joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f5f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x80a9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7f6002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007f9dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7f6002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007f16e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007fa20b
push 0x10
call fcn.007fa1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7f5fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007e61c0
jmp 0x7f5fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007f5b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7f5ff0
mov ecx, edi
call fcn.007e62c0
push edi
call fcn.007fa1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7f6021
inc ebx
cmp ebx, 0x20
jb 0x7f5f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7f7250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x80b808
push 0x7fb288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7f7329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7f7329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007fa1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x7f7329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x7f7329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x7f732c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.007f7351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7f7d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7f7d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x7f7d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7f7d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7f7d94
push eax
push esi
call fcn.007fa20b
add esp, 8
pop esi
ret 0x10

Function at 0x7f7da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7f7e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x7f7e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x810320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007f9dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x7f7dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x7f7e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7f7ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x7f7eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x810320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007f9dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x7f7eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x7f7e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x7f8000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7f8131
push esi
call fcn.007fb145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.007ea080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7f8131
push 0
push ebp
call fcn.007ea3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.007ea260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7f808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007ea2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7f8121
push 0x810918
push edi
call fcn.007f93f0
push eax
push ebx
push esi
call fcn.007f7f60
push 0x8108f8
push edi
call fcn.007f93f0
push eax
push ebx
push esi
call fcn.007f7f60
push 0x8108d8
push edi
call fcn.007f93f0
push eax
push ebx
push esi
call fcn.007f7f60
push 0x8108c0
push edi
call fcn.007f93f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007f7f60
push 0x8108a0
push edi
call fcn.007f93f0
push eax
push ebx
push esi
call fcn.007f7f60
push 0x810888
push edi
call fcn.007f93f0
push eax
push ebx
push esi
call fcn.007f7f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7f91b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007f9140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007f9140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007f9140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007f9140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7f9bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7f9c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x80b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7f9c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7f9c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1000d740
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000d8c8
pushal
mov esi, section..data
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x1000d76a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1000d771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1000d760
mov eax, 1
add ebx, ebx
jne 0x1000d783
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1000d778
jne 0x1000d794
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000d778
xor ecx, ecx
sub eax, 3
jb 0x1000d7a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000d81a
mov ebp, eax
add ebx, ebx
jne 0x1000d7b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1000d7c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1000d7e4
inc ecx
add ebx, ebx
jne 0x1000d7d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1000d7c5
jne 0x1000d7e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000d7c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1000d804
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1000d7f5
jmp 0x1000d766
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1000d804
add edi, ecx
jmp 0x1000d766
pop esi
mov edi, esi
mov ecx, 0xcf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1000d822
cmp byte [edi], 1
jne 0x1000d822
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1000d827
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x1000d896
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1000d854
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd054]
or eax, eax
je 0x1000d890
mov dword [ebx], eax
add ebx, 4
jmp 0x1000d871
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1000d8c7
cmp al, 0xef
ja 0x1000d8ba
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1000d89c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1000d8a9
popal
jmp 0x100018c2
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c3008], 0x8088405
inc edx
mov dword [ebx + 0x4c3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d254
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d285
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d26d
add dl, dl
jne 0x41d290
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2e1
xor eax, eax
add dl, dl
jne 0x41d29d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d37e
add dl, dl
jne 0x41d2ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d2d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d27c
mov eax, 1
add dl, dl
jne 0x41d2ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2e6
sub eax, ebx
mov ebx, 1
jne 0x41d32d
mov ecx, 1
add dl, dl
jne 0x41d313
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d31e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d30a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d33b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d39f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d27c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4a689e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f3ff
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
jmp 0x41f41e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f490
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f479
test esi, esi
jbe 0x41f490
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f46b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f490
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f448
jmp 0x41f490
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f490
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a68a5
ret
Function at 0x4205fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4a7c17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420637
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420650
lea eax, [ebp - 0x10]
mov edx, dword [0x4c55f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420663
lea eax, [ebp - 0x10]
mov edx, dword [0x4c55f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42066f
adc edx, 0
mov edx, dword [edx*4 + 0x4c43fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4207e9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4207dc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4207dc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42077a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42077a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42077a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42077a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4207dc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4207dc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420801
inc ebx
cmp ebx, 0x19
jne 0x420629
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7c1e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401819
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401854
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401850
lea ebx, [ebx]
cmp esi, eax
jae 0x401854
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401840
cmp esi, eax
jb 0x40185a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404310
Capabilities:
Check os version
Get token membership

Disassembly:
sub esp, 0xf0
mov eax, dword [0x4a3f9c]
xor eax, esp
mov dword [esp + 0xec], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x90
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x28], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x94
call fcn.0045bc90
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404425
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x404425
cmp dword [esp + 0x24], 6
jb 0x4043cb
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x20]
push ecx
push 0x12
push edx
call esi
test eax, eax
je 0x404425
cmp dword [esp + 0x18], 3
jne 0x4043cb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x13
push edx
call esi
test eax, eax
je 0x404425
cmp dword [esp + 0xc], ebx
jne 0x4043e7
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x404425
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xb8]
push eax
push ebx
push 0x1a
mov dword [esp + 0x24], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x404425
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xb8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40442d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x404442
push eax
call esi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x404451
push eax
call esi
mov dword [esp + 0xc], ebx
cmp edi, ebx
je 0x404468
push 0x498aa4
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], edi
call fcn.0045bd0a
mov ecx, dword [esp + 0xf8]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045af2d
add esp, 0xf0
ret
Function at 0x4096b0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
sub esp, 0x1c
push ebp
push esi
xor eax, eax
xor esi, esi
push esi
push 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4096ec
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push ebp
mov dword [esp + 0x10], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x409755
push ebx
mov bl, byte [esp + 0x30]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
nop
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x1c], ecx
jne 0x409741
mov edx, dword [esp + 0x18]
push edx
push 0
push 2
call edi
mov esi, eax
push esi
test bl, bl
je 0x409734
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40973a
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x409710
pop edi
lea esi, [eax + 1]
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
add esp, 0x1c
ret

Function at 0x40a6c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4a3f9c]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
push ebx
push ebp
mov ebp, dword [esp + 0x68]
mov ebx, ecx
push esi
mov esi, dword [ebx]
mov dword [esp + 0xc], eax
test esi, esi
je 0x40a716
mov ecx, dword [esp + 0xc]
push ecx
push 0x50
lea edx, [esp + 0x18]
push edx
push 0x48d651
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebp
lea eax, [esp + 0x14]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, dword [ebx + 4]
add ebx, 4
test esi, esi
jne 0x40a6e5
mov ecx, dword [esp + 0x64]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045af2d
add esp, 0x5c
ret