joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ab0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004035e4
test esi, esi
jne 0x402ae7
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004036a8
jmp 0x402b08
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0040294c
mov dword [esp], eax
test esi, esi
je 0x402b08
cmp dword [ebx], 0
je 0x402b08
dec esi
jmp 0x402aef
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402bcc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x406008], 0x8088405
inc edx
mov dword [ebx + 0x406008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x406018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402df8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402dd8
xor eax, eax
push ebp
push 0x402dd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e14
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402dd8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x406018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x406018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403460
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x407034], 0
je 0x4034c1
cmp word [0x407208], 0xd7b2
jne 0x403489
cmp dword [0x407210], 0
jbe 0x403489
mov eax, 0x407204
call dword [0x407220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x406060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4034e8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x406024], 0
jne 0x4034dd
push 0
push 0x406058
push 0x406060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404288
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4042ee
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004036f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c54
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4042d8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042f5
lea eax, [ebp - 0x10]
call fcn.004035e4
ret
Function at 0x404870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x404956
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00404c94
mov eax, dword [ebp - 0xc]
call fcn.0040390c
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404c54
mov ebx, eax
test ebx, ebx
je 0x40493b
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [0x407998]
mov ecx, dword [eax + esi*4 - 4]
mov eax, dword [0x40799c]
mov edx, dword [eax + esi*4 - 4]
lea eax, [ebp - 0x14]
call fcn.00403758
mov eax, dword [ebp - 0x14]
call fcn.0040390c
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4079a4]
call fcn.004039ec
lea eax, [ebp - 0x10]
call fcn.0040395c
mov edx, eax
mov eax, ebx
mov ecx, dword [0x4079a4]
call fcn.0040290c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4079a4]
push eax
lea eax, [ebp - 0x10]
call fcn.0040395c
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40495d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403608
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x300093c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30009436
mov eax, dword [ebp + 8]
test eax, 3
je 0x300093f8
cmp word [eax], 0
je 0x300093f1
lea eax, [eax + 2]
test eax, 3
je 0x300093f8
jmp 0x300093df
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30009433
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x300093f8
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30009433
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30009433
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x300093f8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x7ff7311f
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x57ae3c97
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004055d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._birdwp.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00402810
add esp, 4
test eax, eax
jne 0x40113a
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0xfffe
call fcn.0040359f
mov esi, eax
add esp, 4
test esi, esi
jne 0x401163
lea eax, [esi - 2]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret 0x10
push edi
lea eax, [ebp - 0x20c]
push eax
push str.__s___s
push 0x7fff
push esi
call fcn.00401030
push 0x40
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x44
push 0
push eax
call fcn.004055d0
add esp, 0x20
lea eax, [ebp - 0x260]
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
push eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4011e9
push esi
call fcn.0040359a
add esp, 4
mov eax, 0xfffffffd
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 0x25c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.00403589
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414408
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0x690051
mov dword [ebp - 0x68], 0x6f0068
mov dword [ebp - 0x64], 0x20006f
mov dword [ebp - 0x60], 0x360033
mov dword [ebp - 0x5c], 0x200030
mov dword [ebp - 0x58], 0x6f0053
mov dword [ebp - 0x54], 0x740066
mov dword [ebp - 0x50], 0x610077
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x280020
mov dword [ebp - 0x44], 0x650042
mov dword [ebp - 0x40], 0x6a0069
mov dword [ebp - 0x3c], 0x6e0069
mov dword [ebp - 0x38], 0x290067
mov dword [ebp - 0x34], 0x430020
mov dword [ebp - 0x30], 0x6d006f
mov dword [ebp - 0x2c], 0x610070
mov dword [ebp - 0x28], 0x79006e
mov dword [ebp - 0x24], 0x4c0020
mov dword [ebp - 0x20], 0x6d0069
mov dword [ebp - 0x1c], 0x740069
mov dword [ebp - 0x18], 0x640065
mov word [ebp - 0x14], ax
call fcn.00402730
mov ecx, eax
test ecx, ecx
je 0x4014cd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00402530
test al, al
jne 0x4014ad
lea ecx, [ebp - 0x6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401492
sub ecx, edx
lea eax, [ebp - 0x6c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00403310
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402510
int3
Function at 0x4015c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414438
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x650042
mov dword [ebp - 0x50], 0x6a0069
mov dword [ebp - 0x4c], 0x6e0069
mov dword [ebp - 0x48], 0x200067
mov dword [ebp - 0x44], 0x690051
mov dword [ebp - 0x40], 0x750068
mov dword [ebp - 0x3c], 0x540020
mov dword [ebp - 0x38], 0x630065
mov dword [ebp - 0x34], 0x6e0068
mov dword [ebp - 0x30], 0x6c006f
mov dword [ebp - 0x2c], 0x67006f
mov dword [ebp - 0x28], 0x200079
mov dword [ebp - 0x24], 0x6f0043
mov dword [ebp - 0x20], 0x2c002e
mov dword [ebp - 0x1c], 0x4c0020
mov dword [ebp - 0x18], 0x640074
mov dword [ebp - 0x14], 0x2e
call fcn.00402730
mov ecx, eax
test ecx, ecx
je 0x4016db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00402530
test al, al
jne 0x4016bb
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016a0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00403310
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402510
int3
Function at 0x4016f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414438
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x680043
mov dword [ebp - 0x50], 0x6e0065
mov dword [ebp - 0x4c], 0x640067
mov dword [ebp - 0x48], 0x200075
mov dword [ebp - 0x44], 0x690051
mov dword [ebp - 0x40], 0x75006c
mov dword [ebp - 0x3c], 0x540020
mov dword [ebp - 0x38], 0x630065
mov dword [ebp - 0x34], 0x6e0068
mov dword [ebp - 0x30], 0x6c006f
mov dword [ebp - 0x2c], 0x67006f
mov dword [ebp - 0x28], 0x200079
mov dword [ebp - 0x24], 0x6f0043
mov dword [ebp - 0x20], 0x20002e
mov dword [ebp - 0x1c], 0x74004c
mov dword [ebp - 0x18], 0x2e0064
mov word [ebp - 0x14], ax
call fcn.00402730
mov ecx, eax
test ecx, ecx
je 0x40180b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00402530
test al, al
jne 0x4017eb
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4017d0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00403310
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403589
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402510
int3
Function at 0x403450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4034a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4034a9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40349a
cmp esi, edx
jae 0x4034a9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403488
cmp esi, edx
jae 0x4034a9
cmp word [esi], 0
je 0x4034a9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x413a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov ecx, 0
lea edx, [0x413230]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
add eax, 0x2c
mov esi, dword [ebp - 0xc]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [ebp - 0x18], ecx
call fcn.0042f387
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x41ddef3b
mov eax, dword [ebp - 0x14]
mov ecx, eax
sub ecx, 0x279d8d1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jg 0x413b27
jmp 0x413b11
mov eax, dword [ebp - 0x1c]
sub eax, 0xb832c27d
mov dword [ebp - 0x24], eax
je 0x413c53
jmp 0x413bc1
mov eax, dword [ebp - 0x1c]
sub eax, 0x41ddef3a
mov dword [ebp - 0x28], eax
jg 0x413b53
jmp 0x413b3d
mov eax, dword [ebp - 0x1c]
sub eax, 0x279d8d1d
mov dword [ebp - 0x2c], eax
je 0x413be4
jmp 0x413bc1
mov eax, dword [ebp - 0x1c]
sub eax, 0x4fb13e11
mov dword [ebp - 0x30], eax
jg 0x413b7f
jmp 0x413b69
mov eax, dword [ebp - 0x1c]
sub eax, 0x41ddef3b
mov dword [ebp - 0x34], eax
je 0x413bc6
jmp 0x413bc1
mov eax, dword [ebp - 0x1c]
sub eax, 0x4fb13e12
mov dword [ebp - 0x38], eax
je 0x413bf0
jmp 0x413b95
mov eax, dword [ebp - 0x1c]
sub eax, 0x6ff01d16
mov dword [ebp - 0x3c], eax
je 0x413c33
jmp 0x413bab
mov eax, dword [ebp - 0x1c]
sub eax, 0x76611d6c
mov dword [ebp - 0x40], eax
je 0x413c17
jmp 0x413bc1
jmp 0x413c59
mov eax, 0x4fb13e12
mov ecx, 0x279d8d1d
mov edx, dword [ebp - 8]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x413c59
mov dword [ebp - 0x14], 0x76611d6c
jmp 0x413c59
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0x14], 0x76611d6c
mov dword [ebp - 0x44], eax
jmp 0x413c59
mov eax, 0xb832c27d
mov ecx, 0x6ff01d16
cmp dword [ebp - 0x10], 0
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x413c59
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0x14], 0xb832c27d
mov dword [ebp - 0x48], eax
jmp 0x413c59
add esp, 0x5c
pop esi
pop ebp
ret
jmp 0x413af5
Function at 0x436dfa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4396c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00433c87
mov dword [ebp - 0x14], eax
cmp dword [0x481b70], edi
jne 0x436eeb
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x436e78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x436fcb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x436fcb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x436fcb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x481b70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x481b74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x481b78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x481b80], eax
test eax, eax
je 0x436ee8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x481b7c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x436f10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x436f03
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x436f25
push 4
pop eax
jmp 0x436fcd
cmp dword [ebp - 0x14], edi
je 0x436f25
push dword [0x481b70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x436f0a
mov eax, dword [0x481b7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x436f83
cmp dword [0x481b80], esi
je 0x436f83
push eax
call ebx
push dword [0x481b80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x436f83
test eax, eax
je 0x436f83
call ecx
test eax, eax
je 0x436f78
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x436f78
test byte [ebp - 8], 1
jne 0x436f83
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x436fb3
mov eax, dword [0x481b74]
cmp eax, esi
je 0x436fb0
push eax
call ebx
test eax, eax
je 0x436fb0
call eax
mov edi, eax
test edi, edi
je 0x436fb0
mov eax, dword [0x481b78]
cmp eax, esi
je 0x436fb0
push eax
call ebx
test eax, eax
je 0x436fb0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x481b70]
call ebx
test eax, eax
je 0x436fcb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x436fcd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430f99
leave
ret