joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b158
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10023968]
jne 0x1000b162
repz ret
jmp fcn.1000f9d5

Function at 0x1000f337
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10023c38]
je 0x1000f352
inc edi
cmp edi, 0x17
jb 0x1000f343
cmp edi, 0x17
jae 0x1000f4d2
push ebp
push 3
call fcn.1001566f
cmp eax, 1
pop ecx
je 0x1000f49e
push 3
call fcn.1001566f
test eax, eax
pop ecx
jne 0x1000f386
cmp dword [0x10026b78], 1
je 0x1000f49e
cmp ebx, 0xfc
je 0x1000f4d1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10026d30
push ebp
call fcn.1000c21f
add esp, 0xc
test eax, eax
je 0x1000f3bc
push esi
push esi
push esi
push esi
push esi
call fcn.1000f546
add esp, 0x14
push 0x104
mov esi, 0x10026d49
push esi
push 0
mov byte [0x10026e4d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000f400
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000c21f
add esp, 0xc
test eax, eax
je 0x1000f400
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000f546
add esp, 0x14
push esi
call fcn.1000bd10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1000f445
push esi
call fcn.1000bd10
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10027044
push 0x1001da64
sub ecx, eax
push ecx
push eax
call fcn.1000dd28
add esp, 0x14
test eax, eax
je 0x1000f445
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000f546
add esp, 0x14
jmp 0x1000f447
xor esi, esi
push 0x1001da60
push ebx
push ebp
call fcn.1000c284
add esp, 0xc
test eax, eax
je 0x1000f467
push esi
push esi
push esi
push esi
push esi
call fcn.1000f546
add esp, 0x14
push dword [edi*8 + 0x10023c3c]
push ebx
push ebp
call fcn.1000c284
add esp, 0xc
test eax, eax
je 0x1000f489
push esi
push esi
push esi
push esi
push esi
call fcn.1000f546
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.100154b2
add esp, 0xc
jmp 0x1000f4d1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1000f4d1
cmp ebp, 0xffffffff
je 0x1000f4d1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10023c3c]
push dword [esi]
call fcn.1000bd10
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100154b2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10010acf
xor ebx, ebx
cmp dword [0x100275fc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10015588
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10015668
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001e498
push edi
call esi
cmp eax, ebx
je 0x10015668
push eax
call fcn.10010a61
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100275fc], eax
call esi
push eax
call fcn.10010a61
mov dword [esp], 0x1001e474
push edi
mov dword [0x10027600], eax
call esi
push eax
call fcn.10010a61
mov dword [0x10027604], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000e173
test eax, eax
pop ecx
pop ecx
je 0x10015556
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000f546
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10015588
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10010a61
cmp eax, ebx
pop ecx
mov dword [0x1002760c], eax
je 0x10015588
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10010a61
pop ecx
mov dword [0x10027608], eax
mov eax, dword [0x10027608]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001560d
cmp dword [0x1002760c], ecx
je 0x1001560d
push eax
call fcn.10010ad8
push dword [0x1002760c]
mov esi, eax
call fcn.10010ad8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001560d
cmp edi, ebx
je 0x1001560d
call esi
cmp eax, ebx
je 0x100155da
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100155da
test byte [ebp - 0x18], 1
jne 0x1001560d
lea eax, [ebp - 0x10]
push eax
call fcn.1000e1aa
test eax, eax
pop ecx
je 0x100155f5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000f546
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10015604
or dword [ebp + 0x10], 0x200000
jmp 0x10015648
or dword [ebp + 0x10], 0x40000
jmp 0x10015648
mov eax, dword [0x10027600]
cmp eax, dword [ebp - 8]
je 0x10015648
push eax
call fcn.10010ad8
cmp eax, ebx
pop ecx
je 0x10015648
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10015648
mov eax, dword [0x10027604]
cmp eax, dword [ebp - 8]
je 0x10015648
push eax
call fcn.10010ad8
cmp eax, ebx
pop ecx
je 0x10015648
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100275fc]
call fcn.10010ad8
cmp eax, ebx
pop ecx
je 0x10015668
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001566a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100324c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x100ad24]
xor ebx, ebx
cmp eax, ebx
je 0x10032c4
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003278
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 8]
push dword [0x100ad24]
call esi
test eax, eax
je 0x10032c7
mov ecx, 0x100229c
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10032a7
push ebx
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push ecx
push dword [0x100ad24]
call esi
test eax, eax
pop edi
je 0x10032c7
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x100356e
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
push esi
xor esi, esi
inc esi
cmp byte [eax], 0
je 0x100358c
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x100358c
xor esi, esi
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
je 0x10035a8
push 1
push dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x10035a8
xor esi, esi
mov eax, esi
pop esi
ret 0x10

Function at 0x10035d9
Capabilities:
Query environment variable
Set environment variable
Write file on windows

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 0x1002388
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10036a4
push esi
mov esi, 0x100afa0
push esi
push 0x1002378
push 0x100ad60
call fcn.01002ab9
push ebx
push 0x4000002
push 1
push ebx
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x100a024], edx
je 0x10036a3
push ebp
push edi
mov ebp, 0x100a5a0
xor eax, eax
push ebx
mov ecx, 0xc5
mov edi, ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
mov edi, 0x314
push edi
push ebp
push edx
mov dword [0x100a5a0], 0x6e776453
mov dword [0x100a5a4], 0x10000
mov dword [0x100a5a8], 0xc0000013
mov byte [0x100a7b0], bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100368e
cmp dword [esp + 0x10], edi
jne 0x100368e
push esi
push 0x1002388
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x10036a1
push dword [0x100a024]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100a024], 0xffffffff
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x10036a7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x10036c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0x101b0c0], 0
jne 0x1003722
lea eax, [ebp - 0x280]
push eax
push 0x200
push esi
call fcn.01002bdc
lea eax, [ebp - 0x280]
push eax
call fcn.010032d8
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0x20000003
push dword [0x100a05c]
mov byte [ebp - 0x80], 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10010
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [0x100aae4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.01002c44
test esi, esi
jne 0x100372c
inc esi
cmp dword [0x100a060], 0
je 0x1003747
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x100a060], 0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1005e64
Capabilities:
Terminate process

Disassembly:
insb byte es:[edi], dx
jne 0x1005ece
imul ebp, dword [esi + 0x2e], 0x6c6c64
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
inc ebx
outsd dx, dword [esi]
add bh, bh
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005e96
call eax
cmp dword [0x101b0d0], 0
je 0x1005edd
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
sbb byte [ecx], ah
add byte [ecx], al
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005e64
add ebp, 0x2a8
leave
ret

Function at 0x10070fe
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007139
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007116
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007155
dec esi
je 0x100714e
dec esi
jne 0x100715a
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x427580
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2adb
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x64306c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
push 0x62c9a4
lea ecx, [ebp - 0x230]
call fcn.00425a30
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00596fa0
add esp, 0xc
mov dword [ebp - 0x250], 0
xor edx, edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax]
call fcn.004543a5
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x248], ecx
lea ecx, [ebp - 0x230]
call fcn.00422ca0
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], 0x40
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4276d7
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax]
add ecx, 0x474
call fcn.00434720
mov ecx, dword [ebp - 0x254]
mov ecx, dword [ecx]
call fcn.00429b80
lea ecx, [ebp - 0x274]
call fcn.00441b30
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
call fcn.00422ca0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x274]
call fcn.00425b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00425b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e11e
mov esp, ebp
pop ebp
ret
Function at 0x427ab0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2b70
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x64306c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp + 0xc]
call fcn.00422ca0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x30]
call fcn.00425f30
mov byte [ebp - 4], 1
cmp dword [ebp - 0x44], 0
ja 0x427b31
cmp dword [ebp - 0x48], 0x40000000
jbe 0x427b91
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.0057f030
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
divsd xmm0, qword [0x62d168]
divsd xmm0, qword [0x62d168]
divsd xmm0, qword [0x62d168]
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_GB
lea edx, [ebp - 0x7c]
push edx
call fcn.004401d0
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.00433560
lea ecx, [ebp - 0x7c]
call fcn.00425b70
jmp 0x427cb1
cmp dword [ebp - 0x44], 0
ja 0x427ba0
cmp dword [ebp - 0x48], 0x100000
jbe 0x427bfe
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.0057f030
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
divsd xmm0, qword [0x62d168]
divsd xmm0, qword [0x62d168]
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_MB
lea ecx, [ebp - 0x94]
push ecx
call fcn.004401d0
add esp, 0x10
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
push edx
lea ecx, [ebp - 0x30]
call fcn.00433560
lea ecx, [ebp - 0x94]
call fcn.00425b70
jmp 0x427cb1
cmp dword [ebp - 0x44], 0
ja 0x427c0d
cmp dword [ebp - 0x48], 0x400
jbe 0x427c60
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.0057f030
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
divsd xmm0, qword [0x62d168]
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_KB
lea eax, [ebp - 0xac]
push eax
call fcn.004401d0
add esp, 0x10
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00433560
lea ecx, [ebp - 0xac]
call fcn.00425b70
jmp 0x427cb1
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.0057f030
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x62d148]
sub esp, 8
movsd qword [esp], xmm0
push str._.2f_B
lea edx, [ebp - 0xc4]
push edx
call fcn.004401d0
add esp, 0x10
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00433560
lea ecx, [ebp - 0xc4]
call fcn.00425b70
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00425250
mov edx, dword [ebp - 0x4c]
or edx, 1
mov dword [ebp - 0x4c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00425b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00425b70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e11e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4296e0
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x64306c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 1
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [ebp + 0xc]
call fcn.00422ca0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x14]
push eax
push 0x5ca860
push 1
push 0
push 0x5ca8d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x429785
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0x19], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00425b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x2c]
call fcn.00425b70
mov al, byte [ebp - 0x19]
jmp 0x429851
mov ecx, dword [ebp + 8]
call fcn.00422ca0
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 0x50]
call ecx
lea edx, [ebp - 0x18]
push edx
push 0x5ca8f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx]
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x4297eb
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0x1a], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00425b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x2c]
call fcn.00425b70
mov al, byte [ebp - 0x1a]
jmp 0x429851
push 2
mov ecx, dword [ebp + 0xc]
call fcn.00422ca0
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0x1b], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00425b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x2c]
call fcn.00425b70
mov al, byte [ebp - 0x1b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e11e
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x429d40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x64306c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], ecx
push 0x44
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00596fa0
add esp, 0xc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor ecx, ecx
mov word [ebp - 0x18], cx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00422ca0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x60], eax
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x429db3
push 0xffffffffffffffff
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e11e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432e00
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x64306c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
popal
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e11e
mov esp, ebp
pop ebp
ret

Function at 0x435d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c39c1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x64306c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x58
call fcn.0057e13d
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x58
mov ecx, dword [ebp - 0x14]
call fcn.004277f0
push 1
push str.Global_Chores_Thread
push 1
mov ecx, dword [ebp - 0x14]
call fcn.00435ae0
mov dword [ebp - 0x18], eax
jmp 0x435df3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x48
call fcn.004362e0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x48
call fcn.00436320
mov ecx, eax
call fcn.004452b0
xor ecx, ecx
call fcn.004427c0
mov edx, dword [0x64f770]
push edx
call fcn.00452b2d
add esp, 4
push 0x6287d0
push 0x82
mov eax, dword [0x64f770]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [0x64f770]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [0x64f770]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.00452d59
add esp, 8
push 0x554
call fcn.0057e13d
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
push 0x554
mov ecx, dword [ebp - 0x24]
call fcn.004277f0
mov ecx, dword [ebp - 0x24]
call fcn.004263c0
mov dword [ebp - 0x28], eax
jmp 0x435eba
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
push 0
push accept
push accept
push accept
push accept
push 0x100
push 0x96c80000
push 0x6287d8
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004544fd
push 0x6b
mov ecx, dword [ebp - 0x10]
call fcn.004548d6
mov ecx, dword [ebp - 0x10]
call fcn.004543a9
push 1
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00454a4d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4370a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c3a98
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x64306c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x28]
call fcn.00425f30
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
popal
cmp dword [ebp - 0x2c], 5
jl 0x43715a
call fcn.00437050
push eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0x628890
lea edx, [ebp - 0x58]
push edx
call fcn.004401d0
add esp, 0x14
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x28]
call fcn.00433560
lea ecx, [ebp - 0x58]
call fcn.00425b70
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00425250
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00425b70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e11e
mov esp, ebp
pop ebp
ret