joyce8/EMBER2024-capa huggingface dataset:
Function at 0x788aa0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push ebp
mov eax, dword [ecx]
push esi
mov dword [edx], eax
mov esi, dword [ecx + 4]
mov dword [esp + 0xc], eax
push edi
mov dword [edx + 4], esi
mov edi, dword [ecx + 8]
lea eax, [edx + 8]
mov dword [eax], edi
mov ebp, dword [ecx + 0xc]
mov dword [esp + 0x1c], ebp
mov dword [edx + 0xc], ebp
mov ecx, 0x7680fc
mov edx, dword [esp + 0x1d]
mov bl, byte [esp + 0x10]
and edx, 0xff
add eax, 0x10
add ecx, 4
mov dl, byte [edx + 0x767afc]
xor dl, bl
mov bl, byte [ecx - 4]
xor dl, bl
mov bl, byte [esp + 0x11]
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x1e]
and edx, 0xff
mov dl, byte [edx + 0x767afc]
xor bl, dl
mov edx, dword [esp + 0x1f]
and edx, 0xff
mov byte [esp + 0x11], bl
mov bl, byte [esp + 0x12]
mov dl, byte [edx + 0x767afc]
xor bl, dl
mov edx, ebp
and edx, 0xff
mov byte [esp + 0x12], bl
mov bl, byte [esp + 0x13]
mov dl, byte [edx + 0x767afc]
xor bl, dl
mov byte [esp + 0x13], bl
mov edx, dword [esp + 0x10]
xor esi, edx
mov dword [eax - 8], edx
xor edi, esi
mov dword [eax - 4], esi
xor ebp, edi
cmp ecx, 0x768124
mov dword [esp + 0x1c], ebp
mov dword [eax], edi
mov dword [eax + 4], ebp
jl 0x788ad4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x788d20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
xor ecx, ecx
mov cl, byte [eax]
mov dl, byte [ecx + 0x767afc]
mov ecx, dword [esp + 4]
mov byte [ecx], dl
xor edx, edx
mov dl, byte [eax + 4]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 4], dl
xor edx, edx
mov dl, byte [eax + 8]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 8], dl
xor edx, edx
mov dl, byte [eax + 0xc]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 0xc], dl
xor edx, edx
mov dl, byte [eax + 1]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 0xd], dl
xor edx, edx
mov dl, byte [eax + 5]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 1], dl
xor edx, edx
mov dl, byte [eax + 9]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 5], dl
xor edx, edx
mov dl, byte [eax + 0xd]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 9], dl
xor edx, edx
mov dl, byte [eax + 2]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 0xa], dl
xor edx, edx
mov dl, byte [eax + 0xa]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 2], dl
xor edx, edx
mov dl, byte [eax + 6]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 0xe], dl
xor edx, edx
mov dl, byte [eax + 0xe]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 6], dl
xor edx, edx
mov dl, byte [eax + 3]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 7], dl
xor edx, edx
mov dl, byte [eax + 0xf]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 3], dl
xor edx, edx
mov dl, byte [eax + 0xb]
mov dl, byte [edx + 0x767afc]
mov byte [ecx + 0xf], dl
xor edx, edx
mov dl, byte [eax + 7]
mov al, byte [edx + 0x767afc]
mov byte [ecx + 0xb], al
ret
Function at 0x789250
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
xor ecx, ecx
mov cl, byte [eax]
mov dl, byte [ecx + 0x767bfc]
mov ecx, dword [esp + 4]
mov byte [ecx], dl
xor edx, edx
mov dl, byte [eax + 4]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 4], dl
xor edx, edx
mov dl, byte [eax + 8]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 8], dl
xor edx, edx
mov dl, byte [eax + 0xc]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 0xc], dl
xor edx, edx
mov dl, byte [eax + 1]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 5], dl
xor edx, edx
mov dl, byte [eax + 0xd]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 1], dl
xor edx, edx
mov dl, byte [eax + 9]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 0xd], dl
xor edx, edx
mov dl, byte [eax + 5]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 9], dl
xor edx, edx
mov dl, byte [eax + 2]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 0xa], dl
xor edx, edx
mov dl, byte [eax + 0xa]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 2], dl
xor edx, edx
mov dl, byte [eax + 6]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 0xe], dl
xor edx, edx
mov dl, byte [eax + 0xe]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 6], dl
xor edx, edx
mov dl, byte [eax + 3]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 0xf], dl
xor edx, edx
mov dl, byte [eax + 7]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 3], dl
xor edx, edx
mov dl, byte [eax + 0xb]
mov dl, byte [edx + 0x767bfc]
mov byte [ecx + 7], dl
xor edx, edx
mov dl, byte [eax + 0xf]
mov al, byte [edx + 0x767bfc]
mov byte [ecx + 0xb], al
ret

Function at 0x7896d0
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
xor eax, eax
mov ecx, 0x10
lea edi, [edx + 0x1c]
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
rep stosd dword es:[edi], eax
pop edi
ret 4
Function at 0x78d9b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x140
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0078c770
lea ecx, [esp + 0x14]
lea edx, [esp + 0xa4]
push ecx
push edx
call fcn.00788aa0
mov edi, dword [esp + 0x160]
add esp, 0xc
mov ebp, 0x60
lea ecx, [esp + 0x20]
lea eax, [edi + ebp]
sub ecx, edi
mov esi, 0x10
mov dl, byte [eax - 0x10]
mov bl, byte [eax]
xor dl, bl
mov byte [ecx + eax], dl
inc eax
dec esi
jne 0x78d9f3
lea eax, [esp + ebp + 0x20]
lea ecx, [esp + 0xa0]
push eax
push ecx
call fcn.007890f0
sub ebp, 0x10
add esp, 8
cmp ebp, 0x10
jge 0x78d9e5
push 0x10
lea edx, [esp + 0x24]
push edi
push edx
call fcn.00799510
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xac]
push eax
push ecx
call fcn.007890f0
lea edx, [esp + 0x24]
push edx
call fcn.0078c7c0
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x28]
push eax
push 0x10
push ecx
lea edx, [esp + 0x44]
push 0x60
push edx
call fcn.0078db70
push 0x10
lea eax, [esp + 0x40]
push 0
push eax
call fcn.00799530
add esp, 0x38
xor eax, eax
mov cl, byte [esp + eax + 0x90]
mov dl, byte [esp + eax + 0x80]
cmp cl, dl
jne 0x78dae3
inc eax
cmp eax, 0x10
jl 0x78da75
mov esi, dword [esp + 0x158]
lea edx, [esp + 0x30]
push 0x10
push edx
push esi
call fcn.00799510
lea eax, [esp + 0x5c]
push 0x10
lea ecx, [esi + 0x10]
push eax
push ecx
call fcn.00799510
lea edx, [esp + 0x88]
push 0xa
add esi, 0x20
push edx
push esi
call fcn.00799510
add esp, 0x24
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0x28]
mov dl, byte [esp + eax + 0x20]
not ecx
cmp edx, ecx
jne 0x78daf3
inc eax
cmp eax, 8
jl 0x78dac9
jmp 0x78db1b
pop edi
pop esi
pop ebp
mov eax, 0xca
pop ebx
add esp, 0x140
ret
mov eax, dword [esp + 0x15c]
mov ecx, 0x100
pop edi
pop esi
mov word [eax + 2], cx
mov word [eax], cx
mov word [eax + 4], cx
mov word [eax + 6], cx
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
lea eax, [esp + 0x40]
push eax
call fcn.007842f0
mov esi, dword [esp + 0x160]
lea ecx, [esp + 0x46]
push ecx
mov word [esi + 2], ax
call fcn.007842f0
lea edx, [esp + 0x4c]
mov word [esi], ax
push edx
call fcn.007842f0
mov word [esi + 4], ax
lea eax, [esp + 0x52]
push eax
call fcn.007842f0
add esp, 0x10
mov word [esi + 6], ax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x78db70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x140
push esi
mov esi, dword [esp + 0x154]
cmp esi, 0x40
jle 0x78dbc6
lea eax, [esp + 0xec]
push eax
call fcn.0078dcc0
mov ecx, dword [esp + 0x154]
push esi
lea edx, [esp + 0xf4]
push ecx
push edx
call fcn.0078dcf0
lea eax, [esp + 0xfc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0078dda0
add esp, 0x18
lea edx, [esp + 4]
mov esi, 0x10
jmp 0x78dbcd
mov edx, dword [esp + 0x150]
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xb0]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x18]
test esi, esi
rep stosd dword es:[edi], eax
jle 0x78dc0a
mov edi, edx
lea edx, [esp + 0x18]
sub edi, edx
lea ecx, [esp + eax + 0x18]
inc eax
cmp eax, esi
mov dl, byte [edi + ecx]
mov byte [esp + eax + 0xaf], dl
mov byte [ecx], dl
jl 0x78dbf5
xor eax, eax
pop edi
mov dl, byte [esp + eax + 0xac]
mov cl, byte [esp + eax + 0x14]
xor dl, 0x36
xor cl, 0x5c
mov byte [esp + eax + 0xac], dl
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, 0x40
jl 0x78dc0d
lea eax, [esp + 0x54]
push eax
call fcn.0078dcc0
lea ecx, [esp + 0xb0]
push 0x40
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.0078dcf0
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x158]
push eax
lea edx, [esp + 0x68]
push ecx
push edx
call fcn.0078dcf0
mov esi, dword [esp + 0x174]
lea eax, [esp + 0x70]
push eax
push esi
call fcn.0078dda0
lea ecx, [esp + 0x78]
push ecx
call fcn.0078dcc0
lea edx, [esp + 0x3c]
push 0x40
lea eax, [esp + 0x80]
push edx
push eax
call fcn.0078dcf0
push 0x10
lea ecx, [esp + 0x8c]
push esi
push ecx
call fcn.0078dcf0
add esp, 0x40
lea edx, [esp + 0x54]
push edx
push esi
call fcn.0078dda0
add esp, 8
pop esi
add esp, 0x140
ret

Function at 0x78dcc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x790a20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc0
push ebx
push ebp
push esi
mov esi, dword [esp + 0xd0]
push edi
push 0x50
push esi
call fcn.00787900
mov ebx, dword [esp + 0xe0]
lea edi, [esi + 0x10]
push 0x10
push ebx
push edi
call fcn.00799510
lea eax, [ebx + 0x10]
push 0x10
lea ecx, [esi + 0x30]
push eax
push ecx
call fcn.00799510
add ebx, 0x20
push 0xa
lea edx, [esi + 0x50]
push ebx
push edx
call fcn.00799510
mov ebp, dword [esp + 0x108]
add esp, 0x2c
test ebp, ebp
je 0x790ad6
mov ecx, 0xfffffff8
lea eax, [esi + 8]
sub ecx, esi
mov dl, byte [eax - 8]
inc eax
not dl
mov byte [eax - 1], dl
lea edx, [ecx + eax]
cmp edx, 8
jl 0x790a82
xor eax, eax
lea ecx, [esi + 0x20]
mov ax, word [ebp + 2]
push eax
push ecx
call fcn.00784310
xor edx, edx
lea eax, [esi + 0x22]
mov dx, word [ebp]
push edx
push eax
call fcn.00784310
xor ecx, ecx
lea edx, [esi + 0x24]
mov cx, word [ebp + 4]
push ecx
push edx
call fcn.00784310
xor eax, eax
lea ecx, [esi + 0x26]
mov ax, word [ebp + 6]
push eax
push ecx
call fcn.00784310
add esp, 0x20
lea ebx, [esi + 0x60]
push 0x10
push 0
push ebx
call fcn.00799530
lea edx, [esp + 0x1c]
push edx
call fcn.0078c7c0
push ebx
lea eax, [esp + 0x24]
push 0x10
push eax
push 0x60
push esi
call fcn.0078db70
lea ecx, [esp + 0x34]
push ecx
call fcn.0078c770
lea edx, [esp + 0x38]
lea eax, [esp + 0x48]
push edx
push eax
call fcn.00788aa0
lea ecx, [esp + 0x50]
push esi
push ecx
call fcn.00788b80
add esp, 0x38
xor esi, esi
lea edx, [edi + esi]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00788b80
add esp, 8
mov eax, 0x10
mov cl, byte [edi + esi - 0x10]
mov bl, byte [edi + esi]
xor bl, cl
mov byte [edi + esi], bl
inc esi
dec eax
jne 0x790b3c
cmp esi, 0x60
jl 0x790b26
push 0x10
lea edx, [esp + 0x14]
push 0
push edx
call fcn.00799530
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret
Function at 0x79a380
Capabilities:
Hash data with crc32

Disassembly:
push 0x400
call dword [fcn.008c9268]
add esp, 4
test eax, eax
jne 0x79a396
or eax, 0xffffffff
ret
push esi
push edi
xor edx, edx
mov esi, eax
mov ecx, edx
mov edi, 8
test cl, 1
je 0x79a3b2
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x79a3b4
shr ecx, 1
dec edi
jne 0x79a3a3
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0xff
jle 0x79a39c
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x79a3d0
Capabilities:
Encode data using xor

Disassembly:
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 8]
push eax
call fcn.0079a380
add esp, 4
test eax, eax
je 0x79a3eb
or eax, 0xffffffff
pop edi
ret
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, eax
dec eax
push esi
mov esi, dword [esp + 0x18]
test ecx, ecx
je 0x79a424
push ebx
lea edx, [eax + 1]
mov eax, dword [esi]
xor ebx, ebx
mov bl, byte [edi]
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
inc edi
shr eax, 8
mov ecx, dword [ebp + ecx*4]
xor eax, ecx
dec edx
mov dword [esi], eax
jne 0x79a404
pop ebx
test ebp, ebp
je 0x79a432
push ebp
call dword [fcn.008c9264]
add esp, 4
mov eax, dword [esi]
pop esi
pop ebp
pop edi
ret
Function at 0x833114
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x5603a83b
jbe 0x833149
mov al, byte [0xc5039f31]
mov esi, 0x28ee7d08
cmp ecx, ebp
in al, dx
xor bl, byte [eax + 0x5300427c]
adc al, 0xe2
mov ebx, esi
stc
inc edx
cmp cl, byte [edi - 0x7a]
dec ebx
jp 0x833129
cmp dword [eax + 0x3d], esi
push 0x69b9be80
ficomp word [esi - 0x4f]
pushfd
xchg edi, eax
mov esi, ebx
mov esi, 0xfc2a51e3
add ecx, dword [edi + 0x54]
xor byte [edi], bh
jae 0x833190
inc bx
sub eax, 0x713722d7
push ds
fcom st(3)
mov al, 0x87
and dword [ecx], ebp
into
mov ch, 0x24
test byte [ebx + ecx*8], 0xa3
test al, 0xd5
push ebp
xchg ecx, eax
push esi
xchg ecx, eax
mov fs, word [eax + ebp + 0x7935bad0]
movsd dword es:[edi], dword [esi]
out dx, al
push ecx
cmp dword [ebx], 0x59acc60d
sub dl, byte [ecx]
xchg ecx, eax
mov byte [0xa191339f], al
inc edi
mov cl, 0x4c
in eax, 0xa9
shl dword [esi - 0x47], cl
mov ecx, 0x9844be6a
test eax, 0xb9b966d3
push 0xffffffffffffffbe
inc esp
cwde
out dx, al
dec esi
test dword [0x982fce99], esi
cmpsb byte [esi], byte es:[edi]
jnp 0x8331f8
aas
dec edi
out 0x7a, al
in al, 0x25
sti
ja 0x833174
mov byte [ebp - 0x48918578], cl
enter 0x723c, 0x28
jg 0x83322c
outsb dx, byte [esi]
fstp xword [edx + 0x3bf23f58]
js 0x8331f3
nop
test al, 0x37
lds ebx, [eax + 0x8f5b822]
call 0x9b4452d7
sti
insb byte es:[edi], dx
cdq
inc ecx
ljmp 0x3fb4
test ch, dh
sbb ax, 0x6237
and edx, dword [ebx + 0x63]
mov al, byte [0x60e9a9ff]
retf 0x408a
test eax, 0xca6560e9
mov al, byte [eax + 0x57]
fdivp st(5)
ret
jae 0x833236
adc al, 0xec
lcall 0xa4a5, 0xdb5a8615
movsb byte es:[edi], byte [esi]
test al, 0x11
jecxz 0x833292
jecxz 0x8331e7
in al, dx
cmp byte [esi], dl
sbb dword [eax], esi
iretd
shr byte [ebx + ebx*8 - 0x4a], cl
sbb eax, 0xbe0a3ad1
xor dword [ebp - 0x63], 0x5e113f3a
cmpsd dword [esi], dword es:[edi]
in al, 0x89
add ecx, ebx
stosd dword es:[edi], eax
frstor dword [esi]
push cs
mov edi, edx
das
pop eax
jmp 0x83232d5c
Function at 0x4013e0
Capabilities:
Create process on windows
Inspect load icon resource

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x65
push 0
mov esi, eax
call edi
mov ebx, dword [sym.imp.USER32.dll_LoadIconA]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 1
push 0x80
push esi
call ebp
push 0x68
push 0
call edi
push eax
call ebx
push eax
push 0
push 0x80
push esi
call ebp
call fcn.0040350e
test eax, eax
jne 0x40143c
push 0x80004005
call fcn.00401bf0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
call fcn.0040350e
test eax, eax
jne 0x40145f
push 0x80004005
call fcn.00401bf0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
add eax, 0x10
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
call fcn.00401190
mov esi, dword [esp + 0x1c]
add esp, 8
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esp + 0x10]
push eax
call fcn.00401080
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4014d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4014ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10

Function at 0x401880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401899
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4018d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4018d0
lea ebx, [ebx]
cmp esi, eax
jae 0x4018d4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4018c0
cmp esi, eax
jb 0x4018da
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4025b0
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x41d7d9
mov eax, dword fs:[0]
push eax
mov eax, 0x1094
call fcn.00410600
mov eax, dword [0x425a94]
xor eax, esp
mov dword [esp + 0x1090], eax
push ebx
push ebp
push edi
mov eax, dword [0x425a94]
xor eax, esp
push eax
lea eax, [esp + 0x10a4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x10b4]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 4], bl
lea edi, [esi + 0x1c]
mov dword [esp + 0x10ac], ebx
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
push 0x824
lea eax, [esp + 0x55]
push ebx
mov byte [esp + 0x10b4], 1
push eax
mov byte [esp + 0x5c], bl
call fcn.0040faa0
push 0x824
lea ecx, [esp + 0x889]
push ebx
push ecx
mov byte [esp + 0x890], bl
call fcn.0040faa0
push 0x38
lea edx, [esp + 0x34]
push ebx
push edx
mov dword [esp + 0x38], 0x3c
call fcn.0040faa0
mov eax, 0x824
lea edx, [esp + 0x89c]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x68], eax
lea ecx, [esp + 0x74]
mov eax, ebp
mov dword [esp + 0x64], edx
add esp, 0x24
mov dword [esp + 0x24], ecx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402690
lea ecx, [esp + 0x14]
push ecx
push 0x10000000
sub eax, edx
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x4026f5
mov edx, dword [esp + 0x24]
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4026b8
sub eax, ebp
push eax
push edx
mov ecx, esi
call fcn.004028e0
mov edx, dword [esp + 0x40]
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4026d3
sub eax, ebp
push eax
push edx
mov ecx, edi
call fcn.004028e0
mov dx, word [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov word [esi + 0x38], dx
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [esp + 0x10a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1090]
xor ecx, esp
call fcn.0040d0ab
add esp, 0x10a0
ret 4

Function at 0x40d0ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425a94]
jne 0x40d0b5
repz ret
jmp fcn.0041178b
Function at 0x417c90
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041119a
and dword [ebp - 4], 0
cmp dword [0x4296b4], 0
mov ebx, eax
jne 0x417d41
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417df2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420214
push edi
call esi
test eax, eax
je 0x417df2
push eax
call fcn.00411128
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4296b4], eax
call esi
push eax
call fcn.00411128
mov dword [esp], 0x4201f0
push edi
mov dword [0x4296b8], eax
call esi
push eax
call fcn.00411128
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4296bc], eax
call esi
push eax
call fcn.00411128
pop ecx
mov dword [0x4296c4], eax
test eax, eax
je 0x417d41
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411128
pop ecx
mov dword [0x4296c0], eax
mov eax, dword [0x4296c0]
cmp eax, ebx
je 0x417d99
cmp dword [0x4296c4], ebx
je 0x417d99
push eax
call fcn.004111a3
push dword [0x4296c4]
mov esi, eax
call fcn.004111a3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417d99
test edi, edi
je 0x417d99
call esi
test eax, eax
je 0x417d90
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417d90
test byte [ebp - 0xc], 1
jne 0x417d99
or dword [ebp + 0x10], 0x200000
jmp 0x417dd2
mov eax, dword [0x4296b8]
cmp eax, ebx
je 0x417dd2
push eax
call fcn.004111a3
pop ecx
test eax, eax
je 0x417dd2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417dd2
mov eax, dword [0x4296bc]
cmp eax, ebx
je 0x417dd2
push eax
call fcn.004111a3
pop ecx
test eax, eax
je 0x417dd2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4296b4]
call fcn.004111a3
pop ecx
test eax, eax
je 0x417df2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417df4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x440465a7
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x67185122
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219