joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e62
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [0x406198]
mov esi, dword [esi + 8]
and dword [ebp - 8], 0
and dword [0x40612c], 0
movzx edi, ax
xor edx, edx
mov eax, edi
mov ecx, 0x3ff
inc edx
and esi, 0xff
and eax, ecx
mov dword [ebp - 4], edx
cmp esi, edx
jbe 0x402edc
push ebx
mov ebx, dword [0x40618c]
add ebx, 0x62
movzx edx, word [ebx]
cmp di, dx
je 0x402ee0
cmp dword [ebp - 8], 0
jne 0x402ec4
and edx, ecx
cmp ax, dx
jne 0x402ec4
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
inc dword [ebp - 4]
add ebx, 0x62
cmp dword [ebp - 4], esi
jb 0x402ea9
mov eax, dword [ebp - 8]
test eax, eax
je 0x402edb
mov dword [0x40612c], eax
pop ebx
pop edi
pop esi
leave
ret
mov eax, dword [ebp - 4]
jmp 0x402ed6

Function at 0x402ee5
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.00402154
pop ecx
push 2
pop edi
push 0x5c
mov dword [0x4061a4], eax
pop ebx
test eax, eax
je 0x402f5f
push 1
lea esi, [ebp - 0x208]
call fcn.00401d64
pop ecx
test eax, eax
je 0x402f5f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, edi
test cx, cx
jne 0x402f24
sub eax, edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x208]
je 0x402f48
cmp word [ecx - 2], bx
je 0x402f48
mov eax, ebx
mov word [ecx], ax
add ecx, edi
mov eax, dword [0x4061c0]
mov edx, ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
test cx, cx
jne 0x402f51
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, edi
test cx, cx
jne 0x402f68
sub eax, edx
sar eax, 1
lea esi, [ebp + eax*2 - 0x208]
cmp word [esi - 2], bx
je 0x402f8d
mov word [esi], bx
add esi, edi
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402fa3
test al, 0x10
jne 0x402fb9
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402fb9
inc eax
jmp 0x403010
xor ebx, ebx
cmp dword [0x4061cc], ebx
jne 0x402fee
mov eax, dword [0x4061c8]
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x402fcc
lea eax, [ebp - 0x208]
push eax
call fcn.00403cee
pop ecx
mov dword [0x4061cc], eax
jmp 0x402ff8
mov dword [0x4061a8], 1
push ebx
call fcn.004018b9
push 1
push esi
push ebx
lea eax, [ebp - 0x208]
call fcn.00401a8d
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403106
Capabilities:
Create process on windows

Disassembly:
push ebx
call fcn.00402b28
xor ebx, ebx
mov dword [0x406198], eax
cmp eax, ebx
jne 0x40312e
push 0x10
push ebx
push str.This_setup_package_is_damaged_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
inc eax
jmp 0x4031f8
mov ecx, dword [eax + 4]
movzx edx, cx
test edx, edx
je 0x403176
and ecx, dword [0x4061ac]
test ecx, 0xffff
jne 0x403176
push 0x10
push ebx
push str.This_operating_system_is_not_supported_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x403126
mov eax, dword [0x4061ec]
cmp eax, ebx
je 0x403126
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x403126
mov al, byte [eax + 9]
cmp al, bl
je 0x403191
movzx eax, al
test dword [0x4061b0], eax
jne 0x403191
push eax
call fcn.00403015
pop ecx
jmp 0x403126
call fcn.00402e62
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x4031b1
push 0x10
push ebx
push 0x15
pop edx
call fcn.00401e3b
push eax
jmp 0x40311f
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x4031c8
cmp cl, 0x2f
jne 0x4031da
mov al, byte [eax + 1]
cmp al, 0x73
je 0x4031d3
cmp al, 0x53
jne 0x4031da
call fcn.00402ee5
jmp 0x4031f6
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push dword [esp + 8]
push 0x402a3c
push ebx
push 1
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
pop ebx
ret 0x10

Function at 0x4031fc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push str.IsWow64Process2
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403253
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x403253
movzx eax, word [ebp - 4]
sub eax, 0x14c
je 0x403285
sub eax, 0x78
je 0x403280
sub eax, 0x84a0
je 0x40327c
sub eax, 0x2400
jmp 0x403272
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x2c]
test eax, eax
je 0x403285
cmp eax, 5
je 0x403280
cmp eax, 9
je 0x40327c
cmp eax, 0xc
je 0x403278
xor eax, eax
jmp 0x403288
push 4
jmp 0x403282
push 2
jmp 0x403282
push 8
pop eax
jmp 0x403288
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x403393
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push 0x40
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00403e68
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push esi
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4033d8
mov eax, 0x12345678
jmp 0x403401
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call fcn.0040336e
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x403d35
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0x403d5a
cmp al, 0x20
jle 0x403d6c
inc esi
cmp byte [esi], 0x20
jg 0x403d4e
jmp 0x403d6c
cmp al, 0x22
je 0x403d6b
inc esi
mov al, byte [esi]
test al, al
jne 0x403d56
cmp al, 0x22
jne 0x403d6c
jmp 0x403d6b
cmp al, 0x20
jg 0x403d72
inc esi
mov al, byte [esi]
test al, al
jne 0x403d67
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403df4
push 0x4041ac
push 0x4041a8
call fcn.00403dda
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403da2
movzx eax, word [ebp - 0x14]
jmp 0x403da5
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00403e0c
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1b9d2a5b
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
mov ecx, 0x73b333b7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x27786f60
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x45f90d49
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4047fe
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48c
mov eax, dword [0x45c4d0]
xor eax, esp
mov dword [esp + 0x488], eax
push ebx
push esi
push edi
sub esp, 0x14
mov esi, ecx
call fcn.00427caa
mov ecx, dword [0x45f408]
add esp, 0x14
test ecx, ecx
je 0x404837
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
xor edi, edi
push 0x206
mov word [esp + 0x84], ax
lea eax, [esp + 0x86]
push edi
push eax
call fcn.0042e7e0
add esp, 0xc
lea eax, [esp + 0x80]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404887
push str.TencentQQBrowser_bugreport.exe
lea eax, [esp + 0x84]
push ebx
push eax
call fcn.0042c16e
add esp, 0xc
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404a12
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
mov dword [0x45f2b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x45f254]
mov dword [0x45f2b8], eax
mov eax, dword [0x45f258]
sub eax, ecx
mov dword [0x45f2c8], esi
cdq
mov esi, 0x280
idiv esi
mov dword [0x45f2c0], edi
test eax, eax
je 0x4048e5
mov dword [0x45f2d0], ecx
mov dword [0x45f2d4], eax
xor eax, eax
push 0x206
mov word [esp + 0x28c], ax
lea eax, [esp + 0x28e]
push edi
push eax
call fcn.0042e7e0
add esp, 0xc
mov dword [esp + 0x1c], 0xc
xor eax, eax
mov dword [esp + 0x20], edi
inc eax
mov dword [esp + 0x24], eax
push edi
push edi
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x40
mov esi, eax
mov dword [esp + 0x3c], 0x44
lea eax, [esp + 0x40]
push edi
push eax
call fcn.0042e7e0
add esp, 0xc
xorps xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor edx, edx
mov dword [esp + 0x14], edi
inc edx
xor ecx, ecx
push edx
push edi
mov word [esp + 0x74], cx
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x80], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404a08
test esi, esi
je 0x404a0f
call ebx
push eax
push 0x45f2b0
push dword [esp + 0x18]
lea eax, [esp + 0x294]
push esi
push str.bugreport__buginfo:_p:_p:_p:_lu
push 0x104
push eax
call fcn.00404def
add esp, 0x1c
lea eax, [esp + 0x28]
xor ebx, ebx
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [esp + 0x2a8]
push eax
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404a08
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push ebx
push eax
push 2
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esp + 0x28]
call edi
push dword [esp + 0x2c]
call edi
test esi, esi
je 0x404a0f
push esi
call edi
xor eax, eax
inc eax
mov ecx, dword [esp + 0x494]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042b782
mov esp, ebp
pop ebp
ret
Function at 0x405142
Capabilities:
Delete directory

Disassembly:
push 0x5c
mov eax, 0x445d85
call fcn.0042f004
mov ebx, ecx
mov dword [ebp - 0x48], ebx
xor esi, esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401a3b
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00404e42
push 0x44fb0c
lea ecx, [ebp - 0x44]
call fcn.00403d75
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00404f91
push esi
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004040c8
push esi
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x2c]
call fcn.004052a7
pop ecx
push esi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004040c8
lea edx, [ebp - 0x54]
mov ecx, ebx
call fcn.0040539b
mov eax, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x60]
sub eax, esi
cdq
push 0x18
pop edi
idiv edi
mov ebx, dword [ebp - 0x54]
mov ecx, eax
mov eax, dword [ebp - 0x50]
sub eax, ebx
cdq
idiv edi
mov edi, eax
mov dword [ebp - 0x64], edi
test ecx, ecx
je 0x405242
mov ebx, dword [ebp - 0x48]
mov edi, ecx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401a3b
mov edx, esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00404f91
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0042c9ab
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004040c8
add esi, 0x18
dec edi
jne 0x4051fd
mov edi, dword [ebp - 0x64]
mov ebx, dword [ebp - 0x54]
test edi, edi
je 0x40528f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x2c]
call fcn.00401a3b
mov edx, ebx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.00404f91
lea ecx, [ebp - 0x2c]
call fcn.00405142
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004040c8
add ebx, 0x18
dec edi
jne 0x405246
lea ecx, [ebp - 0x54]
call fcn.0040219f
lea ecx, [ebp - 0x60]
call fcn.0040219f
mov al, 1
call fcn.0042efc2
ret
Function at 0x406e98
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x456fb8
call fcn.00433270
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x406eff
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x406eff
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x406eff
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x406eff
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x406f08
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.004332b5
ret
Function at 0x406f84
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x45f1e0]
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x45f1e8]
test edx, edx
jne 0x406fd2
test eax, eax
je 0x406fe5
mov edx, eax
mov dword [0x45f1e0], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x406fe5
cmp ecx, ebx
jb 0x406fe5
cmp ecx, edi
jbe 0x4070bd
mov edx, eax
test eax, eax
jmp 0x407007
test edx, edx
je 0x407002
mov eax, dword [edx + 8]
test eax, eax
je 0x407002
cmp eax, ebx
jb 0x407002
cmp eax, edi
jbe 0x4070bd
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x45f1e0], edx
jne 0x406feb
movzx eax, si
sub esi, eax
mov ecx, esi
cmp esi, ebx
jbe 0x40715d
lea eax, [ecx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe ecx, edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40715d
mov eax, 0x10000
cmp dword [ebp - 0x2c], eax
jne 0x407058
cmp dword [ebp - 0x30], eax
jae 0x40706a
mov ecx, dword [ebp - 0x38]
add ecx, 0xffff0000
cmp ecx, ebx
ja 0x40701e
jmp 0x40715d
push 0x40
push 0x3000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x45f1e0], edx
test edx, edx
je 0x40715d
mov eax, dword [0x45f1e8]
xor ecx, ecx
mov dword [edx + 4], eax
mov esi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], ecx
mov dword [0x45f1e8], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec esi
jne 0x4070af
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x407161
cmp esi, edi
ja 0x407161
mov ecx, dword [esi + 0x18]
mov eax, 0xcccccccc
mov dword [edx + 8], ecx
mov edi, esi
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, esi
jmp 0x407163
lea eax, [esi - 0x70000000]
mov ecx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x407161
mov eax, 0x10000
cmp dword [ebp - 0x10], eax
jne 0x407155
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x407158
movzx edx, si
test edx, edx
je 0x407136
mov esi, dword [ebp - 0x20]
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov eax, 0x10000
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x45f1e0], edx
test edx, edx
jne 0x40708b
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jb 0x4070e6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40722c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x45f1ec], 0
je 0x407240
mov eax, 0x10dd
jmp 0x4072a3
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x45f1ec
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x407261
mov eax, 0x10dd
jmp 0x4072a2
mov dword [0x45f1f4], esi
mov dword [0x45f1e4], esi
mov dword [0x45f1dc], esi
mov dword [0x45f1f0], esi
mov dword [0x45f1d8], esi
mov esi, dword [0x45f1e8]
jmp 0x40729c
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x407287
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4072a7
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x45f1ec], eax
je 0x4072c3
mov eax, 0x10dd
jmp 0x40734b
push ebx
push esi
push edi
mov edi, dword [0x45f1e4]
xor ebx, ebx
test edi, edi
je 0x40730d
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x4072fe
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4072fe
call fcn.0040716a
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.0042c242
mov edi, esi
pop ecx
test esi, esi
jne 0x4072d2
mov dword [0x45f1e4], ebx
call fcn.00406f59
mov edi, dword [0x45f1dc]
test edi, edi
je 0x40733a
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.0042c242
mov edi, esi
pop ecx
test esi, esi
jne 0x407322
pop edi
pop esi
mov dword [0x45f1dc], ebx
xor eax, eax
mov dword [0x45f1ec], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], 0x1388
jne 0x408565
lea eax, [ebp - 4]
push eax
call fcn.00407ec0
test al, al
je 0x40856c
mov ecx, ebx
call fcn.00407f70
mov esi, dword [ebx + 0xc0]
cmp esi, dword [ebx + 0xc4]
je 0x4085b0
lea ebx, [ebx]
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 8]
cmp eax, dword [edi + 4]
jbe 0x4085a5
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax]
call eax
test al, al
je 0x4085a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 8], eax
add esi, 4
cmp esi, dword [ebx + 0xc4]
jne 0x408580
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408690
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x45c4d0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xd0], eax
mov edi, 0x3e8
mov eax, dword [ebx + 0xd4]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xd8]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
push edi
push 0
lea eax, [esp + 0x18]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x408759
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x1388
push eax
mov ecx, ebx
call fcn.00407ec0
test al, al
je 0x40870b
mov ecx, ebx
call fcn.00407f70
mov esi, dword [ebx + 0xc0]
cmp esi, dword [ebx + 0xc4]
je 0x408750
lea esp, [esp]
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 8]
cmp eax, dword [edi + 4]
jbe 0x408745
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax]
call eax
test al, al
je 0x408745
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 8], eax
add esi, 4
cmp esi, dword [ebx + 0xc4]
jne 0x408720
mov edi, dword [esp + 0xc]
jmp 0x4086d5
test eax, eax
jne 0x4087ac
mov ecx, ebx
call fcn.00407f70
mov esi, dword [ebx + 0xc0]
cmp esi, dword [ebx + 0xc4]
je 0x4087a2
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 8]
cmp eax, dword [edi + 4]
jbe 0x408797
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax]
call eax
test al, al
je 0x408797
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 8], eax
add esi, 4
cmp esi, dword [ebx + 0xc4]
jne 0x408772
mov edi, 0x1388
jmp 0x4086d5
cmp eax, 1
je 0x4087c4
cmp eax, 2
jne 0x4086d5
mov edi, 0xc8
jmp 0x4086d5
push 1
mov ecx, ebx
call fcn.00408540
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042b782
mov esp, ebp
pop ebp
ret 4