joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x958]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41a9de
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aa5f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41aa70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41aadf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41aaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ab53
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41abbf
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41abd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.0041b010
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x41ac26
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b476
cmp dword [esi + 0x18], 0
je 0x41b491
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b46e
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b450
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41b491
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41b491
cmp eax, ecx
je 0x41b46e
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41b484
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b4a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b4f8
cmp dword [esi + 0x18], 0
je 0x41b4f8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b500
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b4e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41b568
cmp dword [esi + 0x18], 0
je 0x41b568
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041cd20
add esp, 8
test eax, eax
jne 0x41b570
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b550
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x41b664
cmp dword [eax + 0x18], 0
je 0x41b664
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x41b657
mov esp, ebp
pop ebp
ret

Function at 0x41b670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041be60
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41b6fb
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041c480
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00414df0
add esp, 0x10
test eax, eax
jne 0x41b703
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41b6d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bb40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41bb4e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bb4a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x41bb4a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x41bb90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41bbb4
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41bbb4
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x41bbbc
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041bf90
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041be10
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041bde0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x41bc4e
mov dword [ebp + 0xc], edx
jmp 0x41bbf9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x41bc10
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x41bc26
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x41bc33
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041bde0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41bbf7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41bc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41bc80
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41bc80
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x41bc84
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x41bd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41bd20
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bd20
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41bd24
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41bd20
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x401150
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x418
mov eax, dword [0x437d18]
xor eax, esp
mov dword [esp + 0x414], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.004130c0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call fcn.004130c0
lea edi, [esp + 0x1c]
call fcn.00404ba0
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x22c]
push str._sCmdDloader.ini
push edx
call fcn.00411348
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x24
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
test edx, edx
jg 0x4011db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x210]
push ecx
push 0x104
lea edx, [esp + 0x10]
push edx
push str.ResearchDownload.exe
push str.FlashApp
push str.Setting
call esi
lea eax, [esp + 8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401210
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, 0x43c0f4
call fcn.00401520
lea ecx, [esp + 0x210]
push ecx
push 0x104
lea edx, [esp + 0x10]
push edx
push 0x431920
push 0x431924
push str.Setting
call esi
lea eax, [esp + 8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401260
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, 0x43c0f8
call fcn.00401520
lea ecx, [esp + 0x210]
push ecx
push 0x104
lea edx, [esp + 0x10]
push edx
push str.ResearchDownload
push str.PipeName
push str.Setting
call esi
lea eax, [esp + 8]
lea edx, [eax + 2]
pop esi
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4012b0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
mov ecx, 0x43c0fc
call fcn.00401520
lea ecx, [esp + 0x20c]
push ecx
push 1
push str.ShowProcess
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x414]
xor ecx, esp
mov dword [0x43c100], eax
call fcn.00411339
add esp, 0x418
ret
Function at 0x4039d0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x42b8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push esi
push edi
mov eax, dword [0x437d18]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
push 0x44
xor edi, edi
lea eax, [esp + 0x30]
push edi
push eax
call fcn.004130c0
xor eax, eax
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x2c], 0x44
mov word [esp + 0x5c], cx
mov dword [esp + 0x58], 0x101
mov dword [0x43c0d8], eax
mov dword [0x43c0dc], eax
mov dword [0x43c0e0], eax
mov dword [0x43c0e4], eax
cmp dword [0x43c0d4], eax
jne 0x403a5d
push str._ERROR__Invalid_COM_Port._n
call fcn.00411637
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x78
ret
lea ecx, [esp + 0x14]
call fcn.0040654e
mov dword [esp + 0x80], 0
mov edx, dword [0x43c0d0]
push 0
push edx
lea ecx, [esp + 0x1c]
call fcn.0040660b
test eax, eax
jne 0x403a9f
mov eax, dword [0x43c0d0]
push eax
push str._ERROR__Pac_file___s__dont_exist._n
call fcn.00411637
add esp, 8
jmp 0x403ba6
lea ecx, [esp + 0x14]
call fcn.0040613e
mov ecx, dword [0x43c0cc]
push 0
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040660b
test eax, eax
jne 0x403ad7
mov edx, dword [0x43c0cc]
push edx
push str._ERROR__Dloader_application___s__dont_exist._n
call fcn.00411637
add esp, 8
jmp 0x403ba6
lea ecx, [esp + 0x14]
call fcn.0040613e
call fcn.00404cc6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403afa
push 0x80004005
call fcn.00401650
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x80], 1
mov ecx, dword [0x43c0d4]
mov edx, dword [0x43c0d0]
mov eax, dword [0x43c0cc]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push str.__s___pac___s___port__d
push ecx
call fcn.004036b0
mov esi, dword [esp + 0x24]
add esp, 0x14
push 0x43c0d8
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x403b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._ERROR__CreateProcess____s___failed___Errorcode0x_x_._n
call fcn.00411637
add esp, 0xc
jmp 0x403b82
mov dword [0x43c0c8], 0
lea eax, [esi - 0x10]
mov byte [esp + 0x80], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403ba6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x80], 0xffffffff
call fcn.00406577
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x78
ret
Function at 0x403e60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x437d18]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
mov esi, dword [edi + 4]
test esi, esi
jne 0x403e94
xor eax, eax
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00411339
add esp, 0x808
ret
push 0x7ff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.004130c0
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push 0x7ff
lea edx, [esp + 0x14]
push edx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403e7c
mov ecx, dword [esp + 4]
test ecx, ecx
jbe 0x403ee8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x403ee8
push ecx
lea ecx, [esp + 0xc]
push ecx
call eax
mov ecx, dword [esp + 0x808]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00411339
add esp, 0x808
ret

Function at 0x403f70
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword [esi + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], 1
test eax, eax
je 0x403fae
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403fa1
mov eax, dword [esi + 0x14]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x14]
push ecx
call edi
mov dword [esi + 0x14], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x403fbf
push eax
call edi
mov dword [esi + 4], 0
mov edx, dword [esp + 8]
lea eax, [esi + 0x18]
push eax
push 0
push esi
push 0x403f10
push 0
push 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
pop edi
ret 4

Function at 0x404000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404019
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404054
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404050
lea ebx, [ebx]
cmp esi, eax
jae 0x404054
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404040
cmp esi, eax
jb 0x40405a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4043a0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x42bb0b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x437d18]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437d18]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x25c]
mov esi, ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.00404570
push 0
push 2
mov dword [esp + 0x25c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [esp + 0x18]
mov ebp, eax
mov dword [esp + 0x1c], 0x22c
cmp ebp, 0xffffffff
je 0x404482
lea ecx, [esp + 0x1c]
push ecx
push ebp
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40447b
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x24]
push edx
push 0
push 0x1fffff
call ebx
mov edi, eax
test edi, edi
je 0x40446c
mov ecx, dword [esp + 0x14]
call fcn.00404780
test eax, eax
je 0x404465
mov eax, dword [esp + 0x24]
push 0
push eax
push 0
push 0x1fffff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
push ecx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40442d
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov dword [esp + 0x254], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4044a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00411339
add esp, 0x244
ret 4

Function at 0x4044e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [0x437d18]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], 0x22c
cmp esi, 0xffffffff
je 0x404557
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x404550
lea esp, [esp]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x404539
lea ecx, [esp + 4]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x404520
jmp 0x404550
push 0
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x230]
pop esi
xor ecx, esp
call fcn.00411339
add esp, 0x230
ret
Function at 0x404570
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x42bacc
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x437d18]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [0x437d18]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.00404280
mov dword [esp + 0x224], 0
test esi, esi
je 0x404712
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4045d1
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x404712
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004130c0
add esp, 0xc
push esi
lea ecx, [esp + 0xc]
call fcn.00404280
push 2
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x230], 1
call fcn.00404900
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x228], 2
call fcn.00403740
mov byte [esp + 0x224], 1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404661
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 8]
push 0x104
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4046d3
push 2
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.004048d0
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x228], 3
call fcn.00403740
mov byte [esp + 0x224], 1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4046c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
call fcn.00404810
mov eax, dword [esp + 4]
add eax, 0xfffffff0
push eax
call fcn.004036d0
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x228], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404727
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404727
mov eax, dword [esp + 4]
add eax, 0xfffffff0
push eax
call fcn.004036d0
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x224], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404752
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00411339
add esp, 0x224
ret

Function at 0x411339
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437d18]
jne 0x411343
repz ret
jmp fcn.0041599f