joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8056a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x80581c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6638d0]
call fcn.00664edc
mov dword [ebp - 0x10], eax
mov eax, dword [0x830bd4]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 0x10]
call fcn.00694f2c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6528f0]
call fcn.006530b4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00674c88
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x14]
call fcn.006557ac
mov edx, 0x805834
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x805894
mov eax, dword [ebp - 0x14]
call fcn.00655878
mov edx, dword [ebp - 4]
call fcn.00684ef4
mov eax, dword [ebp - 8]
call fcn.00405624
mov edx, 5
sub edx, eax
test edx, edx
jle 0x80576f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 1
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x8058ac
call fcn.00405670
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x805757
fild dword [ebp - 0xc]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea edx, [ebp - 0x20]
mov eax, 0x8058b8
call fcn.0040c858
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.0040562c
mov eax, dword [ebp - 0x20]
push eax
mov edx, 0x8058c4
mov eax, dword [ebp - 0x14]
call fcn.00655878
pop edx
call fcn.00685568
mov eax, dword [ebp - 0x14]
call fcn.004e4f3c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
jle 0x8057d6
mov edx, 0x8058c4
mov eax, dword [ebp - 0x14]
call fcn.004e61b4
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
jmp 0x8057de
mov eax, dword [ebp + 8]
call fcn.00405364
mov eax, dword [ebp - 0x14]
call fcn.004e4f48
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x14]
call fcn.00404414
mov eax, dword [ebp - 0x10]
call fcn.00404414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x805823
lea eax, [ebp - 0x20]
call fcn.00405364
lea eax, [ebp - 8]
call fcn.00405364
ret
Function at 0x8058d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6638d0]
call fcn.00664edc
mov dword [ebp - 0xc], eax
mov eax, dword [0x830bd4]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 0xc]
call fcn.00694f2c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6528f0]
call fcn.006530b4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00674c88
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.006557ac
mov edx, 0x805994
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x8059e8
mov eax, dword [ebp - 0x10]
call fcn.00655878
mov edx, dword [ebp - 4]
call fcn.00684ef4
mov eax, dword [ebp - 0x10]
call fcn.004e4f3c
mov edx, 0x805a00
mov eax, dword [ebp - 0x10]
call fcn.004e61b4
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x10]
call fcn.004e4f48
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.00404414
mov eax, dword [ebp - 0xc]
call fcn.00404414
mov esp, ebp
pop ebp
ret

Function at 0x805a0c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6638d0]
call fcn.00664edc
mov dword [ebp - 0xc], eax
mov eax, dword [0x830bd4]
mov edx, dword [eax + 0x36c]
mov eax, dword [ebp - 0xc]
call fcn.00694f2c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6528f0]
call fcn.006530b4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00674c88
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 0x10]
call fcn.006557ac
mov edx, 0x805ad0
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x805b28
mov eax, dword [ebp - 0x10]
call fcn.00655878
mov edx, dword [ebp - 4]
call fcn.00684ef4
mov eax, dword [ebp - 0x10]
call fcn.004e4f3c
mov edx, 0x805b40
mov eax, dword [ebp - 0x10]
call fcn.004e61b4
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x10]
call fcn.004e4f48
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.00404414
mov eax, dword [ebp - 0xc]
call fcn.00404414
mov esp, ebp
pop ebp
ret
Function at 0x809bd8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405814
xor eax, eax
push ebp
push 0x809d79
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x809d90
call fcn.004053fc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x809c81
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0070b7ac
test al, al
je 0x809c79
push dword [ebp - 0x14]
push 0x809dc4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [eax + 4]
lea edx, [ebp - 0x20]
call fcn.0040ab00
push dword [ebp - 0x20]
push 0x809dd8
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004056e4
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x809c31
mov eax, dword [ebp - 0x14]
call fcn.00405624
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 1
call fcn.004058c4
mov eax, dword [ebp - 0x14]
call fcn.00405624
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 1
call fcn.004058c4
mov eax, dword [ebp - 0x14]
call fcn.00405624
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 1
call fcn.004058c4
lea eax, [ebp - 0x14]
mov edx, 0x809de4
call fcn.0040562c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
call fcn.006557ac
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov edx, 0x809e20
call fcn.00655878
mov edx, dword [ebp - 8]
call fcn.00685568
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
call fcn.004e4f3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 0xd]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
call fcn.004e4f48
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a8]
mov edx, dword [eax]
call dword [edx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x809d80
lea eax, [ebp - 0x20]
call fcn.00405364
lea eax, [ebp - 0x14]
call fcn.00405364
lea eax, [ebp - 8]
call fcn.00405364
ret
Function at 0x81ad28
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00405814
xor eax, eax
push ebp
push 0x81adff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]

Function at 0x81b2d4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00405814
xor eax, eax
push ebp
push 0x81b3bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]
call fcn.006557ac
mov edx, 0x81b3d4
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]
mov edx, 0x81b410
call fcn.00655878
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
call fcn.00685568
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]
call fcn.004e4f3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax]
call dword [edx + 0x14c]
test eax, eax
setg byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x81b391
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]
mov edx, 0x81b424
call fcn.004e61b4
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004053b8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x374]
call fcn.004e4f48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81b3c4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405388
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401030
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401059
xor eax, eax
pop esi
pop ecx
ret 4
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 8]
push ecx
push 0x1000000
push edx
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4

Function at 0x401090
Capabilities:
Get common file path

Disassembly:
sub esp, 0x824
mov eax, dword [0x467be8]
xor eax, esp
mov dword [esp + 0x820], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x216]
push edi
push eax
mov word [esp + 0x21c], di
call fcn.0043a940
push 0x206
lea ecx, [esp + 0x1a]
push edi
push ecx
mov word [esp + 0x20], di
call fcn.0043a940
push 0x206
lea edx, [esp + 0x436]
push edi
push edx
mov word [esp + 0x43c], di
call fcn.0043a940
push 0x206
lea eax, [esp + 0x64a]
push edi
push eax
mov word [esp + 0x650], di
call fcn.0043a940
add esp, 0x30
lea ecx, [esp + 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x104
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x218]
push eax
call esi
push 0x104
lea ecx, [esp + 0x41c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea edx, [esp + 0x624]
push edx
lea eax, [esp + 0x420]
push eax
call esi
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401170
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x624]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.004393b5
mov ecx, dword [esp + 0x834]
add esp, 0xc
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
add eax, 1
call fcn.00439112
add esp, 0x824
ret
Function at 0x4011c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45025b
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x467be8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401090
test eax, eax
je 0x401208
push 0
push 0x45a980
push 0x45a990
jmp 0x401393
push 0x1000000
call fcn.00405c55
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x401383
push 0x1000000
push 0
push ebx
call fcn.0043a940
push 0x206
lea eax, [ebp - 0x216]
push 0
push eax
mov word [ebp - 0x218], 0
call fcn.0043a940
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x218]
push edx
call edi
push str.BossKeyHelper.dat
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x226
lea ecx, [ebp - 0x43e]
push 0
push ecx
mov word [ebp - 0x440], 0
call fcn.0043a940
add esp, 0xc
push 0x104
lea edx, [ebp - 0x440]
push edx
push 0
call esi
lea eax, [ebp - 0x440]
push eax
call edi
push str.BossKeyHelper.dll
lea ecx, [ebp - 0x440]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [ebp - 0x218]
push edx
call esi
test eax, eax
je 0x401387
lea eax, [ebp - 0x440]
push eax
call esi
test eax, eax
je 0x401387
push ebx
lea eax, [ebp - 0x218]
call fcn.00401030
mov edi, eax
push edi
push ebx
call fcn.00403c80
add esp, 8
lea esi, [ebp - 0x474]
call fcn.00401ba0
push edi
mov ecx, esi
push ecx
mov dword [ebp - 4], 0
call fcn.00401f10
test eax, eax
je 0x401371
push ebx
call fcn.00405c5a
add esp, 4
call fcn.00405b80
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x444], eax
push 0
push 1
push dword [ebp - 0x444]
call dword [ebp - 0x448]
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00401c10
jmp 0x40139b
lea ecx, [ebp - 0x474]
mov dword [ebp - 4], 0xffffffff
call fcn.00401c10
xor eax, eax
jmp 0x4013a0
push 0
push 0x45a980
push 0x45aa40
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439112
mov esp, ebp
pop ebp
ret
Function at 0x401db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 0xc]
sub esp, 0x2c
test edx, edx
push ebx
push esi
push edi
jne 0x401dce
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp word [edx], 0x5a4d
jne 0x401dc3
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x401dc3
mov esi, dword [eax + 0x80]
test esi, esi
jne 0x401dfa
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + edx + 0x10]
add esi, edx
test ecx, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
je 0x401ef8
mov eax, dword [esi + 0xc]
add eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [esi]
add ecx, edx
test eax, eax
lea edi, [eax + edx]
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], ecx
jne 0x401e36
mov dword [esp + 0x10], ecx
mov edi, ecx
cmp dword [edi], 0
mov dword [esp + 0x14], 0
je 0x401ee6
mov eax, edi
xor edi, edi
jmp 0x401e50
mov eax, dword [eax]
mov ecx, eax
and ecx, 0x80000000
xor ebx, ebx
xor esi, esi
cmp ecx, 0x80000000
jne 0x401e6f
and eax, 0x7fffffff
mov ebx, eax
jmp 0x401e7b
test eax, eax
je 0x401f00
lea esi, [eax + edx + 2]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401f00
test ebx, ebx
mov ecx, ebx
jne 0x401e92
mov ecx, esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401f00
mov ecx, dword [esp + 0x24]
mov ebx, dword [ebp + 8]
add ecx, edi
lea edx, [esp + 0x28]
push edx
add ebx, 0x18
lea edi, [esp + 0x30]
mov dword [ecx], eax
mov dword [esp + 0x2c], ecx
call fcn.00402260
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0xc]
add eax, 1
mov dword [esp + 0x14], eax
lea edi, [eax*4]
mov eax, dword [esp + 0x10]
add eax, edi
cmp dword [eax], 0
jne 0x401e50
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x24]
add esi, 0x14
test ecx, ecx
mov dword [esp + 0x18], esi
jne 0x401e14
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403c80
Capabilities:
Encode data using xor
Hash data with md5
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x467be8]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
mov ebp, dword [esp + 0x88]
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
mov eax, str.8EBA9960_22CD_4acb_BECE_7762272864DC
mov byte [esp + 0x10], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x403cd8
sub eax, ecx
push str.8EBA9960_22CD_4acb_BECE_7762272864DC
lea ecx, [esp + 0x34]
mov ebx, eax
mov dword [esp + 0x34], 0x67452301
mov dword [esp + 0x38], 0xefcdab89
mov dword [esp + 0x3c], 0x98badcfe
mov dword [esp + 0x40], 0x10325476
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call fcn.00403a10
lea eax, [esp + 0x14]
push eax
lea esi, [esp + 0x38]
call fcn.00403b30
xor eax, eax
add esp, 8
cmp dword [esp + 0x94], eax
jle 0x403e1b
jmp 0x403d42
xor eax, eax
lea ecx, [edi + ebp]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
push ecx
mov eax, 0x10
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0x67452301
mov dword [esp + 0x38], 0xefcdab89
mov dword [esp + 0x3c], 0x98badcfe
mov dword [esp + 0x40], 0x10325476
call fcn.00403a10
push str.8EBA9960_22CD_4acb_BECE_7762272864DC
mov eax, ebx
lea ecx, [esp + 0x38]
call fcn.00403a10
lea edx, [esp + 0x18]
push edx
mov eax, 0x10
lea ecx, [esp + 0x3c]
call fcn.00403a10
lea eax, [esp + 0x2c]
push eax
lea esi, [esp + 0x40]
call fcn.00403b30
add esp, 0x10
xor eax, eax
lea ecx, [edi + ebp + 1]
jmp 0x403dc0
movzx edx, byte [esp + eax + 0x10]
xor byte [ecx + eax - 1], dl
movzx edx, byte [esp + eax + 0x11]
xor byte [ecx + eax], dl
movzx edx, byte [esp + eax + 0x12]
xor byte [ecx + eax + 1], dl
movzx edx, byte [esp + eax + 0x13]
xor byte [ecx + eax + 2], dl
add eax, 4
cmp eax, 0x10
jl 0x403dc0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
add edi, 0x10
cmp edi, dword [esp + 0x94]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jl 0x403d40
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00439112
add esp, 0x7c
ret
Function at 0x404770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x462f90
push 0x439e90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x467be8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 1
jne 0x404840
mov edi, dword [esi]
and edi, 0xf0000000
lea eax, [edi + 0x10000000]
mov dword [ebp - 0x24], eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp edi, eax
jae 0x4047f5
lea ecx, [ecx]
push 0x40
push 0x2000
push 0xe
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4047f5
add edi, 0x1000
cmp edi, dword [ebp - 0x24]
jb 0x4047d0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4048af
push 0x40
push 0x1000
push 0xe
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov dword [esi + 0xc], eax
test eax, eax
je 0x4048af
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4048af
mov byte [eax], 0x68
mov dword [eax + 1], ecx
mov dword [eax + 5], 0x42444c7
mov ecx, dword [ebp - 0x24]
mov dword [eax + 9], ecx
mov byte [eax + 0xd], 0xc3
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x20]
push edx
push 0x40
mov eax, dword [esi + 0x54]
push eax
mov ecx, dword [esi]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
cmp eax, ebx
je 0x4048af
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.00404b60
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [esi + 0x54]
push edx
mov eax, dword [esi]
push eax
call edi
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
push 0x45b64c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x405bb7
push 0x45b64c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
jne 0x405bb7
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x45b668
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, edi
je 0x405baf
mov dword [0x46c188], eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x58
push 0x46c188
mov dword [0x46c18c], 0x405b30
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x405baf
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov esi, 0x46c188
lea edi, [esp + 0x10]
call fcn.00404720
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4083dc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x408422
call fcn.0041f859
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x408422
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x408465
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40844e
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40844e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x408462
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40a267
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x44f9d7
call fcn.0043a3ed
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40a28c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40a2d8
call fcn.00420e33
push eax
lea ecx, [ebp - 0x10]
call fcn.00406ebb
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409b8a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00405c98
mov eax, esi
call fcn.0043a4c5
ret 8

Function at 0x40afae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0041f859
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40afe5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040abd0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8