joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e194
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x101e14b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x101e1a9
movzx eax, word [ebp + 0xc]
push 5
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x101e1a7
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x101e1a7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x101e1a6
lea eax, [ebp + 8]
push eax
push esi
call fcn.0101e03e
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp eax, edi
je 0x101e1a6
cmp dword [ebp + 8], edi
je 0x101e19e
push eax
push esi
call fcn.0101e100
mov edi, eax
jmp 0x101e1a6
push reloc.KERNEL32.dll_GetFileSize
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, edi
pop edi
pop ebp
ret 0xc

Function at 0x101e28e
Capabilities:
Get process heap flags
Get storage device properties

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
test byte [ecx + 4], 1
je 0x101e289
call fcn.0101e1b3
test eax, eax
je 0x101e289
lea edx, [eax + 6]
mov eax, edx
pop ebp
ret 4
Function at 0x101e88c
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 0x63
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x101e8ac
cmp ebx, edi
jl 0x101e920
mov ebx, 0xc0000001
jmp 0x101e920
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x101e8cf
mov ebx, 0xc000009a
jmp 0x101e907
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x63
call esi
mov ebx, eax
test ebx, ebx
jl 0x101e907
movzx eax, word [edi]
mov ecx, dword [ebp + 0x10]
add eax, 2
mov dword [ecx], eax
cmp eax, dword [ebp + 0xc]
jbe 0x101e8f8
mov ebx, 0xc0000023
jmp 0x101e907
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.0100c1da
add esp, 0xc
test edi, edi
je 0x101e920
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x101e9d8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], esi
call fcn.0101f780
test al, al
jne 0x101e9a1
xor eax, eax
jmp 0x101eaec
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x10200b0
push 0x102008a
push esi
call fcn.0101ef74
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
test eax, eax
jl 0x101ead1
cmp dword [ebp - 0x40], 4
jb 0x101ead1
push dword [ebp - 0x3c]
shr dword [ebp - 0x40], 1
call fcn.0100b8ea
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x1020054
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
call fcn.0100b940
add esp, 0x1c
cmp eax, 3
jne 0x101ead1
cmp dword [ebp - 0x54], esi
jne 0x101ead1
cmp dword [ebp - 0x4c], esi
jne 0x101ead1
cmp dword [ebp - 0x48], esi
jne 0x101ead1
lea eax, [ebp - 0x50]
push eax
push 0x1020012
call fcn.0101f0c0
test eax, eax
jl 0x101ead1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [ebp - 0x3c]
push esi
push dword [eax + 0x18]
call ebx
mov edx, dword [ebp - 0x50]
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
pop ecx
xor eax, eax
push 0x28
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.0101f68c
cmp eax, esi
pop edi
jge 0x101ea8c
cmp eax, 0xc000003a
jmp 0x101ea90
cmp dword [ebp - 0x1c], 7
jne 0x101ead1
push 0x101ffd0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
push 0x20001
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x6c], 0x18
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp dword [ebp - 0x3c], esi
je 0x101eae8
push dword [ebp - 0x3c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call ebx
mov eax, dword [ebp - 0x44]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100b8d5
leave
ret
Function at 0x101f27d
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x18]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], eax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push 3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x80000000
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
cmp ebx, esi
jl 0x101f317
push esi
push esi
push esi
push 0x1f0003
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov ebx, eax
cmp ebx, esi
jl 0x101f317
push esi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtResetEvent]
xor eax, eax
push 0xc
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push 0x2d1080
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
cmp ebx, 0x103
jne 0x101f2f6
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
cmp ebx, esi
jl 0x101f317
mov ebx, dword [ebp - 0x10]
cmp ebx, esi
jl 0x101f317
cmp dword [ebp - 0x24], 7
je 0x101f307
mov ebx, 0xc00000bb
jmp 0x101f317
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edi, dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 4], esi
je 0x101f327
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], esi
je 0x101f331
push dword [ebp - 8]
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x401150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401169
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011a0
lea ebx, [ebx]
cmp esi, eax
jae 0x4011a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401190
cmp esi, eax
jb 0x4011aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401200
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x40121b
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
pop esi
ret

Function at 0x401230
Capabilities:
Get disk information

Disassembly:
push ecx
mov ax, word [0x4406cc]
mov cl, byte [0x4406ce]
push ebx
push esi
mov word [esp + 8], ax
mov byte [esp + 0xa], cl
call sub.KERNEL32.dll_GetLogicalDrives
mov ebx, eax
test ebx, ebx
je 0x401279
mov esi, dword [esp + 0x10]
test bl, 1
je 0x401270
push 1
lea edx, [esp + 0xc]
push esi
push edx
call fcn.004260e7
add esp, 0xc
test eax, eax
je 0x40127f
add byte [esp + 8], 1
shr ebx, 1
jne 0x401257
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4015b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x30c
mov eax, dword [0x4516ac]
xor eax, esp
mov dword [esp + 0x308], eax
push 0x103
lea eax, [esp + 0x209]
push 0
push eax
mov byte [esp + 0x210], 0
call fcn.00427ba0
push 0x103
lea ecx, [esp + 0x111]
push 0
push ecx
mov byte [esp + 0x118], 0
call fcn.00427ba0
add esp, 0x18
push 0x104
lea edx, [esp + 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40171e
push esi
push edi
lea edi, [esp + 0x108]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x401626
mov ecx, 9
mov esi, str._tempDriver_Install_UnInstallLog.tmp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x318]
lea eax, [esp + 0x31c]
push eax
push ecx
lea edx, [esp + 0x214]
push edx
movsw word es:[edi], word [esi]
call fcn.00426ad5
push 0x7f
lea eax, [esp + 0x99]
push 0
push eax
mov byte [esp + 0xa0], 0
call fcn.00427ba0
push 0x7f
lea ecx, [esp + 0x25]
push 0
push ecx
mov byte [esp + 0x2c], 0x20
call fcn.00427ba0
call fcn.00427b0e
lea edx, [esp + 0xac]
push edx
call fcn.004273c5
lea eax, [esp + 0x31]
push eax
call fcn.00427303
lea ecx, [esp + 0x134]
push 0x4406fc
push ecx
call fcn.0042724f
mov esi, eax
add esp, 0x34
test esi, esi
je 0x40171c
lea edx, [esp + 0x88]
push edx
push esi
call fcn.0042703c
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0042703c
push 0x4406f8
push esi
call fcn.0042703c
mov ecx, dword [0x452b08]
push ecx
push esi
call fcn.0042703c
push 0x4406f4
push esi
call fcn.0042703c
lea edx, [esp + 0x234]
push edx
push esi
call fcn.0042703c
push 0x4406f0
push esi
call fcn.0042703c
push esi
call fcn.00426fc0
add esp, 0x3c
pop edi
pop esi
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.00427b87
add esp, 0x30c
ret
Function at 0x4038f0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43c8c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4516ac]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
call fcn.0040c04d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40392f
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x38]
test edx, edx
mov dword [esp + 0x20], 0
jne 0x403957
add eax, 0xfffffff0
jmp 0x403a69
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403960
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004020d0
mov edi, dword [esp + 0x28]
test edi, edi
mov ebx, dword [esp + 0x14]
je 0x403a59
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x403a59
cmp dword [ebx - 0xc], 0
je 0x403a59
mov esi, dword [esp + 0x34]
push ebx
push 0x104
push 0x104
mov ecx, esi
call fcn.00401c30
push eax
push str.DEFAULT_READ_STRING
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esi]
test ecx, ecx
jne 0x4039ca
xor eax, eax
jmp 0x4039dd
mov eax, ecx
lea edi, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4039d0
sub eax, edi
js 0x403a4f
cmp eax, dword [ecx - 8]
jg 0x403a4f
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
push str.DEFAULT_READ_STRING
mov ecx, esi
call fcn.00401740
test eax, eax
jne 0x403a15
push ebx
push ebp
push str.Err:_Read_parameter__s__from__s_Failed
call fcn.004015b0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00401bf0
jmp 0x403a8a
cmp dword [esp + 0x30], 0
jne 0x403a2d
mov edx, dword [esi]
cmp dword [edx - 0xc], 0
jne 0x403a2d
push ebx
push ebp
push str.Err:_The_parameter__s__data_from__s_is_empty__but_its_value_dont_allow_be_empty
jmp 0x403a02
lea ecx, [esp + 0x14]
call fcn.00401bf0
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x80070057
call fcn.004010d0
push str.Err:_The_cfg_buffer_is_null
call fcn.004015b0
add esp, 4
lea eax, [ebx - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x20], 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403a8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x408fb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4516ac]
xor eax, esp
mov dword [esp + 0x128], eax
push edi
push 0x124
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.00427ba0
mov edi, dword [esp + 0x140]
add esp, 0xc
cmp dword [edi - 0xc], 0
jne 0x409024
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40900a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00427b87
add esp, 0x12c
ret 4
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x409078
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x409071
lea esp, [esp]
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.004265a4
add esp, 8
test eax, eax
je 0x4090af
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x409050
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409094
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x130]
pop esi
pop edi
xor ecx, esp
call fcn.00427b87
add esp, 0x12c
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x138]
call fcn.00401bf0
mov eax, 1
jmp 0x409096
Function at 0x411d2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x411d6d
call fcn.004175c4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411d6d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x411d88
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004118e1
test ebx, ebx
mov esi, eax
je 0x411d86
test edi, edi
je 0x411d86
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x415978
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4159be
call fcn.004175c4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4159be
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x415a01
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4159ea
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4159ea
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4159fe
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x416bb4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x416be2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x416c00
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00416b1e
jmp 0x416c00
mov eax, dword [esi + 0x14]
test eax, eax
je 0x416c00
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00416b1e
test edi, edi
mov eax, edi
jne 0x416bea
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x454ed8]
test ecx, ecx
je 0x416cc3
jmp 0x416bb3
ret 8

Function at 0x427b87
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4516ac]
jne 0x427b91
repz ret
jmp fcn.0043092c
Function at 0x437ee0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042d33d
xor ebx, ebx
cmp dword [0x455ca0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x437fb5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x437f20
xor eax, eax
jmp 0x438079
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x445e94
push edi
call esi
cmp eax, ebx
je 0x437f19
push eax
call fcn.0042d2da
mov dword [esp], 0x445e84
push edi
mov dword [0x455ca0], eax
call esi
push eax
call fcn.0042d2da
mov dword [esp], 0x445e70
push edi
mov dword [0x455ca4], eax
call esi
push eax
call fcn.0042d2da
mov dword [0x455ca8], eax
lea eax, [ebp - 8]
push eax
call fcn.0042afee
test eax, eax
pop ecx
pop ecx
je 0x437f83
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00426dd3
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x437fb5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042d2da
cmp eax, ebx
pop ecx
mov dword [0x455cb0], eax
je 0x437fb5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042d2da
pop ecx
mov dword [0x455cac], eax
mov eax, dword [0x455cac]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x43802e
cmp dword [0x455cb0], esi
je 0x43802e
push eax
call fcn.0042d346
pop ecx
call eax
cmp eax, ebx
je 0x437ffb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x455cb0]
call fcn.0042d346
pop ecx
call eax
test eax, eax
je 0x437ffb
test byte [ebp - 0x18], 1
jne 0x43802e
lea eax, [ebp - 0xc]
push eax
call fcn.0042b025
test eax, eax
pop ecx
je 0x438016
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00426dd3
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x438025
or dword [ebp + 0x10], 0x200000
jmp 0x43805f
or dword [ebp + 0x10], 0x40000
jmp 0x43805f
mov eax, dword [0x455ca4]
cmp eax, esi
je 0x43805f
push eax
call fcn.0042d346
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43805f
mov eax, dword [0x455ca8]
cmp eax, esi
je 0x43805f
push dword [ebp - 4]
push eax
call fcn.0042d346
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x455ca0]
call fcn.0042d346
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c1c2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4516ac]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043c157
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00427ba0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43c211
cmp dword [ebp - 0x1c], 5
jb 0x43c229
jmp 0x43c225
cmp dword [ebp - 0x10], 1
jne 0x43c229
cmp dword [ebp - 0x1c], 4
ja 0x43c225
jne 0x43c229
cmp dword [ebp - 0x18], 0
jbe 0x43c229
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4466b0
call fcn.0043c048
test eax, eax
jge 0x43c24a
mov byte [0x4533bc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00427b87
add ebp, 0x78
leave
ret
Function at 0x4188a1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418720
Function at 0x10069ec0
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100bf78d
call fcn.100a17f1
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x10069ee5
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10069f2b
lea ecx, [ebp - 0x10]
call fcn.1000160b
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1006442e
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100010b0
mov eax, esi
call fcn.100a18c9
ret 8

Function at 0x10070448
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1007048f
call fcn.10074883
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1007048f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x100704ab
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1006ffc2
mov esi, eax
test edi, edi
je 0x100704a9
test ebx, ebx
je 0x100704a9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10071137
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.10074883
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10071170
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.10070d88
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x100711ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x100711f2
cmp dword [edi + 0x54], 0
jne 0x100711f2
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10074883
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1007118f
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8