joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b970
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x268]
push edi
mov edi, dword [esi + 0x44]
cmp edi, 0x2710
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], edx
jge 0x41b9b0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ebp
push edi
push ecx
push eax
mov eax, edx
jmp 0x41ba83
lea edx, [edi + 0x22]
test dl, 1
je 0x41b9bb
add edx, 1
add edx, ecx
cmp eax, 1
mov dword [esp + 0xc], edx
jge 0x41b9cd
mov eax, 1
jmp 0x41b9d7
cmp eax, 0x64
jle 0x41b9d7
mov eax, 0x64
lea edx, [eax - 1]
mov eax, 0x55555556
imul edx
mov eax, edx
push ebx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0x14]
imul ebx, edi
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push ebp
push edi
push eax
push edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x38], ebx
call fcn.0041b280
add esp, 0x14
cmp ebp, 3
jl 0x41ba52
test edi, edi
mov dword [esp + 0x10], 1
je 0x41ba24
mov dword [esp + 0x10], edi
sub ebx, dword [esp + 0x24]
sub esp, 8
mov dword [esp + 0x24], ebx
fild dword [esp + 0x24]
fidiv dword [esp + 0x18]
fstp qword [esp]
push edi
push ebx
push str._______d_work___d_block__ratio__5.2f_n
call fcn.0043221d
add eax, 0x40
push eax
call fcn.004323eb
add esp, 0x18
cmp dword [esp + 0x24], 0
pop ebx
jge 0x41ba8b
cmp ebp, 2
jl 0x41ba75
push str.____too_repetitive__using_fallback_sorting_algorithm_n
call fcn.0043221d
add eax, 0x40
push eax
call fcn.004323eb
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push ebp
push edi
push eax
mov eax, dword [esp + 0x1c]
push ecx
call fcn.0041a4f0
add esp, 0x10
or ecx, 0xffffffff
xor eax, eax
cmp dword [esi + 0x44], eax
mov dword [esi + 0x1c], ecx
jle 0x41bab3
mov edx, dword [esp + 0x14]
lea esp, [esp]
cmp dword [edx + eax*4], 0
je 0x41bab0
add eax, 1
cmp eax, dword [esi + 0x44]
jl 0x41baa0
jmp 0x41bab3
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], ecx
pop edi
pop esi
pop ebp
jne 0x41bacb
add esp, 0x10
mov dword [esp + 4], 0x3eb
jmp fcn.00415210
add esp, 0x10
ret
Function at 0x41c50a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x445b2f
call fcn.00432cb3
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0042581c
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x41c555
call fcn.0042581c
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x41c566
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x41c573
or eax, 0xffffffff
jmp 0x41c6cf
mov ecx, esi
call fcn.0041c051
mov dword [ebp - 0x14], eax
call fcn.0041f1a8
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x41c5f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x41c5f1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41c5f1
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041bf02
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x41c5f1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x41c5f1
mov ecx, ebx
call fcn.0041c9dd
test eax, eax
je 0x41c5f1
push 0
mov ecx, ebx
call fcn.0041c9f8
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.00420b29
push dword [ebp - 0x14]
call fcn.0041f100
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041c312
xor edi, edi
cmp eax, edi
je 0x41c64e
test byte [esi + 0x3c], 0x10
je 0x41c638
push 4
pop edi
mov ecx, esi
call fcn.0041c8c4
test ax, 0x100
je 0x41c62e
push 5
pop edi
push edi
mov ecx, esi
call fcn.0041ecc8
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x41c64e
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041ca5f
or dword [ebp - 4], 0xffffffff
jmp 0x41c679
cmp dword [ebp - 0x28], edi
je 0x41c687
push 1
mov ecx, ebx
call fcn.0041c9f8
cmp dword [ebp - 0x2c], edi
je 0x41c697
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41c6b0
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x41c6b0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0041c08b
cmp dword [esi + 0x58], edi
je 0x41c6cc
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.00432d1f
ret
Function at 0x41c739
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x41c759
cmp dword [edi + 0x54], 0
jne 0x41c759
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0042581c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041c700
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x42011f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x420158
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00406388
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00402958
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x421769
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x45100c
mov ecx, edi
call fcn.0040165e
cmp dword [esi + 0x4c], 0
push dword [esp + 0xc]
jne 0x4217bc
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4217cf
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00406388
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00402958
jmp 0x4217cf
mov ecx, esi
call fcn.0041c804
test eax, eax
je 0x4217cf
push edi
mov ecx, eax
call fcn.0042011f
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
pop edi
pop esi
ret 8

Function at 0x421cb3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x421cf6
call fcn.0042581c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x421cf6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x421d11
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0042186d
test ebx, ebx
mov esi, eax
je 0x421d0f
test edi, edi
je 0x421d0f
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x426375
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x460df0]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
cmp dword [ebp + 0x200], 0x800
mov eax, dword [ebp + 0x1fc]
push esi
mov dword [ebp - 0x40], eax
mov esi, ecx
lea eax, [ebp + 0x1e8]
jne 0x426413
push 0x44c9ec
push 4
push eax
call fcn.0042fe0e
push eax
call fcn.00401637
add esp, 0x10
push ebx
push edi
call fcn.00432fac
mov edi, dword [eax]
call fcn.00432fac
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp + 0x1e8]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00432f52
add esp, 0x18
mov dword [ebp - 0x40], eax
call fcn.00432fac
cmp dword [eax], ebx
je 0x42642a
call fcn.00432fac
push dword [eax]
call fcn.0041cadc
pop ecx
jmp 0x426431
push 4
push eax
push 3
push dword [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4263c4
jmp 0x4264a3
call fcn.00432fac
mov dword [eax], edi
cmp dword [ebp - 0x40], 0xffffffff
je 0x42649f
cmp dword [ebp - 0x40], esi
jae 0x42649f
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.0042e7a0
add esp, 0xc
push 0x44c524
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x426491
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x426491
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x426491
push ebx
push ebx
push esi
jmp 0x426497
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4264a1
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f0]
xor ecx, ebp
pop esi
call fcn.0042e0d5
add ebp, 0x1f4
leave
ret
Function at 0x42914a
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x429153
xor eax, eax
jmp 0x4291bc
cmp dword [esp + 8], 0
jne 0x42915f
call fcn.0041bc0f
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.004327d6
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x42919a
push dword [esi + 0x10]
call fcn.00431d16
test eax, eax
pop ecx
jne 0x42919a
mov esi, dword [esi + 0xc]
call fcn.00432fbf
push esi
push dword [eax]
push 1
call fcn.004299e3
push dword [esi + 0x10]
call fcn.00431d45
test eax, eax
pop ecx
je 0x4291b9
push dword [esi + 0x10]
call fcn.00433bc6
push eax
call fcn.00401637
pop ecx
pop ecx
jmp 0x429188
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4291c5
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4291cf
call fcn.0041bc0f
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.00431ed3
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x4291fc
mov esi, dword [esi + 0xc]
call fcn.00432fbf
push esi
push dword [eax]
push 1
call fcn.004299e3
pop esi
ret 8

Function at 0x42a616
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x42a63f
call fcn.0042581c
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x42a662
push eax
push dword [esi + 4]
call fcn.0042a5a1
push esi
push eax
mov ecx, 0x4645cc
call fcn.0042a290
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x42e0d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x460df0]
jne 0x42e0df
repz ret
jmp fcn.004357d3
Function at 0x43253a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x432577
cmp dword [ebp + 0x14], edi
je 0x432577
cmp ecx, edi
jne 0x43257e
call fcn.00432fac
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00435d4b
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x432592
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4325b3
cmp ebx, 0xffffffff
je 0x4325a2
push ebx
push edi
push ecx
call fcn.0042e7a0
add esp, 0xc
cmp esi, edi
je 0x43255f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43255f
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4325cf
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4325d6
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4326c7
test word [esi + 0xc], 0x10c
je 0x43262a
mov eax, dword [esi + 4]
test eax, eax
je 0x43262a
jl 0x432728
cmp ebx, eax
mov edi, ebx
jb 0x4325fb
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4326cf
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0042e71f
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4326bf
cmp ebx, dword [ebp - 0xc]
jb 0x432697
cmp dword [ebp - 0xc], 0
je 0x432654
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x432649
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x432650
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43265f
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43265f
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4326fb
push eax
push dword [ebp - 8]
push esi
call fcn.00433a13
pop ecx
push eax
call fcn.0043d36a
add esp, 0xc
test eax, eax
je 0x43273a
cmp eax, 0xffffffff
je 0x432728
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4326bf
push esi
call fcn.0043b4f8
cmp eax, 0xffffffff
pop ecx
je 0x43272c
cmp dword [ebp - 4], 0
je 0x4326fb
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4325de
mov eax, dword [ebp + 0x14]
jmp 0x432579
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4326e6
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0042e7a0
add esp, 0xc
call fcn.00432fac
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43256f
cmp dword [ebp + 0xc], 0xffffffff
je 0x432711
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0042e7a0
add esp, 0xc
call fcn.00432fac
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43256f
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x432579
or dword [esi + 0xc], 0x10
jmp 0x43272c
Function at 0x434547
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x460f80]
je 0x434562
inc edi
cmp edi, 0x17
jb 0x434553
cmp edi, 0x17
jae 0x4346e2
push ebp
push 3
call fcn.004402df
cmp eax, 1
pop ecx
je 0x4346ae
push 3
call fcn.004402df
test eax, eax
pop ecx
jne 0x434596
cmp dword [0x460b34], 1
je 0x4346ae
cmp ebx, 0xfc
je 0x4346e1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x464930
push ebp
call fcn.0044027a
add esp, 0xc
test eax, eax
je 0x4345cc
push esi
push esi
push esi
push esi
push esi
call fcn.00435c4f
add esp, 0x14
push 0x104
mov esi, 0x464949
push esi
push 0
mov byte [0x464a4d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x434610
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0044027a
add esp, 0xc
test eax, eax
je 0x434610
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00435c4f
add esp, 0x14
push esi
call fcn.0042f1d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x434655
push esi
call fcn.0042f1d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x464c44
push 0x44e8a4
sub ecx, eax
push ecx
push eax
call fcn.004401c7
add esp, 0x14
test eax, eax
je 0x434655
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00435c4f
add esp, 0x14
jmp 0x434657
xor esi, esi
push 0x44e8a0
push ebx
push ebp
call fcn.00440156
add esp, 0xc
test eax, eax
je 0x434677
push esi
push esi
push esi
push esi
push esi
call fcn.00435c4f
add esp, 0x14
push dword [edi*8 + 0x460f84]
push ebx
push ebp
call fcn.00440156
add esp, 0xc
test eax, eax
je 0x434699
push esi
push esi
push esi
push esi
push esi
call fcn.00435c4f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043ff99
add esp, 0xc
jmp 0x4346e1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4346e1
cmp ebp, 0xffffffff
je 0x4346e1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x460f84]
push dword [esi]
call fcn.0042f1d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43ff99
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043510b
xor ebx, ebx
cmp dword [0x465438], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44006f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44014f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44014f
push eax
call fcn.0043509d
mov dword [esp], 0x44ecb8
push edi
mov dword [0x465438], eax
call esi
push eax
call fcn.0043509d
mov dword [esp], 0x44eca4
push edi
mov dword [0x46543c], eax
call esi
push eax
call fcn.0043509d
mov dword [0x465440], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042edfc
test eax, eax
pop ecx
pop ecx
je 0x44003d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00435c4f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44006f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043509d
cmp eax, ebx
pop ecx
mov dword [0x465448], eax
je 0x44006f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043509d
pop ecx
mov dword [0x465444], eax
mov eax, dword [0x465444]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4400f4
cmp dword [0x465448], ecx
je 0x4400f4
push eax
call fcn.00435114
push dword [0x465448]
mov esi, eax
call fcn.00435114
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4400f4
cmp edi, ebx
je 0x4400f4
call esi
cmp eax, ebx
je 0x4400c1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4400c1
test byte [ebp - 0x18], 1
jne 0x4400f4
lea eax, [ebp - 0x10]
push eax
call fcn.0042ee33
test eax, eax
pop ecx
je 0x4400dc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00435c4f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4400eb
or dword [ebp + 0x10], 0x200000
jmp 0x44012f
or dword [ebp + 0x10], 0x40000
jmp 0x44012f
mov eax, dword [0x46543c]
cmp eax, dword [ebp - 8]
je 0x44012f
push eax
call fcn.00435114
cmp eax, ebx
pop ecx
je 0x44012f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44012f
mov eax, dword [0x465440]
cmp eax, dword [ebp - 8]
je 0x44012f
push eax
call fcn.00435114
cmp eax, ebx
pop ecx
je 0x44012f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x465438]
call fcn.00435114
cmp eax, ebx
pop ecx
je 0x44014f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x440151
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445674
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x460df0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00445609
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042e7a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4456c3
cmp dword [ebp - 0x1c], 5
jb 0x4456db
jmp 0x4456d7
cmp dword [ebp - 0x10], 1
jne 0x4456db
cmp dword [ebp - 0x1c], 4
ja 0x4456d7
jne 0x4456db
cmp dword [ebp - 0x18], 0
jbe 0x4456db
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44fcf4
call fcn.004454dd
test eax, eax
jge 0x4456fc
mov byte [0x465780], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042e0d5
add ebp, 0x78
leave
ret
Function at 0x403668
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x403689
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x403680
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x403678
mov eax, ebx
leave
ret

Function at 0x4036af
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40370e
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40373b
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40372a
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40371b
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x403761
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x403702
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8