joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008f057
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1008f079
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1008f079
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1008f079
ret
cmp word [ebx + 4], 0x14c
jne 0x1008f079
test word [ebx + 0x16], 2
je 0x1008f079
test word [ebx + 0x16], 0x100
je 0x1008f079
cmp word [ebx + 0x18], 0x10b
jne 0x1008f079
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1008f079
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1008f105
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1008f099
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10075fe4
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1008f079
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1008f105
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1008f079
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1008f079
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1008f079
ret
cmp word [ebx + 4], 0x14c
jne 0x1008f079
test word [ebx + 0x16], 2
je 0x1008f079
test word [ebx + 0x16], 0x100
je 0x1008f079
cmp word [ebx + 0x18], 0x10b
jne 0x1008f079
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1008f079
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1008f105
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1008f099
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10075fe4
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1008f079
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1008f1bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1008f215
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1008f1bc
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1008f1cb
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10494e6e
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1008f21c
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10076092
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1008f2bb
add edi, 4
add eax, 2
dec ecx
jne 0x1008f201
call 0x1008f268
loope 0x1008f25e
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1008f2b8
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1008f2c9
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1008f27c
cmp eax, ecx
ja 0x1008f27c
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1008f306
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1008f2fc
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.10076571
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1008f1cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1008f215
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1008f1bc
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1008f1cb
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10494e6e
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1008f21c
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10076092
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1008f2bb
add edi, 4
add eax, 2
dec ecx
jne 0x1008f201
call 0x1008f268
loope 0x1008f25e
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1008f2b8
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1008f2c9
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1008f27c
cmp eax, ecx
ja 0x1008f27c
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1008f306
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1008f2fc
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.10076571
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x41c9e2
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x41ca8e
sub ecx, 1
je 0x41ca80
sub ecx, 1
je 0x41ca72
sub ecx, 1
je 0x41ca3f
sub ecx, 1
jne 0x41cad0
push 1
sub esp, 0x18
mov ecx, esp
push 0x46611c
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x466118
jmp 0x41cabc
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c5f0
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x46611c
jmp 0x41cabc
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c9f8
jmp 0x41ca4b
push 1
sub esp, 0x18
mov ecx, esp
push 0x466104
jmp 0x41ca4b
push 1
sub esp, 0x18
mov ebx, 0x46611c
mov ecx, esp
push ebx
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402093
push str.TileWallpaper
mov edx, esi
call fcn.0041376f
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x41cd9b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [0x474b18]
test bl, bl
mov dword [0x474b34], eax
pop ebx
jne 0x41cdc3
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0043c1b8
push eax
push 0x46ce14
push str.CONOUT_
call fcn.00441c22
add esp, 0x10
push 0x4e4
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call fcn.0041cd58
push 0x64
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00436e90
lea eax, [ebp - 0x64]
push str._n_tRemcos_v
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push str.4.9.3_Pro
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push 0x46cf18
push eax
call fcn.00441f60
lea eax, [ebp - 0x64]
push eax
call fcn.00407200
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x641d3a35
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x340e1548
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40268b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4026c2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4026be
jmp 0x4026b0
cmp esi, eax
jae 0x4026c2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4026b0
cmp esi, eax
jb 0x4026c9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4058f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5375f6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x587be0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, 1
cmp dword [edi + 0xa68], ebx
jne 0x405940
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
mov esi, 0x6b
call fcn.00401f60
add esp, 4
lea ecx, [edi + 0xac4]
push eax
mov dword [esp + 0x34], 0
call fcn.00402580
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40598e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, edi
call fcn.00407c20
call fcn.00406890
mov ecx, dword [edi + 0x20]
push 0
push 0x1f4
push 7
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
lea esi, [esp + 0x14]
call fcn.00405a50
push 0
mov dword [esp + 0x34], ebx
push 0x56560c
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0
call fcn.00402bc0
mov edx, dword [esp + 0x14]
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x20], esp
lea eax, [esp + 0x28]
mov dword [edi + 0xa68], ebx
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x24], esi
mov dword [esi], edx
call fcn.004023a0
lea edx, [esp + 0x2c]
lea ecx, [esi + 8]
push edx
mov byte [esp + 0x44], 2
call fcn.004023a0
lea eax, [esp + 0x30]
lea ecx, [esi + 0xc]
push eax
mov byte [esp + 0x44], 3
call fcn.004023a0
mov byte [esp + 0x40], bl
call fcn.004091c0
add esp, 0x10
lea esi, [esp + 0x14]
call fcn.00405ac0
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405b20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xa68], 1
push edi
jne 0x405b85
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 7
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0x65
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0x66
push edx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4094c0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x409590
push 0
push 0
call edi
mov dword [esi + 0xa68], 0
lea ebx, [esi + 0x10c]
call fcn.0040e310
lea ebx, [esi + 0x20c]
call fcn.0040e310
mov eax, dword [esi + 0x12c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x405bc7
lea ebx, [esi + 0x10c]
call fcn.0040e310
xor ebx, ebx
push ebx
lea ecx, [esi + 0x10c]
call fcn.00414f69
jmp 0x405bc9
xor ebx, ebx
mov ecx, dword [esi + 0x22c]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x405bf0
lea ebx, [esi + 0x20c]
call fcn.0040e310
push 0
mov ecx, ebx
call fcn.00414f69
xor ebx, ebx
lea edi, [esi + 0x6c0]
mov dword [esi + 0xabc], ebx
mov dword [esi + 0xa90], ebx
mov dword [esi + 0xa94], ebx
mov dword [esi + 0xa98], ebx
mov dword [esi + 0xa9c], ebx
mov dword [esi + 0xaa0], ebx
mov edx, dword [edi + 0xb4]
mov dword [edi + 0xf0], ebx
mov dword [edi + 0xb8], edx
mov dword [edi + 0xb4], 1
mov byte [edi + 0x85], bl
cmp dword [edi + 0xa0], ebx
je 0x405c4b
mov ecx, edi
call fcn.0040cf70
mov ecx, edi
call fcn.0040d590
call fcn.0040d1c0
mov eax, dword [esi + 0x20]
push ebx
push ebx
push 0x18
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.00417c6a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c2e0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x587be0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x114
lea eax, [ebp - 0x120]
push ebx
push eax
mov dword [0x58f9d0], ebx
mov dword [0x58f9d4], 5
call fcn.00513f60
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40c34c
lea ecx, [ebp - 0x144]
push ecx
call eax
jmp 0x40c359
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x144]
cmp eax, 9
jg 0x40c388
je 0x40c37c
cmp eax, ebx
je 0x40c38f
cmp eax, 6
jne 0x40c38f
mov dword [0x58f9d0], 1
jmp 0x40c3a1
mov dword [0x58f9d0], 2
jmp 0x40c3a1
cmp eax, 0xffff
je 0x40c397
mov dword [0x58f9d0], ebx
jmp 0x40c3a1
mov dword [0x58f9d0], 3
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x40c3c6
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511f1b
mov esp, ebp
pop ebp
ret
push 0x11c
lea ecx, [ebp - 0x120]
push ebx
push ecx
call fcn.00513f60
add esp, 0xc
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x11c
call esi
test al, al
jne 0x40c409
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x40c3b4
mov eax, dword [ebp - 0x110]
dec eax
je 0x40c4f6
dec eax
je 0x40c428
mov dword [0x58f9d4], 0xc
jmp 0x40c531
mov eax, dword [ebp - 0x11c]
cmp eax, 4
ja 0x40c43d
mov dword [0x58f9d4], 3
mov ecx, 5
cmp eax, ecx
jne 0x40c48c
mov eax, dword [ebp - 0x118]
cmp eax, ebx
jne 0x40c45f
mov dword [0x58f9d4], 4
jmp 0x40c531
cmp eax, 1
je 0x40c481
cmp eax, 2
jne 0x40c531
cmp byte [ebp - 6], 1
mov dword [0x58f9d4], 6
jne 0x40c531
mov dword [0x58f9d4], ecx
jmp 0x40c531
cmp eax, 6
jne 0x40c4dd
mov eax, dword [ebp - 0x118]
cmp eax, ebx
jne 0x40c4aa
mov dword [0x58f9d4], 7
jmp 0x40c531
cmp eax, 1
jne 0x40c4bb
mov dword [0x58f9d4], 8
jmp 0x40c531
cmp eax, 2
jne 0x40c4cc
mov dword [0x58f9d4], 9
jmp 0x40c531
cmp eax, 3
jne 0x40c531
mov dword [0x58f9d4], 0xa
jmp 0x40c531
cmp eax, 0xa
jne 0x40c531
cmp dword [ebp - 0x118], ebx
jne 0x40c531
mov dword [0x58f9d4], 0xb
jmp 0x40c531
cmp dword [ebp - 0x11c], 4
jne 0x40c531
mov eax, dword [ebp - 0x118]
cmp eax, ebx
jne 0x40c511
mov dword [0x58f9d4], ebx
jmp 0x40c531
cmp eax, 0xa
jne 0x40c522
mov dword [0x58f9d4], 1
jmp 0x40c531
cmp eax, 0x5a
jne 0x40c531
mov dword [0x58f9d4], 2
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00511f1b
mov esp, ebp
pop ebp
ret
Function at 0x40e470
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [esi + 0xac], 0
je 0x40e4d5
cmp dword [esi + 0xa0], 0
je 0x40e4db
mov ecx, dword [esi + 0xe4]
sub ecx, dword [esi + 0xe0]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x40e4db
lea ecx, [ebp - 8]
push ecx
push 4
push esi
push 0x40ea00
push 0
push 0
call fcn.005133ba
add esp, 0x18
mov dword [esi + 0xc8], eax
test eax, eax
je 0x40e4d5
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x40e4d5
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push edi
lea ecx, [ebp - 8]
push ecx
push eax
call edx
mov eax, dword [esi + 0xd0]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0xd0]
mov edx, dword [eax]
push 0
mov edx, dword [edx + 0x20]
mov edi, ecx
neg edi
push edi
mov edi, dword [ebp - 8]
push edi
push ecx
mov ecx, dword [esi + 0x88]
push 0
push ecx
mov ecx, dword [esi + 0x84]
push ecx
mov ecx, dword [esi + 0xb0]
push 0
push 0
push ecx
push eax
call edx
pop edi
test eax, eax
jne 0x40e4d5
push eax
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40e560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00418e86
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push 0x565b34
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40e623
call fcn.00418e86
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40e623
push edi
call fcn.00418e86
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x40e5c9
pop edi
pop esi
pop ebp
ret 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [ebp + 0xc]
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40e613
test ebx, ebx
je 0x40e613
push edi
push eax
push ebx
call fcn.00515870
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push edi
push esi
call fcn.0040df90
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x412980
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
and byte [edi + 0xc], 9
test byte [edi + 0xc], 1
je 0x4129b1
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x4129b1
or byte [edi + 0xc], 4
mov cl, byte [edi + 0xc]
test eax, 0x21000000
jne 0x4129b1
or cl, 2
mov byte [edi + 0xc], cl
test byte [edi + 0xc], 2
je 0x4129cb
mov eax, dword [edi + 4]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.00411e80
pop edi
ret
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret