joyce8/EMBER2024-capa huggingface dataset:
Function at 0x593054
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5b1524]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x59309f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x5a003c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a015c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x48]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00408708
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x5a0130
cmp dword [ebp - 4], 7
jne 0x5a0118
mov eax, dword [ebp - 8]
call fcn.00405454
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a0111
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, edi
call fcn.00408708
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov ebx, dword [ebp - 0xc]
jmp 0x5a00f5
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040876c
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push ebx
call sub.kernel32.dll_lstrlenW
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
jne 0x5a00d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0146
mov eax, dword [ebp - 0xc]
call fcn.00405470
ret
mov ecx, 0x5a0178
mov dl, 1
mov eax, dword [0x4c3820]
call fcn.00425a48
call fcn.00407368
jmp 0x5a0146
mov ecx, 0x5a01b0
mov dl, 1
mov eax, dword [0x59d05c]
call fcn.005a0394
call fcn.00407368
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0163
lea eax, [ebp - 0x10]
call fcn.00407c6c
ret
Function at 0x5a01e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a0339
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a0252
inc ebx
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a0246
sub eax, 4
mov eax, dword [eax]
inc eax
add eax, eax
add dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
dec ebx
jne 0x5a022c
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.00405454
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5a0317
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a02b6
inc ebx
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00408708
push eax
push esi
call sub.kernel32.dll_lstrcpyW
push esi
call sub.kernel32.dll_lstrlenW
inc eax
add eax, eax
add esi, eax
inc dword [ebp - 0x14]
dec ebx
jne 0x5a0288
mov word [esi], 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 7
push 0
mov eax, dword [ebp - 8]
call fcn.00408708
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x5a0301
mov ecx, 0x5a0354
mov dl, 1
mov eax, dword [0x59d05c]
call fcn.005a0394
call fcn.00407368
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a031e
mov eax, dword [ebp - 0x10]
call fcn.00405470
ret
Function at 0x5a33ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407d50
mov eax, dword [ebp - 8]
call fcn.00407d50
lea esi, [ebp - 0x48]
xor eax, eax
push ebp
push 0x5a3475
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00405a34
mov dword [esi], 0x3c
mov dword [esi + 4], 0x40
mov eax, 0x5a3484
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00408708
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00408708
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ebx
push esi
call sub.shell32.dll_ShellExecuteExW
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x5a3457
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push 0xa
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0xc], 0x103
je 0x5a343a
mov ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a347c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ccc
ret

Function at 0x5ac56c
Capabilities:
Get session integrity level

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x5a36f0
call fcn.0040d554
xor eax, eax
push ebp
push 0x5ac5d3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.shell32.dll_IsUserAnAdmin
test eax, eax
je 0x5ac59d
call fcn.0059ed58
jmp 0x5ac5a2
call fcn.0059f2f4
call sub.shell32.dll_IsUserAnAdmin
test eax, eax
je 0x5ac5c9
call fcn.0059f9c0
mov eax, 0x5ac5f4
call fcn.00590fe4
call fcn.0059fa44
call fcn.005a27f0
call fcn.005a356c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ac5dd
pop edi
pop esi
pop ebx
call fcn.0040799c
add byte [eax], al
add byte [eax - 0xfffdfc], dh
invalid
Function at 0x401b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401b99
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401bad
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401bce
cmp esi, eax
jae 0x401ba7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401bc0
cmp esi, eax
jae 0x401ba7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4072f0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x443958
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x45568c]
mov ecx, dword [0x45569c]
imul eax, eax, 0x6e7be
push esi
mov esi, dword [0x4556a8]
imul esi, esi, 0xcecf4
add esi, eax
mov eax, 0x948af151
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455694]
mov eax, 0x3b1784cb
imul ecx
mov ecx, dword [0x455690]
sar edx, 0x11
push edi
mov edi, edx
add esi, edx
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
mov edx, dword [0x56bcbc]
add edi, esi
sub edi, eax
mov ecx, 0x56bcbc
mov dword [str._r_____r____], edi
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x455690]
mov esi, dword [0x455688]
mov eax, 0x57ab2ce3
imul esi, esi, 0x5715a
imul ecx
mov ecx, dword [0x4556a8]
sar edx, 0x12
imul ecx, ecx, 0xa0008
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
sub esi, eax
mov eax, dword [0x4556a0]
lea ecx, [esp + 0x20]
sub esi, eax
push ecx
sub esi, 0x205c4
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x455690], esi
call fcn.00407060
mov ecx, dword [0x45568c]
mov esi, dword [0x455690]
mov eax, 0x1784740b
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
imul esi, esi, 0xdc98b
imul ecx, ecx, 0x8a933
sub esi, eax
add esi, ecx
mov ecx, dword [0x455694]
mov edx, ecx
imul edx, edx, 0x205c4
add esi, edx
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [esp + 8]
push esi
mov dword [0x45569c], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x40748d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x416310
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x456fc0]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x416432
lea ecx, [esp + 8]
call fcn.004161f0
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x416436
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x4163e0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00416310
mov edi, eax
test edi, edi
jne 0x41645a
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x4163a2
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4163f9
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416418
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.0042909d
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x416441
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.0042909d
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416469
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.0042909d
add esp, 0x118
ret 4
Function at 0x416940
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x416952
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x41a2b0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [0x45568c]
push esi
imul ebx, ebx, 0x6e7be
mov esi, dword [0x45569c]
mov eax, 0x948af151
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3b1784cb
imul dword [0x455694]
sar edx, 0x11
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [0x455690]
mov eax, 0xcccc28f7
imul ebx
push edi
mov edi, dword [0x4556a8]
imul edi, edi, 0xcecf4
add edx, ebx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [esp + 0x14]
add ecx, edi
cmp eax, 0x132b600
mov dword [esp + 0xc], edi
mov dword [str._r_____r____], ecx
je 0x41a351
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
jmp 0x41a340
push 0x3e8
call edi
dec esi
jne 0x41a340
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [0x4556a4]
mov edi, dword [0x4556a0]
mov eax, 0x1784740b
imul edx
push ebp
sar edx, 0xf
mov ebp, edi
imul ebp, ebp, 0xfff23675
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x3b1db3af
imul esi
sar edx, 0x11
add ebp, edx
mov eax, edx
mov edx, ebx
imul edx, edx, 0x205c4
shr eax, 0x1f
add eax, ebp
sub eax, edx
add eax, ecx
mov ecx, dword [0x455688]
add ecx, eax
mov eax, dword [0x56977c]
mov edx, eax
inc eax
test edx, edx
mov dword [0x455688], ecx
mov dword [0x56977c], eax
pop ebp
jle 0x41a40a
mov eax, 0x30f1b28f
imul edi, edi, 0x6e7be
imul dword [0x45568c]
mov esi, dword [esp + 0xc]
sar edx, 0x10
add edi, edx
mov ecx, edx
mov eax, 0x3b1784cb
imul ebx
sar edx, 0x11
shr ecx, 0x1f
add ecx, edi
mov eax, edx
shr eax, 0x1f
add ecx, edx
mov edx, dword [0x455694]
add eax, ecx
sub eax, esi
sub eax, edx
pop edi
add eax, 0xbae2b
pop esi
mov dword [0x45568c], eax
mov eax, 1
pop ebx
pop ecx
ret
mov eax, 0x57ab2ce3
imul ecx, ecx, 0x5715a
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [0x4556a8]
imul eax, eax, 0xa0008
add ecx, eax
mov eax, 0xcccc28f7
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, edi
sub ecx, 0x205c4
mov dword [0x455690], ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x419d90
push 0
push 0
mov dword [0x5694a8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x455698]
mov edx, dword [0x45568c]
imul esi, esi, 0x5715a
mov ecx, dword [0x45569c]
imul edx, edx, 0x6e7be
add esi, edx
mov eax, 0x30f1b28f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
imul ecx, ecx, 0x8aa1b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [0x4556a4]
pop edi
lea edx, [ecx + esi - 0x205c4]
pop esi
mov dword [0x455694], edx
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x41edd0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [0x455698]
push ebx
push esi
push edi
mov edi, dword [0x455694]
mov eax, 0x3b1784cb
imul edi
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x9e71fdc9
imul ecx
add edx, ecx
mov ecx, dword [0x4556a8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x944b09c1
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a0]
sub ebx, eax
imul edx, edx, 0x53aff
mov eax, ecx
imul eax, eax, 0x205c4
add ebx, edx
sub ebx, eax
mov eax, dword [esp + 0x10]
sub ebx, esi
cmp eax, 0x132b600
mov dword [0x455698], ebx
je 0x41eeb8
mov edx, dword [0x45568c]
imul ecx, ecx, 0xcecf4
mov edi, dword [0x45569c]
imul edx, edx, 0x6e7be
add ecx, edx
mov eax, 0x948af151
imul edi
add edx, edi
mov edi, dword [0x455690]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0xcccc28f7
imul edi
add edx, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
mov dword [str._r_____r____], ecx
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x41eea8
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov esi, dword [0x45568c]
mov ebx, dword [0x455690]
mov eax, 0x1784740b
imul ebx, ebx, 0xdc98b
imul esi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, esi
imul edx, edx, 0x8a933
mov eax, edi
imul eax, eax, 0x205c4
sub ebx, ecx
add ebx, edx
add ebx, eax
mov eax, 0xcccc28f7
imul edi
mov eax, dword [0x56949c]
add edx, edi
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
test eax, eax
mov dword [0x45569c], ecx
jne 0x41efef
mov edi, dword [0x455688]
mov eax, 0x948af151
imul edi, edi, 0x53aff
imul ecx
add edx, ecx
imul ecx, ecx, 0x8aa1b
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3b1784cb
imul esi
add edi, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x4556a4]
mov eax, 0xcccc28f7
imul ecx
add edx, ecx
lea ecx, [esp + 0x10]
push ecx
push 0
sar edx, 0x13
push 0
mov eax, edx
shr eax, 0x1f
push 0x41d840
add eax, edx
push 0
sub edi, eax
push 0
mov dword [0x4556a4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [0x455698]
mov edx, dword [0x45568c]
imul esi, esi, 0x5715a
mov ecx, dword [0x45569c]
imul edx, edx, 0x6e7be
mov dword [0x56948c], eax
add esi, edx
mov eax, 0x30f1b28f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
imul ecx, ecx, 0x8aa1b
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, dword [0x4556a4]
lea edx, [ecx + esi - 0x205c4]
mov dword [0x56949c], 1
mov dword [0x455694], edx
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x420268
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4202bb
call fcn.00440e15
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4202bb
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4202b1
xor eax, eax
jmp 0x4203d4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4202eb
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4202eb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4203d1
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x420318
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00420a0c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4203d1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x420361
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x420361
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x42035b
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00420a0c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4203c1
and dword [ebp + 0xc], 0
jmp 0x4203c1
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4203c1
push 0xc
call fcn.0043ad17
mov esi, eax
test esi, esi
pop ecx
je 0x4203a3
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4203a5
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4203bc
push dword [ebp - 8]
call fcn.0043676a
jmp 0x4203c1
call fcn.00436741
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x420326
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4295bd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4295dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042b88c
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x429600
test byte [esp + 8], 2
je 0x429600
call fcn.0042b87a
mov dword [eax], 0xd
call fcn.0042b883
mov dword [eax], 5
jmp 0x4295d9
xor eax, eax
ret