joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b190
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x2104
call fcn.0042b660
mov eax, dword [esp + 0x2108]
push ebx
push ebp
push esi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
push edi
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x521894]
test al, al
je 0x42b2b2
mov edi, dword [sym.imp.WS2_32.dll_recv]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 1
xor eax, eax
lea ecx, [esp + 0x14]
cmp dword [ecx], ebx
je 0x42b1f7
inc eax
add ecx, 4
cmp eax, 1
jb 0x42b1ea
cmp eax, 1
jne 0x42b208
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 2
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x42b2b2
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42b264
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebp
call edi
mov esi, eax
test esi, esi
jle 0x42b2b2
lea eax, [esp + 0x114]
push esi
push eax
push ebx
call fcn.0042b140
add esp, 0xc
test eax, eax
je 0x42b2b2
cmp eax, esi
jne 0x42b2b2
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42b2a5
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebx
call edi
mov esi, eax
test esi, esi
jle 0x42b2b2
lea eax, [esp + 0x114]
push esi
push eax
push ebp
call fcn.0042b140
add esp, 0xc
test eax, eax
je 0x42b2b2
cmp eax, esi
jne 0x42b2b2
mov al, byte [0x521894]
test al, al
jne 0x42b1d8
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2104
ret 4

Function at 0x42b2d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42b2ee
xor eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x42b32e
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x42b400
Capabilities:
Create thread
Receive data
Receive data on socket

Disassembly:
mov eax, 0x1038
call fcn.0042b660
push ebx
push ebp
push esi
push edi
mov ecx, 0x40c
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x18], 0x4c98c8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1054]
lea ecx, [esp + 0x1c]
push eax
push 0x50db70
push 0x20
push ecx
call fcn.0042e309
mov eax, dword [esp + 0x1060]
mov ecx, dword [esp + 0x105c]
mov dx, word [esp + 0x1068]
push eax
push ecx
mov word [esp + 0x54], dx
call fcn.0042b340
mov edi, eax
add esp, 0x18
test edi, edi
jbe 0x42b51f
mov al, byte [0x521894]
mov dword [esp + 0x40], edi
test al, al
je 0x42b51f
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea edx, [esp + 0x16]
push 2
push edx
push edi
call ebx
test eax, eax
jle 0x42b51f
mov edx, dword [0x520890]
mov eax, dword [esp + 0x44]
inc edx
cmp eax, 0x800
mov dword [0x520890], edx
jge 0x42b4cd
mov cx, word [esp + 0x12]
inc eax
mov dword [esp + 0x44], eax
mov word [esp + eax*2 + 0x48], cx
mov edx, dword [0x521898]
lea eax, [esp + 0x18]
inc edx
mov dword [0x521898], edx
lea edx, [esp + 0x14]
push edx
push 0
push eax
push 0x42b360
push 0
push 0
call esi
mov ecx, dword [0x521898]
test eax, eax
mov dword [ecx*4 + 0x520894], eax
je 0x42b507
push eax
call ebp
jmp 0x42b512
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x521894]
test al, al
jne 0x42b496
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1038
ret 0x10

Function at 0x42b540
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x80
mov byte [0x521894], 0
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x52088c]
test eax, eax
je 0x42b5a3
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x52088c]
lea ecx, [esp + 8]
push eax
push str.nsocket_di:_d
push ecx
call esi
mov edx, dword [0x52088c]
add esp, 0xc
mov eax, dword [edx*4 + 0x51f88c]
cmp eax, 0xffffffff
je 0x42b596
push eax
call edi
mov eax, dword [0x52088c]
dec eax
mov dword [0x52088c], eax
jne 0x42b56c
mov eax, dword [0x521898]
test eax, eax
je 0x42b5e2
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x521898]
mov eax, dword [eax*4 + 0x520894]
cmp eax, 0xffffffff
je 0x42b5d5
push 0
push eax
call esi
push 0x520894
call edi
mov eax, dword [0x521898]
dec eax
mov dword [0x521898], eax
jne 0x42b5b8
pop edi
mov dword [0x521898], 0
mov dword [0x52088c], 0
mov byte [0x521894], 1
pop esi
add esp, 0x80
ret
Function at 0x465720
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [esp + 0x2c]
cmp byte [esi + 2], 1
je 0x465738
mov eax, 0xfffffffc
pop esi
add esp, 0x24
ret
mov dword [esi + 4], 0x10305
mov dword [esi + 8], str.xvid_1.3.5
call fcn.00465640
mov dword [esi + 0xc], eax
lea eax, [esp + 4]
push eax
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0x10], ecx
pop esi
add esp, 0x24
ret
Function at 0x48ebe0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
lea eax, [eax + eax*2]
push ebp
xor ebp, ebp
push esi
lea eax, [eax + eax*4]
push edi
mov dword [esp + 0x10], ebp
lea ecx, [ecx + eax*2 + 0x20]
mov ax, word [edx]
imul ax, word [esp + 0x24]
cmp ax, 0xf800
mov word [ecx], ax
jge 0x48ec1a
mov eax, 0xfffff800
jmp 0x48ec2a
cmp ax, 0x7ff
jle 0x48ec27
mov eax, 0x7ff
jmp 0x48ec2a
movsx eax, ax
mov edi, edx
mov word [ecx], ax
lea esi, [edx + 0x10]
lea eax, [ecx + 2]
sub edi, ecx
mov dword [esp + 0x20], esi
mov ecx, 7
mov bx, word [edi + eax]
add esi, 0x10
mov word [eax], bx
mov bx, word [esi - 0x10]
mov word [eax + 0xe], bx
add eax, 2
dec ecx
jne 0x48ec40
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov esi, 1
mov ax, word [edi]
sub word [edx], ax
mov eax, dword [esp + 0x1c]
cmp dword [ecx + eax*4 + 0xd4], esi
jne 0x48ecc2
mov ebx, edx
lea esi, [edi + 2]
sub ebx, edi
mov edi, 7
mov cx, word [ebx + esi]
add esi, 2
movsx eax, cx
cdq
xor eax, edx
mov dword [esp + 0x18], ecx
sub cx, word [esi - 2]
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
mov word [esi - 2], cx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
dec edi
mov dword [esp + 0x10], edx
jne 0x48ec84
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov dx, word [ebx]
add ebx, 0x10
mov cx, dx
mov dword [esp + 0x18], edx
movsx eax, cx
sub cx, word [edi + esi*2]
cdq
xor eax, edx
mov word [edi + esi*2], cx
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
inc esi
cmp esi, 8
mov dword [esp + 0x10], edx
jb 0x48ecc6
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
Function at 0x103117bb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push cx
push dword [esp + 5]
jbe 0x10311839
mov dword [esp + 4], eax
jmp 0x103117d3
jmp 0x103117a5
mov word [esp + 7], sp
lea esp, [esp + 2]
mov dword [esp + 4], esi
jmp 0x1031184a
mov dword [esp + 4], eax
mov word [esp + 7], sp
lea esp, [esp + 2]
mov dword [esp + 4], esi
call fcn.103117bd
mov esi, dword [esp + 0x2c]
stc
jo 0x103118ec
adc ebx, 0x7663096a
jmp 0x103119cb
call fcn.1031195c
lea eax, [ecx + edi]
mov ecx, 0xec2fc702
mov bh, byte [esp]
sub esp, 0xc0
jmp 0x103119f4
lea edi, [esp]
call fcn.10311979
cmc
call 0x103119ff
pop ds
cmc
xchg ch, dh
lea esp, [esp + 2]
jmp 0x10311a1b
mov ebp, esp
pushfd
push word [esp]
jge 0x103119d3
jl 0x103119da
inc ecx
not bl
call fcn.10311a67
push ebx
retf
mov ecx, esi
jmp 0x10311a23
lea eax, [edx + edx]
xor dx, 0x56df
jne 0x10311ad5
mov bx, 0x62c9
jmp 0x10311abf
mov dl, 0x6e
bt ax, di
neg edx
jmp 0x10311b0b
mov bx, 0x62c9
mov dl, 0x6e
bt ax, di
neg edx
btr ebx, ecx
mov al, 0xfc
mov ebx, dword [esp]
jmp 0x10311af5
neg esi
lea eax, [ebp*4]
lea edx, [eax + esi]
bts ax, bx
jmp 0x10311b10
btr ebx, ecx
jmp 0x10311ae4
jnp 0x10311b26
dec ax
mov eax, dword [esp]
jmp 0x10311b49
dec ax
mov eax, dword [esp]
xchg dh, ah
ror esi, 0
mov bl, al
lea ebx, [eax + esi]
mov ebx, dword [esp]
jmp 0x10311b4d
xchg dh, ah
jmp 0x10311b2d
not eax
mov dx, 0xc94f
mov dx, 0xcdf5
mov bl, 0xd1
not ebx
jmp 0x10311bd0
call fcn.10311b94
xor eax, 0x9f6c0595
sbb al, byte [esi + eax - 0x47f10c6c]
mov ebx, 0xdbd4e2b
push ds
inc esi
inc al
jae 0x10311b5d
jb 0x10311b5d
xchg bx, ax
jmp 0x10312081
mov edx, dword [esp]
rdtsc
setp ah
rdtsc
jmp fcn.10311c3e
mov bx, di
xchg ebx, edx
add esi, dword [edi]
jmp 0x10311c78
xchg bh, dh
jmp 0x10311d81
sub esi, 0x41f966de
neg edx
jge 0x1031201a
xchg bh, dh
mov bx, di
xchg ebx, edx
jmp 0x10311d86

Function at 0x103117bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x2fe754
jmp 0x103117e2
mov dword [esp + 4], edi
jmp 0x103117f8
cmc
jp 0x10311818
jnp 0x10311802
xor al, 0xb4
sub cl, byte [ebp - 0x44]
or al, 0x22
mov eax, dword [reloc.WINMM.dll_waveOutUnprepareHeader]
pushal
mov dword [reloc.WINMM.dll_waveOutUnprepareHeader], eax
and al, 4
lea esp, [esp + 4]
pushfd
jmp 0x10310ec6
lea ebp, [eax*4]
mov bp, word [esp]
not edi
jmp 0x1031184f
lea ebp, [eax*4]
mov bp, word [esp]
not edi
call fcn.10311894
mov word [ecx], cs
cdq
clc
or edi, dword [ebp + reloc.WINMM.dll_waveOutUnprepareHeader]
stosb byte es:[edi], al
adc eax, 0x891de24b
inc esp
and al, 4

Function at 0x10311bed
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
mov ah, bl
btc dx, bp
jge 0x10311bd7
xchg bx, ax
jmp 0x10312081
lea ebx, [esi + edi]
lea esp, [esp + 8]
add esi, 0xf77d1f5
lea ebx, [edi*4]
jmp 0x10311ba0

Function at 0x1031c23c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
out dx, eax
pop ecx
xchg esp, eax
pop es
scasb al, byte es:[edi]
mov ecx, 0xe8e8eb98
jmp 0x1031c224
call 0x1031c257
std
call 0x1031c257
std
jg 0x1031c233
mov bh, byte [ecx + 0x38]
aad 0x50
invalid
Function at 0x1031c6d9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1031d1ea
jmp 0x103022d1
jmp 0x103023f6
call 0x10355408
rcr dword [eax - 0x32], cl
test eax, 0xb53fea58
and eax, 0x2479bf4c
push edi
mov esi, 0xb2eb2889
jmp 0x1031d1b4
call fcn.10355699
shl dword [ecx - 0xf], 0x90
arpl si, sp
and byte [edx + 0x14a25730], ah
arpl word [edx - 0x7fe81b0b], bx
adc eax, dword [ebx + reloc.WINMM.dll_waveOutUnprepareHeader]
invalid

Function at 0x1033d5a8
Capabilities:
Encrypt data using aes

Disassembly:
neg edx
jmp 0x1033d5ea
mov esi, ecx
jmp 0x1033d568
mov dword [edi], eax
mov eax, 0x27e70c89
push esi
jmp 0x1033d532
xor eax, ebx
jmp 0x1033d577
add esi, 8
mov eax, dword [esi]
pop esi
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x1033d552
mov dword [ecx + 0x14], ebx
mov bx, di
push ebp
jmp 0x1033d59d
xor edx, eax
lea ebx, reloc.WINMM.dll_waveOutUnprepareHeader
xchg bx, ax
mov bx, 0x390
jmp 0x1033d5a8
sub esp, 0x10
jmp 0x1033d548
mov ebp, ecx
add ebp, 0x18
mov dword [ebp], eax
pop ebp
jmp 0x1033d580
push esi
mov esi, ecx
add esi, 0x1c
jmp 0x1033d602
mov ebx, 0x1038a796
jmp 0x1033d5db
add ebx, 0xfff8189a
lea esp, [esp + 0x28]
jmp 0x102ff58c
mov eax, edi
or dl, ah
mov di, 0xd696
jmp 0x1033d6b1
mov dword [esi], edx
pop esi
xchg dx, ax
bsf ebx, esp
setno al
jmp 0x1033d5b0
neg di
bts edi, edx
jmp 0x1033d64a
xor edi, ecx
mov di, word [esp]
stc
shr ecx, 8
mov edi, dword [esp]
jmp 0x1033d60f
mov edi, edx
and ecx, esi
call fcn.1033d634
push bx
lea esp, [esp + 2]
shr edi, 0x10
push sp
lea esp, [esp + 2]
jmp 0x1033d687
and ecx, 0xff0000
sub esp, 0x19
pushfd
pop word [esp + 0x18]
jmp 0x1033d696
mov edx, dword [ebx]
pop ebx
neg cl
neg cl
mov ecx, edx
jmp 0x1033d625
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
lea esp, [esp + 4]
jmp 0x1033d664
lea esp, [esp + 3]
lea esp, [esp + 0x18]
and edi, 0xff000000
push ebx
jmp 0x1033d6e5
push ebx
mov ebx, eax
add ebx, 0xc
jmp 0x1033d67c
mov edi, edx
push bx
lea esp, [esp]
lea esp, [esp + 2]
and edx, esi
jmp 0x1033d6cc
sub esp, 0xb
lea esp, [esp + 3]
jmp 0x1033d708
xor ecx, edi
mov edi, 0xc0b0b88f
rcr edi, 0x18
pushfd
jmp 0x1033d6b9
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
call fcn.1033d6f2
shr edi, 0x18
push esi
mov esi, edi
jmp 0x1033d720
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
movzx edi, byte [esi]
pop esi
jmp 0x1033d83a
xor ecx, edi
call fcn.1033d762
lea esp, [esp + 2]
jmp 0x1033d867
xor edx, ecx
push esi
mov esi, eax
jmp 0x1033d872
add esi, 0x1c
mov dword [esi], edx
pop esi
lea esp, [esp + 0x1c]
jmp 0x1033d8b2
bswap edi
mov al, 0x2e
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x1033d8db
cmp ebx, 0x1030c054
jne 0x102ff58c
lea ebp, [ecx + edi]
push 0xa
jmp 0x1033d89c
mov edi, dword [esp]
bswap esi
lea ebx, [esi - 0x61]
jmp 0x1033d8fa
pop eax
mov bl, 0x8d
mov bl, 0x14
mov ebp, ecx
jmp 0x1033d8c5
mov ebp, dword [esp + 8]
jmp 0x1033dad2
mov esi, dword [esp + 4]
lea ebx, [ebp*4]
jmp 0x1033d8e4
lea esp, [esp + 0xc]
pop ebx
ret

Function at 0x1033d634
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, dword [ecx*4 + reloc.WINMM.dll_waveOutUnprepareHeader]
jmp 0x1033d653
Function at 0x1033d762
Capabilities:
Encrypt data using aes

Disassembly:
bsf edi, edi
jmp 0x1033d7a0
and edx, ebp
mov edi, 0xa84d8b1a
mov edi, dword [esp]
jmp 0x1033d74c
lea edi, [eax + 0x10]
lea edx, [ebp*4]
mov dx, word [esp]
jmp 0x1033d7c4
xor ecx, dword [ebx]
lea edx, [ecx*4]
neg dh
bt di, sp
mov edx, dword [esp]
jmp 0x1033d76e
xor ecx, edx
btc edx, edx
mov dl, byte [esp]
lea esp, [esp + 0x18]
jmp 0x1033d784
mov edx, 0xce867ad
jmp 0x1033d7ef
lea edx, reloc.WINMM.dll_waveOutUnprepareHeader
lea edx, [ecx*4]
xor ecx, dword [eax]
inc dh
mov edx, esi
jmp 0x1033d7ae
xor edx, ecx
jmp 0x1033d80f
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
jmp 0x1033d7d9
popal
jmp 0x1033d81b
push esi
pushal
bsf bp, cx
mov dword [esp + 4], eax
jmp 0x1033d7f9
add esi, 0x14
mov dword [esi], edx
pop esi
mov ecx, dword [eax + 8]
jmp 0x1033d88f
mov dword [eax + 0x18], ecx
shr dx, cl
mov edx, dword [eax + 0xc]
push ecx
lea esp, [esp + 2]
jmp 0x1033d841
pushal
lea esp, [esp + 3]
lea esp, [esp + 1]
xor ecx, edx
jmp 0x1033d857

Function at 0x1039011c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp]
lea edx, [esi + ebp]
mov dh, ah
xchg dword [esp], ecx
call fcn.103900ef

Function at 0x1051805f
Capabilities:
Parse pe header

Disassembly:
call int.10504505
mov eax, dword fs:[0x30]
jmp 0x10518069
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x10518049
mov eax, dword [eax + 0xc]
jmp 0x1051808e
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x1051809c
push eax
jmp 0x10504500
Function at 0x47ac50
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x47acb6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x47acb6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x47ac97
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x49362b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x493663
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004916e2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004916ba
jmp 0x49366f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x494d1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x494d5e
call fcn.0049a89a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x494d5e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x494d55
xor eax, eax
jmp 0x494d66
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00494d6c
pop edi
pop esi
pop ebx
ret 4

Function at 0x49adca
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49adf8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49ae16
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049ad30
jmp 0x49ae16
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49ae16
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049ad30
test edi, edi
mov eax, edi
jne 0x49ae00
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x681a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x681a860]
xor edx, dword [ebx*4 + 0x681ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x681a460]
add ecx, 4
xor edx, dword [eax*4 + 0x681b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x681a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x681ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x681a460]
add ecx, 4
xor eax, dword [edx*4 + 0x681b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x681a860]
xor edx, dword [ebx*4 + 0x681ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x681a460]
xor edx, dword [eax*4 + 0x681b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x681a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x681ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x681a460]
xor eax, dword [edx*4 + 0x681b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x681a860]
xor edx, dword [ebx*4 + 0x681ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x681a460]
xor edx, dword [eax*4 + 0x681b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x681a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x681ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x681a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x681b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x681a860]
xor edx, dword [ebx*4 + 0x681ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x681a460]
add ecx, 4
xor edx, dword [eax*4 + 0x681b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x681a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x681ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x681a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x681b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x681a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x681ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x681a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x681b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x681a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x1000a220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, dword [esi + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
add ecx, eax
cmp eax, ecx
mov dword [esp + 0xc], ecx
je 0x1000a3c8
push ebx
push ebp
push edi
nop
movzx edi, byte [eax]
mov ecx, dword [esp + 0x10]
add eax, 1
mov ebp, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x40]
shl edi, 4
xor edi, eax
lea edx, [edi + edi*2]
shl ebp, 0xc
lea ebx, [ecx + edx*4]
mov ecx, dword [ebx]
or ebp, eax
cmp ecx, ebp
jne 0x1000a279
movzx edx, word [ebx + 8]
mov dword [esi + 0x40], edx
jmp 0x1000a3b7
cmp ecx, 0xffffffff
jne 0x1000a29b
push eax
push esi
call fcn.10009c60
mov eax, dword [esp + 0x14]
mov dword [esi + 0x40], eax
mov dword [ebx], ebp
mov cx, word [esi + 0x44]
mov word [ebx + 8], cx
jmp 0x1000a393
mov ecx, dword [ebx + 4]
cmp ecx, ebp
jne 0x1000a2c5
movzx ecx, word [ebx + 0xa]
mov dword [esi + 0x40], ecx
mov edx, dword [ebx]
mov ax, word [ebx + 8]
mov dword [ebx + 4], edx
mov word [ebx + 0xa], ax
mov dword [ebx], ebp
mov cx, word [esi + 0x40]
mov word [ebx + 8], cx
jmp 0x1000a3b7
cmp ecx, 0xffffffff
jne 0x1000a307
push eax
push esi
call fcn.10009c60
mov edx, dword [esp + 0x14]
mov dword [esi + 0x40], edx
mov dword [ebx + 4], ebp
mov ax, word [esi + 0x44]
mov word [ebx + 0xa], ax
add dword [esi + 0x44], 1
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
add ecx, 1
add esp, 8
cmp eax, ecx
jbe 0x1000a3b7
mov edx, dword [esi + 0xc]
add edx, 1
push edx
jmp 0x1000a3ae
test edi, edi
jne 0x1000a310
lea ecx, [edi + 1]
jmp 0x1000a315
mov ecx, dword [esi + 0x18]
sub ecx, edi
mov dword [esp + 0x14], ecx
lea esp, [esp]
cmp edi, ecx
jae 0x1000a32d
mov edx, dword [esi + 0x18]
sub edx, ecx
add edi, edx
jmp 0x1000a32f
sub edi, ecx
mov edx, dword [esp + 0x10]
lea ecx, [edi + edi*2]
mov ecx, dword [edx + ecx*4 + 4]
cmp ecx, ebp
je 0x1000a349
cmp ecx, 0xffffffff
je 0x1000a370
mov ecx, dword [esp + 0x14]
jmp 0x1000a320
lea eax, [edi + edi*2]
movzx ecx, word [edx + eax*4 + 0xa]
lea eax, [edx + eax*4]
mov dword [esi + 0x40], ecx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov cx, word [ebx + 8]
mov word [eax + 0xa], cx
mov dword [ebx], ebp
mov dx, word [esi + 0x40]
mov word [ebx + 8], dx
jmp 0x1000a3b7
push eax
push esi
call fcn.10009c60
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi + 0x40], eax
lea ecx, [edi + edi*2]
lea eax, [edx + ecx*4]
mov dword [eax + 4], ebp
mov cx, word [esi + 0x44]
mov word [eax + 0xa], cx
mov edx, dword [esi + 0x48]
add dword [esi + 0x44], 1
mov eax, dword [esi + 0x44]
add edx, 1
add esp, 8
cmp eax, edx
jbe 0x1000a3b7
mov eax, dword [esi + 0xc]
add eax, 1
push eax
push esi
call fcn.10009d70
add esp, 8
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x18]
jne 0x1000a240
pop edi
pop ebp
pop ebx
add esp, 0x10
ret