 0x10046a26
pop esi
mov edi, esi
mov ecx, 0x7d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10046b02
cmp byte [edi], 1
jne 0x10046b02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10046b07
lea edi, [esi + 0x43000]
mov eax, dword [edi]
or eax, eax
je 0x10046b7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46d68]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x46e44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10046b34
mov ecx, edi
jns 0x10046b63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x46e48]
or eax, eax
je 0x10046b79
mov dword [ebx], eax
add ebx, 4
jmp 0x10046b51
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10046bb0
cmp al, 0xef
ja 0x10046ba3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10046b85
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10046b92
mov ebp, dword [esi + 0x46e4c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10046be4
sub esp, 0xffffff80
jmp 0x10018ad1
Function at 0x403070
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, 0x1024
call fcn.0040f480
mov eax, dword [0x4ab344]
mov ecx, dword [0x4a8250]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40318d
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x4ab344], 0x959
jne 0x403173
call esi
push 0
lea eax, [esp + 0x834]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
lea ecx, [esp + 0x38]
push ecx
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea edx, [esp + 0x2c]
push edx
push 0
lea eax, [esp + 0x438]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0x402c80
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x10]
push edx
call fcn.00402ed0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4030b4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1024
ret
Function at 0x408c20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e580]
jne 0x408c2a
repz ret
jmp fcn.0040c0e3

Function at 0x40b623
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406b64
and dword [ebp - 4], 0
cmp dword [0x440db4], 0
mov ebx, eax
jne 0x40b6d4
push 0x401b5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b785
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b50
push edi
call esi
test eax, eax
je 0x40b785
push eax
call fcn.00406af2
mov dword [esp], 0x401b40
push edi
mov dword [0x440db4], eax
call esi
push eax
call fcn.00406af2
mov dword [esp], 0x401b2c
push edi
mov dword [0x440db8], eax
call esi
push eax
call fcn.00406af2
mov dword [esp], 0x401b10
push edi
mov dword [0x440dbc], eax
call esi
push eax
call fcn.00406af2
pop ecx
mov dword [0x440dc4], eax
test eax, eax
je 0x40b6d4
push 0x401af8
push edi
call esi
push eax
call fcn.00406af2
pop ecx
mov dword [0x440dc0], eax
mov eax, dword [0x440dc0]
cmp eax, ebx
je 0x40b72c
cmp dword [0x440dc4], ebx
je 0x40b72c
push eax
call fcn.00406b6d
push dword [0x440dc4]
mov esi, eax
call fcn.00406b6d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b72c
test edi, edi
je 0x40b72c
call esi
test eax, eax
je 0x40b723
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b723
test byte [ebp - 0xc], 1
jne 0x40b72c
or dword [ebp + 0x10], 0x200000
jmp 0x40b765
mov eax, dword [0x440db8]
cmp eax, ebx
je 0x40b765
push eax
call fcn.00406b6d
pop ecx
test eax, eax
je 0x40b765
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b765
mov eax, dword [0x440dbc]
cmp eax, ebx
je 0x40b765
push eax
call fcn.00406b6d
pop ecx
test eax, eax
je 0x40b765
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440db4]
call fcn.00406b6d
pop ecx
test eax, eax
je 0x40b785
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b787
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403590
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x49d4dc]
mov ecx, dword [0x49a3e4]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40367f
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x49d4dc], 0x959
jne 0x403665
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea edx, [esp + 0x43c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402cb0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033e0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x4035d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x40725c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430238]
jne 0x407266
repz ret
jmp fcn.0040c565

Function at 0x40d05f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a778
and dword [ebp - 4], 0
cmp dword [0x433278], 0
mov ebx, eax
jne 0x40d110
push 0x4024b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d1c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024a8
push edi
call esi
test eax, eax
je 0x40d1c1
push eax
call fcn.0040a706
mov dword [esp], 0x402498
push edi
mov dword [0x433278], eax
call esi
push eax
call fcn.0040a706
mov dword [esp], 0x402484
push edi
mov dword [0x43327c], eax
call esi
push eax
call fcn.0040a706
mov dword [esp], 0x402468
push edi
mov dword [0x433280], eax
call esi
push eax
call fcn.0040a706
pop ecx
mov dword [0x433288], eax
test eax, eax
je 0x40d110
push 0x402450
push edi
call esi
push eax
call fcn.0040a706
pop ecx
mov dword [0x433284], eax
mov eax, dword [0x433284]
cmp eax, ebx
je 0x40d168
cmp dword [0x433288], ebx
je 0x40d168
push eax
call fcn.0040a781
push dword [0x433288]
mov esi, eax
call fcn.0040a781
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d168
test edi, edi
je 0x40d168
call esi
test eax, eax
je 0x40d15f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d15f
test byte [ebp - 0xc], 1
jne 0x40d168
or dword [ebp + 0x10], 0x200000
jmp 0x40d1a1
mov eax, dword [0x43327c]
cmp eax, ebx
je 0x40d1a1
push eax
call fcn.0040a781
pop ecx
test eax, eax
je 0x40d1a1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d1a1
mov eax, dword [0x433280]
cmp eax, ebx
je 0x40d1a1
push eax
call fcn.0040a781
pop ecx
test eax, eax
je 0x40d1a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433278]
call fcn.0040a781
pop ecx
test eax, eax
je 0x40d1c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d1c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x41bc7b18
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x34210f17
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219