joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d05
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ecx
push ebx
push ebp
xor ebp, ebp
push edi
mov ecx, ebp
movzx eax, byte [ecx + 0x433008]
mov byte [eax + 0x439eb8], cl
inc ecx
cmp ecx, 0x100
jl 0x404d0e
mov al, byte [ebp + 0x433008]
mov byte [esp + 0x10], al
push 2
push dword [esp + 0x14]
mov byte [ebp*4 + 0x43abb9], al
mov byte [ebp*4 + 0x43abb8], al
mov byte [ebp*4 + 0x43a7bb], al
mov byte [ebp*4 + 0x43a7b8], al
mov byte [ebp*4 + 0x43a3bb], al
mov byte [ebp*4 + 0x43a3ba], al
mov byte [ebp*4 + 0x439fba], al
mov byte [ebp*4 + 0x439fb9], al
call fcn.004054ca
push 3
push dword [esp + 0x14]
mov byte [ebp*4 + 0x43abbb], al
mov byte [ebp*4 + 0x43a7ba], al
mov byte [ebp*4 + 0x43a3b9], al
mov byte [ebp*4 + 0x439fb8], al
call fcn.004054ca
mov bl, byte [ebp + 0x439eb8]
push 0xb
mov byte [esp + 0x10], bl
push dword [esp + 0x10]
mov byte [ebp*4 + 0x43abba], al
mov byte [ebp*4 + 0x43a7b9], al
mov byte [ebp*4 + 0x43a3b8], al
mov byte [ebp*4 + 0x439fbb], al
call fcn.004054ca
movzx edi, bl
push 9
push dword [esp + 0x10]
mov byte [ebp*4 + 0x43bbba], al
mov byte [ebp*4 + 0x43b7b9], al
mov byte [ebp*4 + 0x43b3b8], al
mov byte [ebp*4 + 0x43afbb], al
mov byte [edi*4 + 0x43cbba], al
mov byte [edi*4 + 0x43c7b9], al
mov byte [edi*4 + 0x43c3b8], al
mov byte [edi*4 + 0x43bfbb], al
call fcn.004054ca
push 0xd
push dword [esp + 0x10]
mov byte [ebp*4 + 0x43bbb8], al
mov byte [ebp*4 + 0x43b7bb], al
mov byte [ebp*4 + 0x43b3ba], al
mov byte [ebp*4 + 0x43afb9], al
mov byte [edi*4 + 0x43cbb8], al
mov byte [edi*4 + 0x43c7bb], al
mov byte [edi*4 + 0x43c3ba], al
mov byte [edi*4 + 0x43bfb9], al
call fcn.004054ca
push 0xe
push dword [esp + 0x10]
mov byte [ebp*4 + 0x43bbb9], al
mov byte [ebp*4 + 0x43b7b8], al
mov byte [ebp*4 + 0x43b3bb], al
mov byte [ebp*4 + 0x43afba], al
mov byte [edi*4 + 0x43cbb9], al
mov byte [edi*4 + 0x43c7b8], al
mov byte [edi*4 + 0x43c3bb], al
mov byte [edi*4 + 0x43bfba], al
call fcn.004054ca
mov byte [ebp*4 + 0x43bbbb], al
mov byte [ebp*4 + 0x43b7ba], al
mov byte [ebp*4 + 0x43b3b9], al
mov byte [ebp*4 + 0x43afb8], al
inc ebp
mov byte [edi*4 + 0x43cbbb], al
mov byte [edi*4 + 0x43c7ba], al
mov byte [edi*4 + 0x43c3b9], al
mov byte [edi*4 + 0x43bfb8], al
cmp ebp, 0x100
jl 0x404d24
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4055a8
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov ebp, ecx
lea eax, [esp + 0x1c]
push edi
push 0x20
push dword [esp + 0x48]
mov esi, dword [ebp + 4]
sub esi, 6
mov dword [esp + 0x18], ebp
push eax
mov dword [esp + 0x24], esi
call fcn.00415140
add esp, 0xc
xor ebx, ebx
xor edx, edx
xor edi, edi
test esi, esi
jle 0x405628
cmp ebx, dword [ebp + 4]
jg 0x40578c
cmp edi, esi
jge 0x405615
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x405611
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x4055f1
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x40561b
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x4055dc
cmp ebx, dword [ebp + 4]
jg 0x40578c
mov edi, 0x433108
movzx eax, byte [esp + esi*4 + 0x1d]
mov cl, byte [esp + 0x20]
xor cl, byte [eax + 0x433008]
mov byte [esp + 0x20], cl
movzx eax, byte [esp + esi*4 + 0x1e]
mov al, byte [eax + 0x433008]
xor byte [esp + 0x21], al
movzx eax, byte [esp + esi*4 + 0x1f]
mov al, byte [eax + 0x433008]
xor byte [esp + 0x22], al
movzx eax, byte [esp + esi*4 + 0x1c]
mov al, byte [eax + 0x433008]
xor byte [esp + 0x23], al
mov al, byte [edi]
xor al, cl
inc edi
mov byte [esp + 0x20], al
mov dword [esp + 0x1c], edi
cmp esi, 8
je 0x4056b9
cmp esi, 1
jle 0x4056ad
lea eax, [esi - 1]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], eax
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x40569b
sub dword [esp + 0x14], 1
jne 0x405698
xor edi, edi
test esi, esi
jle 0x40577f
jmp 0x405737
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 3
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x4056c8
sub dword [esp + 0x14], 1
jne 0x4056c5
movzx eax, byte [esp + 0x2c]
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], 3
mov al, byte [eax + 0x433008]
xor byte [esp + 0x30], al
movzx eax, byte [esp + 0x2d]
mov al, byte [eax + 0x433008]
xor byte [esp + 0x31], al
movzx eax, byte [esp + 0x2e]
mov al, byte [eax + 0x433008]
xor byte [esp + 0x32], al
movzx eax, byte [esp + 0x2f]
mov al, byte [eax + 0x433008]
xor byte [esp + 0x33], al
push 4
pop edi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x405725
sub dword [esp + 0x14], 1
jne 0x405722
cmp ebx, dword [ebp + 4]
jg 0x405782
cmp edi, esi
jge 0x40576c
lea ebp, [esp + 0x20]
lea ebp, [ebp + edi*4]
cmp edx, 4
jge 0x405768
mov esi, dword [esp + 0x10]
lea ecx, [edx + ebx*4]
mov eax, dword [ebp]
inc edi
add ebp, 4
inc edx
mov dword [esi + ecx*4 + 0x18], eax
mov esi, dword [esp + 0x18]
cmp edi, esi
jl 0x405748
mov ebp, dword [esp + 0x10]
cmp edx, 4
jne 0x405772
inc ebx
lea eax, [edx - 4]
neg eax
sbb eax, eax
and edx, eax
cmp edi, esi
jl 0x405737
cmp ebx, dword [ebp + 4]
mov edi, dword [esp + 0x1c]
jle 0x405636
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4
Function at 0x4145d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x414612
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414612
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414612
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x414612
cmp dword [ecx + 0x74], 0xe
jbe 0x414612
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4269d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4269fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4269fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x1cde2024
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5d451f50
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x7f835116
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x708230a1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x403bf6
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403c0e
push dword [esp + 4]
push 0x403b8f
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403c4b
push esi
mov esi, dword [0x4cd300]
test esi, esi
je 0x403c4a
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403c42
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x4cd300
call fcn.00404dda
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403c1b
pop edi
pop ebx
pop esi
ret 4
Function at 0x4043b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4043e5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x404670
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x4cd364]
push ebx
push esi
push edi
push eax
or edi, 0xffffffff
push ecx
or ebx, edi
call fcn.00404c1e
mov esi, eax
test esi, esi
je 0x4046ca
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov eax, dword [esp + 0x10]
xor edi, edi
xor edx, edx
or ecx, edx
or edi, eax
cmp dword [esi + 4], edx
je 0x4046c0
cmp dword [esi + 0x14], edx
jne 0x4046c0
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
cdq
add ecx, eax
adc edi, edx
mov edx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
ret 4

Function at 0x4046e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4cd364]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00404c1e
test eax, eax
je 0x40472a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x404717
push 1
push edx
push eax
call fcn.004049a0
movzx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x404740
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4cd364]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00404c1e
test eax, eax
je 0x40478a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x404777
push 4
push edx
push eax
call fcn.004049a0
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x4047a0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x4cd364]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.00404c1e
test eax, eax
je 0x4047ea
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x4047d7
push 1
push edx
push eax
call fcn.004049a0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x404800
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x404859
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x404858
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4cd364]
push eax
push ecx
call fcn.00404c1e
test eax, eax
je 0x404854
cmp dword [eax + 4], 0
je 0x404842
push esi
push edi
push eax
call fcn.00404ad0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x404860
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.004050b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x4cd364]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.00404c1e
mov ebx, eax
test ebx, ebx
je 0x40497e
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x4048be
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004049a0
mov dword [esp + 0x14], eax
jmp 0x4048d5
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x4048e7
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x404911
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.004050b0
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x40497d
cmp dword [esp + 0x14], 0
je 0x404928
cmp al, 0xd
je 0x404928
cmp al, 0xa
jne 0x4048a0
sub ebp, 1
cmp al, 0xd
jne 0x40497d
cmp dword [ebx + 4], 0
je 0x404944
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004049a0
jmp 0x40495b
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x40497d
cmp dword [ebx + 4], 0
je 0x40496e
add dword [ebx + 0xc], 1
jmp 0x40497d
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.00405130
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x404ad0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x404af2
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x404b6b
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x404b58
sub ecx, 1
je 0x404b43
sub ecx, 2
je 0x404b30
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.004043b0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x404b98
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x456a7a70
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x773e693b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401450
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x428233
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x432ac0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x432ac0]
xor eax, esp
push eax
lea eax, [esp + 0x14c]
mov dword fs:[0], eax
xor ebx, ebx
push 0x124
lea eax, [esp + 0x24]
push ebx
mov dword [esp + 0x15c], ebx
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00415d60
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
jne 0x4014ee
mov dword [esp + 0x154], ebp
mov eax, dword [esp + 0x15c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4014e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4015c6
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov edi, dword [esp + 0x15c]
je 0x40159b
push 0x42c46b
lea ecx, [esp + 0x18]
call fcn.00402650
mov byte [esp + 0x154], 1
lea eax, [esp + 0x40]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x401530
sub eax, edx
push eax
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x1c]
call fcn.00402430
mov eax, dword [esp + 0x14]
push eax
push edi
call fcn.00412e55
add esp, 8
test eax, eax
je 0x40156d
lea ecx, [esp + 0x1c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401526
jmp 0x401575
mov dword [esp + 0x18], 1
mov byte [esp + 0x154], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40159b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [esp + 0x154], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4015c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00412a2f
add esp, 0x144
ret 4
Function at 0x4017f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x20], 0
call fcn.00415d60
add esp, 8
xor eax, eax
mov ecx, esp
mov dword [esp + 0x20], esp
push str.explorer.exe
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x68], 5
mov dword [esp + 0x40], str.Winsta0Default
mov dword [esp + 0x38], 0x44
call fcn.00402650
call fcn.00401940
test eax, eax
jne 0x40185e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 4
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x401852
lea ecx, [esp + 0x14]
push ecx
push 0x2000000
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x401919
push str.userenv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401919
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push ebx
call edi
push str.DestroyEnvironmentBlock
push ebx
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x40190e
test edi, edi
je 0x40190e
mov edx, dword [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x20]
push eax
call esi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
push 0
push eax
push 0x408
push 0
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40192d
push eax
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 4

Function at 0x402890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4028a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4028e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4028e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4028e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4028d0
cmp esi, eax
jb 0x4028ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4029b1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x4029bf
xor al, al
pop esi
pop ecx
ret
mov eax, dword [esi + 0xc]
push eax
mov byte [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x4033b0
push 0
push 0
mov dword [esi + 4], 0xffffffff
mov dword [esp + 0x1c], 0
call fcn.00414f52
add esp, 0x18
mov dword [esi + 4], eax
mov al, 1
pop esi
pop ecx
ret