joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100019b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
in al, 0x2b
call fcn.10001562
push eax
push esi
push dword [ebp + 8]
call fcn.10001517
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10001552
inc esp
push ecx
inc ebx
daa
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
invalid
inc ebp
invalid

Function at 0x10001c90
Capabilities:
Inspect section memory permissions

Disassembly:
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4

Function at 0x10001ca0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10001c29
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10001c47
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10001ca5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10001c8c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10001c95
invalid
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10001c9f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10001c81
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10001c0b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10001cf2
dec eax
je 0x10001ce9
sub eax, 3
je 0x10001ce0
mov dword [ebp - 4], 0x40
jmp 0x10001d0f
mov dword [ebp - 4], 4
jmp 0x10001cf5
mov dword [ebp - 4], 0x20
jmp 0x10001cf5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10001d41
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10001cc1
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10001552
and ebx, ecx
or ecx, dword [edi - 1]
jne 0x10001d4c
push 1
push esi
call edi
mov eax, esi
jmp 0x10001d4d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403899
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4038ad
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4038ce
cmp esi, eax
jae 0x4038a7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4038c0
cmp esi, eax
jae 0x4038a7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42d69b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [esp + 8], esi
call fcn.00423874
push fcn.00404000
push 0x403fe0
push 0x18
push 4
lea eax, [esi + 0xc0]
xor edi, edi
push eax
mov dword [esp + 0x28], edi
call fcn.00418ca5
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 4], 0xffffffff
mov dword [esi], 0xffffffff
mov dword [esi + 0xc], 3
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
xor ecx, ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x88], ecx
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], ecx
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], ecx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xac], ecx
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xb4], ecx
mov dword [esi + 0xb8], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x124], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42d7b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, dword [esp + 0x38]
push ecx
add ebx, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push ebx
mov dword [esp + 0x34], 1
call fcn.00403f70
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esi + 0x1b4]
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
mov byte [esp + 0x38], 2
call fcn.00403f70
add eax, 0x10
mov dword [edi], eax
mov edi, dword [esp + 0x40]
add edi, 0xfffffff0
mov dword [esp + 0x28], esp
mov ebp, esp
push edi
mov byte [esp + 0x3c], 3
call fcn.00403f70
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [esi + 0x1b0]
sub eax, 0x10
mov dword [esp + 0x30], esp
mov ebp, esp
push eax
mov byte [esp + 0x40], 4
call fcn.00403f70
add eax, 0x10
mov dword [ebp], eax
lea eax, [esp + 0x24]
add esp, 4
push eax
mov byte [esp + 0x40], 1
call fcn.0040a220
add esp, 0x14
lea ecx, [esi + 0x148]
push eax
mov byte [esp + 0x30], 5
call fcn.004056e0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405b45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x3c]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi + 0x1a8], ecx
je 0x405b5c
mov dword [esi + 0x90], eax
mov byte [esp + 0x2c], cl
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x405b77
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov dword [esp + 0x2c], 0xffffffff
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x405b96
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0xc
Function at 0x409900
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
push esi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409955
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x409a40
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 7
mov ecx, 1
jb 0x409a6c
mov dword [0x43f96c], ecx
cmp eax, 6
jne 0x409a8b
cmp dword [esp + 8], 2
jb 0x409a8d
mov dword [0x43f96c], ecx
mov dword [0x43f970], ecx
add esp, 0x114
ret
jb 0x409a9a
mov dword [0x43f970], ecx
add esp, 0x114
ret
cmp eax, 5
jne 0x409aad
mov eax, dword [esp + 8]
test eax, eax
jbe 0x409aad
mov dword [0x43f974], ecx
add esp, 0x114
ret

Function at 0x40a220
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42dc10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov ebp, dword [esp + 0x238]
mov ebx, dword [esp + 0x23c]
mov edi, dword [esp + 0x234]
mov esi, dword [esp + 0x230]
push ebp
push 0x104
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
mov dword [esp + 0x23c], 3
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x230]
call fcn.00405bb0
lea eax, [esi - 0x10]
mov byte [esp + 0x224], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a2b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov byte [esp + 0x224], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a2d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0x224], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a2f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebx - 0x10]
mov dword [esp + 0x224], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x40a322
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20c]
mov eax, dword [esp + 0x21c]
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x40a870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42dd09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [ecx + 0x30]
mov edx, dword [ecx + 0x34]
push esi
push eax
mov eax, dword [ecx + 0x24]
push edx
mov edx, dword [ecx + 0x2c]
push eax
mov eax, dword [ecx + 0x28]
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.0040e440
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov ecx, esi
mov dword [ecx], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x18]
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edx
lea ecx, [esp + 8]
mov dword [esp + 4], 1
call fcn.0040bef0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x40af80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, dword [ebx + 4]
push edi
xor edi, edi
cmp ecx, edi
je 0x40af95
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebx + 8]
cmp eax, edi
mov dword [ebx + 4], edi
je 0x40afb3
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebx + 8], edi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x40b0ac
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40b0ac
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebp, ebp
cmp eax, ebp
je 0x40b0ac
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebp
je 0x40b0ac
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebp
mov dword [ebx + 8], eax
je 0x40b0ac
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebp
je 0x40b09f
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x18]
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 8]
push ebp
push ecx
mov dword [esp + 0x24], ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40b095
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.0040ae50
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
add esp, 8
push eax
call dword [ecx + 8]
mov eax, dword [ebx + 4]
cmp eax, ebp
je 0x40b095
mov ecx, dword [eax + 8]
cmp ecx, ebp
mov dword [eax + 8], ebp
jne 0x40b085
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
mov ecx, dword [ebx + 4]
cmp ecx, ebp
je 0x40b092
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [ebx + 4], ebp
mov eax, dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebx + 8], ebp
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
Function at 0x40b1a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42ddd8
push eax
mov dword fs:[0], esp
push esi
mov edx, dword [esp + 0x14]
mov esi, dword [ecx + 8]
sub esp, 0x14
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x38]
push esi
mov dword [esp + 0x24], 0
mov dword [eax + 0x10], edx
call fcn.0040ad70
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.0040bef0
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x14

Function at 0x40b380
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42de03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x432c34
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x40], 0x432c40
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov edi, dword [esp + 0x20]
cmp edi, 0xffffffff
mov byte [esp + 0x18], 1
jne 0x40b3e1
push edi
call fcn.00415610
push edi
jmp 0x40b3ec
cmp edi, ebx
jl 0x40b400
push ebx
call fcn.00415610
push ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x14], eax
call fcn.00415640
add esp, 8
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
pop edi
mov dword [esi + 0x24], 0x64
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x40c290
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42df38
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
mov esi, dword [esp + 0x18]
test esi, esi
mov dword [esp + 0x10], 0
jge 0x40c2be
call fcn.0042385a
cmp esi, dword [edi + 8]
jl 0x40c2d0
push 0xffffffffffffffff
lea eax, [esi + 1]
push eax
mov ecx, edi
call fcn.0040bfa0
mov edx, dword [edi + 4]
lea ecx, [esi + esi*2]
lea eax, [edx + ecx*8]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x1c]
mov dword [eax + 0x14], edx
mov dword [esp + 0x10], 0xffffffff
call fcn.0040bef0
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x1c
Function at 0x40c9e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42dfa8
push eax
mov dword fs:[0], esp
push esi
mov edx, dword [esp + 0x14]
mov esi, dword [ecx + 8]
sub esp, 0x18
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x40]
push esi
mov dword [esp + 0x28], 0
mov dword [eax + 0x14], edx
call fcn.0040c290
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.0040bef0
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x18
Function at 0x40cca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42dfe1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi], 0x432c80
xor ebx, ebx
push edi
lea edi, [esi + 0x1c]
mov dword [esp + 0x10], esi
mov dword [edi], 0x432c5c
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov eax, dword [esp + 0x24]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
push ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.00415980
push 0x54
call fcn.00424037
add esp, 8
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x40cd3c
push ebx
push 0xffffffffffffffff
mov ecx, eax
call fcn.0040b380
mov dword [esp + 0x24], eax
jmp 0x40cd40
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], eax
mov ebp, dword [edi + 8]
cmp ebp, ebx
mov byte [esp + 0x1c], bl
jge 0x40cd57
call fcn.0042385a
push 0xffffffffffffffff
lea ecx, [ebp + 1]
push ecx
mov ecx, edi
call fcn.0040a910
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x24]
push 0x54
mov dword [edx + ebp*4], eax
call fcn.00424037
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
je 0x40cd94
push ebx
push ebx
mov ecx, eax
call fcn.0040b380
mov dword [esp + 0x24], eax
jmp 0x40cd98
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x14], ecx
mov ebp, dword [edi + 8]
cmp ebp, ebx
mov byte [esp + 0x1c], bl
jge 0x40cdaf
call fcn.0042385a
push 0xffffffffffffffff
lea edx, [ebp + 1]
push edx
mov ecx, edi
call fcn.0040a910
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax + ebp*4], ecx
mov edx, dword [esi + 0x24]
mov eax, 0xfa
mov ecx, 0x159
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], eax
pop edi
mov dword [esi + 0x34], ecx
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 1
mov dword [esi + 0x3c], 0x9b
mov dword [esi + 0x54], 0x18b
mov dword [esi + 0x44], 0x15e
mov dword [esi + 0x5c], 0xf5
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x412f00
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x43e0c4]
mov ecx, dword [eax*8 + 0x43e0a4]
mov edx, dword [eax*8 + 0x43e0a8]
push 0
push 0
push 0
push 0x409e80
push 0
push 0
mov dword [0x43f964], ecx
mov dword [0x43f968], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
jmp 0x409f10

Function at 0x4157c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x18]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4157e6
pop edi
pop esi
add esp, 8
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x415879
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x415879
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x415879
lea edx, [esp + 0xc]
push edx
push 1
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x415879
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push ebx
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [esp + 0xc]
push 0
push eax
call fcn.0040ae50
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
add esp, 8
push eax
call dword [ecx + 8]
mov eax, dword [esi + 8]
test eax, eax
mov dword [esi + 8], 0
jne 0x415879
mov edx, dword [esp + 0x18]
pop ebx
pop edi
mov dword [edx], esi
mov eax, 1
pop esi
add esp, 8
ret
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x4167a0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x43f984]
test eax, eax
je 0x4167cb
push 0
push 0
push 0
push 0x4164f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4191ff
Capabilities:
Terminate process

Disassembly:
push 8
push 0x437370
call fcn.00419874
push 8
call fcn.0041cb53
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x441bdc], esi
jne 0x419233
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x441bd8], esi
mov al, byte [ebp + 0x10]
mov byte [0x441bd4], al
cmp dword [ebp + 0xc], edi
jne 0x41927d
cmp dword [0x443568], edi
je 0x41926d
mov eax, dword [0x443564]
sub eax, 4
mov dword [0x443564], eax
cmp eax, dword [0x443568]
jb 0x41926d
mov eax, dword [eax]
cmp eax, edi
je 0x41924e
call eax
jmp 0x41924e
push 0x43e088
mov eax, 0x43e080
call fcn.0041917d
pop ecx
push 0x43e094
mov eax, 0x43e08c
call fcn.0041917d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4192ae
cmp dword [ebp + 0x10], edi
jne 0x4192bc
mov dword [0x441bdc], esi
push dword [ebp + 8]
call fcn.0041913b
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4192bb
push 8
call fcn.0041ca9e
pop ecx
ret
call fcn.004198af
ret
Function at 0x4199c9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004196e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x419a64
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x441b9c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x419a64
cmp eax, 1
je 0x419a85
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x419a64
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x419a31
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x419a60
xor eax, eax
inc eax
jmp 0x419aa4
cmp edi, eax
jae 0x419a68
xor eax, eax
jmp 0x419aa4
cmp eax, esi
jae 0x419a6f
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x441b9c]
jmp 0x419a88
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret