joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b220
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.0042e640
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
neg esi
sbb esi, esi
lea eax, [esp + 0xc]
inc esi
lea edx, [eax + 2]
jmp 0x40b290
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b290
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.00404f80
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0042c4f0
add esp, 0x214
ret

Function at 0x40b300
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 4]
push esi
xor esi, esi
xor eax, eax
test ecx, ecx
jle 0x40b32c
test eax, eax
jl 0x40b362
cmp eax, ecx
jge 0x40b362
mov edx, dword [ebp]
mov edx, dword [edx + eax*4]
mov edx, dword [edx - 0xc]
inc eax
cmp eax, ecx
lea esi, [esi + edx + 1]
jl 0x40b312
mov eax, esi
neg eax
sbb eax, eax
add eax, 2
add esi, eax
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0040fe92
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
test edi, edi
jne 0x40b373
pop edi
pop esi
pop ebp
pop ecx
ret
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
push ebx
lea ebx, [esi + esi]
push ebx
push 0
push edi
mov dword [esp + 0x24], ebx
call fcn.0042e640
mov eax, dword [ebp + 4]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x40b3c9
test esi, esi
jl 0x40b3fa
cmp esi, eax
jge 0x40b3fa
mov eax, dword [ebp]
mov ecx, dword [eax + esi*4]
lea ebx, [eax + esi*4]
push ecx
push 0x104
push edi
call fcn.0042c4ff
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
lea edi, [edi + eax*2 + 2]
mov eax, dword [ebp + 4]
inc esi
add esp, 0xc
cmp esi, eax
jl 0x40b390
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push ebx
push edi
push 7
push str.LastMounts
push str.SoftwareTowodo_SoftwareVirtual_Drive_ManagerSettings
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call fcn.0040fe87
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x40b6a0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x441448
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x456600]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
call fcn.00410348
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b6dc
push 0x80004005
call fcn.00404f30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push str.MSG:__s_:_s_:_d_n
push ecx
mov dword [esp + 0x28], 0
call fcn.004048a0
mov esi, dword [esp + 0x1c]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x40b760
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44163b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x230], eax
push ebp
push esi
push edi
mov eax, dword [0x456600]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
push 0
push 2
mov dword [esp + 0x1c], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x14]
push eax
push ebp
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40b881
call fcn.00410348
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b7da
push 0x80004005
call fcn.00404f30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x14]
push ecx
push ebp
mov dword [esp + 0x254], 0
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40b85a
xor edx, edx
test ebx, ebx
setne dl
mov edi, edx
lea ecx, [ecx]
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b817
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
call fcn.00404f80
test edi, edi
je 0x40b7d0
mov esi, dword [esp + 0x10]
push ebx
push esi
call fcn.0042caff
add esp, 8
test eax, eax
je 0x40b8aa
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b810
lea eax, [esi - 0x10]
mov dword [esp + 0x24c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b881
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.0042c4f0
add esp, 0x240
ret
mov edx, dword [esp + 0x1c]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.kill_succeed.
call fcn.0040b6a0
lea eax, [esi - 0x10]
add esp, 0xc
mov dword [esp + 0x24c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b907
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x40b883
Function at 0x40db90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40db97
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40dc74
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44b980]
inc ecx
sub edx, 8
sub esi, 1
jne 0x40dbb0
pop edi
test edx, edx
je 0x40dc9b
jmp 0x40dc80
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x44b980]
inc ecx
sub edx, 1
jne 0x40dc80
not eax
pop esi
ret

Function at 0x40e390
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x40e3c2
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e3b8
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x40e3d5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call fcn.00432660
add dword [edi + 0x18], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret

Function at 0x40e3f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x40e423
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e41d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x40e44f
mov eax, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x18]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x40e435
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x10]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.00432660
add esp, 0xc
add ebx, edi
mov dword [esi + 0x18], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x40e466
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x40e460
cmp byte [esi + 8], 0
je 0x40e460
or eax, 0xffffffff
add esp, 8
ret
Function at 0x40e5a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x40e5e5
cmp byte [esi + 1], 0
je 0x40e5ed
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x40e601
cmp byte [esi + 1], 0
je 0x40e5f3
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40e60a
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x40e5be
xor eax, eax
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40e60a
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x40e61e
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0042d767
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40e639
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0
cmp edi, eax
jbe 0x40e74c
jmp 0x40e65c
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x40e66d
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x40e686
mov ebp, 0x404
cmp byte [esi], 0
je 0x40e6ab
cmp byte [esi + 1], 0
je 0x40e74c
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40e6ae
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebp
je 0x40e6d6
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e6d0
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x40e6fc
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40e6e7
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
push edi
add ecx, eax
push ecx
push ebx
call fcn.00432660
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x40e74c
lea eax, [ebp - 3]
test eax, eax
jle 0x40e73e
lea esp, [esp]
dec eax
cmp byte [eax + ebx], 0x50
jne 0x40e72c
cmp byte [eax + ebx + 1], 0x4b
jne 0x40e72c
cmp byte [eax + ebx + 2], 5
jne 0x40e72c
cmp byte [eax + ebx + 3], 6
je 0x40e732
test eax, eax
jg 0x40e710
jmp 0x40e73e
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
jne 0x40e74c
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x40e650
push ebx
call fcn.0042ccff
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x40f5c0
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x40f62c
cmp dword [ebx + 4], 0xffffffff
jne 0x40f62c
lea edi, [ebx + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40f5e3
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [0x448f18]
push ecx
push edx
lea esi, [esp + 0x1c]
mov dword [edi], eax
call fcn.0040e340
add esp, 8
test eax, eax
jne 0x40f61a
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ecx
ret 8
call fcn.0040e760
mov dword [ebx], eax
mov eax, dword [0x45a944]
pop edi
pop esi
pop ecx
ret 8
pop edi
mov eax, 0x1000000
pop esi
pop ecx
ret 8

Function at 0x411bdb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x456600]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x411c73
push 0x443e1c
push 4
push eax
call fcn.0042c4ff
push eax
call fcn.00404b80
add esp, 0x10
push ebx
push edi
call fcn.0042e1bc
mov edi, dword [eax]
call fcn.0042e1bc
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0042cbb0
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0042e1bc
cmp dword [eax], ebx
je 0x411c8a
call fcn.0042e1bc
push dword [eax]
call fcn.0040ffcb
pop ecx
jmp 0x411c91
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x411c1e
jmp 0x411d18
call fcn.0042e1bc
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x411d14
cmp dword [ebp - 0x234], esi
jae 0x411d14
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0042e640
add esp, 0xc
push 0x443b7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x411d03
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x411d03
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x411d03
push ebx
push ebx
push esi
jmp 0x411d0c
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x411d16
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042c4f0
leave
ret
Function at 0x4129fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x412a43
call fcn.00416968
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x412a43
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x412a86
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x412a6f
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x412a6f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x412a83
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41712c
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x440292
call fcn.0042e024
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x417151
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x417197
lea ecx, [ebp - 0x10]
call fcn.004047f0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fef6
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404dc0
mov eax, esi
call fcn.0042e0fc
ret 8

Function at 0x41ca88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41cacf
call fcn.00416968
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41cacf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41caeb
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041c600
mov esi, eax
test edi, edi
je 0x41cae9
test ebx, ebx
je 0x41cae9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42c4f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456600]
jne 0x42c4fa
repz ret
jmp fcn.0043254e

Function at 0x4394c0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00431eb2
and dword [ebp - 4], 0
cmp dword [0x45a64c], 0
mov ebx, eax
jne 0x439571
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x439622
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x439622
push eax
call fcn.00431e40
mov dword [esp], 0x447528
push edi
mov dword [0x45a64c], eax
call esi
push eax
call fcn.00431e40
mov dword [esp], 0x447514
push edi
mov dword [0x45a650], eax
call esi
push eax
call fcn.00431e40
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45a654], eax
call esi
push eax
call fcn.00431e40
pop ecx
mov dword [0x45a65c], eax
test eax, eax
je 0x439571
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00431e40
pop ecx
mov dword [0x45a658], eax
mov eax, dword [0x45a658]
cmp eax, ebx
je 0x4395c9
cmp dword [0x45a65c], ebx
je 0x4395c9
push eax
call fcn.00431ebb
push dword [0x45a65c]
mov esi, eax
call fcn.00431ebb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4395c9
test edi, edi
je 0x4395c9
call esi
test eax, eax
je 0x4395c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4395c0
test byte [ebp - 0xc], 1
jne 0x4395c9
or dword [ebp + 0x10], 0x200000
jmp 0x439602
mov eax, dword [0x45a650]
cmp eax, ebx
je 0x439602
push eax
call fcn.00431ebb
pop ecx
test eax, eax
je 0x439602
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x439602
mov eax, dword [0x45a654]
cmp eax, ebx
je 0x439602
push eax
call fcn.00431ebb
pop ecx
test eax, eax
je 0x439602
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45a64c]
call fcn.00431ebb
pop ecx
test eax, eax
je 0x439622
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x439624
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 0x10]
cmp eax, 0x10
je 0x40130f
cmp eax, 0x18
je 0x401303
cmp eax, 0x20
jne 0x40140a
mov eax, dword [esp + 4]
mov dword [eax], 0xe
jmp 0x401319
mov eax, dword [esp + 4]
mov dword [eax], 0xc
jmp 0x401319
mov eax, dword [esp + 4]
mov dword [eax], 0xa
mov ecx, dword [esp + 8]
push ebx
push esi
push edi
lea edi, [eax + 8]
mov dword [eax + 4], edi
mov esi, dword [ecx]
mov ebx, dword [ecx + 4]
add edi, 4
shl esi, 4
add esi, ebx
add edi, 4
add edi, 4
mov ecx, dword [esi]
add esi, 4
mov dword [edi - 0xc], ecx
add edi, 4
mov edx, dword [esi]
add esi, 4
mov dword [edi - 0xc], edx
mov ecx, dword [esi]
add esi, 4
mov dword [edi - 8], ecx
mov edx, dword [esi]
sub esi, 0x1c
mov dword [edi - 4], edx
mov eax, dword [eax]
dec eax
test eax, eax
jbe 0x4013e8
push ebp
mov dword [esp + 0x14], eax
mov ebp, 4
mov eax, dword [esi]
xor ecx, ecx
mov dword [esp + 0x20], eax
xor edx, edx
mov cl, byte [esp + 0x22]
xor ebx, ebx
add edi, 4
add esi, 4
mov dl, byte [ecx + str.cw]
xor ecx, ecx
mov cl, ah
mov edx, dword [edx*4 + 0x406c64]
mov bl, byte [ecx + str.cw]
mov ecx, dword [ebx*4 + 0x406864]
xor ebx, ebx
xor edx, ecx
mov ecx, eax
shr ecx, 0x18
and eax, 0xff
mov bl, byte [ecx + str.cw]
mov ecx, dword [ebx*4 + 0x407064]
xor edx, ecx
xor ecx, ecx
mov cl, byte [eax + str.cw]
mov ebx, dword [ecx*4 + 0x406464]
xor edx, ebx
dec ebp
mov dword [edi - 4], edx
jne 0x401371
mov eax, dword [esp + 0x14]
sub esi, 0x20
dec eax
mov dword [esp + 0x14], eax
jne 0x40136c
pop ebp
mov edx, dword [esi]
add esi, 4
mov dword [edi], edx
add edi, 4
mov eax, dword [esi]
mov dword [edi], eax
mov ecx, dword [esi + 4]
add edi, 4
add esi, 4
mov dword [edi], ecx
mov edx, dword [esi + 4]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x402060
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov al, byte [0x408388]
xor ecx, ecx
mov dword [esp + 1], ecx
push ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 9], ecx
mov dword [esp + 0xd], ecx
mov byte [esp + 4], al
mov word [esp + 0x11], cx
test ebp, ebp
mov byte [esp + 0x13], cl
jne 0x402090
lea ebp, [esp + 4]
mov eax, dword [esp + 0x34]
cmp eax, 0x10
jl 0x40210b
mov edx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, ebp
add edx, 0x118
sub edi, esi
mov dword [esp + 0x40], edx
shr eax, 4
mov dword [esp + 0x44], eax
push 0x10
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.00401000
push esi
push ebx
mov ecx, dword [esp + 0x48]
push 0
push ecx
call fcn.00401410
mov eax, 0x10
mov dl, byte [edi + esi]
mov cl, byte [esi]
xor cl, dl
mov byte [esi], cl
inc esi
dec eax
jne 0x4020dd
lea eax, [esp + 0x20]
push 0x10
push eax
push ebp
call fcn.00401000
add ebx, 0x10
sub edi, 0x10
mov eax, dword [esp + 0x44]
dec eax
mov dword [esp + 0x44], eax
jne 0x4020bd
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x20
ret 0x14