joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000986a
Capabilities:
Get session user name

Disassembly:
push 0x138
mov eax, 0x1009e4a7
call fcn.1009cc24
mov esi, ecx
mov dword [ebp - 0x134], esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x130]
mov edi, dword [sym.imp.fpsrvutl.dll_Ordinal_4936]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x124], eax
call edi
xor ebx, ebx
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], ebx
call edi
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x11c]
add eax, 4
mov byte [ebp - 4], 1
mov esi, dword [esi + 0xc]
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_4871]
push ecx
push ebx
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.10009a30
lea ecx, [ebp - 0x11c]
mov byte [ebp - 0x115], al
mov byte [ebp - 4], 1
call dword [sym.imp.fpsrvutl.dll_Ordinal_3409]
lea ecx, [ebp - 0x128]
call edi
mov edi, dword [ebp - 0x134]
lea ecx, [ebp - 0x144]
push 0x1267
push ebx
push ebx
mov byte [ebp - 4], 3
mov esi, dword [edi + 0xc]
push 6
call dword [sym.imp.fpsrvutl.dll_Ordinal_304]
push eax
lea ecx, [esi + 0x44]
call dword [sym.imp.fpsrvutl.dll_Ordinal_933]
mov esi, dword [sym.imp.fpsrvutl.dll_Ordinal_4818]
test al, al
je 0x1000996c
mov ecx, dword [edi + 8]
call fcn.10007751
push ebx
lea ecx, [ebp - 0x128]
push ecx
push str.vti_username
mov ecx, eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_3695]
mov bl, al
test bl, bl
je 0x1000996c
lea ecx, [ebp - 0x128]
jmp 0x1000997b
cmp byte [ebp - 0x115], 0
je 0x100099a4
lea ecx, [ebp - 0x130]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5580]
mov edi, dword [ebp - 0x120]
mov ecx, edi
push eax
call esi
cmp byte [ebp - 0x115], 0
je 0x100099aa
lea ecx, [ebp - 0x12c]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5580]
push eax
jmp 0x100099af
mov edi, dword [ebp - 0x120]
push 0x100afe24
mov ecx, dword [ebp - 0x124]
call esi
test bl, bl
jne 0x100099fd
cmp byte [ebp - 0x115], bl
jne 0x100099fd
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x81
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5525]
mov ecx, dword [ebp - 0x124]
push 0x100afe24
call esi
mov eax, dword [edi]
lea ecx, [ebp - 0x128]
mov edi, dword [sym.imp.fpsrvutl.dll_Ordinal_3409]
mov esi, dword [eax - 4]
call edi
lea ecx, [ebp - 0x12c]
call edi
lea ecx, [ebp - 0x130]
call edi
xor eax, eax
cmp eax, esi
sbb eax, eax
neg eax
call fcn.1009cbd6
ret 8
Function at 0x10027f20
Capabilities:
Parse pe header

Disassembly:
push 0x10
mov eax, 0x100a1e41
call fcn.1009cc24
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
test al, 1
je 0x10027f42
mov byte [ebp - 0x18], 0x4e
jmp 0x10027f6d
test al, 2
je 0x10027f4c
mov byte [ebp - 0x18], 0x46
jmp 0x10027f6d
test al, 3
je 0x10027f56
mov byte [ebp - 0x18], 0x53
jmp 0x10027f6d
test al, 4
je 0x10027f60
mov byte [ebp - 0x18], 0x57
jmp 0x10027f6d
and al, 5
neg al
sbb al, al
and al, 0xef
add al, 0x55
mov byte [ebp - 0x18], al
mov ebx, dword [ebp + 0xc]
xor edx, edx
mov byte [ebp - 0x16], dl
test bl, 1
je 0x10027f83
mov byte [ebp - 0x17], 0x49
jmp 0x10028094
test bl, 2
je 0x10027f91
mov byte [ebp - 0x17], 0x48
jmp 0x10028094
test bl, 3
je 0x10027f9f
mov byte [ebp - 0x17], 0x4b
jmp 0x10028094
test bl, 4
je 0x10027fad
mov byte [ebp - 0x17], 0x53
jmp 0x10028094
test bl, 5
je 0x10027fbb
mov byte [ebp - 0x17], 0x41
jmp 0x10028094
test bl, 6
je 0x10027fc9
mov byte [ebp - 0x17], 0x42
jmp 0x10028094
test bl, 7
je 0x10027fd7
mov byte [ebp - 0x17], 0x4c
jmp 0x10028094
test bl, 8
je 0x10027fe5
mov byte [ebp - 0x17], 0x4d
jmp 0x10028094
test bl, 9
je 0x10027ff3
mov byte [ebp - 0x17], 0x54
jmp 0x10028094
test bl, 0xa
je 0x10028001
mov byte [ebp - 0x17], 0x59
jmp 0x10028094
test bl, 0xb
je 0x1002800f
mov byte [ebp - 0x17], 0x46
jmp 0x10028094
test bl, 0xc
je 0x1002801a
mov byte [ebp - 0x17], 0x44
jmp 0x10028094
mov ecx, 0x4000002
mov eax, ebx
and eax, ecx
cmp eax, ecx
jne 0x1002802d
mov byte [ebp - 0x17], 0x4e
jmp 0x10028094
test bl, 0xd
je 0x10028038
mov byte [ebp - 0x17], 0x57
jmp 0x10028094
test bl, 0xe
je 0x10028043
mov byte [ebp - 0x17], 0x43
jmp 0x10028094
test bl, 0xf
je 0x1002804e
mov byte [ebp - 0x17], 0x58
jmp 0x10028094
test bl, 0x10
je 0x10028059
mov byte [ebp - 0x17], 0x51
jmp 0x10028094
test bl, 0x11
je 0x10028064
mov byte [ebp - 0x17], 0x45
jmp 0x10028094
test bl, 0x12
je 0x1002806f
mov byte [ebp - 0x17], 0x47
jmp 0x10028094
test bl, 0x14
je 0x1002807a
mov byte [ebp - 0x17], 0x50
jmp 0x10028094
test bl, 0x15
je 0x10028085
mov byte [ebp - 0x17], 0x5a
jmp 0x10028094
mov al, bl
and al, 0x13
neg al
sbb al, al
and al, 0xfd
add al, 0x55
mov byte [ebp - 0x17], al
mov byte [ebp - 0x15], dl
test ebx, 0x10000000
je 0x100280a8
mov word [ebp - 0x16], 0x4455
mov byte [ebp - 0x14], dl
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_4818]
test ebx, 0x20000000
je 0x100280e3
push 0x100b1b14
lea ecx, [ebp - 0x1c]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2836]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_2202]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.fpsrvutl.dll_Ordinal_3409]
call fcn.1009cbd6
ret 0x10
Function at 0x1002deab
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e9af
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100eed78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
and dword [ebp - 4], 0
push 0
mov dword [esi], vtable.FtpSession.0
call fcn.10001533
lea ecx, [esi + 0x64]
call fcn.10001533
lea ecx, [esi + 0x30]
call fcn.10002a67
mov ecx, esi
mov dword [esi], vtable.InetFtpAsyncObj.0
call fcn.10001533
test byte [ebp + 8], 1
je 0x1002df0b
push esi
call fcn.10001533
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret 4
Function at 0x100303c8
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor edx, edx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebx], edx
test ecx, ecx
je 0x10030405
mov eax, dword [esi + 4]
cmp eax, 4
je 0x100303eb
cmp eax, 5
jne 0x10030405
cmp dword [esi + 0x98], edx
jne 0x10030419
sub eax, 4
je 0x1003040e
sub eax, 1
jne 0x10030405
mov eax, dword [esi + 0x78]
mov dword [ebx], eax
mov dword [esi + 0x78], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 0x9c], eax
jmp 0x10030405
mov cl, byte [esi + 0x7c]
test cl, cl
je 0x10030405
cmp eax, 5
jne 0x10030405
lea edi, [esi + 0xa0]
cmp dword [edi], edx
jne 0x1003048d
push dword [esi + 0x64]
push str.call_InternetWriteFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov byte [esi + 0x7c], al
test al, al
je 0x1003047a
push dword [esi + 0x64]
push str.InternetWriteFile_0x_08x__completed_synchronously_n
push 7
push 0xc
call fcn.1001ef2c
mov al, byte [esi + 0x7c]
add esp, 0x10
xor edx, edx
mov cl, al
test al, al
je 0x1003048d
cmp dword [edi], edx
jne 0x1003048d
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
mov cl, al
test cl, cl
je 0x100304ac
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi]
sub dword [esi + 0x78], eax
mov dword [edi], edx
je 0x100304ac
mov ecx, dword [esi + 0x48]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030405
movsx eax, byte [esi + 0x7c]
push ecx
push edx
push eax
lea ecx, [esi + 0x34]
call fcn.10001533
jmp 0x10030407
Function at 0x100304c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov edx, dword [ebp + 8]
lea edi, [esi + 0x60]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi]
mov dword [eax], ecx
cmp dword [esi + 4], 8
je 0x100304eb
cmp dword [esi + 4], 7
jne 0x10030509
xor ebx, ebx
test ecx, ecx
je 0x10030510
mov ecx, dword [esi + 0x48]
mov dword [esi + 0xa4], ebx
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
xor eax, eax
jmp 0x100305be
cmp dword [esi + 0xa4], ebx
jne 0x10030509
push dword [esi + 0x64]
push str.call_InternetReadFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
push edi
push 0x1000
push eax
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetReadFile]
push dword [esi + 0x64]
test eax, eax
je 0x10030599
push dword [edi]
push str.received__d_bytes_from_0x_08x_n
push 7
push 0xc
call fcn.1001ef2c
mov ecx, dword [edi]
add esp, 0x14
test ecx, ecx
jne 0x10030574
mov dword [esi + 4], 9
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi + 0x48]
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
push ebx
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030509
push str.InternetReadFile_on_0x_08x_returned_FALSE_n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0xc
mov dword [esi + 0xa4], 1
lea ecx, [esi + 0x34]
push ebx
push ebx
call fcn.10001533
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1006dab8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100a91de
call fcn.1009cc92
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1006dcca
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1006db0a
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.1006c7b5
test eax, eax
js 0x1006dcca
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1006db5b
mov ecx, esi
call fcn.1006c818
test al, al
je 0x1006db5b
mov eax, esi
call fcn.1009cd15
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1006db67
push esi
lea ecx, [ebp - 0x428]
call fcn.10001533
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.10001533
mov edi, eax
test edi, edi
je 0x1006dcc4
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x1006dbb5
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x1006dbb5
call fcn.1006c19a
mov edi, eax
jmp 0x1006dca9
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1006dbd8
call fcn.1006c19a
jmp 0x1006dc9c
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1006dbce
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x1006dc0b
mov edi, 0x8007000e
jmp 0x1006dc9e
mov byte [ebp - 4], 2
call fcn.1006c8c7
cmp eax, 0x400
jbe 0x1006dc29
push eax
lea ecx, [ebp - 0x418]
call fcn.10001533
jmp 0x1006dc35
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1006dc59
cmp dword [ebp - 0x418], 0
je 0x1006dc01
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.10001533
pop ecx
pop ecx
mov ecx, eax
call fcn.1006cdee
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.10001533
mov edi, eax
test esi, esi
je 0x1006dca9
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1006dce4
lea ecx, [ebp - 0x418]
call fcn.1006c188
jmp 0x1006dce4
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1006dcdf
lea ecx, [ebp - 0x418]
call fcn.1006c188
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.1006c79b
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1009cbe3
ret 0x10
Function at 0x1006f8c5
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x230
mov eax, 0x100a94b9
call fcn.1009cc24
mov dword [ebp - 0x234], edx
mov ebx, ecx
push ebx
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5241]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [0x100f55b0]
add eax, 0xe8
mov dword [ebp - 0x23c], eax
mov edi, dword [eax]
test edi, edi
jne 0x1006f924
push 0xf0000040
push 1
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, dword [ebp - 0x23c]
mov edi, dword [edi]
test edi, edi
je 0x1006fa2c
lea eax, [ebp - 0x230]
push eax
push 0x18
push edi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1006fa2c
mov eax, dword [ebp - 0x21c]
xor edx, edx
push 0x24
pop ecx
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x220]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x224]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x228]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x22c]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x230]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push str._wswe_c_c_c_c_c_c.tmp
push 0xffffffffffffffff
push eax
call fcn.10001533
add esp, 0x28
lea eax, [ebp - 0x218]
cmp byte [ebp + 8], 0
je 0x1006fa1d
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1006fa10
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1006f924
cmp eax, 0x50
je 0x1006f924
jmp 0x1006fa32
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x234]
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5525]
jmp 0x1006fa41
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov edx, eax
mov ecx, 0x20002
call fcn.10020b05
mov esi, eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2017]
mov eax, esi
call fcn.1009cbd6
ret 4
Function at 0x1006fadc
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x100a94f7
call fcn.1009cbf0
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.fpsrvutl.dll_Ordinal_4936]
push ebx
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov ebx, eax
test ebx, ebx
jle 0x1006fb90
lea edi, [ebx + 1]
call dword [sym.imp.fpsrvutl.dll_Ordinal_4348]
test eax, eax
je 0x1006fb2a
mov ecx, edi
call dword [sym.imp.fpsrvutl.dll_Ordinal_5011]
jmp 0x1006fb32
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
test edi, edi
je 0x1006fb90
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetTempPathA]
push edi
mov ecx, esi
mov byte [eax + edi], 0
call dword [sym.imp.fpsrvutl.dll_Ordinal_4818]
push 0
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_3947]
push 0x5c
push 2
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5801]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_687]
push 0x2f
push 2
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5801]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_687]
push edi
call fcn.10001533
pop ecx
mov eax, esi
call fcn.1009cbc1
ret
Function at 0x10097ef9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
push 1
mov edi, 0x10000000
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10097f3e
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
test eax, eax
je 0x10097f3e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x10097f3e
cmp word [eax + 2], 0
je 0x10097f3e
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x10097f3e
add eax, 0x30
jmp 0x10097f43
mov eax, 0x100c70e8
pop edi
pop esi
ret
Function at 0x406850
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41fa1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4045dc
call fcn.004093c4
push 4
mov dword [esp + 0x18], 0
call fcn.0040ac76
mov edi, eax
add esp, 4
test edi, edi
je 0x4068c4
push ebx
call fcn.004091bf
mov dword [edi], eax
call fcn.00408f7e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409385
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4068b8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.004093ad
pop ebx
jmp 0x4068c6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b76e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4233dc]
jne 0x40b778
repz ret
jmp fcn.0041287c
Function at 0x41828b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4233dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e5a2
and dword [ebp - 0x14], 0
cmp dword [0x834054], 0
mov dword [ebp - 0x18], eax
jne 0x41833e
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4183e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x4183e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x834054], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x834058], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x83405c], eax
call edi
push eax
call esi
mov dword [0x834064], eax
test eax, eax
je 0x41833e
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x834060], eax
mov eax, dword [0x834060]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418397
cmp dword [0x834064], ecx
je 0x418397
push eax
call esi
push dword [0x834064]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418397
test ebx, ebx
je 0x418397
call edi
test eax, eax
je 0x41838e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41838e
test byte [ebp - 8], 1
jne 0x418397
or dword [ebp + 0x10], 0x200000
jmp 0x4183ca
mov eax, dword [0x834058]
cmp eax, dword [ebp - 0x18]
je 0x4183ca
push eax
call esi
test eax, eax
je 0x4183ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4183ca
mov eax, dword [0x83405c]
cmp eax, dword [ebp - 0x18]
je 0x4183ca
push eax
call esi
test eax, eax
je 0x4183ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x834054]
call esi
test eax, eax
je 0x4183e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4183e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b76e
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xd321e1a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x61d2777e
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4204a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
pop ebx
jmp fcn.0041fc00

Function at 0x4211f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 1
xor edx, edx
jmp fcn.00420690