joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408dd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp eax, 2
jne 0x1408e13
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x35b6a84
push 0x40
mov edi, dword [eax + 4]
push 4
push edi
call ebx
test eax, eax
je 0x1408e5b
mov eax, dword [esi + 8]
push 0x35b6a84
mov dword [edi], eax
push dword [0x35b6a84]
push 4
push edi
call ebx
jmp 0x1408e5b
cmp eax, 3
jne 0x1408e4a
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x35b6a84
push 0x40
mov edi, dword [eax]
push 4
push edi
call ebx
test eax, eax
je 0x1408e5b
mov eax, dword [esi + 8]
push 0x35b6a84
mov dword [edi], eax
push dword [0x35b6a84]
push 4
push edi
call ebx
jmp 0x1408e5b
cmp eax, 1
jne 0x1408e5b
push dword [esi + 0xc]
lea eax, [esi + 8]
push eax
call fcn.014025e0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1408e74
push 0
push eax
call fcn.01420932
add esp, 8
mov dword [esi + 0x30], 0
push 0x34
push esi
call fcn.01420932
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x140ef50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
je 0x140ef8a
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140ef8a
cmp dword [ebp - 8], 4
mov eax, dword [ebp - 0xc]
je 0x140ef8d
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x140efa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [0x35b6ad0], 0
cmp byte [ecx + 4], 0
mov dword [ebp - 4], 0x200
je 0x140efe4
lea eax, [ebp - 4]
push eax
push 0x35b6ad0
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140efe4
cmp dword [ebp - 8], 1
mov eax, 0x35b6ad0
je 0x140efe7
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x414779
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004100b5
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41484e
push 0x41cb64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4147b9
xor eax, eax
jmp 0x414912
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41cb58
push edi
call esi
cmp eax, ebx
je 0x4147b2
push eax
call fcn.00410052
mov dword [esp], 0x41cb48
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.00410052
mov dword [esp], 0x41cb34
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.00410052
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040eac1
test eax, eax
pop ecx
pop ecx
je 0x41481c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cbfb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41484e
push 0x41cb18
push edi
call esi
push eax
call fcn.00410052
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x41484e
push 0x41cb00
push edi
call esi
push eax
call fcn.00410052
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4148c7
cmp dword [0x4244b8], esi
je 0x4148c7
push eax
call fcn.004100be
pop ecx
call eax
cmp eax, ebx
je 0x414894
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.004100be
pop ecx
call eax
test eax, eax
je 0x414894
test byte [ebp - 0x18], 1
jne 0x4148c7
lea eax, [ebp - 0xc]
push eax
call fcn.0040eaf8
test eax, eax
pop ecx
je 0x4148af
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040cbfb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4148be
or dword [ebp + 0x10], 0x200000
jmp 0x4148f8
or dword [ebp + 0x10], 0x40000
jmp 0x4148f8
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x4148f8
push eax
call fcn.004100be
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4148f8
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x4148f8
push dword [ebp - 4]
push eax
call fcn.004100be
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.004100be
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406f51
Capabilities:
Encode data using xor

Disassembly:
call fcn.00406e1c
xor ecx, ecx
sub ecx, 0xffffff8e
call 0x406f51
rcr byte [esi - 0x7f], 0x76
push cs
cli
add byte [esi - 0x3117c20], cl
xor dword [esi + 0xe], 0xe08e00fa
sub esi, 0xfffffffc
loop 0x406f54
retf
Function at 0x805df0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805df6
pop ebp
sub ebp, 6
sub ebp, 0x405df0
jmp 0x805e54
add dword [eax], eax
add byte [eax], al
jb 0x805ea1
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
fldcw word [ebp + 0x34]
cmp dword [eax + 0x405df0], 3
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x62e], bh
jmp 0x805e5d
mov eax, 0x405df0
add eax, ebp
add eax, 0x93
mov ecx, 0x62e
mov edx, 0xe8534e4f
xor byte [eax], dl
inc eax
dec ecx
jne 0x805e74
jmp 0x805e87
and eax, 0x5f4f270f
dec edi
dec edi
daa
dec edi
and dword [ebx + 0x4f], 0xffffffce
mov edi, 0xa0e0e337
into
mov edi, 0xa0e0e337
jl 0x805e30
pop ds
mov al, 0xda
dec edi
sahf
jns 0x805ef7
pop ds
les eax, [edx + 0x4f73c6c4]
dec edi
dec edi
into
invalid
invalid
Function at 0x406840
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub dword [ebx - 0x3dfffd4b], 0x85d9453
push esi
push edi
sub eax, dword [ecx - 0x4a077c05]
psrlq mm2, qword [ecx + eax - 0x15797ac2]
adc byte [ebp - 0x76d6f037], al
outsd dx, dword [esi]
add byte [eax], al
mov edx, dword [edx + 0x4d6f8b0c]
lea edx, [esi + 0x28]
dec edi
push edx
push eax
call dword [0x6c15d]
cmp eax, 0xffffffff
jne 0x4069b8
fadd st(1), st(0)
mov eax, 0x7fbdf6c1
salc
xchg esp, eax
or byte [edi], 0x84
stc
add byte [eax], al
add bh, bh
inc ebp
add eax, 0xafc80
cmp eax, 0xb23b3
jp 0x406a09
jnp 0x40685d
sahf
jae 0x4068e4
mov eax, edi
xchg dh, al
jne 0x4068bd
pop edi
pop esi
mov eax, 0x860b23b4
pop ebx
mov esp, ebp
inc eax
ret 0x6108
inc esp
inc ebx
mov eax, dword [0xae0001b9]
enter 0xfffffffffffff685, 0xffffffffffffff89
test dword [ebx - 0x760000a9], edi
invalid
push dword [ebx + 4]
xor eax, eax
jmp 0x406910
cli
lea eax, [ebp - 0x16]
call dword cs:[eax - 0x73]
xchg ebp, eax
invalid
mov edi, dword [esi]
adc byte [ecx - 0x7c99eb0f], cl
js 0x4069ec
add byte [ebp + 7], dh
invalid
ret 8
push esi
push eax
jmp dword [eax + 0x3640c078]

Function at 0x40b63a
Capabilities:
Terminate process

Disassembly:
jl 0x40b6a1
pop es
div edi
neg eax
pop esi
fiadd dword [eax]
pop ebx
pop esi
sub al, dl
adc byte [eax], al
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c760
push 0x40b9d4
mov eax, dword fs:[0x60000]
push eax
fbld tbyte fs:[0xb4003e]
and dword [ebx], 0x20
push ebx
js 0x40b6b4
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
inc ecx
add al, ch
bound eax, qword [edx]
add byte [edi + 0x2505883], cl
inc eax
add bh, bh
arpl ax, sp
rol byte [eax - 0x43], 0xff

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x16805e1d
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x682b61f4
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x409e20
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x409ecb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e244
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e23c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x409eb5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x73807ff0
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x36313224
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x6ffd592e
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x1f363aa0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x409cb2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f67
and dword [ebp - 4], 0
cmp dword [0x427c18], 0
mov ebx, eax
jne 0x409d63
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409e14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409e14
push eax
call fcn.00404ef5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427c18], eax
call esi
push eax
call fcn.00404ef5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427c1c], eax
call esi
push eax
call fcn.00404ef5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427c20], eax
call esi
push eax
call fcn.00404ef5
pop ecx
mov dword [0x427c28], eax
test eax, eax
je 0x409d63
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ef5
pop ecx
mov dword [0x427c24], eax
mov eax, dword [0x427c24]
cmp eax, ebx
je 0x409dbb
cmp dword [0x427c28], ebx
je 0x409dbb
push eax
call fcn.00404f70
push dword [0x427c28]
mov esi, eax
call fcn.00404f70
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409dbb
test edi, edi
je 0x409dbb
call esi
test eax, eax
je 0x409db2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409db2
test byte [ebp - 0xc], 1
jne 0x409dbb
or dword [ebp + 0x10], 0x200000
jmp 0x409df4
mov eax, dword [0x427c1c]
cmp eax, ebx
je 0x409df4
push eax
call fcn.00404f70
pop ecx
test eax, eax
je 0x409df4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409df4
mov eax, dword [0x427c20]
cmp eax, ebx
je 0x409df4
push eax
call fcn.00404f70
pop ecx
test eax, eax
je 0x409df4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427c18]
call fcn.00404f70
pop ecx
test eax, eax
je 0x409e14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4010d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
movzx ecx, word [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4010f5
pop edi
xor al, al
pop esi
ret 0x14
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
jne 0x40110c
pop ebp
pop edi
xor al, al
pop esi
ret 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
ja 0x401124
pop ebx
jmp loc.004e2088
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x40113b
mov edx, dword [esp + 0x24]
mov dword [edx], ebx
pop ebx
pop ebp
pop edi
mov al, 1
pop esi
ret 0x14
mov eax, dword [esp + 0x24]
cmp dword [eax], ebx
jb 0x40111b
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40111b
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov esi, eax
rep movsd dword es:[edi], dword [esi]
pop ebx
mov ecx, edx
and ecx, 3
pop ebp
rep movsb byte es:[edi], byte [esi]
pop edi
mov al, 1
pop esi
ret 0x14

Function at 0x4014a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push edi
push 2
push 0
xor bl, bl
push eax
mov byte [esp + 0x17], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
test edi, edi
je 0x401551
movzx ecx, word [esp + 0x18]
push esi
push 3
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40153f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40153f
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x40153e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp loc.004e26c8
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [esp + 0xf]
pop esi
pop edi
pop ebx
pop ecx
ret 0x10
pop edi
mov al, bl
pop ebx
pop ecx
ret 0x10
Function at 0x4025b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [esi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov edx, dword [esi + 0x14]
shl edx, 2
xor ecx, ecx
test edx, edx
push edi
jle 0x402603
mov edi, dword [esp + 0x10]
mov ebx, ecx
and ebx, 0x80000003
jns 0x4025e4
dec ebx
or ebx, 0xfffffffc
inc ebx
mov eax, ecx
cdq
and edx, 3
add eax, edx
mov dl, byte [ecx + edi]
sar eax, 2
add eax, esi
mov byte [eax + ebx*4 + 4], dl
mov eax, dword [esi + 0x14]
inc ecx
shl eax, 2
cmp ecx, eax
jl 0x4025d5
mov edx, dword [esi + 0x1c]
push ebp
xor ecx, ecx
lea ebp, [esi + 5]
shl edx, 4
mov eax, ebp
lea edi, [edx + esi + 0x44]
mov dl, byte [edi + ecx - 4]
xor byte [eax - 1], dl
mov dl, byte [edi + ecx]
xor byte [eax], dl
mov dl, byte [edi + ecx + 4]
xor byte [eax + 1], dl
mov dl, byte [edi + ecx + 8]
xor byte [eax + 2], dl
inc ecx
add eax, 4
cmp ecx, 4
jl 0x402615
mov eax, dword [esi + 0x1c]
dec eax
cmp eax, 1
jl 0x402692
mov ecx, eax
shl ecx, 4
lea edi, [ecx + esi + 0x44]
mov ebx, eax
lea esp, [esp]
mov ecx, esi
call fcn.00401d20
mov ecx, esi
call fcn.00401ca0
xor ecx, ecx
mov eax, ebp
mov dl, byte [edi + ecx - 4]
xor byte [eax - 1], dl
mov dl, byte [edi + ecx]
xor byte [eax], dl
mov dl, byte [edi + ecx + 4]
xor byte [eax + 1], dl
mov dl, byte [edi + ecx + 8]
xor byte [eax + 2], dl
inc ecx
add eax, 4
cmp ecx, 4
jl 0x402662
mov ecx, esi
call fcn.00401de0
sub edi, 0x10
dec ebx
jne 0x402650
mov ecx, esi
call fcn.00401d20
mov ecx, esi
call fcn.00401ca0
mov eax, ebp
lea ecx, [esi + 0x44]
mov edi, 4
pop ebp
jmp 0x4026b0
mov dl, byte [ecx - 4]
xor byte [eax - 1], dl
mov dl, byte [ecx]
xor byte [eax], dl
mov dl, byte [ecx + 4]
xor byte [eax + 1], dl
mov dl, byte [ecx + 8]
xor byte [eax + 2], dl
inc ecx
add eax, 4
dec edi
jne 0x4026b0
mov eax, dword [esi + 0x14]
shl eax, 2
xor ecx, ecx
test eax, eax
jle 0x40270e
mov edi, dword [esp + 0x14]
lea ecx, [ecx]
mov ebx, ecx
and ebx, 0x80000003
jns 0x4026ef
dec ebx
or ebx, 0xfffffffc
inc ebx
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, esi
mov dl, byte [eax + ebx*4 + 4]
mov byte [ecx + edi], dl
mov eax, dword [esi + 0x14]
inc ecx
shl eax, 2
cmp ecx, eax
jl 0x4026e0
pop edi
pop esi
pop ebx
ret 8

Function at 0x402750
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40277b
xor al, al
pop esi
pop ecx
ret
push 2
push 0
push 0xfffffffffffffff3
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 8]
push ecx
push 0xd
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 4], 0xd
sete al
pop esi
pop ecx
ret