joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009090
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10009068
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10009063
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000904d
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10009055
cmp edx, ebx
jne 0x100091a3
test dword [esi + 1], ecx
add byte [eax], al
test dword [esi + 1], ecx
add byte [eax], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10009024
add eax, dword [eax + 4]
jmp 0x10009011
mov dword [ebp + 0xc], ebx
jmp 0x10009073
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000908b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100090a9
movzx eax, ax
lea eax, [eax + eax*4]
or byte [ebx + 0x104c78c], 0
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
invalid
mov ch, 0x54
invalid

Function at 0x100090f0
Capabilities:
Inspect section memory permissions

Disassembly:
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4

Function at 0x100096b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.100089c4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008979
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.100089b4
jnp 0x1000976d
les ecx, [ecx + ecx*4]
test dword [eax - 7], esi
invalid
inc ebp
cmp al, 0xff
mov ch, 0x68
stc
invalid
Function at 0x10009900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.100089c4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008979
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.100089b4
inc esi
xchg dword [edi], ecx
test byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x1000d620
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100160a0]
jne 0x1000d62a
repz ret
jmp fcn.1000dbc1
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401271
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
push ecx
pop esi
sub ecx, ecx
mov edx, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
add edx, esi
mov dword [eax], ecx
mov eax, 0x14c
push edi
push ecx
pop edi
cmp word [edx + 4], ax
jne 0x4013b8
push ebx
mov ebx, dword [edx + 0x88]
mov dword [ebp - 0x14], ebx
or ebx, ebx
je 0x4013b7
cmp dword [edx + 0x8c], ecx
je 0x4013b7
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
movzx edx, word [edx + 6]
or edx, edx
je 0x4013b7
cmp dword [eax + 0xc], ebx
je 0x4012e2
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x4012d0
jmp 0x4013b7
mov edx, dword [eax + 0x14]
add edx, esi
push 0
movzx ecx, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
pop ebx
je 0x4013b7
xor eax, eax
mov esi, dword [edx + eax*8 + 0x14]
and esi, 0x7fffffff
add esi, edx
push 0
movzx ecx, word [esi + 0xe]
movzx eax, word [esi + 0xc]
add ecx, eax
mov dword [ebp - 0x18], ecx
pop ecx
mov dword [ebp - 0xc], ecx
je 0x4013aa
xor eax, eax
cmp word [esi + eax*8 + 0x10], 0x65
jne 0x40139a
mov ecx, dword [esi + eax*8 + 0x14]
and ecx, 0x7fffffff
add ecx, edx
mov dword [ebp - 8], 0
movzx eax, word [ecx + 0xe]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0xc]
add dword [ebp - 4], eax
je 0x401393
sub eax, eax
mov edx, 0x409
cmp word [ecx + eax*8 + 0x10], dx
mov edx, dword [ebp - 0x10]
je 0x401376
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
movzx eax, ax
cmp eax, dword [ebp - 4]
jb 0x401356
jmp 0x401393
mov ecx, dword [ecx + eax*8 + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edx]
sub eax, dword [ebp - 0x14]
add eax, edx
mov dword [edi], eax
mov eax, dword [ecx + edx + 4]
mov ecx, dword [ebp + 0x10]
sub edi, edi
mov dword [ecx], eax
inc edi
or edi, edi
jne 0x4013b7
mov ecx, dword [ebp - 0xc]
inc ecx
movzx eax, cx
mov dword [ebp - 0xc], ecx
cmp eax, dword [ebp - 0x18]
jb 0x401329
or edi, edi
jne 0x4013b7
inc ebx
movzx eax, bx
cmp eax, dword [ebp - 0x1c]
jb 0x401302
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x4013f3
mov al, byte [ebp + 0xc]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [ebp + 8]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x4013d6
jmp 0x4013f6
mov eax, dword [ebp + 8]
test edi, edi
je 0x401400
xor byte [esi], al
inc esi
dec edi
jne 0x4013fa
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0x3a310
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047950e
Function at 0x40dc20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
jmp 0x40dc3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40dc41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40dc30
mov eax, 1
add ebx, ebx
jne 0x40dc53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40dc48
jne 0x40dc64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40dc48
xor ecx, ecx
sub eax, 3
jb 0x40dc78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40dcea
mov ebp, eax
add ebx, ebx
jne 0x40dc83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40dc90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40dcb4
inc ecx
add ebx, ebx
jne 0x40dca0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40dc95
jne 0x40dcb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40dc95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40dcd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40dcc5
jmp 0x40dc36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40dcd4
add edi, ecx
jmp 0x40dc36
pop esi
mov edi, esi
mov ecx, 0x47
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40dcf2
cmp byte [edi], 1
jne 0x40dcf2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40dcf7
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40dd66
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12c24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12c74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40dd24
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12c7c]
or eax, eax
je 0x40dd60
mov dword [ebx], eax
add ebx, 4
jmp 0x40dd41
call dword [esi + 0x12c78]
mov ebp, dword [esi + 0x12c80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40dd9a
sub esp, 0xffffff80
jmp 0x401110
Function at 0x401fc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2cb8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4ed0f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
lea eax, [ebp - 0x71]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.00402ca0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
call fcn.00401ca0
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x402013
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x48]
lea edi, [ebp - 0x48]
mov eax, dword [eax + 4]
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push dword [ebp - 0x54]
call fcn.00473c4d
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 4
push dword [ebp - 0x4c]
call edi
cmp dword [ebp - 0x58], 8
jb 0x402062
push dword [ebp - 0x6c]
call edi
xor eax, eax
mov word [ebp - 0x6c], ax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], 0
mov eax, dword [eax + 4]
push dword [ebp + eax - 0x70]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x4f3b11], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jne 0x40210d
push 0
push 0
push 0
push esi
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
call eax
push 0
lea eax, [ebp - 0x7c]
push eax
push 2
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4020db
cmp dword [ebp - 0x7c], 2
jne 0x4020db
mov eax, 0xfeff
cmp word [ebp - 0x78], ax
sete al
mov byte [0x4f3b11], al
jmp 0x4020e0
mov al, byte [0x4f3b11]
test al, al
jne 0x402101
push 0
lea eax, [ebp - 0x84]
push eax
push 2
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 0x80], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [0x4f3b11], 1
push 2
push 0
push 0
push esi
call eax
cmp dword [ebp - 0x28], 8
push 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
cmovae ecx, dword [ebp - 0x3c]
add eax, eax
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x402148
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402148
push esi
call eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x18]
mov eax, dword [eax + 4]
add esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
push dword [ebp - 0x24]
call fcn.00473c4d
add esp, 4
push dword [ebp - 0x1c]
call edi
cmp dword [ebp - 0x28], 8
jb 0x402176
push dword [ebp - 0x3c]
call edi
xor eax, eax
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov eax, dword [eax + 4]
push dword [ebp + eax - 0x40]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00473c52
mov esp, ebp
pop ebp
ret
Function at 0x408180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b31bb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x805c
call fcn.00475050
mov eax, dword [0x4ed0f0]
xor eax, esp
mov dword [esp + 0x8058], eax
push ebx
push esi
push edi
mov eax, dword [0x4ed0f0]
xor eax, esp
push eax
lea eax, [esp + 0x8070]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
or esi, 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x8078], 0
test eax, eax
jne 0x4081fc
lea edi, [eax + 0x57]
jmp 0x40836f
mov edx, dword [ecx]
sub esp, 0x18
lea ecx, [esp + 0x44]
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
call fcn.0040a7d0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x40836f
mov eax, dword [esp + 0x14]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x40823e
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x408367
mov esi, eax
mov dword [esp + 0x24], esi
mov dword [ebx], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
lea ecx, [esp + 0x34]
push ecx
push 0x4000
lea ecx, [esp + 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408338
call ebx
cmp eax, 0x26
jne 0x40834d
call ebx
cmp eax, 0x103
je 0x40834d
xor ebx, ebx
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
jmp 0x4082c0
lea eax, [esp + 0x4064]
mov edx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0x4000
mov dword [esp + 0x38], eax
call fcn.0040ad50
cmp eax, 0xfffffffe
je 0x4083a8
mov eax, dword [esp + 0x20]
mov edi, 0x4000
push dword [eax + 4]
sub edi, dword [esp + 0x40]
lea eax, [esp + 0x18]
push eax
push edi
lea eax, [esp + 0x4070]
push eax
mov dword [esp + 0x24], 0
call dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add dword [edx], ecx
test eax, eax
je 0x40835e
cmp ecx, edi
jne 0x40835e
cmp dword [esp + 0x3c], 0
je 0x4082c0
cmp ebx, 4
je 0x408351
mov eax, dword [esp + 0x1c]
jmp 0x408270
cmp dword [esp + 0x30], 0
jne 0x4082ae
mov ebx, 4
jmp 0x4082b0
call ebx
jmp 0x40836d
lea ecx, [esp + 0x2c]
call fcn.0040b560
xor edi, edi
jmp 0x40836f
lea ecx, [esp + 0x2c]
call fcn.0040b560
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x408380
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x408380
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x8070]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8058]
xor ecx, esp
call fcn.00473c52
mov esp, ebp
pop ebp
ret 0xc
mov edi, 0xfffffffe
jmp 0x40836f
Function at 0x4083b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b322b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x8054
call fcn.00475050
mov eax, dword [0x4ed0f0]
xor eax, esp
mov dword [esp + 0x8050], eax
push ebx
push esi
push edi
mov eax, dword [0x4ed0f0]
xor eax, esp
push eax
lea eax, [esp + 0x8068]
mov dword fs:[0], eax
mov dword [esp + 0x50], ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov dword [esp + 0x58], eax
xor edi, edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x8070], edi
test eax, eax
jne 0x40841f
lea eax, [edi + 0x57]
jmp 0x4085c3
sub esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call fcn.00408bb0
add esp, 8
test eax, eax
jne 0x4085c3
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
jb 0x408469
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4085bd
mov esi, eax
mov dword [esp + 0x54], esi
mov eax, dword [esp + 0x50]
push dword [eax + 4]
lea eax, [esp + 0x20]
push eax
push 0x4000
lea eax, [esp + 0x68]
push eax
call dword [esp + 0x68]
test eax, eax
je 0x4085b4
cmp dword [esp + 0x1c], 0
je 0x408546
lea eax, [esp + 0x5c]
mov dword [esp + 0x18], eax
lea ebx, [ebx]
lea eax, [esp + 0x405c]
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0x4000
mov dword [esp + 0x24], eax
call fcn.00408d60
mov edi, eax
cmp edi, 2
je 0x4085ad
cmp edi, 0xfffffffb
jbe 0x408501
cmp edi, 0xfffffffd
jbe 0x408570
push 0
mov ebx, 0x4000
sub ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push ebx
lea eax, [esp + 0x4068]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408568
cmp dword [esp + 0x14], ebx
jne 0x408563
cmp dword [esp + 0x28], 0
je 0x4084d0
cmp edi, 1
jne 0x408495
lea ecx, [esp + 0x18]
call fcn.0040a370
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
dec edi
neg edi
sbb edi, edi
and edi, 0xfffffffd
jmp 0x4085c5
or edi, 0xffffffff
jmp 0x408570
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4085c5
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4085c5
mov edx, dword [eax + 0x34]
test edx, edx
je 0x408599
push edx
push dword [esp + 0x44]
call ecx
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add esp, 8
push eax
push dword [esp + 0x44]
call ecx
add esp, 8
mov dword [esp + 0x34], 0
jmp 0x4085c5
mov edi, 0xfffffffd
jmp 0x408570
lea ecx, [esp + 0x18]
call fcn.0040a370
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x4085d6
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4085d6
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x8068]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8050]
xor ecx, esp
call fcn.00473c52
mov esp, ebp
pop ebp
ret 8
Function at 0x41d619
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x41d68f
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x41d651
push 0
push 0
jmp 0x41d691
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 4], eax
test eax, eax
je 0x41d64b
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi], eax
test eax, eax
je 0x41d64b
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [esi]
call fcn.00472fa0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push ebx
push ebx
call fcn.00473c61
int3
Function at 0x41dfb7
Capabilities:
Copy file
Create thread

Disassembly:
push 0x830
mov eax, 0x4a0cce
call fcn.00473d21
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push edi
call fcn.0041e272
test al, al
je 0x41dfe7
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x41e17e
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push edi
mov ecx, esi
call fcn.0041e186
lea ecx, [ebp - 0x810]
push ecx
lea ecx, [esi + 0xf4]
call fcn.00404ee0
mov eax, 0x4cb558
test ebx, ebx
cmovne eax, ebx
lea ecx, [esi + 0x124]
push eax
call fcn.00404ee0
push 0x2c
call fcn.00474bb7
mov edi, eax
pop ecx
mov dword [ebp - 0x81c], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x41e06e
lea ecx, [esi + 0xf4]
call fcn.00403d20
push 4
push esi
push dword [eax]
mov ecx, edi
call fcn.0041dc43
jmp 0x41e070
mov eax, ebx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x154], eax
lea eax, [ebp - 0x820]
push eax
push ebx
push esi
push 0x41e43f
push ebx
push ebx
mov dword [ebp - 0x820], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
push 4
mov dword [ebp - 0x81c], ebx
call fcn.004521fb
mov dword [esp], 0x4ff
push 0xffffffffffffffff
push 0
push eax
push 1
mov dword [ebp - 0x818], eax
mov dword [eax], ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp edi, 1
jne 0x41e12a
mov ebx, dword [ebp - 0x818]
xor edi, edi
jmp 0x41e0f6
cmp dword [ebp - 0x838], 0x8032
jne 0x41e0e9
mov ecx, dword [esi + 0x154]
call fcn.0041ef72
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x41e0d2
push 0x4ff
push 0xffffffffffffffff
push edi
push ebx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp edi, 1
je 0x41e0ce
mov ebx, dword [ebp - 0x81c]
push dword [ebp - 0x818]
call fcn.00473c4d
mov esi, dword [esi + 0x154]
pop ecx
test esi, esi
je 0x41e14e
mov ecx, esi
call fcn.0041de7d
push esi
call fcn.00472d16
pop ecx
cmp edi, 0xffffffff
jne 0x41e157
xor eax, eax
jmp 0x41e17e
and dword [ebp - 0x814], 0
lea eax, [ebp - 0x814]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x814], eax
setge al
call fcn.00473cd0
ret 8

Function at 0x420c8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x28
mov eax, 0x4a1aee
call fcn.00473d21
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0x74736e49
mov dword [ebp - 0x24], 0x536c6c61
mov dword [ebp - 0x20], 0x6c656968
mov word [ebp - 0x1c], 0x64
cmp byte [ebp + 0xc], bl
je 0x420ccf
mov dword [ebp - 0x1b], 0x7a695720
mov dword [ebp - 0x17], 0x647261
push 1
lea eax, [ebp - 0x29]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00411380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 1
mov eax, esi
call fcn.00473cd0
ret 8