joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462b30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x500420]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4612bb
je 0x46130e
cmp ebx, 0x20
jbe 0x461314
cmp ebx, 0x40
jbe 0x46135a
jmp 0x4613fb
test ebx, ebx
je 0x461304
add eax, 0x10
test ax, 0xff0
je 0x4612f0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x48fbe0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x48fce0]
jmp 0x4612d8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4612d8
pxor xmm1, xmmword [0x500430]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x500430]
pxor xmm2, xmmword [0x500440]
pxor xmm3, xmmword [0x500450]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x500430]
pxor xmm2, xmmword [0x500440]
pxor xmm3, xmmword [0x500450]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46145a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x500144], 0
je 0x462b4a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x461280
jmp fcn.00407c40

Function at 0x4639a0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x4639ba
mov ecx, 0x14
jmp 0x4639c3
shl ecx, 2
add ecx, 0xe10
mov dword [0x500244], ecx
ret
Function at 0x4145aa
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cld
mov esi, dword fs:[0x30]
push dword [esi + 0xc]
pop esi
push dword [esi + 0x14]
pop esi
push 0
pop eax
xor eax, 1
test eax, eax
je 0x414625
sub edi, edi
add edi, dword [esi + 0x28]
xor ecx, ecx
push eax
push edx
pop eax
push esi
mov esi, edi
lodsw ax, word [esi]
imul edi, edi, 0
add edi, esi
pop esi
push 0
pop edx
add edx, eax
pop eax
test dx, dx
je 0x41460c
or dl, 0x20
rol ecx, 0xa
rol ecx, 0x11
ror ecx, 1
ror ecx, 0xb
not cl
not cl
xor cl, dl
not cl
not cl
jge 0x4145d4
jmp 0x4145d4
mov eax, 0
or eax, dword [esi + 0x10]
push dword [esi]
pop esi
push edx
lea edx, [0]
xor edx, dword [ebp + 8]
cmp ecx, edx
pop edx
jne 0x4145c9
push edx
push eax
pop edx
pop eax
shl eax, 0xe
shl eax, 0x11
shl eax, 1
not eax
xor eax, edx
not eax
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x416eff
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov edx, dword fs:[0x30]
push dword [edx + 0xc]
pop edx
push dword [edx + 0x14]
pop edx
shr ebx, 0x17
shr ebx, 8
shr ebx, 1
not ebx
xor ebx, dword [edx + 0x28]
not ebx
push ebx
mov dword [ebp - 0x88], 0
or dword [ebp - 0x88], esi
mov dword [ebp - 0x48], 0
add dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0
or dword [ebp - 0x44], edx
call fcn.004170c2
push 0
pop ecx
or ecx, eax
imul ebx, ebx, 0
or ebx, dword [ebp - 0x48]
mov esi, 0
or esi, dword [ebp - 0x88]
shl edx, 0x1f
shl edx, 1
add edx, dword [ebp - 0x44]
push ecx
pop eax
sub ecx, ecx
or ecx, dword [edx + 0x10]
mov edx, dword [edx]
cmp eax, dword [esp + 4]
jne 0x416f0e
shl eax, 0x1d
shl eax, 2
shl eax, 1
add eax, ecx
ret 4
Function at 0x40a718
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor dh, 0xc7
inc esp
and al, 0x50
test esp, edi
xlatb
xor edi, eax
inc esp
and al, 0x54
hlt

Function at 0x40a74f
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
inc esp
and al, 0x64
or eax, 0x6a2444c6
add bh, al
inc esp
and al, 0x66
add byte [eax], al
add byte [eax], al
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x52
ja 0x40a7a0
dec eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
add al, 0x8b
dec esp
and al, 4
add al, ah
dec esi
mov bh, 0xb6
dec esp
or al, 0x18
lea edx, [eax + 0xc]
mov esi, ecx
not esi
or esi, edx
and edx, ecx
add edx, esi
neg edx
add eax, edx
add eax, 0xab50de0b
push ebx
jb 0x40a763
mov eax, dword [ebp + 0xc]
movzx ecx, byte [esp + 0x18]
mov dword [esi], ecx
add al, 0xeb
jp 0x40a735
leave
je 0x40a7d1
lea esi, [esp + 0x19]
mov edx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x40a7c6
mov byte [edx], 0
add al, ah
dec esi
mov bh, 0xb6
or byte [ecx + ecx*8 - 0x6fbfe98c], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
add al, ah
dec esi
mov bh, 0xb6
or byte [eax - 0x7c], al
leave
jne 0x40a7ec
mov byte [edx], 0
movzx eax, byte [esp + 8]
test al, al
je 0x40a817
lea ecx, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40a80c
mov ebx, dword [ebp + 0x10]
mov byte [edx], 0
movzx eax, byte [esp + 0x80]
test al, al
mov dword [esp + 0x78], edi

Function at 0x40be06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
salc
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x19f]
lea edx, [esp + 0x130]
xor ecx, ecx
Function at 0x4374df
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
inc esp
and al, 0xc
mov ebx, dword [esp + 0x64]
lea ecx, [ebx + ebx]
not ecx
add ecx, ebx
or ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x68]
xor ecx, esi
add ecx, dword [esp + 0x6c]
add edx, ecx
add edx, 0x50a28be6
rol edx, 8
mov edi, dword [esp + 0x60]
add edx, edi
mov ecx, dword [esp + 4]
not ecx
or ecx, esi
xor ecx, edx
add ecx, edi
add ebp, ecx
add ebp, 0x50a28be6
rol ebp, 9
mov esi, edx
mov edi, dword [esp + 0x18]
and esi, edi
xor edi, edx
not edi
add edi, edx
sub edi, esi
add ebp, ebx
xor edi, ebp
mov esi, dword [esp + 0x24]
add esi, ebx
add ebx, eax
cmp dword [edx], 0xe6c681de
mov esp, dword [edx + 0x247c8b50]
or al, 0x8b
pop esp
and al, 0x14
add edi, ebx
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0x10]
rol ecx, 0xa
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 8]
xor edi, eax
and edi, ecx
xor edi, eax
mov dword [esp + 0x58], edi
xor edi, dword [esp + 0x20]
rol esi, 9
add edi, ebx
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 4]
add esi, ecx
rol edx, 0xa
mov eax, edx
not eax
or eax, ebp
xor eax, esi
add ecx, dword [esp + 0x48]
lea ebx, [eax + ecx]
add ebx, 0x50a28be6
rol ebx, 0xb
mov ecx, dword [esp + 0x18]
add ebx, ecx
rol ebp, 0xa
mov eax, ebp
not eax
or eax, esi
xor eax, ebx
add ecx, dword [esp + 0x28]
add ecx, eax
add ecx, 0x50a28be6
rol ecx, 0xd
add ecx, edx
rol esi, 0xa
mov edi, esi
not edi
or edi, ebx
xor edi, ecx
iretd
add edx, dword [esp + 0x1c]
add edi, edx
add edi, 0x50a28be6
rol ebx, 0xa
mov edx, ecx
not edx
or edx, ebx
mov eax, ecx
sub eax, ebx
add eax, edx
rol edi, 0xf
add edi, ebp
xor eax, edi
add ebp, dword [esp + 0x3c]
lea edx, [eax + ebp]
add edx, 0x50a28be6
rol edx, 0xf
add edx, esi
rol ecx, 0xa
mov eax, ecx
not eax
or eax, edi
xor eax, edx
add esi, dword [esp + 0x38]
add esi, eax
add esi, 0x50a28be6
rol esi, 5
add esi, ebx
rol edi, 0xa

Function at 0x43777b
Capabilities:
Encode data using xor

Disassembly:
add dword [esi], ecx
add al, 0xeb
jp 0x437702
ret 0xd124
Function at 0x401070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40bf90]
push ebx
push esi
push edi
lea esi, [eax + 0x14]
mov edi, eax
mov eax, dword [esi]
push 0x40
push 0x3000
inc eax
push eax
push 0
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x4010df
mov ecx, dword [esi]
mov edx, dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00403c70
add esp, 0xc
xor eax, eax
mov eax, dword [ebp - 8]
push eax
mov ebx, 0xdefac00
add ebx, 0xed
push ebx
xor eax, eax
push eax
pop eax
mov ebx, dword [ebp - 4]
push ebx
pop esi
xor edi, edi
add edi, 0x1000
sub esp, edi
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4010f2
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [0x40bf90]
mov ebp, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
cmp ebp, 4
jae 0x401108
pop edi
xor eax, eax
pop ebp
ret
push esi
movzx esi, byte [edx]
xor ecx, ecx
mov edi, edi
mov eax, esi
xor eax, ecx
cmp al, 0xeb
jne 0x40112c
movzx eax, byte [edx + 1]
xor eax, ecx
cmp al, 2
jne 0x40112c
movzx eax, byte [edx + 3]
xor eax, ecx
cmp al, 0xf1
je 0x40113b
inc ecx
cmp ecx, 0x100
jb 0x401110
pop esi
pop edi
xor eax, eax
pop ebp
ret
xor eax, eax
test ebp, ebp
jbe 0x40114a
xor byte [eax + edx], cl
inc eax
cmp eax, dword [edi + 0x14]
jb 0x401141
pop esi
pop edi
mov eax, 1
pop ebp
ret
Function at 0x401300
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
push edi
mov edi, dword [0x40bf90]
xor ebx, ebx
push 0x20a
lea eax, [esp + 0x18]
push ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.004057a0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x4092b8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401411
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push esi
call ebp
push eax
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401409
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x4013fa
push 0
push esi
call ebp
push 4
mov dword [edi + 0x14], eax
push 0x3000
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [edi + 0x10], eax
test eax, eax
je 0x4013f3
mov edx, dword [edi + 0x14]
push edx
push ebx
push eax
call fcn.00403c70
add esp, 0xc
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040154d
add esp, 0x218
ret

Function at 0x40154d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401557
repz ret
jmp fcn.0040170c
Function at 0x4011c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x426e20], ecx
inc eax
cmp eax, 0x100
jb 0x4011c2
cmp eax, 0x800
jae 0x401293
nop word [eax + eax]
mov edx, dword [eax*4 + 0x426a20]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x426e20]
mov dword [eax*4 + 0x426e20], edx
inc eax
cmp eax, 0x800
jb 0x401270
mov dword [0x4269c0], 0x4012c0
call fcn.004054f0
mov ecx, dword [0x4269c0]
test eax, eax
mov edx, 0x4012c0
cmove ecx, edx
mov dword [0x4269c0], ecx
ret

Function at 0x4020a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4263c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov esi, dword [edi]
test esi, esi
je 0x40211f
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x402108
test ecx, ecx
je 0x40211f
test esi, esi
je 0x40211f
mov ecx, dword [ebp - 0xc]
jmp 0x4020cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041adc0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041adc0
mov esp, ebp
pop ebp
ret
Function at 0x405340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x405360
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp - 8], esi
cmp esi, edx
jae 0x405392
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x40538f
inc esi
cmp esi, edx
jb 0x405380
mov dword [ebp - 8], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x4054ba
cmp ecx, 3
jbe 0x4053d2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x14], edi
test cl, cl
je 0x405410
cmp cl, 0xff
je 0x405410
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x405374
dec ecx
shl eax, cl
and eax, 7
je 0x4053aa
cmp byte [eax + 0x41e4f0], 0
je 0x4053fd
movzx ecx, byte [eax + 0x41e4f8]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x4053fa
cmp cl, 0xff
jne 0x4053aa
mov edx, dword [ebp - 4]
mov esi, dword [ebp + 8]
and eax, 3
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x405374
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x40543e
lea edx, [edi + ebx]
add edx, esi
jmp 0x405444
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x405482
movzx edi, byte [eax + 0x41e4f8]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0x10], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 0xc], edi
test cl, cl
je 0x40546e
cmp cl, 0xff
jne 0x405482
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0x10]
shl edi, cl
dec edi
xor edi, edx
jmp 0x405431
mov esi, dword [ebp - 8]
mov ecx, edx
mov edi, dword [ebp - 0x14]
shr ecx, 0x18
and cl, 1
neg cl
mov byte [esi + 1], dl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x405374
pop edi
pop esi
cmp ecx, 3
jbe 0x4054cf
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x409969
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409969
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40995a
cmp esi, edx
jae 0x409969
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x409948
cmp esi, edx
jae 0x409969
cmp word [esi], 0
je 0x409969
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x409a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cbc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4263c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
cmp dword [ebx + 0x38], 0
je 0x409b56
cmp byte [ebx + 0x3d], 0
je 0x409b56
mov eax, dword [ebx]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x41e2f0]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
jne 0x409a73
xor al, al
jmp 0x409b58
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00409cc0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
nop
cmp esi, 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, edi
lea ecx, [ebp - 0x28]
cmovae ecx, edi
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x38]
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x409ae4
sub eax, 1
je 0x409ae8
sub eax, 2
je 0x409b48
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.004086e0
mov al, bl
jmp 0x409b58
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
cmp esi, 0x10
mov ebx, dword [ebp - 0x2c]
cmovae eax, edi
sub ebx, eax
je 0x409b24
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
cmp esi, 0x10
cmovae eax, edi
push dword [ecx + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x409ad6
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp byte [eax + 0x3d], 0
je 0x409b48
test ebx, ebx
mov ebx, eax
jne 0x409aa0
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409c50
jmp 0x409a98
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.004086e0
mov al, bl
jmp 0x409b58
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041adc0
mov esp, ebp
pop ebp
ret
Function at 0x40cda0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ce28
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4263c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0040d130
mov dword [edi], eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.JSON
mov esi, eax
push 0x66
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0x1c], 0
mov ecx, edx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ce30
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0040d2e0
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004126ee
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00412203
mov ebx, eax
cmp edi, ebx
je 0x40cef8
mov esi, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 3
push dword [esi + 4]
call fcn.0040ae90
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov eax, dword [ebx]
mov esi, dword [edi]
push esi
push dword [eax + 4]
call fcn.0040c490
mov dword [esi + 4], eax
mov esi, dword [edi]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
jne 0x40cef1
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x40ced1
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40cec5
mov dword [esi], edx
mov edx, dword [edi]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x40ceec
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x40cee1
mov dword [edx + 8], ecx
jmp 0x40cef8
mov dword [esi], esi
mov ecx, dword [edi]
mov dword [ecx + 8], ecx
lea ecx, [ebp - 0x44]
call fcn.0040ad90
lea ecx, [ebp - 0x2c]
call fcn.004086e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret