joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4248a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e46c
and dword [ebp - 4], 0
cmp dword [0x44c388], 0
mov ebx, eax
jne 0x424956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424a07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424a07
push eax
call fcn.0041e3fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c388], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c38c], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c390], eax
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c398], eax
test eax, eax
je 0x424956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c394], eax
mov eax, dword [0x44c394]
cmp eax, ebx
je 0x4249ae
cmp dword [0x44c398], ebx
je 0x4249ae
push eax
call fcn.0041e475
push dword [0x44c398]
mov esi, eax
call fcn.0041e475
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4249ae
test edi, edi
je 0x4249ae
call esi
test eax, eax
je 0x4249a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4249a5
test byte [ebp - 0xc], 1
jne 0x4249ae
or dword [ebp + 0x10], 0x200000
jmp 0x4249e7
mov eax, dword [0x44c38c]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4249e7
mov eax, dword [0x44c390]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c388]
call fcn.0041e475
pop ecx
test eax, eax
je 0x424a07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424a09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x3054661f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x67913565
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4064e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
cmp edi, 0x53
ja 0x40657f
je 0x406570
cmp edi, 5
je 0x40654e
cmp edi, 0x46
je 0x406520
cmp edi, 0x4e
jne 0x40659e
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x30]
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esi + 0x18], 0
je 0x406546
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
mov ecx, eax
shr ecx, 0x10
push ecx
mov ecx, dword [esp + 0x18]
movzx eax, ax
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
call edx
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
mov eax, edi
sub eax, 0x110
je 0x406680
sub eax, 1
je 0x406667
sub eax, 2
je 0x40664e
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push ebp
mov ebp, dword [esp + 0x1c]
cmp edi, dword [esi + 8]
jne 0x4065fc
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [ebx]
mov eax, dword [esi + 4]
push 0
push 0
push 0
push eax
push 0
call ebx
test eax, eax
jne 0x4065c0
mov eax, dword [esi + 4]
movzx ecx, word [esp + 0x18]
mov edx, dword [0x43ee44]
push ebp
push 0x4063f0
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp edi, dword [esi + 0x10]
jne 0x406645
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ecx]
mov eax, dword [esi + 4]
push 0
push 0
push 0
push eax
push 0
call ebx
test eax, eax
jne 0x406610
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 4]
mov eax, dword [esi + 4]
push edx
mov edx, dword [ebp]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0x1c]
push ecx
mov bl, al
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc
Function at 0x4079a0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4079bf
cmp eax, 0x106
je 0x4079bf
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x434980
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x4079ea
mov edx, edi
nop
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4079e0
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret 4

Function at 0x4081c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42fdd0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebp]
xor edi, edi
cmp ax, cx
je 0x40820e
inc edi
cmp word [ebp + edi*2], cx
jne 0x408206
cmp edi, 1
movzx ebx, ax
jl 0x408379
cmp bx, 0x5c
je 0x408379
cmp bx, 0x2e
jne 0x408242
cmp edi, 1
je 0x408379
cmp edi, 2
jne 0x408242
cmp word [ebp + 2], bx
je 0x408379
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.00404e70
cmp edi, 3
mov dword [esp + 0x4c], 0
jle 0x408289
cmp word [ebp + 2], 0x3a
jne 0x408289
cmp word [ebp + 4], 0x5c
jne 0x408289
cmp bx, 0x61
jb 0x408280
cmp bx, 0x7a
jbe 0x4082f1
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x4082f1
mov eax, dword [esp + 0x1c]
cmp eax, 0x105
jg 0x4082a9
cmp eax, 0x106
je 0x4082a9
push 0x106
lea esi, [esp + 0x18]
call fcn.00404e70
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x14]
mov edi, eax
call fcn.00406200
test edi, edi
je 0x408391
cmp edi, 0x104
ja 0x408391
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x4082f1
push 0x5c
mov eax, esi
call fcn.00404c40
mov ebx, str.__
lea eax, [esp + 0x38]
call fcn.00404b30
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
mov edi, eax
mov byte [esp + 0x54], 1
call fcn.00407ca0
push ebp
lea ecx, [esp + 0x24]
mov bl, 2
push ecx
mov edi, eax
mov byte [esp + 0x54], bl
call fcn.00408600
mov edi, eax
mov eax, dword [esp + 0x58]
mov byte [esp + 0x4c], 3
call fcn.00404bf0
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x20]
push edx
call fcn.00421dee
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x30]
push eax
call fcn.00421dee
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00421dee
mov dword [esp + 0x58], 0xffffffff
mov edx, dword [esp + 0x20]
push edx
call fcn.00421dee
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.00421dee
add esp, 4
xor al, al
jmp 0x40837b
Function at 0x4139d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f818
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.00413850
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
test eax, eax
je 0x413a39
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x418e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430049
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
call fcn.00418c90
lea edx, [esp + 0xc]
mov dword [esp + 0x20], 0
push edx
mov dword [esp + 0xc], 1
call fcn.00405080
push ebx
mov ecx, eax
call fcn.00404fe0
mov eax, dword [esp + 0xc]
push eax
call fcn.00421dee
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x419c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f628
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
mov dword [esp + 0x28], eax
mov byte [ebx], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0xc
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x419c9e
lea ecx, [esp + 0xc]
call fcn.00408890
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
mov ax, word [esp + 0xc]
cmp ax, 0x40
jne 0x419cb8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x419cf0
test ax, ax
je 0x419cdf
lea ecx, [esp + 0xc]
call fcn.00408890
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
cmp byte [ebp + 0x2c], 0
je 0x419cf3
mov edx, dword [ebp + 0x24]
mov dword [esi], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 4], eax
mov byte [ebx], 1
lea ecx, [esp + 0xc]
call fcn.00408890
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
Function at 0x41afe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e97e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x41b016
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea edi, [ebx + 4]
lea eax, [esi + 4]
mov dword [esp + 0x14], 0
call fcn.00404b90
lea edi, [ebx + 0x10]
lea eax, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.00404b90
mov byte [esp + 0x14], 2
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov cl, byte [ebx + 0x2c]
lea edi, [ebx + 0x30]
lea eax, [esi + 0x30]
mov byte [esi + 0x2c], cl
call fcn.00404b90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41d740
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x43ee44]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 0x118]
push esi
push 0x4063f0
push 0
push 0x1f6
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x41d771
mov dword [esi + 4], eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x434850
lea edi, [ebp + 0x14]
push ecx
call fcn.00408600
call fcn.0041c040
mov bl, al
test bl, bl
je 0x41d7ab
cmp byte [ebp + 0x169], 0
jne 0x41d7ab
mov edx, dword [ebp + 0x11c]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [ebp + 0x169]
mov byte [ebp + 0x88], al
test bl, bl
je 0x41d7c3
mov ebx, dword [ebp + 0x11c]
jmp 0x41d7c5
xor ebx, ebx
mov edi, dword [esp + 0x28]
lea esi, [ebp + 0x70]
lea eax, [esi + 0x24]
call fcn.00404bf0
mov ecx, dword [0x43ee44]
push esi
push 0x4063f0
push 0
push 0x1f4
push ecx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, 0x45
lea ecx, [esp + 0x14]
call fcn.0041b1d0
mov eax, dword [eax]
mov ecx, dword [ebp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00421dee
mov eax, dword [ebp + 0x74]
add esp, 4
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
Function at 0x421ddf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c024]
jne 0x421de9
repz ret
jmp fcn.00422c62

Function at 0x427845
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00424251
and dword [ebp - 4], 0
cmp dword [0x43ecd8], 0
mov ebx, eax
jne 0x4278f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4279a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4279a7
push eax
call fcn.004241df
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ecd8], eax
call esi
push eax
call fcn.004241df
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43ecdc], eax
call esi
push eax
call fcn.004241df
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ece0], eax
call esi
push eax
call fcn.004241df
pop ecx
mov dword [0x43ece8], eax
test eax, eax
je 0x4278f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004241df
pop ecx
mov dword [0x43ece4], eax
mov eax, dword [0x43ece4]
cmp eax, ebx
je 0x42794e
cmp dword [0x43ece8], ebx
je 0x42794e
push eax
call fcn.0042425a
push dword [0x43ece8]
mov esi, eax
call fcn.0042425a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42794e
test edi, edi
je 0x42794e
call esi
test eax, eax
je 0x427945
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x427945
test byte [ebp - 0xc], 1
jne 0x42794e
or dword [ebp + 0x10], 0x200000
jmp 0x427987
mov eax, dword [0x43ecdc]
cmp eax, ebx
je 0x427987
push eax
call fcn.0042425a
pop ecx
test eax, eax
je 0x427987
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x427987
mov eax, dword [0x43ece0]
cmp eax, ebx
je 0x427987
push eax
call fcn.0042425a
pop ecx
test eax, eax
je 0x427987
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ecd8]
call fcn.0042425a
pop ecx
test eax, eax
je 0x4279a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4279a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010d7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401108
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401104
cmp esi, eax
jae 0x401108
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4010f4
cmp esi, eax
jb 0x40110e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401510
Capabilities:
Get session user name

Disassembly:
sub esp, 0x20c
mov eax, dword [0x460164]
xor eax, esp
mov dword [esp + 0x208], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [esp]
push edx
push 1
lea eax, [esp + 0x10]
push eax
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
je 0x40156c
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00435245
add esp, 0x20c
ret
mov eax, dword [esp]
xor ecx, ecx
cmp dword [eax + 0xc], ecx
push esi
sete cl
push eax
mov esi, ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00435245
add esp, 0x20c
ret
Function at 0x405910
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x462770]
sub esp, 0x14
push ebx
mov ebx, dword [0x46276c]
cmp ebx, eax
push ebp
push esi
push edi
jbe 0x405930
call fcn.00435b3c
mov eax, dword [0x462770]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x46276c], eax
mov esi, eax
jbe 0x40594a
call fcn.00435b3c
mov eax, dword [0x462770]
cmp ebx, esi
je 0x4059e0
cmp ebx, eax
jb 0x40595b
call fcn.00435b3c
mov eax, dword [ebx]
push 0
push 0
push eax
push 0x4052f0
push 0
push 0
call ebp
mov esi, dword [0x46279c]
test esi, esi
mov edi, dword [0x4627a0]
mov dword [esp + 0x14], eax
je 0x4059a6
mov edx, dword [0x4627a4]
mov ecx, edi
sub ecx, esi
sub edx, esi
sar ecx, 2
sar edx, 2
cmp ecx, edx
jae 0x4059a6
mov ecx, edi
add ecx, 4
mov dword [edi], eax
mov dword [0x4627a0], ecx
jmp 0x4059c5
cmp esi, edi
jbe 0x4059af
call fcn.00435b3c
push edi
mov eax, 0x462798
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00405f40
mov eax, dword [0x462770]
cmp ebx, eax
jb 0x4059d8
call fcn.00435b3c
mov eax, dword [0x462770]
add ebx, 4
jmp 0x405936
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4059f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x462780]
push ebx
push ebp
push esi
mov esi, dword [0x46277c]
cmp esi, eax
push edi
jbe 0x405a13
call fcn.00435b3c
mov eax, dword [0x462780]
cmp dword [0x46277c], eax
mov edi, eax
jbe 0x405a27
call fcn.00435b3c
mov eax, dword [0x462780]
cmp esi, edi
je 0x405a50
cmp esi, eax
jb 0x405a34
call fcn.00435b3c
mov eax, dword [esi]
call eax
mov eax, dword [0x462780]
cmp esi, eax
jb 0x405a4b
call fcn.00435b3c
mov eax, dword [0x462780]
add esi, 4
jmp 0x405a13
cmp dword [0x46277c], eax
mov edi, eax
jbe 0x405a64
call fcn.00435b3c
mov eax, dword [0x462780]
mov esi, dword [0x46277c]
cmp esi, eax
jbe 0x405a78
call fcn.00435b3c
mov eax, dword [0x462780]
cmp esi, edi
je 0x405aa1
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + esi]
jle 0x405a9b
push ecx
push edi
push ecx
push esi
call fcn.0043547f
add esp, 0x10
mov dword [0x462780], ebx
mov esi, dword [0x46279c]
mov eax, dword [0x4627a0]
cmp esi, eax
jbe 0x405aba
call fcn.00435b3c
mov eax, dword [0x4627a0]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x46279c], eax
mov edi, eax
jbe 0x405ada
call fcn.00435b3c
mov eax, dword [0x4627a0]
cmp esi, edi
je 0x405b2e
cmp esi, eax
jb 0x405ae7
call fcn.00435b3c
mov ecx, dword [esi]
push ecx
call ebx
test eax, eax
jne 0x405b16
cmp esi, dword [0x4627a0]
jb 0x405afd
call fcn.00435b3c
mov edx, dword [esi]
push 0
push edx
call ebp
cmp esi, dword [0x4627a0]
jb 0x405b11
call fcn.00435b3c
mov eax, dword [esi]
push eax
call ebx
mov eax, dword [0x4627a0]
cmp esi, eax
jb 0x405b29
call fcn.00435b3c
mov eax, dword [0x4627a0]
add esi, 4
jmp 0x405ac6
cmp dword [0x46279c], eax
mov edi, eax
jbe 0x405b42
call fcn.00435b3c
mov eax, dword [0x4627a0]
mov esi, dword [0x46279c]
cmp esi, eax
jbe 0x405b56
call fcn.00435b3c
mov eax, dword [0x4627a0]
cmp esi, edi
je 0x405b7f
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + esi]
jle 0x405b79
push ecx
push edi
push ecx
push esi
call fcn.0043547f
add esp, 0x10
mov dword [0x4627a0], ebx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4081b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44f460
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x460164]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
call fcn.00401a60
xor eax, eax
lea esi, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.00408a60
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x30], 1
call fcn.00428b10
add esp, 0xc
mov byte [esp + 0x24], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408236
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 4
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40825a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Version
call fcn.00401a60
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
mov edx, SysReAllocStringLen
mov byte [esp + 0x28], 5
call fcn.00426700
mov esi, eax
mov byte [esp + 0x28], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4082ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test esi, esi
jne 0x4082e7
test edi, edi
jg 0x4082d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
test edi, edi
jg 0x4082f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret