joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e10a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4942e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esi], 0x49f41c
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
call fcn.004678a0
mov ecx, dword [esp + 8]
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x45eaa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 4]
push 4
push str.VoiceManager
push eax
push 0x14
mov dword [esp + 0x30], eax
call fcn.00475ec0
mov esi, eax
add esp, 0x10
mov dword [esp + 0xc], esi
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x18], ebx
je 0x45eb0d
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.004678a0
mov dword [esi + 0xc], eax
pop edi
mov dword [esi + 0x10], ebx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0xfffffffffffffffd
push 0x49f530
push ebx
call fcn.00475d20
mov ecx, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x479fd0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x494548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x24]
push 4
push str.CriDelegateWin
push eax
push 0xb8
mov dword [edi], 0
call fcn.00475ec0
add esp, 0x10
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x47a028
mov ecx, eax
call fcn.00479660
mov esi, eax
jmp 0x47a02a
xor esi, esi
test esi, esi
mov dword [esp + 0x18], 0xffffffff
jne 0x47a05d
push str.E2006082001:Can_not_allocate_memory.
push esi
call fcn.00475c60
add esp, 8
mov dword [edi], 0xfffffffd
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x24]
push ecx
lea edx, [esi + 0xc]
push 0x40
push edx
call fcn.00475f50
add esp, 0xc
test eax, eax
mov dword [esi + 8], eax
je 0x47a177
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x47a177
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 0x50]
push 0x40
push ecx
call fcn.00475f50
add esp, 0xc
test eax, eax
mov dword [esi + 0x4c], eax
je 0x47a144
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x47a144
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x94], eax
jne 0x47a0d0
push str.E2006082004:Can_not_create_wait_event.
jmp 0x47a149
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x479fc0
push 0
push 0
call fcn.0043b71a
add esp, 0x18
test eax, eax
mov dword [esi + 0x90], eax
jne 0x47a0fa
push str.E2006082005:Can_not_create_thread.
jmp 0x47a149
mov eax, dword [esi + 0xa8]
test eax, eax
jne 0x47a11e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0xa
call edi
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x47a110
mov eax, dword [esi + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0xb0], eax
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.E2006082003:Can_not_create_critical_section.
push 0
call fcn.00475c60
add esp, 8
mov dword [edi], 0xffffffff
mov edx, dword [esi]
push 0x4c6a88
mov ecx, esi
call dword [edx]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.E2006082002:Can_not_create_critical_section.
push 0
call fcn.00475c60
add esp, 8
mov dword [edi], 0xffffffff
mov eax, dword [esi]
push 0x4c6a88
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0x10]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x47b180
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
call dword [0x4c6c7c]
mov ebx, dword [ebp + 8]
mov esi, eax
mov eax, dword [0x4c6c8c]
test eax, eax
je 0x47b1c5
cmp esi, ebx
jae 0x47b1c7
mov eax, dword [0x4c6c8c]
test eax, eax
jge 0x47b1bf
mov eax, dword [0x4c6c8c]
neg eax
cmp esi, eax
jae 0x47b1bf
or esi, 0xffffffff
jmp 0x47b1c5
add esi, dword [0x4c6c8c]
cmp esi, ebx
jbe 0x47b1cb
xor esi, esi
xor edx, edx
lea ecx, [ebx + 0x32]
mov eax, 0x5f5e100
div ecx
xor edx, edx
div edi
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, ebx
sub eax, esi
imul eax, eax, 0x186a0
div ecx
xor edx, edx
div edi
mov edi, eax
cmp edi, 1
jle 0x47b20f
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
cmp esi, ebx
jae 0x47b2d3
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ecx]
lea ecx, [esp + 0x10]
push ecx
call ebx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4c6c98]
call fcn.0048f9c0
mov esi, eax
mov edi, edx
mov edi, edi
lea edx, [esp + 0x18]
push edx
call ebx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x4c6c98]
call fcn.0048f9c0
push 0
sub eax, esi
push 0xf4240
sbb edx, edi
push edx
push eax
call fcn.0043f080
mov ecx, dword [0x4c6c64]
push ecx
mov ecx, dword [0x4c6c60]
push ecx
push edx
push eax
call fcn.0043f0c0
cmp eax, dword [esp + 0xc]
jl 0x47b240
call dword [0x4c6c7c]
mov ecx, dword [0x4c6c8c]
test ecx, ecx
mov ecx, dword [ebp + 8]
je 0x47b2bf
cmp eax, ecx
jae 0x47b2c1
mov edx, dword [0x4c6c8c]
test edx, edx
jge 0x47b2b9
mov edx, dword [0x4c6c8c]
neg edx
cmp eax, edx
jae 0x47b2b9
or eax, 0xffffffff
jmp 0x47b2bf
add eax, dword [0x4c6c8c]
cmp eax, ecx
ja 0x47b2d3
mov edx, ecx
shr edx, 1
cmp eax, edx
jb 0x47b2d3
cmp eax, ecx
jb 0x47b220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b750
Capabilities:
Resume thread

Disassembly:
sub esp, 8
mov ecx, dword [0x4c6d08]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
cmp ecx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x14], eax
mov ebp, 1
je 0x47b80c
mov dword [esp + 0x10], eax
jmp 0x47b790
mov dword [0x4c6cec], ebp
mov eax, dword [0x4c6d08]
push 2
push eax
call esi
mov ecx, dword [0x4c6d08]
push ecx
call edi
mov edx, dword [0x4c6d08]
push 0x3e8
push edx
call ebx
cmp eax, 0x102
jne 0x47b7cc
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x47b790
cmp dword [esp + 0x10], 0x1e
jne 0x47b7e8
push str.02100901:_Timeout_Error:_adxm_destroy_thrd__vsync_
call fcn.00486d60
add esp, 4
mov dword [esp + 0x14], 0xffffffff
xor eax, eax
mov dword [0x4c6cf0], eax
mov dword [0x4c6cec], eax
mov eax, dword [0x4c6d08]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x4c6d04], eax
mov dword [0x4c6d08], eax
cmp dword [0x4c6d10], eax
je 0x47b89e
mov dword [esp + 0x10], eax
lea esp, [esp]
mov dword [0x4c6cf4], ebp
mov ecx, dword [0x4c6d10]
push 2
push ecx
call esi
mov edx, dword [0x4c6d10]
push edx
call edi
mov eax, dword [0x4c6d10]
push 0x3e8
push eax
call ebx
cmp eax, 0x102
jne 0x47b85c
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x47b820
cmp dword [esp + 0x10], 0x1e
jne 0x47b879
push str.02100902:_Timeout_Error:_ADXWIN_DisableFsThrd
call fcn.00486d60
mov eax, dword [esp + 0x18]
add esp, 4
dec eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [0x4c6cf8], eax
mov dword [0x4c6cf4], eax
mov ecx, dword [0x4c6d10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x4c6d0c], eax
mov dword [0x4c6d10], eax
cmp dword [0x4c6d18], eax
je 0x47b930
mov dword [esp + 0x10], eax
mov edi, edi
mov dword [0x4c6cfc], ebp
mov edx, dword [0x4c6d18]
push 2
push edx
call esi
mov eax, dword [0x4c6d18]
push eax
call edi
mov ecx, dword [0x4c6d18]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x47b8ec
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x47b8b0
cmp dword [esp + 0x10], 0x1e
jne 0x47b909
push str.02100903:_Timeout_Error:_adxm_destroy_thrd__mwidle_
call fcn.00486d60
mov eax, dword [esp + 0x18]
add esp, 4
dec eax
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [0x4c6d00], esi
mov dword [0x4c6cfc], esi
mov edx, dword [0x4c6d18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c6d14], esi
mov dword [0x4c6d18], esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x47ba70
Capabilities:
Create thread

Disassembly:
push 0x4c6d04
push 4
push 0
push 0x47b9c0
push 0x100000
push 0
call fcn.0043b71a
mov dword [0x4c6d08], eax
mov eax, dword [0x4c6d08]
add esp, 0x18
test eax, eax
jne 0x47baac
push str.E02100911_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00486d60
add esp, 4
or eax, 0xffffffff
ret
push 0x4c6d0c
push 4
push 0
push 0x47ba30
push 0x100000
push 0
call fcn.0043b71a
mov dword [0x4c6d10], eax
mov eax, dword [0x4c6d10]
add esp, 0x18
test eax, eax
jne 0x47bae8
push str.E02100912_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00486d60
add esp, 4
or eax, 0xffffffff
ret
push 0x4c6d14
push 4
push 0
push 0x47b670
push 0x100000
push 0
call fcn.0043b71a
mov dword [0x4c6d18], eax
mov eax, dword [0x4c6d18]
add esp, 0x18
test eax, eax
jne 0x47bb24
push str.E02100913_:_The_error_occurred_within_the_CreateThread_function.
call fcn.00486d60
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x47bb30
Capabilities:
Resume thread

Disassembly:
push edi
push 0x4c6cc4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x47bc2e
push esi
push eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
call fcn.0047b2e0
xor esi, esi
mov dword [0x4c6cec], esi
mov dword [0x4c6cf0], esi
mov dword [0x4c6cfc], esi
mov dword [0x4c6d00], esi
mov dword [0x4c6cd8], esi
call fcn.00486680
push esi
push esi
call fcn.00486590
push esi
push esi
call fcn.004865b0
push 0x47b5d0
call fcn.00486760
add esp, 0x14
cmp edi, esi
jne 0x47bbb8
mov dword [0x4c6cc8], 2
mov dword [0x4c6ccc], 1
mov dword [0x4c6cd0], 0xfffffff1
jmp 0x47bbd1
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [0x4c6cc8], eax
mov dword [0x4c6ccc], ecx
mov dword [0x4c6cd0], edx
call fcn.0047ba70
test eax, eax
jl 0x47bbe3
call fcn.0047b940
test eax, eax
jge 0x47bbef
call fcn.0047b750
pop esi
pop edi
jmp fcn.00486720
mov eax, dword [0x4c6ccc]
push eax
call fcn.0047c670
mov ecx, dword [0x4c6d08]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
add esp, 4
push ecx
call edi
mov edx, dword [0x4c6d10]
push edx
call edi
mov eax, dword [0x4c6d18]
push eax
call edi
push esi
push 0x47b5f0
push 6
call fcn.00486a10
add esp, 0xc
pop esi
pop edi
ret

Function at 0x488b10
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push edi
je 0x488b55
mov edi, dword [esp + 0xc]
test edi, edi
je 0x488b55
push esi
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x488b44
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x488b44
pop esi
xor eax, eax
pop edi
ret
mov edx, dword [esp + 0xc]
mov dword [edi], esi
pop esi
mov dword [edi + 4], edx
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x48e984
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4b9668]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0048e919
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043cd70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x48e9d3
cmp dword [ebp - 0x1c], 5
jb 0x48e9eb
jmp 0x48e9e7
cmp dword [ebp - 0x10], 1
jne 0x48e9eb
cmp dword [ebp - 0x1c], 4
ja 0x48e9e7
jne 0x48e9eb
cmp dword [ebp - 0x18], 0
jbe 0x48e9eb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4a676c
call fcn.0048e80a
test eax, eax
jge 0x48ea0c
mov byte [0x4d8048], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043a54e
add ebp, 0x78
leave
ret

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x76751cdd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7f172df3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x402959
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40296f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402966
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4029a2
nop
cmp esi, ecx
jae 0x402966
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402990
cmp esi, ecx
jae 0x402966
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.0040fac7
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x402b51
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402b51
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402b51
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402b51
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402ad8
cmp esi, ecx
jae 0x402b51
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402ac2
cmp esi, ecx
jae 0x402b51
movzx eax, word [esi]
test ax, ax
je 0x402b51
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402b0b
push edi
mov ecx, ebx
call fcn.00402da0
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x402b0e
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0055a782
add esp, 0x10
cmp eax, 0x50
ja case.0x402b2c.1
movzx eax, byte [eax + 0x402b80]
jmp dword [eax*4 + 0x402b70]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402b61
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0040f87b
push 0x80070057
call fcn.00402f40
call fcn.0040f861
xor ebp, dword [ebx]
inc eax
add byte [ebx + ebp + 0x40], bl
add byte [ebx + 0x2b], ch
inc eax
add byte [ebx + 0x2b], ch
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x403260
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x5db004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, ecx
mov dword [ebp - 0x234], 0
push 2
mov dword [ebp - 0x238], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x403339
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
mov ecx, dword [esi]
lea eax, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4032ee
test dx, dx
je 0x4032ea
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4032ee
add ecx, 4
add eax, 4
test dx, dx
jne 0x4032c8
xor eax, eax
jmp 0x4032f3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403312
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x403322
mov esi, dword [ebp - 0x238]
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x4032c0
jmp 0x403338
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov dword [ebp - 0x234], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
call fcn.00555b04
mov esp, ebp
pop ebp
ret

Function at 0x403360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5db004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [edx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4033cb
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4033c9
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00555b04
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00555b04
mov esp, ebp
pop ebp
ret
Function at 0x4033e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5db004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [edx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403458
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x403456
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00555b04
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00555b04
mov esp, ebp
pop ebp
ret
Function at 0x40d2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041d671

Function at 0x410933
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x410978
call fcn.0042c28c
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x410975
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4109bf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x41099b
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5829ec]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4109bc
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x5829ec]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x41ce5a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41cead
push esi
push dword [ebp + 8]
call fcn.0041d043
mov edi, eax
test edi, edi
je 0x41cea8
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41cea8
mov eax, dword [ebp - 8]
jmp 0x41cebf
mov eax, dword [ebp + 0x10]
jmp 0x41cebf
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x41d6c9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.0042c28c
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41d6fc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.0041d70f
pop edi
pop esi
pop ebx
pop ebp
ret 8