joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55b334
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x55b369
cmp edi, dword [esi + 0xc]
jge 0x55b369
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x55b369
cmp edi, dword [eax + 8]
jge 0x55b369
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x55b36b
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x55b46f
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x55b4a3
jmp fcn.0054f474
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x55b514
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x55b60d
cmp eax, dword [edi + 0xc]
jge 0x55b60d
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x55b565
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x55b5f6
cmp dword [ebp + 0xc], ebx
je 0x55b5f6
jmp 0x55b58f
push 0x10
call fcn.0055b200
cmp eax, ebx
je 0x55b57b
mov ecx, eax
call fcn.0055b466
mov esi, eax
jmp 0x55b57d
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x55b5a6
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x55b5b6
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x55b5c8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0054f474
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0053c340
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x55b608
cmp ecx, dword [esi + 8]
jge 0x55b608
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x55b60e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4014a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x1c
mov eax, dword [ebp + 8]
shl eax, 1
push eax
call fcn.0041d553
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401640
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x4014ed
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 8]
jae 0x401571
mov eax, dword [ebp - 4]
mov dword [eax], 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
and edx, 0xffff
mov eax, dword [ebp - 4]
mov word [eax + 4], dx
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
and edx, 0xffff
movzx eax, dx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [ebp - 4]
mov word [ecx + 6], ax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
test ecx, ecx
je 0x40154e
mov edx, dword [ebp - 4]
mov dword [edx + 8], 1
jmp 0x401558
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
jmp 0x4014d2
mov eax, dword [ebp + 0xc]
sub eax, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], 0
jmp 0x40159e
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
sub edx, 4
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0x1c
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jae 0x401622
mov edx, dword [ebp - 4]
mov dword [edx], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
and ecx, 0xffff
mov edx, dword [ebp - 4]
mov word [edx + 4], cx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
and ecx, 0xffff
movzx edx, cx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, dword [ebp - 4]
mov word [ecx + 6], ax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
test ecx, ecx
je 0x4015ff
mov edx, dword [ebp - 4]
mov dword [edx + 8], 3
jmp 0x401609
mov eax, dword [ebp - 4]
mov dword [eax + 8], 2
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
jmp 0x401583
push 0x1c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
shl ecx, 1
push ecx
call dword [sym.imp.USER32.dll_SendInput]
mov edx, dword [ebp - 8]
push edx
call fcn.0041d4c5
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x401670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x43f6fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.HOTKEY01]
mov dword [ebp - 0x218], eax
mov ecx, dword [0x432898]
mov dword [ebp - 0x214], ecx
mov dl, byte [0x43289c]
mov byte [ebp - 0x210], dl
push 0xfb
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.0041d0e0
add esp, 0xc
mov cl, byte [0x43284a]
mov byte [ebp - 0x110], cl
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.0041d0e0
add esp, 0xc
mov al, byte [0x43284a]
mov byte [ebp - 0x428], al
push 0x103
push 0
lea ecx, [ebp - 0x427]
push ecx
call fcn.0041d0e0
add esp, 0xc
mov dl, byte [0x43284a]
mov byte [ebp - 0x320], dl
push 0x103
push 0
lea eax, [ebp - 0x31f]
push eax
call fcn.0041d0e0
add esp, 0xc
lea ecx, [ebp - 0x320]
push ecx
push 0x104
lea edx, [ebp - 0x110]
push edx
push str.ActionCommand
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.Skutil.dll_Reg_GetProfileString]
add esp, 0x14
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x401788
push str.http:__yangtian.lenovo.net_icpsc_remotehelp.aspx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x110]
push eax
push str.ActionCommand
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.Skutil.dll_Reg_SetProfileString]
add esp, 0xc
push 5
push 0
push 0
lea edx, [ebp - 0x110]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cf4c
mov esp, ebp
pop ebp
ret
Function at 0x402ec0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [0x43e8b8], 0
jne 0x402ed7
jmp 0x402fa1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x280], 0
je 0x402fa1
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 1
je 0x402f11
mov ecx, dword [ebp - 0x18]
add ecx, 0xe8
call fcn.00401280
mov byte [0x449211], 1
jmp 0x402f26
mov ecx, dword [ebp - 0x18]
add ecx, 0xe8
call fcn.004012c0
mov byte [0x449211], 0
movzx edx, byte [0x43e8f8]
test edx, edx
je 0x402f42
mov al, byte [0x449211]
mov byte [0x449210], al
mov byte [0x43e8f8], 0
movzx ecx, byte [0x449210]
movzx edx, byte [0x449211]
cmp ecx, edx
je 0x402fa1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
movzx ecx, byte [0x449211]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
call dword [sym.imp.skosd.dll_OSD_ShowNumLk]
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov cl, byte [0x449211]
mov byte [0x449210], cl
mov esp, ebp
pop ebp
ret

Function at 0x402fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [0x43e8b8], 0
jne 0x402fc7
jmp 0x403072
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x280], 0
je 0x403072
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 1
je 0x402ff0
mov byte [0x449213], 1
jmp 0x402ff7
mov byte [0x449213], 0
movzx edx, byte [0x43e8f9]
test edx, edx
je 0x403013
mov al, byte [0x449213]
mov byte [0x449212], al
mov byte [0x43e8f9], 0
movzx ecx, byte [0x449212]
movzx edx, byte [0x449213]
cmp ecx, edx
je 0x403072
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
movzx ecx, byte [0x449213]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
call dword [sym.imp.skosd.dll_OSD_ShowCapsLk]
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov cl, byte [0x449213]
mov byte [0x449212], cl
mov esp, ebp
pop ebp
ret
Function at 0x4035a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43002d
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x43f6fc]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], ecx
mov ax, word [0x433090]
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xa0], 0
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx + 0x48]
push edx
push 0x80
lea eax, [ebp - 0x9c]
push eax
call fcn.0041da5a
add esp, 0xc
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x9c]
push eax
call fcn.0041da40
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40367c
push str._show
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0041d85a
add esp, 8
test eax, eax
jne 0x40365a
mov ecx, dword [ebp - 0xb0]
call fcn.00403ad0
xor eax, eax
jmp 0x403780
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.0041da40
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp 0x40362d
push str.SKD8821_DESC_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 0xb0]
mov dword [edx + 0xa4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4036ce
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xb0]
mov dword [edx + 0xa4], 0
xor eax, eax
jmp 0x403780
push str.Local_AppWizard_Generated_Applications
mov ecx, dword [ebp - 0xb0]
call fcn.00416761
push 0x534
call fcn.00409580
add esp, 4
mov dword [ebp - 0xac], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0xac], 0
je 0x403714
mov ecx, dword [ebp - 0xac]
call fcn.004018d0
mov dword [ebp - 0xb4], eax
jmp 0x40371e
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x20], eax
push 0
push 0
push 0xcf8000
push 0x80
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x140]
call eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.0041053a
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041cf4c
mov esp, ebp
pop ebp
ret
Function at 0x405800
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x43f6fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa4], 0
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.0041d0e0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x405939
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xa8], 2
je 0x40586c
jmp 0x405939
cmp dword [ebp - 0x9c], 4
ja 0x405884
mov dword [ebp - 0xa4], 1
jmp 0x405939
cmp dword [ebp - 0x9c], 5
jne 0x4058a5
cmp dword [ebp - 0x98], 0
jne 0x4058a5
mov dword [ebp - 0xa4], 2
jmp 0x405939
cmp dword [ebp - 0x9c], 5
jne 0x4058c3
cmp dword [ebp - 0x98], 1
jne 0x4058c3
mov dword [ebp - 0xa4], 3
jmp 0x405939
cmp dword [ebp - 0x9c], 5
jne 0x4058e1
cmp dword [ebp - 0x98], 2
jne 0x4058e1
mov dword [ebp - 0xa4], 4
jmp 0x405939
cmp dword [ebp - 0x9c], 6
jne 0x4058ff
cmp dword [ebp - 0x98], 0
jne 0x4058ff
mov dword [ebp - 0xa4], 5
jmp 0x405939
cmp dword [ebp - 0x9c], 6
jne 0x40591d
cmp dword [ebp - 0x98], 1
jne 0x40591d
mov dword [ebp - 0xa4], 6
jmp 0x405939
cmp dword [ebp - 0x9c], 6
jb 0x405939
cmp dword [ebp - 0x98], 0
jb 0x405939
mov dword [ebp - 0xa4], 7
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041cf4c
mov esp, ebp
pop ebp
ret
Function at 0x406550
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], 0
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.0041d0e0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041d0e0
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4065be
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0x5c]
mov esp, ebp
pop ebp
ret 8

Function at 0x4065d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x43f6fc]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406709
mov dword [ebp - 8], 0
jmp 0x40662a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov cl, byte [0x43284a]
mov byte [ebp - 0x120], cl
push 0x103
push 0
lea edx, [ebp - 0x11f]
push edx
call fcn.0041d0e0
add esp, 0xc
mov al, byte [0x43284a]
mov byte [ebp - 0x228], al
push 0x103
push 0
lea ecx, [ebp - 0x227]
push ecx
call fcn.0041d0e0
add esp, 0xc
mov dword [ebp - 0x22c], 0x104
mov dword [ebp - 0x14], 0x104
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4066f8
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4066f6
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0xc], 1
jmp 0x4066ff
jmp 0x4066fa
jmp 0x4066ff
jmp 0x406621
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041cf4c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x409fd4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x409ff8
cmp dword [edi + 0x54], 0
jne 0x409ff8
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041509d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00409f95
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40fbb9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40fc00
call fcn.0041509d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40fc00
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40fc1c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040f733
mov esi, eax
test edi, edi
je 0x40fc1a
test ebx, ebx
je 0x40fc1a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41cf4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f6fc]
jne 0x41cf56
repz ret
jmp fcn.004224fc
Function at 0x429f44
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00421e3a
and dword [ebp - 4], 0
cmp dword [0x44bb74], 0
mov ebx, eax
jne 0x429ff5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42a0a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x437760
push edi
call esi
test eax, eax
je 0x42a0a6
push eax
call fcn.00421dc8
mov dword [esp], 0x437750
push edi
mov dword [0x44bb74], eax
call esi
push eax
call fcn.00421dc8
mov dword [esp], 0x43773c
push edi
mov dword [0x44bb78], eax
call esi
push eax
call fcn.00421dc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44bb7c], eax
call esi
push eax
call fcn.00421dc8
pop ecx
mov dword [0x44bb84], eax
test eax, eax
je 0x429ff5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00421dc8
pop ecx
mov dword [0x44bb80], eax
mov eax, dword [0x44bb80]
cmp eax, ebx
je 0x42a04d
cmp dword [0x44bb84], ebx
je 0x42a04d
push eax
call fcn.00421e43
push dword [0x44bb84]
mov esi, eax
call fcn.00421e43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42a04d
test edi, edi
je 0x42a04d
call esi
test eax, eax
je 0x42a044
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42a044
test byte [ebp - 0xc], 1
jne 0x42a04d
or dword [ebp + 0x10], 0x200000
jmp 0x42a086
mov eax, dword [0x44bb78]
cmp eax, ebx
je 0x42a086
push eax
call fcn.00421e43
pop ecx
test eax, eax
je 0x42a086
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42a086
mov eax, dword [0x44bb7c]
cmp eax, ebx
je 0x42a086
push eax
call fcn.00421e43
pop ecx
test eax, eax
je 0x42a086
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44bb74]
call fcn.00421e43
pop ecx
test eax, eax
je 0x42a0a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42a0a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4904c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49060e
push dword fs:[eax]
mov dword fs:[eax], esp
fild dword [ebp - 8]
fld xword [0x49061c]
fmulp st(1)
call fcn.004029a4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x244]
add eax, dword [ebp - 0xc]
cmp eax, 0x2faf080
jg 0x49051a
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add dword [edx + 0x244], eax
jmp 0x49054e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x244], 0x1e8480
jl 0x490530
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x49054e
mov eax, 0x1e8480
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x244]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x244], 0x1e8480
cmp dword [ebp - 0xc], 0
jle 0x490599
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x240]
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
cmp eax, 0x5f5e100
ja 0x49058c
cmp edx, 0
jne 0x49057c
jmp 0x49057e
jg 0x49058c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add dword [edx + 0x240], eax
jmp 0x490599
mov eax, dword [ebp - 4]
mov dword [eax + 0x240], 0x5f5e100
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
cmp eax, 0x927c0
jbe 0x4905f3
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
push 0x490630
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x240]
call fcn.004091c0
push dword [ebp - 0x14]
push 0x490650
push 0x49065c
push 0x490668
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00403f8c
mov eax, dword [ebp - 0x10]
call fcn.004e42f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490615
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403c70
ret
Function at 0x4bca00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x530]
cmp eax, 0x2710
jbe 0x4bca52
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x530], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x52f], 1
mov ecx, 1
mov edx, 0x4bca70
mov eax, dword [ebp - 4]
call fcn.004bb124
mov byte [ebp - 5], 1
jmp 0x4bca61
xor ecx, ecx
mov edx, 0x4bca94
mov eax, dword [ebp - 4]
call fcn.004bb124
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c03b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x1c0
xor ecx, ecx
mov edx, 0x22
call fcn.00402b58
mov eax, dword [ebp - 4]
lea esi, [eax + 0x198]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
lea esi, [eax + 0x34]
lea edi, [edx + 0x198]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebp - 0x40]
mov edx, dword [ebp - 4]
mov word [edx + 0x1a4], ax
mov ax, word [ebp - 0x3e]
mov edx, dword [ebp - 4]
mov word [edx + 0x1a6], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x1b8], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x1bc], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x1be], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x24a], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x24b], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x248], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x249], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x24c], 1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x250], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x26e], 0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x344], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x34b], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x34c], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x34d], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x354], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x355], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x356], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x357], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x358], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x359], 0
mov eax, dword [ebp - 4]
jmp loc.0050a986