joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a5bd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor esi, esi
mov ebx, edx
push esi
push esi
push 0x40a224
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [edi], eax
test eax, eax
jne 0x41a5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41a5f0
movzx esi, si
or esi, 0x80070000
and dword [ebx], 0
jmp 0x41a68e
push 0x40a23c
push eax
mov dword [ebx], 1
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 4], eax
test eax, eax
je 0x41a689
push 0x40a24c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 8], eax
test eax, eax
je 0x41a689
push 0x40a25c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x10], eax
test eax, eax
je 0x41a689
push 0x40a278
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0xc], eax
test eax, eax
je 0x41a689
push 0x40a28c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x14], eax
test eax, eax
je 0x41a689
push 0x40a29c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x18], eax
test eax, eax
je 0x41a689
push 0x40a2b8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x41a68e
mov esi, 0x8007007f
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x41a8cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push esi
push 0x40a2cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [edi], eax
test eax, eax
jne 0x41a8f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x41a970
push 0x7e
jmp 0x41a96f
push 0x40a2e4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 4], eax
test eax, eax
je 0x41a96d
push 0x40a2f4
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 8], eax
test eax, eax
je 0x41a96d
push 0x40a304
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0xc], eax
test eax, eax
je 0x41a96d
push 0x40a318
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x10], eax
test eax, eax
je 0x41a96d
push 0x40a324
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x14], eax
test eax, eax
je 0x41a96d
push 0x40a338
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x41a98d
push 0x7f
pop esi
cmp dword [edi], 0
je 0x41a980
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [edi], 0
test esi, esi
jle 0x41a98d
movzx esi, si
or esi, 0xc0070000
pop edi
mov eax, esi
pop esi
ret
Function at 0x41af2a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
test ecx, ecx
je 0x41afcf
test ebx, ebx
je 0x41afcf
xor edx, edx
call fcn.0041bb15
mov edi, eax
test edi, edi
je 0x41af8e
xor edx, edx
mov ecx, ebx
call fcn.0041bb15
mov esi, eax
test esi, esi
je 0x41af8e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41af7b
mov ecx, esi
call fcn.0041b5fc
push dword [ebp + 8]
mov edx, esi
mov ecx, edi
sub esp, 0xc
call fcn.0041afe0
mov ebx, eax
jmp 0x41af91
mov ebx, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test edi, edi
je 0x41afae
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x41afc2
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x41afd9
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41afe0
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, ecx
xor edi, edi
test dword [ebp + 0x14], 0xffffffe0
mov ebx, edx
mov dword [ebp - 0x10], eax
je 0x41b00c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41b182
mov esi, dword [ebp + 0x14]
and esi, 1
test dword [ebp + 0x14], 8
je 0x41b021
or esi, 0x1000
xor edx, edx
call fcn.0041bb15
mov dword [ebp - 0x18], eax
test eax, eax
je 0x41b180
xor edx, edx
mov ecx, ebx
call fcn.0041bb15
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41b157
xor eax, eax
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 0
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov edi, eax
test edi, edi
jne 0x41b0dc
test dword [ebp + 0x14], 2
je 0x41b0d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [ebp - 4]
lea edx, [ebp - 8]
and dword [ebp - 8], edi
and dword [ebp - 0xc], edi
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
mov ecx, eax
call fcn.0041b189
test eax, eax
je 0x41b09e
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x41b0d8
mov edi, dword [ebp - 0xc]
jmp 0x41b0a9
cmp dword [ebp - 4], 2
jae 0x41b0d8
mov edi, 0xbb8
push edi
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
push 0x40a410
push 0x4000000
push 0x42c454
call fcn.0041aebe
add esp, 0x1c
test edi, edi
je 0x41b04c
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41b04c
test edi, edi
je 0x41b157
test dword [ebp + 0x14], 4
je 0x41b157
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
test edi, edi
jne 0x41b157
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x41b106
push 0x1f
pop esi
push esi
push ebx
push 0x40a4a8
push 0x2000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
mov ecx, ebx
call fcn.0041b5fc
test eax, eax
jne 0x41b150
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41b137
push 0x1f
pop eax
push eax
push ebx
push 0x40a548
push 0x2000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41b180
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x41b9b6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push edi
xor edi, edi
test ecx, ecx
je 0x41ba22
xor eax, eax
cmp ax, word [ecx]
je 0x41ba22
push ebx
xor edx, edx
call fcn.0041bb15
mov ebx, eax
test ebx, ebx
je 0x41ba1d
push esi
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41b9ea
test al, 0x10
je 0x41b9ea
inc edi
jmp 0x41ba05
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x41b9fd
mov esi, 0x10b
cmp esi, 2
jne 0x41ba05
push 3
pop esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
mov eax, edi
pop edi
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
ret

Function at 0x41ba2e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
test ecx, ecx
je 0x41bb06
xor eax, eax
cmp ax, word [ecx]
je 0x41bb06
xor edx, edx
call fcn.0041bb15
mov edi, eax
test edi, edi
je 0x41bb0e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41bae3
test eax, 0x800
je 0x41bade
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41bae3
push esi
push 0x80
push 3
push esi
push 7
push 0xc0010000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x41bae3
xor ecx, ecx
xor edx, edx
push edx
mov word [ebp - 4], cx
lea ecx, [ebp - 0xc]
push ecx
push edx
push edx
push 2
lea ecx, [ebp - 4]
push ecx
push 0x9c040
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41bacb
inc ebx
jmp 0x41bad3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41baeb
xor ebx, ebx
inc ebx
jmp 0x41baeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x41bb10
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bd34
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
cmp ax, word [esi]
jne 0x41bd62
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41beb9
push ebx
lea edx, [ebp - 4]
call fcn.0041bb15
mov ebx, eax
test ebx, ebx
je 0x41bea6
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push ecx
push eax
mov ecx, ebx
call fcn.0041bf7d
test eax, eax
js 0x41be68
cmp dword [ebp - 8], 1
push 0x5c
pop ecx
jne 0x41be08
mov edx, dword [ebp - 0xc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x41bda5
mov eax, dword [ebp - 4]
sub ecx, esi
sar ecx, 1
lea esi, [eax + ecx*2]
test edx, edx
je 0x41bdd0
push edx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x5c
pop ecx
xor edi, edi
push ecx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
mov ecx, ebx
test esi, esi
je 0x41be36
xor eax, eax
mov word [esi], ax
call fcn.0041b9b6
test eax, eax
jne 0x41bdfd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop ecx
mov word [esi], cx
add esi, 2
jmp 0x41bdd5
mov esi, dword [ebp - 4]
movzx eax, word [esi]
cmp eax, 0x61
jb 0x41be18
cmp eax, 0x7a
jbe 0x41be22
cmp eax, 0x41
jb 0x41bdd3
cmp eax, 0x5a
ja 0x41bdd3
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x41bdd3
cmp cx, word [esi + 4]
jne 0x41bdd3
add esi, 8
jmp 0x41bdd3
call fcn.0041b9b6
xor esi, esi
inc esi
cmp eax, esi
je 0x41be63
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x41be63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push dword [ebp - 0x1c]
push 0x40a950
jmp 0x41be81
mov dword [ebp - 0x10], esi
jmp 0x41be93
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push esi
push 0x40a9b0
push 0x3000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41beae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x421f4f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00421668
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
invalid
test dword [esi - 4], eax

Function at 0x4222b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sal byte [eax + 0x5b], cl
movsb byte es:[edi], byte [esi]
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
invalid

Function at 0x424e04
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 8]
cmp dword [ecx], 6
push edi
mov dword [esp + 0xc], ebx
push eax
jne 0x424e27
call fcn.0041ddad
jmp 0x424e2f
push dword [ebp + 0xc]
call fcn.00423d29
mov esi, eax
test esi, esi
js 0x424ec5
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x424e3f
mov eax, dword [esp + 0xc]
sub ecx, edx
sar ecx, 1
mov ebx, dword [eax + 8]
mov eax, dword fs:[0x30]
lea edi, [ecx*2 + 2]
add ebx, 0xc
add ebx, edi
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x424e82
mov esi, 0xc000009a
xor ebx, ebx
jmp 0x424ec5
mov dword [esi], 1
mov dword [esi + 8], 5
mov dword [esi + 4], ebx
mov eax, dword [esp + 0xc]
push dword [eax + 8]
push eax
lea eax, [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x18]
push edi
push dword [ebp + 8]
mov eax, dword [eax + 8]
add eax, 0xc
add eax, esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0x18
xor ebx, ebx
mov dword [eax], esi
mov esi, ebx
cmp dword [esp + 0xc], 0
je 0x424ee1
push dword [esp + 0xc]
mov ecx, dword fs:[0x30]
push ebx
push dword [ecx + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000f8fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008c140]
jne 0x1000f906
repz ret
jmp fcn.1000fbad

Function at 0x10011260
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [0x1008c11c], 0x252d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [0x1008c120]
add eax, 0x253
mov dword [0x1008c11c], eax
mov dword [ebp - 0xc], 0
jmp 0x100112d9
jmp 0x100112cf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x100112d9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x1001131b
jmp 0x1001131d
jmp 0x100113c8
jmp 0x100113c1
cmp dword [ebp - 0xc], 0x104
jl 0x100112bc
jmp 0x100112fa
jmp 0x100112a7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + eax*2 - 0x18]
cmp eax, 0x6f
je 0x10011329
jmp 0x100112cf
mov dword [0x1008c120], 0x1ac
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x100112e6
jmp 0x100113c8
jmp 0x100112fa
mov dword [0x1008c11c], 0xbea
jmp 0x100112a9
mov dword [0x1008c120], 0x198f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x100112a7
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x100112e4
mov eax, dword [0x1008c11c]
sub eax, 0x1325
mov dword [0x1008c11c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x100113c3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x100113c1
mov dword [0x1008c11c], 0x23b8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x100112d4
mov dword [0x1008c120], 0xc8
mov dword [ebp - 0x10], 1
jmp 0x100113d1
jmp 0x100113c3
jmp 0x100112e4
mov dword [ebp - 0x10], 0
jmp 0x100113d1
mov eax, dword [ebp - 0x10]
add esp, 0x14
pop ebp
ret

Function at 0x100115d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.100115d0]
mov dword [ebp - 4], eax
jmp 0x100115e3
jmp 0x10011613
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100115fa
jmp 0x10011613
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10011641
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x100115f2
jmp 0x100115e1
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov eax, dword [0x1008c11c]
sub eax, 0x362
mov dword [0x1008c11c], eax
mov al, 1
test al, 1
jne 0x100115e3
jmp 0x1001163a
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 0xc
pop ebp
ret
Function at 0x41b328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41b442
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409938
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41b371
push ebx
mov eax, edi
call fcn.0040a944
push eax
push esi
call sub.kernel32.dll_FindResourceW
mov ebx, eax
jmp 0x41b3de
movzx eax, bl
cmp ebx, eax
jne 0x41b39b
push ebx
lea eax, [ebp - 4]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 4]
call fcn.0040a3a8
push eax
push esi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
jmp 0x41b3de
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040a9ac
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 8]
call fcn.0040a3a8
push eax
lea eax, [ebp - 0x10]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x10]
call fcn.0040a3a8
push eax
push esi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x41b417
push ebx
push esi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x41b417
push 0
push ebx
push esi
call sub.kernel32.dll_SizeofResource
push eax
push edi
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp + 8]
pop ecx
call fcn.00409af0
mov eax, edi
call fcn.004120c4
push edi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b449
lea eax, [ebp - 0x10]
call fcn.00409938
lea eax, [ebp - 0xc]
call fcn.00409914
lea eax, [ebp - 8]
mov edx, 2
call fcn.004099a4
ret
Function at 0x41eee4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x41f02e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x41ef0c
cmp dword [ebx + 4], 0
jne 0x41f02e
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x41ef32
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x41ef32
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
push 0
push 0x100000
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
push edx
push eax
call fcn.0041ee38
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x41f02e
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
jne 0x41efe1
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x41ef87
push 4
push 0x1000
push 0x100000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push dword [ebx + 0xc]
push dword [ebx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor ecx, ecx
xor edx, edx
call fcn.0041ee78
test al, al
je 0x41efd7
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x41efd7
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 4]
jne 0x41efd7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
jmp 0x41efff
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x20], edx
jmp 0x41efff
push dword [ebx + 0xc]
push dword [ebx + 8]
mov ecx, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, 4
call fcn.0041eecc
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x41f02e
mov ecx, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
call fcn.0042312c
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov dword [edx], eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41f3f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x24]
sub esi, dword [ebx + 0x5c]
sub esi, dword [ebx + 0x54]
test esi, esi
jne 0x41f429
cmp dword [ebx + 0x54], 0
jne 0x41f429
cmp dword [ebx + 0x5c], 0
jne 0x41f429
mov esi, dword [ebp - 8]
jmp 0x41f4d4
cmp esi, 0xffffffff
jne 0x41f434
dec esi
jmp 0x41f4d4
mov eax, dword [ebx + 0x54]
mov edx, dword [ebp - 8]
sub edx, 0x106
add edx, dword [ebp - 8]
cmp eax, edx
jb 0x41f4d4
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 8]
lea edx, [eax + edx]
mov ecx, dword [ebp - 8]
xchg edx, eax
call fcn.0040690c
mov eax, dword [ebp - 8]
sub dword [ebx + 0x58], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x54], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x2c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x41f496
movzx ecx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x41f49b
mov word [edx], 0
dec eax
test eax, eax
jne 0x41f478
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x28]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x41f4c7
movzx ecx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x41f4cc
mov word [edx], 0
dec eax
test eax, eax
jne 0x41f4a9
add esi, dword [ebp - 8]
mov ecx, dword [ebx]
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
push edx
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
cmp edx, dword [esp + 4]
jne 0x41f4f0
cmp eax, dword [esp]
pop edx
pop eax
je 0x41f55e
push ebp
mov eax, dword [ebx + 0x54]
add eax, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x20]
add edx, eax
mov eax, ecx
mov ecx, esi
call fcn.0041f384
pop ecx
add dword [ebx + 0x5c], eax
cmp dword [ebx + 0x5c], 3
jb 0x41f538
mov eax, dword [ebx + 0x54]
mov edx, dword [ebx + 0x20]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x30], eax
mov ecx, dword [ebx + 0x40]
shl eax, cl
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x20]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x3c]
mov dword [ebx + 0x30], eax
cmp dword [ebx + 0x5c], 0x106
jae 0x41f55e
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx + 0x18]
jne 0x41f408
cmp eax, dword [ecx + 0x14]
jne 0x41f408
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret