joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444820
Capabilities:
Set environment variable

Disassembly:
push ebp
xor edx, edx
push edi
push esi
push ebx
sub esp, 0x7c
mov eax, dword [esp + 0x90]
mov word [esp + 0x20], dx
lea edi, [esp + 0x20]
movzx eax, byte [eax]
test al, al
je 0x4448c7
xor ebp, ebp
lea edi, [esp + 0x20]
lea esi, [esi]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x1a]
mov esi, 0x28
lea ebx, [edi + ebp*2]
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
sub esi, ebp
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x1b], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x4b0aa7
cmp word [edi + ebp*2], 0
movzx eax, word [esp + 0x1c]
je 0x4448a4
lea esi, [esi]
add ebx, 2
sub esi, 1
cmp word [ebx], 0
jne 0x444898
test esi, esi
je 0x4b0aa7
mov word [ebx], ax
xor eax, eax
add ebp, 1
mov word [ebx + 2], ax
mov eax, dword [esp + 0x90]
movzx eax, byte [eax + ebp]
test al, al
jne 0x444850
mov eax, dword [esp + 0x94]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x498ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4df631], 0
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
je 0x499078
mov dword [esp + 4], 0x4bc506
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4990f0
mov ebx, dword [0x4df584]
jmp 0x499034
lea ebx, [eax + ecx + 4]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax + 1]
mov ecx, dword [eax]
test edi, edi
jne 0x499030
lea ecx, [eax + 6]
movzx eax, word [eax + 4]
mov edx, ebp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00488960
mov dword [esp + 8], 0xa
mov dword [esp + 4], 3
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax + 4]
sub esp, 4
mov dword [0x4df584], eax
add eax, 8
mov ebx, dword [eax - 8]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0
mov dword [0x4df584], eax
call fcn.00498540
cmp eax, ebx
jne 0x49915f
mov byte [0x4df631], 1
jmp 0x499010
cmp byte [0x4df630], 0
jne 0x499028
mov ebx, dword [sym.imp.python39.dll_PyDict_New]
call ebx
mov dword [0x4dfe14], eax
call ebx
mov dword [0x4dfe10], eax
call ebx
mov dword [0x4dfe0c], eax
call ebx
mov dword [0x4dfe08], eax
call ebx
mov dword [0x4dfe04], eax
call ebx
mov dword [0x4dfe00], eax
call ebx
mov dword [0x4dfdfc], eax
call ebx
mov byte [0x4df630], 1
mov dword [0x4dfdf8], eax
mov eax, dword [sym.imp.python39.dll__PyRuntime]
mov eax, dword [eax + 0x118]
mov eax, dword [eax + 8]
add eax, 0x754
mov dword [0x4df580], eax
jmp 0x499028
mov dword [esp], str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort

Function at 0x4a0518
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.004afed8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.004afed8
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
Function at 0x4a10ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4a110b
mov eax, 0
jmp 0x4a114f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x4a112e
mov eax, 0
jmp 0x4a114f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x4a114a
mov eax, 0
jmp 0x4a114f
mov eax, 1
leave
ret

Function at 0x4a1151
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4a11b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4a11a8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4a11a8
mov eax, dword [ebp - 4]
jmp 0x4a11c4
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4a1185
mov eax, 0
leave
ret
Function at 0x10630058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106301a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1063007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063006a
add dl, dl
jne 0x10630089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106300dc
xor eax, eax
add dl, dl
jne 0x10630096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063017d
add dl, dl
jne 0x106300a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106300d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10630075
mov eax, 1
add dl, dl
jne 0x106300ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106300f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106300e1
sub eax, ebx
mov ebx, 1
jne 0x10630128
mov ecx, 1
add dl, dl
jne 0x1063010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10630119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10630105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10630075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1063013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1063014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10630136
cmp eax, 0x7d00
jae 0x1063016d
cmp eax, 0x500
jb 0x10630168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10630075
cmp eax, 0x7f
ja 0x10630170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10630075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1063019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10630075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10016a6b
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x1004d4d0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.10015859
push 0x1000fd64
lea ecx, [esp + 0x1c]
call fcn.100157b5
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x10016aef
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x10016b29
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x1000fd28
call fcn.1001670c
mov edi, eax
jmp 0x10016b29
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.1001694e
mov ebx, eax
test ebx, ebx
jns 0x10016b1b
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x1000fd28
call fcn.100166ef
mov edi, ebx
jmp 0x10016b29
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x10016b33
push esi
call fcn.10016783
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10037040
mov esp, ebp
pop ebp
ret 8

Function at 0x10019b50
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push edi
push 0x20006
push edi
push edi
push edi
push edx
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0x10019b94
mov ecx, dword [ebp + 4]
mov edx, 0x103
push eax
push 0x100108b4
call fcn.1001976f
mov esi, eax
jmp 0x10019bf7
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, 0x100108b4
test eax, eax
je 0x10019bcc
mov edx, 0xfb
mov ecx, dword [ebp + 4]
push eax
push ebx
call fcn.1001976f
mov esi, eax
jmp 0x10019be0
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegFlushKey]
test eax, eax
je 0x10019bde
mov edx, 0xfc
jmp 0x10019bbe
mov esi, edi
test esi, esi
jns 0x10019bf5
mov ecx, dword [ebp + 4]
mov edx, 0x104
push esi
push ebx
call fcn.100166ef
jmp 0x10019bf7
mov esi, edi
cmp dword [ebp - 4], edi
je 0x10019c05
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1001c707
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038422
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1004d4d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0xac]
push ebx
push 0x71
sub esp, 0x18
mov dword [ebx], 0x10001ae8
mov ecx, esp
mov dword [ebx + 4], 0x10001ad4
mov dword [ebx + 8], 0x10001ac4
mov dword [ebx + 0xc], 0x10001a9c
push 0x10010dc0
mov dword [ebx + 0x24], 0x10001a80
mov dword [ebx + 0x28], 0x10001a68
call fcn.100247f9
sub esp, 0x18
mov ecx, esp
push 0x10010c50
call fcn.100247f9
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x1004e348]
mov ecx, edi
call esi
push ebx
call fcn.1001ca30
mov ecx, ebx
call fcn.1001c889
mov edi, dword [ebx + 0xac]
push ebx
push 0x74
sub esp, 0x18
mov ecx, esp
push 0x10010dc0
call fcn.100247f9
sub esp, 0x18
mov ecx, esp
push 0x10010c50
call fcn.100247f9
mov eax, dword [edi]
mov esi, dword [eax + 0x30]
mov ecx, esi
call dword [0x1004e348]
mov ecx, edi
call esi
lea esi, [ebx + 0xb0]
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.10026e42
mov ecx, dword [esi]
push 0x20
pop edx
call fcn.10026e15
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
je 0x1001c803
call fcn.100150d0
mov ecx, dword [ebx + 0x84]
test ecx, ecx
je 0x1001c812
call fcn.100150d0
mov ecx, dword [ebx + 0x7c]
test ecx, ecx
je 0x1001c81e
call fcn.100150d0
mov ecx, dword [ebx + 0x74]
test ecx, ecx
je 0x1001c82a
call fcn.100150d0
lea ecx, [ebx + 0x58]
call fcn.10025097
mov eax, dword [ebx + 0x44]
xor esi, esi
test eax, eax
je 0x1001c844
push eax
mov dword [ebx + 0x44], esi
call fcn.100249a0
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x1001c854
push eax
mov dword [ebx + 0x38], esi
call fcn.100249a0
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x1001c864
push eax
mov dword [ebx + 0x2c], esi
call fcn.100249a0
mov ecx, ebx
mov dword [ebx + 0x28], 0x10001bb8
mov dword [ebx + 0x24], 0x10001bd0
call fcn.100259ca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10033a0b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0xea60
push dword [esi + 0x44]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10033a2d
call fcn.10033c30
mov al, byte [esi + 0x72]
nop
test al, al
jne 0x10033a5d
push dword [ebp + 8]
mov ecx, esi
call fcn.10033c54
cmp byte [esi + 0x5c], 0
je 0x10033a5d
xor eax, eax
push eax
push eax
push esi
push 0x10033a70
push eax
push eax
mov byte [esi + 0x5c], al
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov dword [esi + 0x58], eax
push dword [esi + 0x44]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
pop esi
pop ebp
ret 4

Function at 0x10033cba
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [esi + 0x88]
cmp dword [eax + 0x14], 8
jb 0x10033cd2
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [esi + 0xa0]
cmp dword [eax + 0x14], 8
jb 0x10033ce3
mov eax, dword [eax]
lea edx, [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
call fcn.10033fee
push 0
push dword [esi + 0x58]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
pop esi
leave
ret

Function at 0x10034d9b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov bh, 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10034b07
in eax, 0x9b
wait
lea eax, [ebp - 0x58]
push eax
call fcn.10034b17
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10034acc
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10034df5
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10034b07
sub eax, 0x8dcdc227
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x10035764
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.10034b17
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10034acc
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.10034b07
adc byte [edx - 0x25], bl
sbb byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x100357d0
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x100357fb
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x100359c5
cmp dword [ebp + 0xc], 1
je 0x100359c5
cmp dword [ebp + 0xc], 8
jne 0x1003598d
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.10034b17
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10034acc
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
invalid
xchg ebp, eax
invalid

Function at 0x10036cbf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x10036ccb
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10034b07
xlatb
sar byte [esi + 0x57], 1
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.10034b07
Function at 0x10037300
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x1003733d
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x10037336
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x10037342
add edx, 0x28
cmp edx, esi
jne 0x10037327
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1003733f
Function at 0x41a40e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41a42e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041bb56
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x41a451
test byte [esp + 8], 2
je 0x41a451
call fcn.0041bbc9
mov dword [eax], 0xd
call fcn.0041bbd2
mov dword [eax], 5
jmp 0x41a42a
xor eax, eax
ret

Function at 0x4246d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test al, 0x88
pop ebp
test eax, 0x58aa45c6
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0042447b
or bh, byte [ebx + 0x48]
push ebx
lea eax, [ebp - 0x58]
push eax
call fcn.0042448b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00424440
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x424769
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0042447b
mov eax, dword [0x8d68f9e0]
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x42483b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0042448b
push eax
push esi
push dword [ebp + 8]
call fcn.00424440
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0042448b
push eax
push esi
push dword [ebp + 8]
call fcn.00424440
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0042447b
cmp cl, ch
invalid
Function at 0x401770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40178b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4017c2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4017be
jmp 0x4017b0
cmp esi, eax
jae 0x4017c2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4017b0
cmp esi, eax
jb 0x4017c9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret