joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d91a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x1001d945
cmp dword [ebx + 0x80], 0
jne 0x1001d945
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.10009a86
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.1001dbd3
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1001d97f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.10009a86
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1001d9b6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.1001d9d7
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001fad3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x1001faed
mov edi, dword [esi + 0xc]
jmp 0x1001fb2d
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1001fb06
call fcn.1000f204
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1001fb1b
call fcn.1000f204
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1001fb2d
call fcn.1000f204
call fcn.10009a86
cmp dword [eax + 0x3c], 0
je 0x1001fb42
push edi
mov ecx, ebx
call fcn.1001f167
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.1001fd1f
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x1001fb6b
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x1001fb77
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10033460
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10081b33
call fcn.10009ada
cmp dword [eax + 0x14], 0
jne 0x1003347b
mov ecx, esi
pop esi
jmp fcn.100327ab
pop esi
ret

Function at 0x10034351
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.10002800
call fcn.10009ada
cmp dword [eax + 0x14], 0
jne 0x1003436c
mov ecx, esi
pop esi
jmp fcn.10033bcf
pop esi
ret
Function at 0x10042aaa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x10042ac3
call fcn.10009a86
mov esi, dword [eax + 0xc]
push 0x1016e00c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x10042b19
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10042b18
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10042af9
xor esi, esi
jmp 0x10042b0f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.10042b21
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1015345b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015311b
Function at 0x40dcf4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x558c5c
push 0xa
push 0x40dd88
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40dd18
call fcn.00419930
push ebx
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40dd2f
call fcn.00419930
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40dd41
call fcn.00419930
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x558c60], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x558c64], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x558c68], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x558c6c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x558c70], ecx
add edx, dword [eax + 0x14]
mov dword [0x558c74], edx
pop esi
pop ebx
ret

Function at 0x4119ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x411a55
test eax, edx
je 0x411a58
push 0
push 0
cmp word [eax - 0xa], 2
je 0x4119d5
push edx
mov edx, eax
mov eax, esp
call fcn.00406c28
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x4119eb
push eax
lea eax, [esp + 8]
call fcn.00406c28
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4119fa
movzx eax, word [eax]
sub eax, ecx
jmp 0x411a21
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x411a3b
add ecx, 4
js 0x411a12
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x411a38
push eax
mov eax, ecx
mov edx, 2
call fcn.004061c4
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x411a1f
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x411a21
xor eax, eax
ret
test eax, eax
je 0x411a68
test edx, edx
jne 0x4119bc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x412ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00406a98
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x412cbe
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x412cdf
cmp ebx, 3
je 0x412cdf
cmp ebx, 0x7b
je 0x412cdf
mov eax, esi
call fcn.00412c60
test al, al
jne 0x412ce3
xor eax, eax
jmp 0x412ce5
mov al, 1
pop esi
pop ebx
ret

Function at 0x416dc4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x416dfd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406b48
jmp 0x416e06
mov eax, ebx
mov edx, esi
call fcn.00406a0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416e10
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x416e32
movzx eax, word [esp]
jmp 0x416e34
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4175c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4176e9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004173d4
mov esi, eax
mov eax, dword [0x5557d8]
cmp byte [eax], 0
je 0x417691
mov eax, dword [0x5553d4]
call fcn.004047bc
call fcn.004043e8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41759c]
call fcn.004084e0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x417704
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4176cd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x555350]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x558c40]
call fcn.004085d4
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4176f0
lea eax, [ebp - 4]
mov edx, dword [0x41759c]
call fcn.004084ec
ret
Function at 0x4184f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4185c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406a60
lea eax, [ebp - 4]
call fcn.00407410
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a98
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4185b0
mov eax, ebx
call fcn.00404280
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4185a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406a98
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x418593
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4185d8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x418593
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4185b0
mov eax, dword [ebp - 0x10]
call fcn.0040429c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4185cd
lea eax, [ebp - 4]
call fcn.004069fc
ret

Function at 0x4197d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406524
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x419782
mov eax, edi
add eax, eax
call fcn.00404280
mov esi, eax
jmp 0x419784
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4197bd
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4197a7
mov eax, esp
cmp esi, eax
je 0x4197ca
mov eax, esi
call fcn.0040429c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x419804
cmp bl, 0
je 0x419800
cmp bl, 0x41
jl 0x4197fb
cmp bl, 0x5a
jg 0x4197fb
or bl, 0x20
xor al, bl
inc esi
jmp 0x4197df
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x419744
Function at 0x50732c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f4
mov eax, dword [ebp - 8]
call fcn.004069f4
xor eax, eax
push ebp
push 0x5073b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00412ca0
test al, al
je 0x507399
push 0
push 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x5073cc
call fcn.00406ee0
mov eax, dword [ebp - 0xc]
call fcn.00406a98
push eax
mov eax, dword [ebp - 4]
call fcn.00406a98
push eax
push 0x5073e4
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5073bb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406a04
ret

Function at 0x5075bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f4
xor eax, eax
push ebp
push 0x5076e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406a60
push 0xa
mov eax, dword [ebp - 8]
call fcn.00406a98
push eax
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x5076bf
push ebx
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push ebx
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
xor edx, edx
push ebp
push 0x5076a2
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
je 0x507698
push edi
push 0
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
mov ecx, edi
call fcn.00404438
lea eax, [ebp - 0xc]
call fcn.00409918
push eax
push 0
push esi
call sub.ole32.dll_CreateStreamOnHGlobal
push 0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4b6d30]
call fcn.004b7448
mov dword [ebp - 0x10], eax
push esi
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0xc]
call fcn.00409918
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5076bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5076e9
lea eax, [ebp - 0xc]
call fcn.00409918
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a04
ret
Function at 0x51abc4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x51ac4e
xor edx, edx
push ebp
push 0x51ac2f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51ac4e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x51f3f8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51f426
mov eax, ebx
call fcn.0051feac
cmp dword [ebx + 0x40], 0
je 0x51f41f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x51f497
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x51f489
cmp dword [ebx + 8], 0
je 0x51f448
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51f45a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x51f489
cmp dword [ebx + 8], 0
je 0x51f43b
cmp eax, 3
je 0x51f46d
dec eax
jne 0x51f43b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51f43b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51f43b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x51f4b5
cmp dword [ebx + 0x14], 0xcc
je 0x51f4b5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0051f4c0
pop ebx
ret

Function at 0x53896c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ecx, edx
test ecx, ecx
js 0x538982
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x53897b
mov eax, esp
mov esi, edx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 0xc], edx
test esi, esi
jl 0x5389e1
mov edx, esi
inc edx
mov dword [ebp - 0x10], edx
mov ebx, eax
mov eax, dword [ebx]
call fcn.0044cc90
mov ecx, eax
mov eax, ecx
and eax, 0xff
mov edi, esi
cdq
idiv edi
add dword [ebp - 4], eax
mov eax, ecx
and eax, 0xff00
shr eax, 8
cdq
idiv edi
add dword [ebp - 8], eax
mov eax, ecx
and eax, 0xff0000
shr eax, 0x10
cdq
idiv edi
add dword [ebp - 0xc], eax
add ebx, 4
dec dword [ebp - 0x10]
jne 0x5389a1
movzx eax, byte [ebp - 4]
movzx edx, byte [ebp - 8]
shl edx, 8
or eax, edx
movzx edx, byte [ebp - 0xc]
shl edx, 0x10
or eax, edx
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x53f068
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f4
xor eax, eax
push ebp
push 0x53f18e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406a60
push 0xa
mov eax, dword [ebp - 8]
call fcn.00406a98
push eax
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x53f16b
push ebx
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push ebx
mov eax, dword [0x558c40]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
xor edx, edx
push ebp
push 0x53f14e
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
je 0x53f144
push edi
push 0
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
push esi
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
mov ecx, edi
call fcn.00404438
lea eax, [ebp - 0xc]
call fcn.00409918
push eax
push 0
push esi
call sub.ole32.dll_CreateStreamOnHGlobal
push 0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4b6d30]
call fcn.004b7448
mov dword [ebp - 0x10], eax
push esi
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0xc]
call fcn.00409918
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53f16b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53f195
lea eax, [ebp - 0xc]
call fcn.00409918
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a04
ret

Function at 0x5420b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x54216c
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0x542178
lea edx, [ebp - 8]
mov eax, dword [0x55571c]
mov eax, dword [eax]
call fcn.004b5334
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00412e84
lea eax, [ebp - 4]
mov edx, 0x542190
call fcn.00406e20
mov eax, dword [ebp - 4]
call fcn.00406a98
push eax
push 0x5421a4
mov eax, ebx
call fcn.00490038
push eax
call sub.shell32.dll_ShellExecuteW
call fcn.00415268
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00443624
movzx eax, ax
lea edx, [ebp - 0xc]
call fcn.00412614
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x5421bc
mov edx, 0x5421e8
mov eax, 0x80000001
call fcn.0053efa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542173
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406a04
ret
Function at 0xef3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00ef378f
jae 0xef370e
xor ecx, ecx
call fcn.00ef378f
jae 0xef373d
xor eax, eax
call fcn.00ef378f
jae 0xef374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00ef378f
adc al, al
jae 0xef372f
jne 0xef3779
stosb byte es:[edi], al
jmp 0xef3711
call fcn.00ef379b
sub ecx, ebx
jne 0xef3756
call fcn.00ef3799
jmp 0xef3775
lodsb al, byte [esi]
shr eax, 1
je 0xef3783
adc ecx, ecx
jmp 0xef3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00ef3799
cmp eax, 0x7d00
jae 0xef3772
cmp ah, 5
jae 0xef3773
cmp eax, 0x7f
ja 0xef3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xef3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4020b3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
inc ebp
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb fcn.004020aa
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x4020b2
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.00401c14
mov al, byte cs:[0x858d7a44]
jl 0x4020ff
invalid
invalid
Function at 0x403af2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg ecx, eax
add byte [eax], al
add byte [eax - 0x7db5b], al
inc dword [eax]
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.00401c14
cld
fnstsw word [ebx + ecx]
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x403bf7
lea eax, [ebp - 0x714]
push eax
call fcn.00401c24
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00401bd9
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x403bf7
jmp 0x4035b6
cmp dword [ebp - 0x37c], 0
je 0x403c05
jmp 0x403cba
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x403c5e
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x403c63
jmp 0x4035b6
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x403caa
lea eax, [ebp - 0x714]
push eax
call fcn.00401c24
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00401bd9
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x403cb5
jmp 0x403cba
jmp 0x4035b6
cmp dword [ebp - 0x37c], 0
jne 0x403d64
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401df0
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x403d50
lea eax, [ebp - 0x714]
push eax
call fcn.00401c24
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.00401cb9
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret