joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f20
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40a868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x4020a2
push ebp
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [esp + 0x14], ebx
lea edi, [esi + 4]
push edi
call fcn.00404435
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x1c], ebp
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
call fcn.00401d20
push ebp
push 0x40fac4
mov esi, eax
call fcn.00401d40
add esp, 0xc
cmp esi, 1
mov ebp, eax
jle 0x402087
dec esi
mov dword [esp + 0x3c], esi
mov dl, byte [esp + 0x3c]
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1c], dl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
lea eax, [esp + 0x1c]
push ebp
push eax
mov dword [esp + 0x3c], ebx
call fcn.00401d40
add esp, 8
lea ecx, [esp + 0x1c]
mov ebp, eax
mov eax, dword [0x40fabc]
push ecx
push 1
push eax
mov ecx, 0x40fab4
call fcn.00402420
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
cmp ecx, eax
mov dword [esp + 0x34], 0xffffffff
mov edi, eax
je 0x402063
lea esi, [ecx + 4]
mov eax, dword [esi]
cmp eax, ebx
je 0x40204d
mov cl, byte [eax - 1]
dec eax
cmp cl, bl
je 0x402044
cmp cl, 0xff
je 0x402044
dec cl
mov byte [eax], cl
jmp 0x40204d
push eax
call fcn.00403d60
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
add esi, 0x10
lea edx, [esi - 4]
cmp edx, edi
jne 0x40202b
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00403d60
mov eax, dword [esp + 0x40]
add esp, 4
dec eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], eax
jne 0x401fd3
mov eax, dword [esp + 0x18]
push eax
call fcn.00403d60
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x403380
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [str.MOHAA.exe]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
ret

Function at 0x4034d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00403460
add esp, 4
test al, al
je 0x4034e9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
Function at 0x403990
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 8]
lea eax, [ecx + 0x80000]
shr eax, 0x14
mov edx, eax
and edx, 0x80000003
jns 0x4039ba
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, 4
mov dword [0x40fcec], 2
sub ecx, edx
add eax, ecx
cmp eax, 0x82
mov dword [0x40d198], eax
jge 0x4039e3
mov dword [0x40fcec], 1
cmp eax, 0x42
jge 0x4039f2
mov dword [0x40fcec], 0
add esp, 0x20
ret

Function at 0x4071ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d600
cmp edx, dword [eax]
je 0x40720f
add eax, 8
inc ecx
cmp eax, 0x40d690
jl 0x407200
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d600]
jne 0x40733d
mov eax, dword [0x40fd04]
cmp eax, 1
je 0x407317
test eax, eax
jne 0x407240
cmp dword [0x40d2f4], 1
je 0x407317
cmp edx, 0xfc
je 0x40733d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407277
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408560
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404d30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4072ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404d30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b5fc
push edi
call fcn.004097a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408560
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408570
lea eax, [ebp - 0xa0]
push 0x40b5dc
push eax
call fcn.00408570
push dword [esi + 0x40d604]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408570
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409708
add esp, 0x2c
pop edi
jmp 0x40733d
lea eax, [ebp + 8]
lea esi, [esi + 0x40d604]
push 0
push eax
push dword [esi]
call fcn.00404d30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x416266
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
cmp ecx, dword [edx + 0x18]
xchg ecx, esp
xchg ecx, esp
lea edi, [eax + ebx]
wait
je 0x4160c3
jmp 0x416016
mov esp, esp
mov eax, 0
push eax
add ecx, ebx
sub ecx, ebx
clc
imul eax, eax, 0x10
nop
and ch, 0xff
xchg dword [esp], eax
cld
sub dword [esp], eax
jmp 0x4162b7
mov esi, dword [edi + eax*4]
add edx, ebx
not ah
add esi, ebx
ret 4
ret
pop ecx
lodsd eax, dword [esi]
inc edi
add ecx, 1
jmp 0x416000
cld
mov ah, ah
xchg ecx, esp
xchg ecx, esp
nop
jne 0x41611a
mov edi, dword [edx + 0x1c]
mov esi, dword [edx + 0x24]
jmp 0x4162cc
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
sbb ch, bh
test cl, bl
lea ecx, [edi]
mov eax, ebp
inc al
mov ah, 4
lea edx, [edx + ebx]
jmp 0x41a337
nop
sub edx, 0
and esi, esi
movzx eax, byte [edi]
sub dword [esp], eax
sub edi, 0xffffffff
pop eax
jmp 0x41630f
mov edx, edx
mov dh, al
add esi, ebx
mov dl, 0xf1
movzx eax, word [esi + ecx*2]
add edi, ebx
jmp 0x41609f
not dl
not dl
test byte [edi], 0xff
cld
jne 0x41601d
xor eax, 0xcf2d2391
lea edi, [edi]
mov ah, ah
cld
lea esi, [esi]
cld
cld
sub eax, dword [esp + 4]
jmp 0x41624d
mov esi, dword [edx + 0x20]
lea esi, [ebx + esi]
sub edi, 0x14
push 0xffffffffffffffff
jmp 0x416119

Function at 0x402dc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402dd1
pop dword [ebp - 0x50]
mov eax, 0x814b143e
sub eax, 0x810ae66d
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2f40bdce
sub dword [ebp - 0x60], 0xe0ee7883
mov dword [ebp - 0x5c], 0x81cab405
sub dword [ebp - 0x5c], 0x4f9767c0
mov dword [ebp - 0x58], 0xe5f3794a
add dword [ebp - 0x58], 0x6658cae4
mov dword [ebp - 0x54], 0x8fc4f6e6
sub dword [ebp - 0x54], 0x8fc4f6e6
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa383d42a
sub dword [ebp - 0x60], 0x2f116ad4
mov dword [ebp - 0x5c], 0x49db9b15
add dword [ebp - 0x5c], 0xf790c660
mov dword [ebp - 0x58], 0xb037ddf6
sub dword [ebp - 0x58], 0x4cc8718a
mov dword [ebp - 0x54], 0x18f0ed5e
add dword [ebp - 0x54], 0xe70f12a2
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x347e50f8
add eax, 0xcbc75f88
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4fc09
push 0
call eax
mov ecx, 0xf424fed6
add ecx, 0xbdb52ee
xor edx, edx
add edx, eax
mov ebx, 0xcfa34848
add ebx, 0x30a417b8
add ebx, dword [ebp - 0x50]
mov esi, 0xd8c33f75
sub esi, 0x9635dce3
mov edi, dword [ebx]
xor edi, esi
add dword [ebp - 0xc], 0xc43f8b5f
mov dword [edx], edi
add dword [ebp - 0x34], ecx
add edx, 0x3e97b41
add edx, 0xfc1684c3
add ebx, 0x57864d97
sub ebx, 0x57864d93
loop 0x402ef0
add eax, 0xa8213a1d
add eax, 0x57dfffc6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3a10bd6
sub ecx, 0x3610bd6
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1003a700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1003a70f
pop dword [ebp - 0x30]
mov eax, 0xcf575132
add eax, 0x40ac55dd
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xbdf8252c
sub dword [ebp - 0x40], 0x6fa5dfe1
mov dword [ebp - 0x3c], 0xb8bd5530
add dword [ebp - 0x3c], 0x7975f715
mov dword [ebp - 0x38], 0x6e7ef5dc
add dword [ebp - 0x38], 0xddcd4e52
mov dword [ebp - 0x34], 0xa3abf7a7
sub dword [ebp - 0x34], 0xa3abf7a7
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2bfcc864
sub dword [ebp - 0x40], 0xb78a5f0e
mov dword [ebp - 0x3c], 0x4d602a95
add dword [ebp - 0x3c], 0xf40c36e0
mov dword [ebp - 0x38], 0x477fa604
add dword [ebp - 0x38], 0x1befc668
mov dword [ebp - 0x34], 0x644cf0c3
add dword [ebp - 0x34], 0x9bb30f3d
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x407b0
push 0
call eax
mov ecx, 0xff2c18b3
add ecx, 0xd43a68
xor edi, edi
add edi, eax
mov ebx, 0xfba7b759
add ebx, 0x1463d8a7
add ebx, dword [ebp - 0x30]
mov esi, 0xb3e9bceb
add esi, 0xfd64868b
xor dword [ebp - 0x14], 0x55bfae3d
mov edx, dword [ebx]
xor dword [ebp - 0xc], ebx
sub edx, esi
xor dword [ebp - 0x18], edx
mov dword [edi], edx
add dword [ebp - 8], ebx
add edi, 0x471a5843
sub edi, 0x471a583f
add ebx, 0xafba2f5d
sub ebx, 0xafba2f59
loop 0x1003a829
add eax, 0x13f3f
xor ebx, ebx
add ebx, eax
add eax, 0x43106833
add eax, 0xbcef97d2
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x516000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x516db7
call fcn.0051600f
jmp fcn.004b8941
Function at 0x516693
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x5166c1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x5166b8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x5166b0
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5166e2
mov esp, ebp
pop ebp
ret

Function at 0x5166e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x516752
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x51677f
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x51676e
xor ecx, eax
xor edx, ebx
dec edi
jne 0x51675f
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x5167a5
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x516746
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5167d1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x517f59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5b7837
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x1011c6ac], 1
jge 0x5b78a6
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x5b787c
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x5b787c
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5b7859
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5b7892
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5b7899
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5b7996
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5b7967
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5b795c
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x5b7950
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5b7957
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5b7996
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5b7991
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5b797a
mov eax, dword [ebx + 8]
jmp 0x5b7996
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5b7988
xor eax, eax
jmp 0x5b7996
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5b78c6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x5215b7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
imul ecx, eax, 0x28
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
jmp 0x521607
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x18]
je 0x521632
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + 0xc]
jb 0x521630
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 0xc], edx
jae 0x521630
mov eax, dword [ebp - 4]
jmp 0x521634
jmp 0x5215fe
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x521677
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x521687
xor al, al
jmp 0x5216dc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x52169f
xor al, al
jmp 0x5216dc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x5216c0
xor al, al
jmp 0x5216dc
mov ecx, dword [ebp - 8]
add ecx, 0x18
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x10b
je 0x5216da
xor al, al
jmp 0x5216dc
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x525577
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x5255c7
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x5255c7
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x5255c7
xor eax, eax
jmp 0x525608
mov dword [ebp - 4], 1
jmp 0x5255d9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x525603
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x525601
xor eax, eax
jmp 0x525608
jmp 0x5255d0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x56ce27
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [0x1011e07c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x56ce44
xor al, al
jmp 0x56cea8
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x56ce56
xor al, al
jmp 0x56cea8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x56ce71
xor al, al
jmp 0x56cea8
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x56ce83
xor al, al
jmp 0x56cea8
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x74], 0xe
ja 0x56ce90
xor al, al
jmp 0x56cea8
mov edx, 8
imul eax, edx, 0xe
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax + 0x78], 0
jne 0x56cea6
xor al, al
jmp 0x56cea8
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x406569
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4065af
call fcn.00407cb5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4065af
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4065f2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4065db
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4065db
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4065ef
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x408262
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x408290
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4082ae
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004081cc
jmp 0x4082ae
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4082ae
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004081cc
test edi, edi
mov eax, edi
jne 0x408298
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x445aac]
test ecx, ecx
je 0x408371
jmp 0x408261
ret 8

Function at 0x40e36d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40e3b0
call fcn.00407cb5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40e3b0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40e3cb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040df24
test ebx, ebx
mov esi, eax
je 0x40e3c9
test edi, edi
je 0x40e3c9
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41e7cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444504]
jne 0x41e7d5
repz ret
jmp fcn.00425f2c
Function at 0x42f17d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00424c0d
xor ebx, ebx
cmp dword [0x4482dc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42f252
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42f1bd
xor eax, eax
jmp 0x42f316
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43ad2c
push edi
call esi
cmp eax, ebx
je 0x42f1b6
push eax
call fcn.00424baa
mov dword [esp], 0x43ad1c
push edi
mov dword [0x4482dc], eax
call esi
push eax
call fcn.00424baa
mov dword [esp], 0x43ad08
push edi
mov dword [0x4482e0], eax
call esi
push eax
call fcn.00424baa
mov dword [0x4482e4], eax
lea eax, [ebp - 8]
push eax
call fcn.004205c7
test eax, eax
pop ecx
pop ecx
je 0x42f220
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423d8f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42f252
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00424baa
cmp eax, ebx
pop ecx
mov dword [0x4482ec], eax
je 0x42f252
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00424baa
pop ecx
mov dword [0x4482e8], eax
mov eax, dword [0x4482e8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42f2cb
cmp dword [0x4482ec], esi
je 0x42f2cb
push eax
call fcn.00424c16
pop ecx
call eax
cmp eax, ebx
je 0x42f298
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4482ec]
call fcn.00424c16
pop ecx
call eax
test eax, eax
je 0x42f298
test byte [ebp - 0x18], 1
jne 0x42f2cb
lea eax, [ebp - 0xc]
push eax
call fcn.004205fe
test eax, eax
pop ecx
je 0x42f2b3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423d8f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42f2c2
or dword [ebp + 0x10], 0x200000
jmp 0x42f2fc
or dword [ebp + 0x10], 0x40000
jmp 0x42f2fc
mov eax, dword [0x4482e0]
cmp eax, esi
je 0x42f2fc
push eax
call fcn.00424c16
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42f2fc
mov eax, dword [0x4482e4]
cmp eax, esi
je 0x42f2fc
push dword [ebp - 4]
push eax
call fcn.00424c16
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4482dc]
call fcn.00424c16
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433256
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x444504]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004331eb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041e7e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4332a5
cmp dword [ebp - 0x1c], 5
jb 0x4332bd
jmp 0x4332b9
cmp dword [ebp - 0x10], 1
jne 0x4332bd
cmp dword [ebp - 0x1c], 4
ja 0x4332b9
jne 0x4332bd
cmp dword [ebp - 0x18], 0
jbe 0x4332bd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43b5fc
call fcn.004330dc
test eax, eax
jge 0x4332de
mov byte [0x4459f0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e7cb
add ebp, 0x78
leave
ret