joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1043000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1043131
push esi
call fcn.01046145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01035080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1043131
push 0
push ebp
call fcn.010353a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01035260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x104308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.010352f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1043121
push 0x105b918
push edi
call fcn.010443f0
push eax
push ebx
push esi
call fcn.01042f60
push 0x105b8f8
push edi
call fcn.010443f0
push eax
push ebx
push esi
call fcn.01042f60
push 0x105b8d8
push edi
call fcn.010443f0
push eax
push ebx
push esi
call fcn.01042f60
push 0x105b8c0
push edi
call fcn.010443f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01042f60
push 0x105b8a0
push edi
call fcn.010443f0
push eax
push ebx
push esi
call fcn.01042f60
push 0x105b888
push edi
call fcn.010443f0
push eax
push ebx
push esi
call fcn.01042f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10441b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01044140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01044140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01044140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01044140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1044bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1044c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x105687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1044c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1044c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4087c6
Capabilities:
Create thread
Inject thread

Disassembly:
push dword [0x4328dc]
pop dword [0x432978]
mov edx, dword [0x4328c8]
push dword [0x433094]
call fcn.004173c0
lea ecx, [0x4328c0]
pop edx
call fcn.0040a000
push dword [0x4328c0]
call fcn.0040a2c0
mov ebx, eax
inc ebx
mov dword [0x4329b0], ebx
push dword [0x432978]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x432974], eax
cmp dword [0x432974], 0
je 0x408962
push 4
push 0x1000
push dword [0x4329b0]
push 0
push dword [0x432974]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x43298c], eax
cmp dword [0x43298c], 0
je 0x408957
push 0x432880
push dword [0x4329b0]
push dword [0x4328c0]
push dword [0x43298c]
push dword [0x432974]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [0x432880]
cmp ebx, dword [0x4329b0]
jl 0x40893b
push str.Kernel32.dll
push 0
call fcn.0040bac0
and eax, eax
je 0x40893b
push 0x419223
push 0
call fcn.0040bb10
mov dword [0x43293c], eax
push 0
call fcn.0040ba40
cmp dword [0x43293c], 0
je 0x40893b
push 0
push 0
push dword [0x43298c]
push dword [0x43293c]
push 0
push 0
push dword [0x432974]
call sub.KERNEL32.dll_CreateRemoteThread
mov dword [0x4328d8], eax
cmp dword [0x4328d8], 0
je 0x40893b
push 0xffffffff
push dword [0x4328d8]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x43299c
push dword [0x4328d8]
call sub.KERNEL32.dll_GetExitCodeThread
push str.Successful_Injection.
push 0
push 0
call fcn.0040a8c3
push 0x4000
push dword [0x4329b0]
push dword [0x43298c]
push dword [0x432974]
call sub.KERNEL32.dll_VirtualFreeEx
push dword [0x432974]
call sub.KERNEL32.dll_CloseHandle
push dword [0x4328c8]
call fcn.00416a70
mov dword [0x43299c], eax
ret

Function at 0x40b2ce
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x40b2e8
push dword [ebp + 8]
push 0x40b260
call sub.USER32.dll_EnumWindows
jmp 0x40b31f
mov edi, dword [0x42fef0]
jmp 0x40b31b
mov esi, dword [edi]
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x40b319
push 1
push dword [edi + 0xc]
call sub.USER32.dll_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x42fef0
call fcn.00417320
add esp, 8
mov edi, esi
or edi, edi
jne 0x40b2f0
pop edi
pop esi
pop ebp
ret 4
Function at 0x40cc70
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xca
jne 0x40cca6
push edi
call fcn.0040c6a4
pop ecx
cmp byte [edi + 0x40], 0
je 0x40cc9f
mov dword [edi + 0x14], 0xcf
xor eax, eax
inc eax
jmp 0x40cd5b
mov dword [edi + 0x14], 0xcb
cmp dword [edi + 0x14], 0xcb
jne 0x40cd2a
mov eax, dword [edi + 0x190]
cmp byte [eax + 0x10], 0
je 0x40cd1f
cmp dword [edi + 8], 0
je 0x40cccd
push edi
mov ebx, dword [edi + 8]
call dword [ebx]
pop ecx
push edi
mov esi, dword [edi + 0x190]
call dword [esi]
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x40cd5b
cmp dword [ebp - 4], 2
je 0x40cd1f
cmp dword [edi + 8], 0
je 0x40ccbb
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x40ccfc
cmp eax, 1
jne 0x40ccbb
mov eax, dword [edi + 8]
add eax, 4
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov eax, dword [edi + 8]
cmp edx, dword [eax + 8]
jl 0x40ccbb
mov eax, dword [edi + 8]
add eax, 8
mov edx, dword [edi + 0x11c]
add dword [eax], edx
jmp 0x40ccbb
mov eax, dword [edi + 0x7c]
mov dword [edi + 0x84], eax
jmp 0x40cd4f
cmp dword [edi + 0x14], 0xcc
je 0x40cd4f
mov eax, dword [edi]
mov dword [eax + 0x14], 0x14
mov eax, dword [edi]
mov edx, dword [edi + 0x14]
mov dword [eax + 0x18], edx
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
push edi
call fcn.0040cd60
pop ecx
and eax, 0xff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cd60
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xcc
je 0x40cda2
push edi
mov ebx, dword [edi + 0x180]
call dword [ebx]
pop ecx
and dword [edi + 0x78], 0
mov dword [edi + 0x14], 0xcc
jmp 0x40cda2
mov eax, dword [edi]
mov dword [eax + 0x14], 0x30
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
mov eax, dword [edi + 0x180]
cmp byte [eax + 8], 0
jne 0x40cd8e
xor eax, eax
cmp byte [edi + 0x41], 0
sete al
dec eax
and eax, 1
add eax, 0xcd
mov dword [edi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41188a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
and dword [ebx + 4], 0
mov edi, 0x3b9aca00
cmp edi, 0x3b9aca00
je 0x4118bb
mov eax, dword [ebx]
mov dword [eax + 0x14], 3
push ebx
mov eax, dword [ebx]
call dword [eax]
pop ecx
push ebx
call fcn.0041430d
mov dword [ebp - 4], eax
push 0x54
push ebx
call fcn.004142b0
add esp, 0xc
mov esi, eax
or esi, esi
jne 0x4118f7
push ebx
call fcn.00414310
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x36
mov eax, dword [ebx]
and dword [eax + 0x18], 0
push ebx
mov eax, dword [ebx]
call dword [eax]
add esp, 8
lea eax, [fcn.00410c68]
mov dword [esi], eax
lea eax, [fcn.00410da7]
mov dword [esi + 4], eax
lea eax, [fcn.00410e56]
mov dword [esi + 8], eax
lea eax, [fcn.00410f2a]
mov dword [esi + 0xc], eax
lea eax, [0x41100b]
mov dword [esi + 0x10], eax
lea eax, [0x411078]
mov dword [esi + 0x14], eax
lea eax, [0x4110e5]
mov dword [esi + 0x18], eax
lea eax, [0x411483]
mov dword [esi + 0x1c], eax
lea eax, [0x4115d3]
mov dword [esi + 0x20], eax
lea eax, [fcn.0041172a]
mov dword [esi + 0x24], eax
lea eax, [0x411856]
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [ebp - 4]
mov dword [esi + 0x2c], eax
xor edi, edi
inc edi
and dword [esi + edi*4 + 0x34], 0
and dword [esi + edi*4 + 0x3c], 0
dec edi
jge 0x411969
and dword [esi + 0x44], 0
and dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
mov dword [ebx + 4], esi
push str.JPEGMEM
call sub.MSVCRT.dll_getenv
pop ecx
mov dword [ebp - 8], eax
or eax, eax
je 0x4119d9
mov byte [ebp - 9], 0x78
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 4]
push eax
push str._ld_c
push dword [ebp - 8]
call sub.MSVCRT.dll_sscanf
add esp, 0x10
or eax, eax
jle 0x4119d9
mov al, byte [ebp - 9]
cmp al, 0x6d
je 0x4119c5
cmp al, 0x4d
jne 0x4119cf
imul eax, dword [ebp - 4], 0x3e8
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41691a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x4169b3
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4169b3
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4169b3
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4169b3
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x4169b3
call sub.USER32.dll_GetFocus
push 0
push 0
push 0x44e
push eax
call sub.USER32.dll_SendMessageA
test ax, 0x800
jne 0x4169b3
xor eax, eax
jmp 0x4169de
push str.PB_WindowID
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x4169dc
dec eax
push eax
push dword [0x433290]
call fcn.004170f2
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x4169de
xor eax, eax
pop edi
leave
ret 4

Function at 0x416a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0
jne 0x416aaf
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
push eax
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x416d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0x1000
push dword [ebp + 0xc]
push 0x1000
call fcn.004175a0
mov esi, eax
mov edi, esi
push dword [ebp + 8]
push dword [0x4332a0]
call fcn.004170f2
mov dword [ebp - 8], eax
or eax, eax
je 0x416e8f
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x416dc8
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.00416eb0
mov dword [ebp - 0xc], eax
jmp 0x416dde
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_ReadFile
cmp byte [ebp - 1], 0
je 0x416dea
mov al, byte [ebp - 1]
mov byte [edi], al
inc edi
mov eax, edi
sub eax, esi
cmp eax, ebx
jl 0x416e11
add ebx, 0x1000
mov eax, edi
sub eax, esi
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
push ebx
call fcn.004175a0
mov esi, eax
mov eax, dword [ebp - 0x10]
mov edi, eax
add edi, esi
movsx eax, byte [ebp - 1]
or eax, eax
je 0x416e2d
cmp dword [ebp - 0xc], 0
je 0x416e2d
cmp eax, 0xd
je 0x416e2d
cmp eax, 0xa
jne 0x416da8
cmp byte [ebp - 1], 0
je 0x416e8f
dec edi
cmp byte [ebp - 1], 0xd
jne 0x416e8f
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x416e53
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.00416eb0
jmp 0x416e69
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_ReadFile
cmp byte [ebp - 1], 0xa
je 0x416e8f
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x416e7f
add eax, 0xc
inc dword [eax]
jmp 0x416e8f
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_SetFilePointer
mov byte [edi], 0
mov eax, edi
sub eax, esi
mov edx, ebx
sub edx, eax
push edx
call fcn.00417610
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x416eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp dword [edi + 0x14], 0
jne 0x416ed5
push edi
call fcn.00416a80
mov dword [edi + 0x14], 1
and dword [edi + 0xc], 0
cmp dword [edi + 0xc], esi
jl 0x416f2a
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ebx, eax
add ebx, dword [edi + 4]
mov eax, esi
cmp eax, 1
je 0x416ef8
cmp eax, 2
je 0x416f01
cmp eax, 4
je 0x416f0c
jmp 0x416f15
mov eax, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [eax], dl
jmp 0x416f22
mov eax, dword [ebp + 0xc]
mov dx, word [ebx]
mov word [eax], dx
jmp 0x416f22
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx]
mov dword [eax], edx
jmp 0x416f22
push esi
push ebx
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x416fa9
mov ebx, dword [edi + 0xc]
push ebx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, ebx
add eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
sub esi, ebx
cmp esi, dword [edi + 8]
jl 0x416f69
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.dll_ReadFile
and dword [edi + 0xc], 0
jmp 0x416fa9
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
cmp esi, dword [edi + 0xc]
jle 0x416f90
mov esi, dword [edi + 0xc]
push esi
push dword [edi + 4]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov eax, ebx
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x416fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 1
jne 0x416fe3
and dword [edi + 0x14], 0
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
cmp dword [edi + 0xc], esi
jle 0x417044
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, esi
cmp eax, 1
je 0x417007
cmp eax, 2
je 0x417013
cmp eax, 4
je 0x417021
jmp 0x41702d
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
mov byte [eax], dl
jmp 0x41703c
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dx, word [edx]
mov word [eax], dx
jmp 0x41703c
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [eax], edx
jmp 0x41703c
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x41707e
push edi
call fcn.00416a80
cmp esi, dword [edi + 8]
jl 0x417062
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
jmp 0x41707e
push esi
push dword [ebp + 0xc]
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4bc769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0190
cmp edx, dword [eax]
je 0x4bc78b
add eax, 8
inc ecx
cmp eax, 0x4c0220
jl 0x4bc77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0190]
jne 0x4bc8b9
mov eax, dword [0x4c0bb0]
cmp eax, 1
je 0x4bc893
test eax, eax
jne 0x4bc7bc
cmp dword [0x4c00e4], 1
je 0x4bc893
cmp edx, 0xfc
je 0x4bc8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc836
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf45c
push edi
call fcn.004bdf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd680
lea eax, [ebp - 0xa0]
push 0x4bf43c
push eax
call fcn.004bd680
push dword [esi + 0x4c0194]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bde75
add esp, 0x2c
pop edi
jmp 0x4bc8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x4c0194]
push 0
push eax
push dword [esi]
call fcn.004bd490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x710c6e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7109ec
add ecx, 1
call fcn.00710cac
sub ecx, edi
xor dword [ebx], edx
or edi, ecx
add edi, ecx
inc ebx
add ecx, 0x6c2c3eef
mov ecx, 0x44429ae2
add ecx, 1
cmp ebx, esi
jne fcn.00710c6e
sub ecx, edi
and ecx, edi
mov edi, 0xfe2f99dc
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48b004]
jne 0x401010
repz ret
jmp fcn.004015c6

Function at 0x4065eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004022ef
and dword [ebp - 4], 0
cmp dword [0x48cffc], 0
mov ebx, eax
jne 0x40669c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40674d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40674d
push eax
call fcn.0040227d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48cffc], eax
call esi
push eax
call fcn.0040227d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48d000], eax
call esi
push eax
call fcn.0040227d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48d004], eax
call esi
push eax
call fcn.0040227d
pop ecx
mov dword [0x48d00c], eax
test eax, eax
je 0x40669c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040227d
pop ecx
mov dword [0x48d008], eax
mov eax, dword [0x48d008]
cmp eax, ebx
je 0x4066f4
cmp dword [0x48d00c], ebx
je 0x4066f4
push eax
call fcn.004022f8
push dword [0x48d00c]
mov esi, eax
call fcn.004022f8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4066f4
test edi, edi
je 0x4066f4
call esi
test eax, eax
je 0x4066eb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4066eb
test byte [ebp - 0xc], 1
jne 0x4066f4
or dword [ebp + 0x10], 0x200000
jmp 0x40672d
mov eax, dword [0x48d000]
cmp eax, ebx
je 0x40672d
push eax
call fcn.004022f8
pop ecx
test eax, eax
je 0x40672d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40672d
mov eax, dword [0x48d004]
cmp eax, ebx
je 0x40672d
push eax
call fcn.004022f8
pop ecx
test eax, eax
je 0x40672d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48cffc]
call fcn.004022f8
pop ecx
test eax, eax
je 0x40674d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40674f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x483f30
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x48b004]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
mov ebp, dword [esp + 0x41c]
push edi
cmp ebx, 0x182
jne 0x483f6f
push 0
push 0
push 0
push str.soveso
push str.zavonowakude
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x483f99
cmp ebx, 0x19f
jne 0x483f99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edi, edi
test ebx, ebx
jle 0x484013
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], 0
call fcn.00483f20
mov eax, dword [esp + 0x14]
add eax, 0x46
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], 0x46
movsx eax, byte [edi + ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0xc], eax
mov cl, byte [esp + 0xc]
mov byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x48400d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc edi
cmp edi, ebx
jl 0x483fa0
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x48402e
mov dword [0x2b8b218], 0xa62e7790
mov dword [0x2b8b21c], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x63a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x63a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x663074
push ecx
mov edi, eax
call fcn.0064e198
mov esi, eax
add esp, 8
test esi, esi
jne 0x63a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0064e02e
push esi
call fcn.0064dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret