joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4a10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [eax], 0
call fcn.004b55d0
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
push edx
push eax
call fcn.004b5600
mov ebx, dword [esp + 0x40]
add esp, 0x10
cmp eax, ebx
jg 0x4b4aca
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
lea ebx, [ebx]
mov edx, ebx
sub edx, eax
mov eax, dword [esp + 0x20]
push edx
push 0xffffffffffffffff
push eax
call fcn.004b3ae0
add esp, 0xc
test eax, eax
jle 0x4b4aed
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
push edx
call fcn.0049ab70
add esp, 0x10
cmp eax, 0x51
je 0x4b4aa9
test eax, eax
jne 0x4b4af0
mov eax, dword [esp + 0x14]
cmp edi, eax
je 0x4b4ad7
test eax, eax
je 0x4b4aed
sub edi, eax
add ebp, eax
add dword [esp + 0x10], eax
call fcn.004b55d0
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
push edx
push eax
call fcn.004b5600
add esp, 0x10
cmp eax, ebx
jle 0x4b4a60
pop edi
pop esi
pop ebp
mov eax, 0x1c
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
add eax, edx
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 8
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4b5670
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0052cdda
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4b56d5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4b56d5
lea edx, [esp]
push edx
call dword [0x5a1994]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00523c4c
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00523c4c
add esp, 0x108
ret
jmp 0x4b5670

Function at 0x4b56f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0052cdda
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4b56d5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4b56d5
lea edx, [esp]
push edx
call dword [0x5a1994]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00523c4c
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00523c4c
add esp, 0x108
ret
jmp 0x4b5670
Function at 0x4b8e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.00527c00
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x4b8ec7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00523c4c
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0052d12b
mov edi, eax
add esp, 8
mov eax, 8
call fcn.00527c00
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004b8cf0
add esp, 0x10
test edi, edi
jl 0x4b8eb0
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4b8eb0
push 0x55e55c
push esi
call fcn.0052b9f8
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x4b8fa1
jmp 0x4b8f24
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x4b8f32
cmp ebx, 0x400
mov esi, ebx
jl 0x4b8f37
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.00529a1a
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x4b8f85
fild dword [esp + 0x44]
mov eax, 8
call fcn.00527c00
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004b8cf0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4b8f20
sub ebx, esi
test ebx, ebx
jg 0x4b8f20
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00529aae
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.0049c950
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00523c4c
mov esp, ebp
pop ebp
ret
Function at 0x4bdfa0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x74
call fcn.00527c00
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4be125
call fcn.0048d700
test eax, eax
je 0x4be125
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
mov ebx, eax
push edi
mov dword [esp + 0x48], ebx
call esi
push 0xa
push edi
mov dword [esp + 0x4c], eax
call esi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
push 0x10
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push ebx
mov dword [esp + 0x50], esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x50]
push ecx
push 0x18
push esi
mov dword [esp + 0x58], eax
call dword [sym.imp.GDI32.dll_GetObjectA]
movzx esi, word [esp + 0x60]
imul esi, dword [esp + 0x58]
imul esi, dword [esp + 0x5c]
push 0x2d5
push str..crypto_rand_rand_win.c
push esi
call fcn.0048d3a0
add esp, 0xc
mov dword [esp + 0x3c], eax
test eax, eax
je 0x4be106
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
xor ebx, ebx
mov dword [esp + 0x38], ecx
test ecx, ecx
jle 0x4be0f9
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push 0xcc0020
push ebx
push 0
push edi
push 0x10
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x48]
push ecx
push esi
push edx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call fcn.004d8d00
mov ecx, dword [esp + 0x40]
push eax
push 0
lea eax, [esp + 0x74]
push eax
push esi
push ecx
call fcn.004d3550
add esp, 0x18
mov eax, 8
call fcn.00527c00
fldz
fstp qword [esp]
lea edx, [esp + 0x70]
push 0x14
push edx
call fcn.004b8cf0
add ebx, 0x10
add esp, 0x10
cmp ebx, dword [esp + 0x38]
jl 0x4be081
mov eax, dword [esp + 0x3c]
push eax
call fcn.0048d550
mov ebx, dword [esp + 0x44]
add esp, 4
mov eax, dword [esp + 0x4c]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00523c4c
mov esp, ebp
pop ebp
ret
Function at 0x4be880
Capabilities:
Capture screenshot

Disassembly:
call fcn.004be140
jmp fcn.004bdfa0

Function at 0x4c96b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.005257f7
add esp, 0x18
test eax, eax
je 0x4c96d3
cmp eax, 0xffffffff
jne 0x4c96d5
xor eax, eax
ret

Function at 0x4c9710
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a4]
test esi, esi
jne 0x4c9729
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.004b55d0
push edx
push eax
call fcn.004b5600
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x4c9776
mov eax, dword [ebx + 0xbc]
mov ecx, dword [ebx + 0xb8]
push eax
push ecx
call fcn.004b55d0
push edx
push eax
call fcn.004b5600
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x4c9778
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x4cba80
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
lea eax, [ecx + 1]
ret
Function at 0x512e10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe4
call fcn.00527c00
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf0]
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
mov edi, dword [esp + 0xf8]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.00518da0
mov esi, dword [esp + 0x110]
add esp, 4
mov dword [esp + 0x18], esi
test edi, edi
jne 0x512e73
mov dword [esp + 0xfc], edi
jmp 0x512e92
cmp dword [esp + 0xfc], 0xffffffff
jne 0x512e92
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x512e82
sub eax, edx
mov dword [esp + 0xfc], eax
test esi, esi
je 0x512fb2
jmp 0x512ea4
mov esi, dword [esp + 0x18]
cmp esi, 0x14
jle 0x512eae
mov esi, 0x14
mov eax, ebx
mov ecx, ebx
mov edx, ebx
shr eax, 0x18
shr ecx, 0x10
shr edx, 8
push 0
mov byte [esp + 0x18], al
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], bl
call fcn.004d8d00
push eax
mov eax, dword [esp + 0x104]
push eax
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.00518b50
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00518d10
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00518d10
push 0
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.00518d20
push esi
lea eax, [esp + 0x118]
push eax
push ebp
call fcn.00524680
mov eax, dword [esp + 0x14c]
add esp, 0x44
cmp eax, 1
jle 0x512f9d
dec eax
mov dword [esp + 0x10], eax
jmp 0x512f50
mov eax, dword [esp + 0xfc]
push 0
lea ecx, [esp + 0xe0]
push ecx
push 0x14
mov edx, ecx
push edx
push eax
push edi
call fcn.004d8d00
push eax
call fcn.00518e10
add esp, 0x1c
test esi, esi
jle 0x512f96
lea ecx, [esp + 0xdc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x512f87
mov edi, dword [esp + 0x20]
sub dword [esp + 0x10], 1
jne 0x512f50
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x512ea0
lea eax, [esp + 0x24]
push eax
call fcn.00518dd0
mov ecx, dword [esp + 0xf4]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00523c4c
add esp, 0xe4
ret
Function at 0x518b50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.00527c00
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x518b9f
mov eax, 1
mov dword [esi], ebx
jmp 0x518ba1
mov ebx, dword [esi]
test ecx, ecx
je 0x518c60
mov edi, dword [ebx + 0x40]
cmp edi, 0x80
jle 0x518bc8
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.0048d900
add esp, 0xc
mov ebp, dword [esp + 0xa8]
cmp edi, ebp
jge 0x518c01
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esi + 4]
push ebx
push edi
call fcn.004d3230
mov edx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.004d3350
lea ebp, [esi + 0x34]
push ebp
lea eax, [esi + 0x38]
push eax
push edi
call fcn.004d3360
add esp, 0x24
jmp 0x518c3c
cmp ebp, 0x80
jbe 0x518c1d
push str.len_0__len__int_sizeof_ctx__key_
push 0x5c
push str..cryptohmachmac.c
call fcn.0048d900
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esi + 0x38]
push edx
call fcn.00524680
mov eax, dword [esp + 0xb4]
lea ebp, [esi + 0x34]
add esp, 0xc
mov dword [ebp], eax
mov ebp, dword [ebp]
cmp ebp, 0x80
je 0x518c64
mov ecx, 0x80
sub ecx, ebp
push ecx
lea edx, [esi + ebp + 0x38]
push 0
push edx
call fcn.00523d70
add esp, 0xc
jmp 0x518c64
test eax, eax
je 0x518ce0
xor eax, eax
jmp 0x518c70
mov cl, byte [esi + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x518c70
mov ebp, dword [esp + 0x10]
push ebp
lea edi, [esi + 0x14]
push ebx
push edi
call fcn.004d3230
mov edx, dword [ebx + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push edi
call fcn.004d3350
add esp, 0x18
xor eax, eax
jmp 0x518cb0
mov cl, byte [esi + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x518cb0
push ebp
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.004d3230
mov edx, dword [ebx + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push edi
call fcn.004d3350
add esp, 0x18
lea ecx, [esi + 0x14]
push ecx
add esi, 4
push esi
call fcn.004d3450
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00523c4c
add esp, 0x8c
ret
Function at 0x51b460
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x51b479
mov edi, ebx
mov ebx, eax
jmp 0x51b47b
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jle 0x51b491
push eax
push esi
call fcn.004c7d90
add esp, 8
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x51b4ad
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x51b498
cmp eax, dword [edi + 4]
jge 0x51b4c2
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x51b4b2
mov edi, dword [edi + 4]
mov dword [esi + 4], edi
test edi, edi
jle 0x51b4e6
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x51b4e6
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x51b4d5
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x523c4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5b0630]
jne 0x523c56
repz ret
jmp fcn.0053138c

Function at 0x52a139
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x52a16a
call fcn.005254a5
mov dword [eax], esi
call fcn.00525492
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0052416c
add esp, 0x14
push 0x16
pop eax
jmp 0x52a1bf
test dword [ebp + 0xc], 0xfffffff9
jne 0x52a146
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x52a197
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005254b8
pop ecx
call fcn.00525492
mov eax, dword [eax]
jmp 0x52a1bf
test al, 0x10
jne 0x52a1bd
test al, 1
je 0x52a1bd
test byte [ebp + 0xc], 2
je 0x52a1bd
call fcn.005254a5
mov dword [eax], 5
call fcn.00525492
mov dword [eax], 0xd
jmp 0x52a18e
xor eax, eax
pop esi
pop ebp
ret

Function at 0x52abd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x52ac09
call fcn.005254a5
mov dword [eax], esi
call fcn.00525492
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0052416c
add esp, 0x14
push 0x16
pop eax
jmp 0x52ac5e
test dword [ebp + 0xc], 0xfffffff9
jne 0x52abe5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x52ac36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005254b8
pop ecx
call fcn.00525492
mov eax, dword [eax]
jmp 0x52ac5e
test al, 0x10
jne 0x52ac5c
test al, 1
je 0x52ac5c
test byte [ebp + 0xc], 2
je 0x52ac5c
call fcn.005254a5
mov dword [eax], 5
call fcn.00525492
mov dword [eax], 0xd
jmp 0x52ac2d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x53f79f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00530b47
and dword [ebp - 4], 0
cmp dword [0x5b8454], 0
mov ebx, eax
jne 0x53f850
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x53f901
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x588928
push edi
call esi
test eax, eax
je 0x53f901
push eax
call fcn.00530ad5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5b8454], eax
call esi
push eax
call fcn.00530ad5
mov dword [esp], 0x588904
push edi
mov dword [0x5b8458], eax
call esi
push eax
call fcn.00530ad5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5b845c], eax
call esi
push eax
call fcn.00530ad5
pop ecx
mov dword [0x5b8464], eax
test eax, eax
je 0x53f850
push 0x5888d0
push edi
call esi
push eax
call fcn.00530ad5
pop ecx
mov dword [0x5b8460], eax
mov eax, dword [0x5b8460]
cmp eax, ebx
je 0x53f8a8
cmp dword [0x5b8464], ebx
je 0x53f8a8
push eax
call fcn.00530b50
push dword [0x5b8464]
mov esi, eax
call fcn.00530b50
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x53f8a8
test edi, edi
je 0x53f8a8
call esi
test eax, eax
je 0x53f89f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x53f89f
test byte [ebp - 0xc], 1
jne 0x53f8a8
or dword [ebp + 0x10], 0x200000
jmp 0x53f8e1
mov eax, dword [0x5b8458]
cmp eax, ebx
je 0x53f8e1
push eax
call fcn.00530b50
pop ecx
test eax, eax
je 0x53f8e1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x53f8e1
mov eax, dword [0x5b845c]
cmp eax, ebx
je 0x53f8e1
push eax
call fcn.00530b50
pop ecx
test eax, eax
je 0x53f8e1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5b8454]
call fcn.00530b50
pop ecx
test eax, eax
je 0x53f901
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x53f903
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5463b9
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x54914d
call fcn.00523cc4
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x5464cb
cmp byte [esi + 0x42], bl
je 0x5464cb
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x5463f5
xor al, al
jmp 0x5464cd
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00414ec0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408760
mov ecx, eax
call fcn.00415ce0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408760
mov ecx, eax
call fcn.00415ce0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x546465
dec eax
je 0x546469
dec eax
dec eax
je 0x5464c7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040a770
mov al, bl
jmp 0x5464cd
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408760
mov ecx, eax
call fcn.00415ce0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x5464a9
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408760
mov ecx, eax
call fcn.00415ce0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0052a3a4
add esp, 0x10
cmp edi, eax
jne 0x546453
cmp byte [esi + 0x42], 0
je 0x5464c7
test edi, edi
jne 0x546403
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e410
jmp 0x546403
mov bl, 1
jmp 0x546455
mov al, 1
call fcn.00523d47
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x61cf36d0
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x51275c09
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401e64
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push str.open
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [0x41d440]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jbe 0x401ea8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x80004005
leave
ret 8
Function at 0x40366a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403689
xor eax, eax
jmp 0x403704
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40369f
xor eax, eax
jmp 0x403704
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4036e7
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x4036e7
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x4036c0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x4036f3
xor eax, eax
jmp 0x403704
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x403701
xor eax, eax
jmp 0x403704
mov eax, dword [ebp - 4]
leave
ret