joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026e9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.0040388c
push 0
push 0x61
mov ecx, edi
call fcn.00406564
mov ecx, dword [ebp + 0xc]
call fcn.00418eb0
mov edx, 0xce4
lea ecx, [ebp - 0xc]
call fcn.00402748
push dword [eax]
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0xc]
call fcn.004032be
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
leave
ret 8

Function at 0x402aeb
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x419bce
call fcn.004192c0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00403747
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402b45
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402b97
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x419c19
call fcn.004192c0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040aeff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402bed
push dword [esi + 0x24]
call fcn.004032be
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.004024f5
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402f8e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4045f2
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x40475d
Capabilities:
Create directory

Disassembly:
mov eax, 0x419e5c
call fcn.004192c0
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404780
mov al, 1
jmp 0x4047c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404791
xor al, al
jmp 0x4047c6
lea ecx, [ebp - 0x44]
call fcn.00404cdb
lea ecx, [ebp - 0x1c]
call fcn.00403747
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00404f92
test al, al
je 0x4047bb
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.004032be
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404f83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404f91
or eax, eax
ret
Function at 0x4055d3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4055f9
xor al, al
jmp 0x405619
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004195f0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x414790
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x3e4
push ebp
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4147be
cmp dword [esp + 0xc], 6
jne 0x4147be
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4147e8
push str.SetDefaultDllDirectories
push 0x41b788
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4147e8
push 0xc00
call eax
test eax, eax
jne 0x41489e
lea ecx, [esp + 0x11c]
push 0x106
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41489e
cmp eax, 0x104
ja 0x41489e
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
cmp word [esp + ebp*2 + 0x11a], 0x5c
je 0x414834
mov word [esp + ebp*2 + 0x11c], 0x5c
inc ebp
mov esi, dword [str.UXTHEME]
cmp byte [esi], 0
je 0x41489e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov al, byte [esi]
xor cx, cx
inc esi
mov cl, al
test al, al
mov word [esp + ebp*2 + 0x124], cx
je 0x41487a
lea ecx, [esp + ebp*2 + 0x126]
mov al, byte [esi]
xor dx, dx
mov dl, al
inc esi
mov word [ecx], dx
add ecx, 2
test al, al
jne 0x414868
lea eax, [esp + 0x124]
push str..dll
push eax
call edi
lea ecx, [esp + 0x124]
push 8
push 0
push ecx
call ebx
cmp byte [esi], 0
jne 0x41484d
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x3e4
ret
Function at 0x4180a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x41810b
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x41814c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x418131
mov ecx, ebx
call fcn.00417d90
add ebx, 0x28
dec ebp
jne 0x418125
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x418147
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.00417cc0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.004181f0
mov ebx, eax
cmp ebx, edi
jne 0x4181af
lea ecx, [ebp + 0x20]
call fcn.00418f50
mov ebx, eax
cmp ebx, edi
jne 0x4181af
lea ecx, [ebp + 0x1c]
call fcn.00418f50
mov ebx, eax
cmp ebx, edi
jne 0x4181af
push ebp
call fcn.00418240
mov ebx, eax
cmp ebx, edi
je 0x4181c4
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.00418220
cmp ebx, edi
jle 0x4181bf
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x4181c4
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x4181d6
cmp dword [esi + 0x40], edi
jne 0x4181d6
cmp dword [esi + 0x3c], edi
jne 0x4181d6
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x418f10
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x418f38
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418f47
mov eax, 1
ret 4
Function at 0x10001000
Capabilities:
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10001097
push edi
push 0x1000bea0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0x80000
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
push eax
push str.POST
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
or ecx, 0xffffffff
mov edx, dword [esp + 0x18]
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Content_Type:_application_x_www_form_urlencoded
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
push ecx
push str.Content_Type:_application_x_www_form_urlencoded
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0xc]
push ecx
push 0x35e
push edx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1000bea0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, 1
pop esi
ret 0x14
mov eax, 1
pop esi
ret 0x14

Function at 0x10001480
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100014d5
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add esp, 0x14
ret

Function at 0x100014e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], esi
push eax
push esi
mov dword [esp + 0x1c], 0x128
call sub.KERNEL32.dll_Process32First
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
jne 0x10001556
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0x1f0fff
call ebx
mov esi, eax
push 0
push esi
call ebp
push esi
call edi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000152b
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret
Function at 0x10003420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x1001b128]
xor eax, ebp
mov dword [esp + 0x120], eax
xor eax, eax
cmp edx, eax
push edi
je 0x1000351f
cmp esi, eax
je 0x1000351f
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x10016320
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x104
push eax
mov dword [esp + 0x20], 1
call fcn.10002f60
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100034fe
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x10016314
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100034d0
sub eax, edx
mov dword [esp + 0x14], eax
je 0x100034f3
cmp ebx, 0x7fffffff
ja 0x100034f3
push 0x10016310
push ebx
push esi
call fcn.10002f90
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003503
sub eax, edx
pop edi
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
Function at 0x100035b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x1001b128]
xor eax, ebp
mov dword [esp + 0x118], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ebx, 0xffffffff
test esi, esi
mov dword [esp + 0x14], esi
stosb byte es:[edi], al
je 0x100036bb
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003604
sub eax, edi
cmp eax, 2
jb 0x100036bb
cmp byte [esi + 1], 0x3a
jne 0x1000364d
lea eax, [esp + 0x18]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
mov cl, byte [esi + eax]
test cl, cl
je 0x10003643
mov byte [eax], cl
inc eax
dec edx
jne 0x10003630
dec eax
mov byte [eax], 0
jmp 0x1000368d
test edx, edx
jne 0x10003648
dec eax
mov byte [eax], 0
jmp 0x1000368d
mov ebx, 0x104
lea esi, [esp + 0x18]
call fcn.10003420
mov ecx, ebx
mov eax, esi
nop
cmp byte [eax], 0
je 0x1000366b
inc eax
dec ecx
jne 0x10003660
jmp 0x1000368d
test ecx, ecx
je 0x1000368d
mov edx, dword [esp + 0x14]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x20]
push edx
call fcn.10002500
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
Function at 0x100036e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x1001b128]
xor eax, ebp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
xor eax, eax
test esi, esi
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 0xffffffff
stosb byte es:[edi], al
je 0x1000388c
mov eax, esi
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003740
sub eax, edi
cmp eax, 2
jb 0x1000388c
cmp byte [esi + 1], 0x3a
jne 0x10003784
lea eax, [esp + 0x20]
mov edx, esi
mov ecx, eax
mov edi, 0x104
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x1000377a
mov byte [eax], cl
inc eax
dec edi
jne 0x10003767
dec eax
mov byte [eax], 0
jmp 0x100037c3
test edi, edi
jne 0x1000377f
dec eax
mov byte [eax], 0
jmp 0x100037c3
mov ebx, 0x104
lea esi, [esp + 0x20]
call fcn.10003420
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x100037a1
inc eax
dec ecx
jne 0x10003796
jmp 0x100037c3
test ecx, ecx
je 0x100037c3
mov edx, dword [esp + 0x10]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x28]
push edx
call fcn.10002500
mov edx, dword [esp + 0x14]
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x128], bl
mov ecx, 0x41
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push 0x104
lea ecx, [esp + 0x130]
push ecx
push 0x10016344
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x18], eax
cmp byte [esp + 0x128], bl
je 0x1000388c
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x12c]
push 0x10016340
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.10008001
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
ja 0x1000388f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x12c]
push 0x10016338
push edx
call fcn.10008001
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
ja 0x1000388f
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x12c]
push 0x10016334
push ecx
call fcn.10008001
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, ebx
ja 0x1000388f
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
Function at 0x100038b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x1001b128]
xor eax, ebp
mov dword [esp + 0x120], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
xor eax, eax
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ebx, 0xffffffff
test esi, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x1c], esi
stosb byte es:[edi], al
je 0x100039cb
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003912
sub eax, edi
cmp eax, 2
jb 0x100039cb
cmp byte [esi + 1], 0x3a
jne 0x10003954
lea eax, [esp + 0x20]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
mov cl, byte [esi + eax]
test cl, cl
je 0x1000394a
mov byte [eax], cl
inc eax
dec edx
jne 0x10003937
dec eax
mov byte [eax], 0
jmp 0x10003993
test edx, edx
jne 0x1000394f
dec eax
mov byte [eax], 0
jmp 0x10003993
mov ebx, 0x104
lea esi, [esp + 0x20]
call fcn.10003420
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x10003971
inc eax
dec ecx
jne 0x10003966
jmp 0x10003993
test ecx, ecx
je 0x10003993
mov edx, dword [esp + 0x1c]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x28]
push edx
call fcn.10002500
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10007bf7
mov esp, ebp
pop ebp
ret
Function at 0x10004310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push 0x100163c4
push 0x100163bc
push esi
push edi
push 0x100163b4
mov edx, 0x10016344
mov ecx, 0x100163ac
call fcn.100038b0
mov al, byte [edi]
add esp, 0x14
test al, al
jne 0x100043fe
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
mov ebp, eax
call fcn.1000778b
mov esi, eax
add esp, 8
test esi, esi
je 0x100043ca
mov eax, ebp
push ebx
sub eax, esi
add eax, edi
push eax
lea ebx, [esi + 9]
push esi
push ebx
mov dword [esp + 0x20], eax
call fcn.10007c10
mov edx, dword [0x100163a0]
mov ecx, esi
mov dword [ecx], edx
mov eax, dword [0x100163a4]
mov dword [ecx + 4], eax
mov dl, byte [0x100163a8]
add esp, 0xc
push edi
mov byte [ecx + 8], dl
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov byte [ebx], 0x5c
je 0x100043b6
test al, 0x10
je 0x100043b6
mov byte [edi + ebp + 9], 0
jmp 0x100043c9
mov eax, dword [esp + 0x14]
push eax
push ebx
push esi
call fcn.10007c10
add esp, 0xc
mov byte [edi + ebp], 0
pop ebx
mov ecx, 0x104
mov eax, edi
pop ebp
cmp byte [eax], 0
je 0x100043de
inc eax
dec ecx
jne 0x100043d2
pop edi
pop esi
ret
test ecx, ecx
je 0x100043fe
mov eax, 0x104
sub eax, ecx
push 0x10016350
mov ecx, 0x104
sub ecx, eax
push ecx
add eax, edi
push eax
call fcn.10002500
pop edi
pop esi
ret
Function at 0x401660
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1004
call fcn.0041abd0
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne 0x4016ea
push esi
push 0x104
push eax
push edi
call fcn.0041a070
mov eax, dword [esp + 0x1018]
add esp, 0xc
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4016e0
lea ecx, [esp + 4]
push ecx
push 0x1000
lea edx, [esp + 0x10]
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4016d9
test dword [esp + 4], 0xfffffffc
jbe 0x4016d9
mov eax, dword [esp + 8]
push 0x104
push edi
push eax
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x1004
ret
xor eax, eax
add esp, 0x1004
ret
Function at 0x4049f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404a84
movzx ecx, word [esp + 0x1c]
push 0x42eec4
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x404a7d
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x404a7d
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea edx, [esp + 0x14]
push edx
mov esi, eax
push esi
push ebx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404a7d
cmp dword [esp + 0x10], esi
jne 0x404a7d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x404a90
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [0x435aa0]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
push 0
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x404af9
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404af2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x42eee8
lea ecx, [esp + 0x30]
push ecx
call edi
test eax, eax
je 0x404b13
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404ad3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00414fa3
add esp, 0x134
ret
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00414fa3
add esp, 0x134
ret

Function at 0x404b40
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
mov dword [esp], 0
test eax, eax
je 0x404ba0
push str.GetNativeSystemInfo
push 0x42eedc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404b96
lea ecx, [esp]
push ecx
call eax
jmp 0x404ba0
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
je 0x404bb4
cmp ax, 6
mov eax, 0x20
jne 0x404bb9
mov eax, 0x40
add esp, 0x24
ret