joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69db50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x69ddc5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x71f834], 0
je 0x69ddaa
mov ebx, dword [0x71f834]
call fcn.00408788
mov eax, ebx
call fcn.00408b24
or edx, 0xffffffff
call fcn.004088c8
xor eax, eax
push ebp
push 0x69dda3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71f834]
mov edx, dword [eax + 0x30]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x69dcba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71f834]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x71f834]
mov edx, dword [0x67d0c0]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x691f9c
mov eax, dword [0x71f834]
call fcn.0069c808
mov eax, dword [0x71f834]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
mov eax, dword [0x71f834]
mov ebx, dword [eax + 0x38]
cmp byte [0x71f87c], 0
je 0x69dc5a
test ebx, ebx
je 0x69dc5a
xor edi, edi
test ebx, ebx
je 0x69dc5a
cmp dword [ebx + 4], 0xfffffffe
jne 0x69dc53
inc edi
push 0x69dde0
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00451460
push dword [ebp - 0x14]
push 0x69de20
push dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040aeb0
mov eax, dword [ebp - 0x10]
call fcn.0040abbc
push eax
call sub.kernel32.dll_OutputDebugStringW
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x69dc18
mov eax, dword [0x71f834]
mov ebx, dword [eax + 0x38]
test ebx, ebx
je 0x69dc91
mov esi, dword [ebx + 0x10]
xor eax, eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], 0xfffffffe
mov dword [ebx + 8], 0xe6
mov edx, dword [ebx + 0xc]
mov ecx, ebx
mov eax, dword [0x71f834]
call fcn.0069cac8
mov ebx, esi
test ebx, ebx
jne 0x69dc66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69dcc1
mov eax, dword [0x71f834]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x71f834]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69ddcc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409cc0
ret
Function at 0x6a6044
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x6a62f9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x75f88c], 0
je 0x6a607c
mov edx, dword [0x75f88c]
mov eax, esi
call fcn.006a4ef4
cmp dword [0x75f89c], 0
je 0x6a60c0
mov eax, dword [0x75f89c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x6a60b6
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x75f89c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.006a4ef4
dec ebx
cmp ebx, 0xffffffff
jne 0x6a6097
mov eax, dword [0x75f89c]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0045914c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00452674
mov edx, dword [ebp - 0xc]
mov eax, 0x75f8ac
call fcn.0040a040
cmp byte [ebp - 1], 0
je 0x6a62de
cmp dword [0x716fc4], 0
je 0x6a62de
mov eax, dword [0x718090]
cmp byte [eax], 0
je 0x6a6173
push 0x6a6314
mov eax, dword [0x75f894]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x18]
call fcn.00451460
push dword [ebp - 0x18]
push 0x6a6350
mov eax, dword [0x75f898]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x1c]
call fcn.00451460
push dword [ebp - 0x1c]
push 0x6a636c
push dword [0x75f888]
push 0x6a638c
push dword [0x75f88c]
push 0x6a63a8
push dword [0x75f8ac]
lea eax, [ebp - 0x14]
mov edx, 0xa
call fcn.0040aeb0
mov eax, dword [ebp - 0x14]
call fcn.0040abbc
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [0x716fc4]
call fcn.00567700
mov eax, dword [0x716fc8]
call fcn.00567700
call fcn.0069db50
mov eax, dword [0x75f894]
mov ebx, eax
call fcn.00408788
mov eax, ebx
call fcn.00408b24
or edx, 0xffffffff
call fcn.004088c8
xor edx, edx
push ebp
push 0x6a61d7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x75f894]
mov edx, dword [eax]
call dword [edx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a61de
mov eax, dword [0x75f894]
call fcn.00408a9c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a6300
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00409cc0
ret

Function at 0x6cbf68
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6cbfe2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call fcn.0040ab14
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a938
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x6cbfc5
mov edx, dword [ebp - 8]
dec edx
lea eax, [ebp - 4]
call fcn.0040ab14
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040acb4
jmp 0x6cbfcc
mov eax, ebx
call fcn.00409c60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cbfe9
lea eax, [ebp - 4]
call fcn.00409ca8
ret
Function at 0x6ce5e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d44
mov eax, dword [ebp + 0x10]
call fcn.00409d44
mov eax, dword [ebp + 0xc]
call fcn.00409d44
mov eax, dword [ebp + 8]
call fcn.00409d44
xor eax, eax
push ebp
push 0x6ce76b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x6ce63a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x6ce645
mov eax, dword [ebp + 8]
call fcn.0040abbc
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
jne 0x6ce64f
xor ebx, ebx
jmp 0x6ce659
mov eax, dword [ebp + 0xc]
call fcn.0040abbc
mov ebx, eax
xor eax, eax
push ebp
push 0x6ce70c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.006ce0d0
test al, al
je 0x6ce69c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040abbc
push eax
push 0x6ce780
mov eax, dword [ebp + 0x10]
call fcn.0040abbc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
jmp 0x6ce6c2
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040abbc
push eax
mov eax, dword [ebp + 0x10]
call fcn.0040abbc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
cmp ebx, 0x20
ja 0x6ce702
cmp ebx, 0x1d
je 0x6ce702
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040abbc
push eax
lea eax, [ebp - 0x14]
call fcn.006ce3e0
mov eax, dword [ebp - 0x14]
call fcn.0040abbc
push eax
mov eax, dword [ebp + 0x10]
call fcn.0040abbc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ce740
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ce772
lea eax, [ebp - 0x14]
call fcn.00409c60
lea eax, [ebp - 4]
call fcn.00409c60
lea eax, [ebp + 8]
mov edx, 3
call fcn.00409cc0
ret
Function at 0x6ce9a4
Capabilities:
Find taskbar
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6cea7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x60
push 0
push 0x6cea90
call sub.user32.dll_FindWindowW
mov dword [ebp - 4], eax
push 0x6ceaac
call sub.kernel32.dll_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x6cea62
test esi, esi
je 0x6ce9f4
push 0x6ceabc
push esi
call fcn.00412e30
mov edi, eax
test edi, edi
je 0x6cea2a
mov eax, dword [ebp - 4]
push eax
call edi
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451460
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x6ceae8
call fcn.0040ae28
mov eax, dword [ebp - 8]
call fcn.0040abbc
push eax
call sub.kernel32.dll_OutputDebugStringW
jmp 0x6cea59
call fcn.006ce980
mov ebx, eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00451460
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x6ceb20
call fcn.0040ae28
mov eax, dword [ebp - 0x10]
call fcn.0040abbc
push eax
call sub.kernel32.dll_OutputDebugStringW
test ebx, ebx
jne 0x6cea62
mov ebx, 0x60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cea84
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00409cc0
ret

Function at 0x6d5e38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff99c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d44
xor eax, eax
push ebp
push 0x6d5f71
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40e]
mov ecx, 0x1ff
mov edx, dword [ebp - 4]
call fcn.00452a80
lea edx, [ebp - 8]
xor eax, eax
call fcn.00406650
lea eax, [ebp - 0x60e]
mov ecx, 0xfe
mov edx, dword [ebp - 8]
call fcn.00452a80
lea eax, [ebp - 0x654]
xor ecx, ecx
mov edx, 0x44
call fcn.004073fc
mov dword [ebp - 0x654], 0x44
mov dword [ebp - 0x628], 1
mov word [ebp - 0x624], bx
xor eax, eax
mov dword [ebp - 0x664], eax
xor eax, eax
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x40e]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x6d5f07
mov dword [ebp - 0xc], 0xffffffff
jmp 0x6d5f56
test esi, esi
je 0x6d5f20
imul eax, esi, 0x3e8
push eax
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x6d5f2e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x664]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x660]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d5f78
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409cc0
ret
Function at 0x6db08c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00409c60
xor edx, edx
push ebp
push 0x6db0e2
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push 0
push esi
lea edx, [ebp - 0x20e]
push edx
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040ac78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6db100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6e2cdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6e2e55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x94]
mov dl, 1
call fcn.00451eb0
test al, al
je 0x6e2e32
mov eax, dword [ebp - 8]
call fcn.006dfbd0
lea eax, [ebp - 4]
mov edx, 0x6e2e70
call fcn.0040a088
mov eax, dword [ebp - 8]
cmp byte [eax + 0x14], 0
je 0x6e2d42
lea eax, [ebp - 4]
mov edx, 0x6e2e90
call fcn.0040add0
xor ecx, ecx
push ebp
push 0x6e2e2b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0x90], 0
je 0x6e2d96
push 0x6e2eac
mov eax, dword [ebp - 8]
push dword [eax + 8]
push dword [ebp - 4]
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.0040aeb0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x94]
mov ebx, dword [ebp - 8]
call dword [ebx + 0x90]
call fcn.00409414
jmp 0x6e2e32
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004073fc
mov dword [ebp - 0x44], 0x3c
mov eax, dword [0x718364]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x94]
call fcn.0040abbc
mov dword [ebp - 0x34], eax
push 0x6e2eac
mov eax, dword [ebp - 8]
push dword [eax + 8]
push dword [ebp - 4]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.0040aeb0
mov eax, dword [ebp - 0x4c]
call fcn.0040abbc
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e2e32
mov eax, dword [ebp - 8]
cmp dword [eax + 0x78], 0
je 0x6e2e2a
mov eax, dword [ebp - 8]
add eax, 0x78
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.00407f1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e2e5c
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00409cc0
lea eax, [ebp - 4]
call fcn.00409c60
ret
Function at 0x401782
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x43c075
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
or eax, 0xffffffff
test ebx, ebx
je 0x4017cd
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x402480
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00408670
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00408670
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4024e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x43f08c]
test esi, esi
jle 0x402600
mov eax, dword [0x43f090]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402514
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402597
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402500
mov dword [esp], ebx
call fcn.00402ed0
mov edi, eax
test eax, eax
je 0x402627
mov eax, dword [0x43f090]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00403010
mov edx, dword [0x43f090]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402607
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x402590
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4025a0
add dword [0x43f08c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x43f090]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402590
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402480
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40251e
mov eax, dword [0x43f090]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402480
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402480
lea esi, cs:[esi]
nop
Function at 0x402b40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x43f0a8
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [0x43f0a0]
sub esp, 4
test ebx, ebx
je 0x402b95
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x402b8e
test eax, eax
jne 0x402b8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402b70
mov dword [esp], 0x43f0a8
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402ed0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402ef5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402f00
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402ef5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402f48
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x402f3e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402f4a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402f30
xor eax, eax
pop ebx
pop esi
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x51c33665
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x68c1590a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401e5b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e92
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401e8e
jmp 0x401e80
cmp esi, eax
jae 0x401e92
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401e80
cmp esi, eax
jb 0x401e99
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403a70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488b9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45d780]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov cl, byte [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov dword [esi], vtable.CClassLogger.0
mov dword [esi + 0xc], esi
xor ebx, ebx
cmp byte [ebp + 0x10], bl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], esi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 5
mov dword [esi + 0x24], esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0xa
mov dword [esi + 0x30], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 0xf
mov dword [esi + 0x3c], esi
mov byte [esi + 0x48], cl
sete dl
lea edi, [esi + 0x54]
mov ecx, edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov byte [esi + 0x50], dl
mov byte [esi + 0x51], bl
call fcn.00403220
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x17c]
call fcn.00403220
mov byte [ebp - 4], 1
cmp byte [ebp + 0x10], bl
je 0x403b2a
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x403b56
mov eax, 0x44d64c
jmp 0x403b56
add edi, 0xc
mov dword [ebp + 0x10], edi
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x403b3b
xor eax, eax
jmp 0x403b49
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403b40
sub eax, ecx
mov ecx, dword [ebp + 0x10]
push eax
push edi
call fcn.00403380
mov eax, dword [esi + 0x60]
mov dword [esi + 0x4c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10