joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x43eb56
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x455ac0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x50
mov dword [esp + 0x1c], eax
call fcn.004144bf
add esp, 4
mov dword [esp + 0x20], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x2c], esi
je 0x405128
mov ecx, eax
call fcn.00406690
mov edi, eax
jmp 0x40512a
xor edi, edi
mov dword [esp + 0x1c], edi
push 0x6c
mov dword [esp + 0x30], 1
call fcn.004144bf
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, esi
mov byte [esp + 0x2c], 2
je 0x405156
mov ecx, eax
call fcn.00406b90
mov esi, eax
mov dword [esp + 0x20], esi
mov ebp, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x2c], 3
lea esp, [esp]
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
test al, al
jne 0x4051cc
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
test al, al
jne 0x405217
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
push 0xc8
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x18]
cmp eax, ebp
jb 0x405170
mov al, byte [esp + 0x34]
push 0x44d258
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x3c], al
call fcn.00423bbf
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
cmp edi, ecx
mov dword [esp + 0x1c], 0
je 0x4051eb
test ecx, ecx
je 0x4051eb
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
test esi, esi
mov dword [ebx + 4], edi
mov byte [esp + 0x2c], 1
je 0x405201
mov eax, dword [esi]
push 1
mov ecx, esi
mov edx, dword [eax]
call edx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
cmp esi, ecx
mov dword [esp + 0x20], 0
je 0x405236
test ecx, ecx
je 0x405236
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
test edi, edi
mov dword [ebx + 4], esi
mov dword [esp + 0x2c], 0xffffffff
je 0x405201
mov eax, dword [edi]
push 1
mov ecx, edi
jmp 0x4051fd
Function at 0x4071c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
jne 0x40720b
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x407190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x40720b
mov eax, dword [esp + 8]
test eax, eax
jne 0x4071f5
mov al, 1
pop esi
ret 4
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4071ef
mov ecx, esi
call fcn.00407150
xor al, al
pop esi
ret 4

Function at 0x407240
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
xor edx, edx
test esi, esi
jbe 0x4072b6
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edx + edi]
mov ebx, ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x454438]
mov ebx, ecx
shr ebx, 8
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x454438]
mov ebx, ecx
shr ebx, 0x10
xor ebx, eax
shr eax, 8
and ebx, 0xff
xor eax, dword [ebx*4 + 0x454438]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x454438]
add edx, 4
cmp edx, esi
jb 0x407253
pop edi
pop ebx
pop esi
ret

Function at 0x4072c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x4072ee
mov ecx, dword [esp + 8]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x454438]
add ecx, 1
sub esi, 1
jne 0x4072d1
pop esi
ret

Function at 0x407370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43ee96
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x455ac0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x30]
xor ecx, ecx
test eax, eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0xc], ecx
je 0x4073bf
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov dword [esi + 0x30], 0
je 0x4073d3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
lea edi, [esi + 4]
mov ecx, edi
call fcn.00405250
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov byte [esp + 0x1c], 0
je 0x4073f2
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00405470
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x407cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43f020
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x455ac0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 8], esi
call fcn.004070f0
mov dword [esp + 0x30], esi
mov dword [esp + 0xc], vtable.._AUReadThread__1__ReadData__YA_AV__CStringT_DV__StrTraitMFC_DV__ChTraitsCRT_D_ATL_____ATL__PAXKK_Z_.0
call fcn.0041600b
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x407d09
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov dword [esp + 0x1c], ecx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 1
mov dword [esp + 0x24], edx
call fcn.004071c0
push esi
lea ecx, [esp + 0x10]
call fcn.00407120
test al, al
je 0x407d68
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
push eax
call fcn.00401a90
mov esi, dword [esp + 0x3c]
add esp, 4
add eax, 0x10
mov dword [esi], eax
jmp 0x407d78
mov esi, dword [esp + 0x38]
push 0x443898
mov ecx, esi
call fcn.004030d0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x30], 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407da0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
call fcn.004071b0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x409980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f370
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x455ac0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x455ac0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [str.password_w6Qm3Tpd_r]
mov edx, dword [0x443cf4]
mov esi, ecx
mov ecx, dword [0x443cf0]
mov dword [esp + 0x24], eax
mov eax, dword [0x443cf8]
mov dword [esp + 0x28], ecx
mov cx, word [0x443cfc]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dl, byte [0x443cfe]
lea eax, [esp + 0x24]
mov word [esp + 0x34], cx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3a], dl
call fcn.004030d0
push 0x2710
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x4c], 0
call fcn.004075d0
mov eax, dword [esp + 0x18]
or edi, 0xffffffff
add eax, 0xfffffff0
mov dword [esp + 0x44], edi
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409a3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.HTCE
lea ecx, [esp + 0x14]
call fcn.004030d0
push str.HTCS
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 1
call fcn.004030d0
mov ecx, dword [esp + 0x4c]
push ecx
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
mov byte [esp + 0x58], 2
call fcn.00407630
push 1
lea edx, [esp + 0x20]
push edx
mov ecx, eax
mov byte [esp + 0x4c], 3
call fcn.004055a0
mov eax, dword [eax]
push 0x443bc8
push eax
call fcn.00423bac
add esp, 8
test eax, eax
mov eax, dword [esp + 0x1c]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409ac9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x44], 2
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409aed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x44], 1
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x44], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x409b32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004239ff
add esp, 0x38
ret 4
Function at 0x409d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43f410
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x455ac0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x455ac0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [str.getdevinfo_r]
mov edx, dword [0x443d18]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov esi, ecx
mov ecx, dword [0x443d14]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], edx
call fcn.004030d0
push 0x2710
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.004075d0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409db7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.HTCE
lea ecx, [esp + 0x20]
call fcn.004030d0
push str.HTCS
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 1
call fcn.004030d0
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x40
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov byte [esp + 0x4c], 2
call fcn.00407630
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x38], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409e22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x38], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409e47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x20
push 0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00407420
push eax
mov ecx, edi
mov byte [esp + 0x3c], 6
call fcn.00405770
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x38], 5
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409e8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x20
push 0x20
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
call fcn.00407420
push eax
mov ecx, ebp
mov byte [esp + 0x3c], 7
call fcn.00405770
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x38], 5
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409ecf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409ef7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004239ff
add esp, 0x2c
ret 0xc
Function at 0x40a0a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f4a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x455ac0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x455ac0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [str.gethwtype_r]
mov dx, word [0x443d2c]
mov edi, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [0x443d28]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov al, byte [0x443d2e]
push ecx
lea ecx, [esp + 0x18]
mov word [esp + 0x2c], dx
mov byte [esp + 0x2e], al
call fcn.004030d0
push 0x2710
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.004075d0
mov eax, dword [esp + 0x14]
or ebp, 0xffffffff
add eax, 0xfffffff0
mov dword [esp + 0x38], ebp
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a14c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.HTCE
lea ecx, [esp + 0x14]
call fcn.004030d0
push str.HTCS
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 1
call fcn.004030d0
mov ecx, dword [esp + 0x44]
push ecx
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
mov byte [esp + 0x4c], 2
call fcn.00407630
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x38], 1
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a1b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x38], ebp
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a1d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
add eax, 0xfffffff0
mov dword [edi], ecx
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x40a1fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004239ff
add esp, 0x2c
ret 8
Function at 0x41ce40
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41ce79
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00415fea
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0040f210
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x41e9ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41ea11
call fcn.00416c84
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ea11
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41ea2c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041e588
test ebx, ebx
mov esi, eax
je 0x41ea2a
test edi, edi
je 0x41ea2a
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f814
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41f842
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41f860
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041f77e
jmp 0x41f860
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41f860
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0041f77e
test edi, edi
mov eax, edi
jne 0x41f84a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x459024]
test ecx, ecx
je 0x41f923
jmp 0x41f813
ret 8

Function at 0x4239ff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x455ac0]
jne 0x423a09
repz ret
jmp fcn.0042bd8c
Function at 0x43287a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00428e01
xor ebx, ebx
cmp dword [0x459e40], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x43294f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4328ba
xor eax, eax
jmp 0x432a13
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4328b3
push eax
call fcn.00428d9e
mov dword [esp], 0x4488f4
push edi
mov dword [0x459e40], eax
call esi
push eax
call fcn.00428d9e
mov dword [esp], 0x4488e0
push edi
mov dword [0x459e44], eax
call esi
push eax
call fcn.00428d9e
mov dword [0x459e48], eax
lea eax, [ebp - 8]
push eax
call fcn.0042447f
test eax, eax
pop ecx
pop ecx
je 0x43291d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423deb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x43294f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00428d9e
cmp eax, ebx
pop ecx
mov dword [0x459e50], eax
je 0x43294f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00428d9e
pop ecx
mov dword [0x459e4c], eax
mov eax, dword [0x459e4c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4329c8
cmp dword [0x459e50], esi
je 0x4329c8
push eax
call fcn.00428e0a
pop ecx
call eax
cmp eax, ebx
je 0x432995
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x459e50]
call fcn.00428e0a
pop ecx
call eax
test eax, eax
je 0x432995
test byte [ebp - 0x18], 1
jne 0x4329c8
lea eax, [ebp - 0xc]
push eax
call fcn.004244b6
test eax, eax
pop ecx
je 0x4329b0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423deb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4329bf
or dword [ebp + 0x10], 0x200000
jmp 0x4329f9
or dword [ebp + 0x10], 0x40000
jmp 0x4329f9
mov eax, dword [0x459e44]
cmp eax, esi
je 0x4329f9
push eax
call fcn.00428e0a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4329f9
mov eax, dword [0x459e48]
cmp eax, esi
je 0x4329f9
push dword [ebp - 4]
push eax
call fcn.00428e0a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x459e40]
call fcn.00428e0a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b92a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x455ac0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0043b8bf
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00423f20
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43b979
cmp dword [ebp - 0x1c], 5
jb 0x43b991
jmp 0x43b98d
cmp dword [ebp - 0x10], 1
jne 0x43b991
cmp dword [ebp - 0x1c], 4
ja 0x43b98d
jne 0x43b991
cmp dword [ebp - 0x18], 0
jbe 0x43b991
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44a1c8
call fcn.0043b7b0
test eax, eax
jge 0x43b9b2
mov byte [0x457294], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004239ff
add ebp, 0x78
leave
ret
Function at 0x70c7a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x1f2000]
lea eax, [edi + 0x2e9664]
push dword [eax]
mov dword [eax], 0x81334bfc
push eax
push edi
or ebp, 0xffffffff
jmp 0x70c7d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70c7d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70c7c8
mov eax, 1
add ebx, ebx
jne 0x70c7eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70c7fc
jne 0x70c81b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70c81b
dec eax
add ebx, ebx
jne 0x70c808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70c7e0
add ebx, ebx
jne 0x70c817
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70c86d
xor ecx, ecx
sub eax, 3
jb 0x70c833
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70c8a2
sar eax, 1
mov ebp, eax
jmp 0x70c83e
add ebx, ebx
jne 0x70c83e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70c80c
inc ecx
add ebx, ebx
jne 0x70c84c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70c80c
add ebx, ebx
jne 0x70c859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70c84e
jne 0x70c86a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70c84e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70c88c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70c87e
jmp 0x70c7ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70c88c
add edi, ecx
jmp 0x70c7ce
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x108e9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70c8ae
cmp byte [edi], 0x29
jne 0x70c8ae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70c8b3
lea edi, [esi + 0x2ff000]
mov eax, dword [edi]
or eax, eax
je 0x70c92b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30c1e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30c3dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70c8e0
mov ecx, edi
jns 0x70c90f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30c3e4]
or eax, eax
je 0x70c925
mov dword [ebx], eax
add ebx, 4
jmp 0x70c8fd
call dword [esi + 0x30c3e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x70c95c
cmp al, 0xef
ja 0x70c94f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x70c931
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x70c93e
mov ebp, dword [esi + 0x30c3e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70c990
sub esp, 0xffffff80
jmp 0x5c7969