joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [ebp + 0x14]
mov dword [0x1002f498], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1002f49c], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x1002f4a0], eax
lea eax, [ebp - 0x823]
push 0
push eax
mov byte [ebp - 0x824], 0
call fcn.100067f0
lea eax, [ebp - 0x824]
push eax
call fcn.10003e00
push 0x3ff
lea eax, [ebp - 0x423]
push 0
push eax
mov byte [ebp - 0x424], 0
call fcn.100067f0
lea eax, [ebp - 0x424]
push eax
call fcn.10003e00
add esp, 0x20
lea eax, [ebp - 0x24]
push 0x23
push eax
push ecx
lea eax, [ebp - 0x424]
mov ecx, esp
push eax
mov dword [ebp - 4], 0x336b65
mov dword [ebp - 0x1c], 0x62753733
mov dword [ebp - 0xb], 0x69657465
mov dword [ebp - 0x14], 0x6b746d34
mov word [ebp - 0x1e], 0x3063
mov word [ebp - 0x21], 0x306f
mov dword [ebp - 0x10], 0x766b6c77
mov word [ebp - 6], 0x3439
mov word [ebp - 0x24], 0x7a65
mov dword [ebp - 0x18], 0x64657578
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x22], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0xc], 0x34
call fcn.10001110
push ecx
lea eax, [ebp - 0x824]
mov ecx, esp
push eax
call fcn.10001110
call fcn.10003c80
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000d104
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1002ebd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.1000c78c
mov dword [ebp - 0x14], eax
cmp dword [0x1003011c], edi
jne 0x1000d1f5
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1000d182
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000d2d5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000d2d5
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d2d5
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1003011c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10030120], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x10030124], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1003012c], eax
test eax, eax
je 0x1000d1f2
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10030128], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000d21a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000d20d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1000d22f
push 4
pop eax
jmp 0x1000d2d7
cmp dword [ebp - 0x14], edi
je 0x1000d22f
push dword [0x1003011c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1000d214
mov eax, dword [0x10030128]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1000d28d
cmp dword [0x1003012c], esi
je 0x1000d28d
push eax
call ebx
push dword [0x1003012c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1000d28d
test eax, eax
je 0x1000d28d
call ecx
test eax, eax
je 0x1000d282
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1000d282
test byte [ebp - 8], 1
jne 0x1000d28d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1000d2bd
mov eax, dword [0x10030120]
cmp eax, esi
je 0x1000d2ba
push eax
call ebx
test eax, eax
je 0x1000d2ba
call eax
mov edi, eax
test edi, edi
je 0x1000d2ba
mov eax, dword [0x10030124]
cmp eax, esi
je 0x1000d2ba
push eax
call ebx
test eax, eax
je 0x1000d2ba
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1003011c]
call ebx
test eax, eax
je 0x1000d2d5
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1000d2d7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006edd
leave
ret
Function at 0x1001c5ca
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10009206
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1001c602
xor eax, eax
jmp 0x1001c62e
cmp esi, dword [ebp - 4]
je 0x1001c62b
cmp dword [ebp + 0xc], 0
je 0x1001c62b
push dword [edi + 0x9c]
call fcn.1001c1d8
push dword [edi + 0x9c]
mov esi, eax
call fcn.1000cfe0
pop ecx
pop ecx
cmp esi, eax
je 0x1001c5fe
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x64f980
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x64fa64
jmp 0x64f9c0
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x64f9c0
add eax, 4
jle 0x64fb05
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x64faff
movd dword [edi], mm4
je 0x64fb05
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x69a390
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 2
jl 0x69a344
movd dword [edi], mm4
je 0x69a34a
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret
xchg edi, eax
out 0xe2, eax
dec eax
push edi
loope 0x69a333
cmp edi, dword [eax + 0x5bf22399]
mov es, word [edi]
aad 0x4b
xor edx, edi
inc eax
out dx, al
xchg ecx, eax
cld
xchg edx, eax
add byte [esi + 0x3e], 0x7e
mov word [edi + 0x2373e5ae], ss
xor cl, dl
out 0x9b, al
in eax, 0x73
and esi, dword [eax]
sal ebx, 1
out 0x9b, al
cld
shl byte [edi + ecx - 0x78], 1
pop ds
salc
xor dl, byte [edi - 0x3f]
les edi, [0xef6dcf61]
jbe 0x69a3b1
iretd
Function at 0x109a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x109a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x109a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109a06a
add dl, dl
jne 0x109a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109a0dc
xor eax, eax
add dl, dl
jne 0x109a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109a17d
add dl, dl
jne 0x109a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x109a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x109a075
mov eax, 1
add dl, dl
jne 0x109a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x109a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109a0e1
sub eax, ebx
mov ebx, 1
jne 0x109a128
mov ecx, 1
add dl, dl
jne 0x109a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x109a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x109a136
cmp eax, 0x7d00
jae 0x109a16d
cmp eax, 0x500
jb 0x109a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109a075
cmp eax, 0x7f
ja 0x109a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x109a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x109a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x109a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
push esi
mov word [esp + 5], ax
mov byte [esp + 7], al
mov eax, dword [esp + 0x10]
mov eax, dword [eax*4 + 0x4d64ec]
push edi
xor ecx, ecx
lea esi, [esp + 0x10]
lea edi, [esp + 8]
sub esi, eax
mov byte [esp + 8], cl
sub edi, eax
jmp 0x401030
mov dl, byte [esi + eax]
sub dl, cl
xor dl, byte [eax]
inc ecx
mov byte [edi + eax], dl
inc eax
cmp ecx, 4
jl 0x401030
lea eax, [esp + 8]
push eax
call fcn.0047aff0
add esp, 4
pop edi
pop esi
pop ecx
ret

Function at 0x403b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ab688
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00406a00
mov dword [esp + 0x18], 0
test edi, edi
je 0x403b74
add edi, 0x28
jmp 0x403b76
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x403b8e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x404b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aba88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405900
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x404b6a
add edi, 0x28
jmp 0x404b6c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x404b84
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4051a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aba88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405900
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4051ea
add edi, 0x28
jmp 0x4051ec
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x405204
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x405820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aba88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00405900
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x40586a
add edi, 0x28
jmp 0x40586c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x405884
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x406980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ab688
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00406a00
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov byte [ecx + 4], dl
call fcn.00401990
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x407430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ac490
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0xc], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], ebx
mov dword [esp + 0x28], esp
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push 0xffffffffffffffff
mov word [ecx + 4], ax
push ebx
lea eax, [esp + 0x64]
call fcn.004078a0
lea ecx, [esp + 0x2c]
call fcn.00407310
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
mov byte [esp + 0x58], 1
push ebx
lea edx, [esp + 0x34]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00401990
call fcn.004073a0
add esp, 0x1c
cmp dword [esp + 0x28], 0x10
jb 0x4074db
mov eax, dword [esp + 0x14]
push eax
call fcn.0047afc0
add esp, 4
cmp dword [esp + 0x58], 8
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
jb 0x4074ff
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0047afc0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047afcb
add esp, 0x30
ret

Function at 0x4081a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408201
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x408201
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
call edi
inc eax
push eax
call fcn.004451aa
add esp, 4
push esi
push 0
mov dword [ebx], eax
call edi
inc eax
push eax
mov eax, dword [ebx]
push 0
push eax
call fcn.0047ecc0
add esp, 0xc
push esi
push 0
call edi
mov ecx, dword [ebx]
push eax
push ebp
push ecx
call fcn.0047e650
add esp, 0xc
push esi
push 0
call edi
pop edi
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409990
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x10], 0
jne 0x4099a7
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0xc]
push ecx
call edi
mov eax, dword [esp + 8]
lea edx, [esi + 4]
push edx
push 0
push eax
push 0x4099f0
push 0
push 0
call fcn.0047be49
add esp, 0x18
test eax, eax
mov dword [esi + 8], eax
setne al
pop edi
ret 4

Function at 0x40bf10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40bf27
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40bf58
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40bf54
cmp esi, eax
jae 0x40bf58
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x40bf44
cmp esi, eax
jb 0x40bf5e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40bff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ac720
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
mov dword [esp + 0x58], ebx
push ebx
lea eax, [esp + 0x64]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401990
lea esi, [esp + 0x2c]
call fcn.00401860
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
mov byte [esp + 0x58], 1
push ebx
mov edx, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00401990
mov esi, edi
call fcn.00407a80
mov esi, 0x10
add esp, 0x1c
cmp dword [esp + 0x28], esi
jb 0x40c09b
mov eax, dword [esp + 0x14]
push eax
call fcn.0047afc0
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x58], esi
jb 0x40c0be
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0047afc0
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047afcb
add esp, 0x30
ret
Function at 0x411ff0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call fcn.0049de4d
mov ecx, dword [esp + 0x20]
add esp, 4
lea edx, [esp]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov ecx, 0x10
lea edx, [esp + 0x13]
push esi
xor eax, ecx
mov dword [esp + 0x10], 0x4bad78
mov dword [esp + 0x14], fcn.004125a0
sub edx, ecx
push edi
movzx esi, byte [edx + ecx]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
dec ecx
xor eax, esi
cmp ecx, 1
jae 0x412036
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.0047afcb
add esp, 0x18
ret
Function at 0x41e8d0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2018
call fcn.004800e0
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x2014], eax
mov eax, dword [esp + 0x201c]
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2000
lea ebx, [ebx]
lea edx, [esp]
push edx
mov ecx, 0x2000
call fcn.0040af90
add esp, 4
push esi
push 0x2000
push 1
push eax
call fcn.0049db11
add dword [esp + 0x18], eax
add esp, 0x10
cmp eax, 0x2000
je 0x41e910
lea eax, [esp]
call fcn.0040b030
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.0047afcb
add esp, 0x2018
ret

Function at 0x41e960
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x201c
call fcn.004800e0
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x2018], eax
mov eax, dword [esp + 0x2020]
push esi
mov esi, ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push edx
mov ecx, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x2000
call fcn.0040af90
add esp, 4
push edi
push esi
push 1
push eax
call fcn.0049db11
mov esi, eax
add dword [esp + 0x20], esi
add esp, 0x10
lea eax, [esp + 8]
call fcn.0040b030
mov ecx, dword [esp + 0x201c]
xor eax, eax
cmp eax, esi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0047afcb
add esp, 0x201c
ret

Function at 0x41e97f
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x201c
call fcn.004800e0
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x2018], eax
mov eax, dword [esp + 0x2020]
push esi
mov esi, ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push edx
mov ecx, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x2000
call fcn.0040af90
add esp, 4
push edi
push esi
push 1
push eax
call fcn.0049db11
mov esi, eax
add dword [esp + 0x20], esi
add esp, 0x10
lea eax, [esp + 8]
call fcn.0040b030
mov ecx, dword [esp + 0x201c]
xor eax, eax
cmp eax, esi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0047afcb
add esp, 0x201c
ret