joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4264f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453983
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.004396c0
mov dword [ebp - 4], 0
cmp dword [0x464b24], 0
jne 0x42653b
push 0x104
call fcn.00438ba0
add esp, 4
mov dword [0x464b24], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4585fc
push 0x104
mov edx, dword [0x464b24]
push edx
call fcn.004011d0
add esp, 0x14
mov eax, dword [0x464b24]
push eax
lea ecx, [ebp - 0x20]
call fcn.00439450
push 0x80
lea ecx, [ebp - 0x20]
call fcn.004395e0
movzx ecx, al
test ecx, ecx
jne 0x426748
mov dword [ebp - 0x90], 0
push 0x80
lea ecx, [ebp - 0x20]
call fcn.00439630
push 0x5e
push 0
push 0x464c28
call fcn.00409d10
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, eax
push 0x2000
push 0x100
call fcn.00423660
add esp, 8
mov edx, eax
mov eax, esi
mul edx
mov cl, 0x20
call fcn.00453340
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, eax
mov eax, ebx
mul ecx
add esi, eax
adc edi, edx
mov dword [0x464c28], esi
mov dword [0x464c2c], edi
mov byte [0x464c40], 1
mov byte [0x464c3e], 1
mov byte [0x464c48], 1
mov byte [0x464c47], 1
mov byte [0x464c46], 1
mov byte [0x464c45], 1
mov byte [0x464c4f], 0
mov dword [0x464c54], 1
mov dword [0x464c58], 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x464c50], eax
cmp dword [0x464ec4], 0
je 0x426663
mov ecx, dword [0x464ec4]
call fcn.004396f0
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x42670a
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
lea edx, [ebp - 0x8c]
push edx
call fcn.00438cc0
add esp, 8
push 0x1c2
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00438c10
add esp, 0xc
lea edx, [ebp - 0x8c]
push edx
call fcn.00438c00
add esp, 4
mov dword [ebp - 0x94], 0
jmp 0x4266cb
mov eax, dword [ebp - 0x94]
add eax, 1
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x10
jge 0x42670a
mov ecx, dword [ebp - 0x94]
movzx edx, byte [ebp + ecx - 0x34]
push edx
push str._02X
push 3
lea eax, [ebp - 0x98]
push eax
call fcn.004011d0
add esp, 0x10
lea ecx, [ebp - 0x98]
push ecx
push 0x464c64
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
jmp 0x4266bc
push 8
push 0x464c28
push 0x56
push 0x464c30
call fcn.004272b0
add esp, 0x10
lea edx, [ebp - 0x24]
push edx
push 0x5e
push 0x464c28
lea ecx, [ebp - 0x20]
call fcn.00439540
lea ecx, [ebp - 0x20]
call fcn.004395b0
push 0x80
lea ecx, [ebp - 0x20]
call fcn.004395e0
lea eax, [ebp - 0x24]
push eax
push 0x5e
push 0x464c28
lea ecx, [ebp - 0x20]
call fcn.004394d0
push 8
push 0x464c28
push 0x56
push 0x464c30
call fcn.00426fe0
add esp, 0x10
mov ecx, dword [0x464c54]
add ecx, 1
mov edx, dword [0x464c58]
adc edx, 0
mov dword [0x464c54], ecx
mov dword [0x464c58], edx
lea ecx, [ebp - 0x20]
call fcn.004395b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00439680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426db0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x12c], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x426de2
xor eax, eax
jmp 0x426eee
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x426e17
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x426eee
push str.opera.exe
lea eax, [ebp - 0x104]
push eax
call fcn.0041e2ba
add esp, 8
test eax, eax
jne 0x426e39
mov dword [ebp - 0x12c], 1
push str.chrome.exe
lea ecx, [ebp - 0x104]
push ecx
call fcn.0041e2ba
add esp, 8
test eax, eax
jne 0x426e5b
mov dword [ebp - 0x12c], 2
push str.firefox.exe
lea edx, [ebp - 0x104]
push edx
call fcn.0041e2ba
add esp, 8
test eax, eax
jne 0x426e7d
mov dword [ebp - 0x12c], 3
push str.iexplore.exe
lea eax, [ebp - 0x104]
push eax
call fcn.0041e2ba
add esp, 8
test eax, eax
jne 0x426e9f
mov dword [ebp - 0x12c], 4
cmp dword [ebp - 0x12c], 0
jle 0x426ec0
mov ecx, dword [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x120]
push edx
call fcn.00426af0
add esp, 8
jmp 0x426edb
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x426e17
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x12c]
mov esp, ebp
pop ebp
ret

Function at 0x427a30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x9c], ecx
push 0x1fc
push 0
mov eax, dword [ebp - 0x9c]
add eax, 4
push eax
call fcn.00409d10
add esp, 0xc
mov ecx, dword [ebp - 0x9c]
mov dword [0x464f70], ecx
mov edx, dword [ebp - 0x9c]
mov dword [edx + 0x20c], 0
mov eax, dword [ebp - 0x9c]
mov dword [eax + 0x210], 1
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 0x214], 1
mov edx, dword [ebp - 0x9c]
mov dword [edx + 0x250], 0
mov eax, dword [ebp - 0x9c]
mov dword [eax + 0x254], 1
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 0x218], 0
mov edx, dword [ebp - 0x9c]
mov dword [edx + 0x238], 0
mov eax, dword [ebp - 0x9c]
mov dword [eax + 0x24c], 0
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + 0x208], 0
mov edx, dword [ebp - 0x9c]
mov dword [edx + 0x258], 0
mov dword [ebp - 0x98], 0x94
push 0x90
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.00409d10
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x427b4f
cmp dword [ebp - 0x94], 5
jb 0x427b4f
mov dword [ebp - 0xa0], 1
jmp 0x427b59
mov dword [ebp - 0xa0], 0
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov dword [edx + 0x21c], eax
mov esp, ebp
pop ebp
ret
Function at 0x427b70
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x427bb2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp + 8]
push edx
push 0x4275c0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x427cc0
mov dword [ebp - 0x28], 0x24
lea ecx, [ebp - 0x28]
push ecx
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x427c38
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 3
ja case.default.0x427bd8
mov eax, dword [ebp - 0x2c]
jmp dword [eax*4 + 0x427cc4]
mov ecx, dword [ebp - 0xc]
sub ecx, 0x64
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
sub eax, 0x10
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 8], edx
jmp case.default.0x427bd8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x64
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x10]
sub eax, 0x10
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
jmp 0x427cc0
cmp dword [ebp - 4], 0
je 0x427c91
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 8]
sub eax, dword [edx]
cmp eax, 0x96
jle 0x427c6f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
sub edx, 0x96
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
sub eax, dword [edx + 4]
cmp eax, 0x1e
jle 0x427c8f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
sub edx, 0x1e
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
jmp 0x427cc0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
sub eax, 0x96
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
sub eax, 0x1e
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x42d6c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
push 0xe
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x42d731
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.00438b80
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.00438ba0
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0xd
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x50]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x24]
jmp 0x42d733
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4344f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45381a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x2e]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2e]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 6], 0
je 0x43454c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 6]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 8], 0
je 0x434564
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edx, dword [ebp - 0x14]
mov dword [edx + 6], eax
jmp 0x434575
push str.about:blank
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 6], eax
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 6]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x16]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x16]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x2c]
call eax
jmp 0x4345a7
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x436670
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x30011
push 0x16
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret
Function at 0x438d40
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x438d78
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], 0
xor al, al
jmp 0x438d99
cmp dword [ebp - 4], 1
jbe 0x438d90
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [ebp - 4], eax
jmp 0x438d78
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], 1
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x438da0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], 0
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x438e45
cmp dword [ebp - 4], 0
jle 0x438e0e
movzx ecx, byte [ebp - 5]
test ecx, ecx
jne 0x438e0e
push 0
push 0x1f4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObjectEx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
je 0x438dfd
cmp dword [ebp - 0x14], 0x102
je 0x438e03
jmp 0x438e0c
mov byte [ebp - 5], 1
jmp 0x438e0c
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x438dc1
movzx eax, byte [ebp - 5]
test eax, eax
jne 0x438e25
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x438e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x438e89
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x438e89
mov ecx, dword [ebp - 4]
push ecx
push 4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x438ead
cmp dword [ebp + 8], 0
je 0x438ead
mov eax, dword [ebp - 4]
push eax
push 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x438eba
xor al, al
jmp 0x438ebc
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4394d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x4394ed
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
je 0x4394ed
cmp dword [ebp + 0xc], 0
jne 0x4394f1
xor al, al
jmp 0x439530
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x439522
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax]
jne 0x439522
mov al, 1
jmp 0x439530
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
xor al, al
mov esp, ebp
pop ebp
ret 0xc

Function at 0x439540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x43955d
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
je 0x43955d
cmp dword [ebp + 0xc], 0
jne 0x439561
xor al, al
jmp 0x4395a0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x439592
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax]
jne 0x439592
mov al, 1
jmp 0x4395a0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
xor al, al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439700
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 5
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x1c0], 0
lea ecx, [ebp - 0x1c]
push ecx
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x439862
lea edx, [ebp - 8]
push edx
push 0
push 0
push 2
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x439858
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x439858
mov ecx, dword [ebp - 8]
push ecx
call fcn.00438ba0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x439858
mov edx, dword [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00409d10
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 2
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43984c
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x43984c
mov dword [ebp - 4], 0
jmp 0x439811
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp eax, dword [edx]
jae 0x439842
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx*8 + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x439840
mov edx, dword [ebp + 8]
mov byte [edx + 0x1c0], 1
jmp 0x439842
jmp 0x439808
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00438b80
add esp, 4
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x439870
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x105
push 0x105
push 0
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.00409d10
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x14
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esp, ebp
pop ebp
ret

Function at 0x4398b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x10
push 0x10
push 0
mov eax, dword [ebp + 8]
add eax, 4
push eax
call fcn.00409d10
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov esp, ebp
pop ebp
ret
Function at 0x439d10
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x20
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00409d10
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a6], 0
mov dword [ebp - 0x20], 0x20
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [ebp - 0x18]
shr eax, 0x14
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a6], eax
mov esp, ebp
pop ebp
ret

Function at 0x439d60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 4
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00409d10
add esp, 0xc
push 3
mov ecx, dword [ebp + 8]
push ecx
push 7
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
pop ebp
ret

Function at 0x439f40
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
fldz
fstp dword [eax + 0x1ba]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
test eax, eax
je 0x43a064
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
adc ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x24]
jb 0x439fcd
ja 0x439fe9
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x28]
jb 0x439fcd
rdtsc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
and dword [ebp - 0x2c], 0x7fffffff
fild qword [ebp - 0x30]
and dword [ebp - 0x34], 0x80000000
mov dword [ebp - 0x38], 0
fild qword [ebp - 0x38]
fchs
faddp st(1)
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
and dword [ebp - 0x3c], 0x7fffffff
fild qword [ebp - 0x40]
and dword [ebp - 0x44], 0x80000000
mov dword [ebp - 0x48], 0
fild qword [ebp - 0x48]
fchs
faddp st(1)
fsubp st(1)
fdiv qword [0x45bb18]
mov edx, dword [ebp + 8]
fstp dword [edx + 0x1ba]
mov esp, ebp
pop ebp
ret
Function at 0x43aba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453ba8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00407360
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x18
call fcn.00407360
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.00407360
mov byte [ebp - 4], 2
push 0xa
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43ac0a
jmp 0x43aca8
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 8
jae 0x43ac26
jmp 0x43aca8
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43ac3f
jmp 0x43aca8
mov eax, dword [ebp - 0x28]
add eax, 1
push eax
call fcn.00438ba0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040a310
add esp, 0xc
mov ecx, dword [ebp - 0x18]
movzx eax, byte [ecx]
cdq
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
push 8
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x28]
sub eax, 8
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 8
push ecx
call fcn.00426fe0
add esp, 0x10
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x28]
sub eax, 8
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 8
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0043a870
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc