joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485830
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x48585e
lea ecx, [ecx]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x4ea938]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x485840
pop esi
ret

Function at 0x48a540
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push 0x14
mov dword [edi], 0
call fcn.00461c40
mov esi, eax
add esp, 8
test esi, esi
jne 0x48a564
pop edi
lea eax, [esi + 7]
pop esi
ret
cmp dword [0x509004], 0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
je 0x48a59b
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x470960
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004c9c2e
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x48a5ab
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x48a5c3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop ebp
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
ret
Function at 0x4a9e70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7880
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x50a0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov esi, 0x1000
mov dword [ebp - 4], ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4a9f24
lea eax, [ebp - 0x30]
push eax
push esi
push edi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x4a9f14
mov eax, dword [ebp - 0x30]
cmp esi, eax
jne 0x4a9f57
add esi, esi
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x4a9f14
lea ecx, [ebp - 0x30]
mov edi, eax
push ecx
push esi
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x4a9ee5
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf929
mov esp, ebp
pop ebp
ret
shr eax, 2
mov dword [ebp - 0x34], 0
test eax, eax
je 0x4aa036
mov esi, eax
jmp 0x4a9f70
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp dword [ebp + 0x10], eax
je 0x4a9fa7
lea eax, [ebp - 0x2c]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4a9fea
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ecx]
jne 0x4a9fea
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call fcn.004aa260
add esp, 8
test al, al
je 0x4a9fea
push dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
push eax
call fcn.004aa710
add esp, 8
test al, al
je 0x4a9fea
cmp ebx, dword [ebp - 0x40]
je 0x4a9fdd
mov eax, dword [edi]
mov dword [ebx], eax
add ebx, 4
mov dword [ebp - 0x44], ebx
jmp 0x4a9fea
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.004a9c40
mov ebx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4aa024
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa01a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa04c
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov ecx, dword [ebp - 0x34]
add edi, 4
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, esi
jl 0x4a9f70
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x40]
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x4a9f3b
call fcn.004c4cda
int3
Function at 0x4aa260
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x22c
mov eax, dword [0x50a0b0]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [esp + 0x230]
push esi
mov esi, dword [esp + 0x238]
push edi
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4aa3a7
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4aa3a0
push 0x104
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x10]
push edi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
je 0x4aa3a0
xor eax, eax
lea ecx, [esp + 0x10]
mov word [esp + 0x22e], ax
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.00402b20
mov ebx, eax
cmp esi, ebx
je 0x4aa376
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x4aa32e
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4aa324
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa3c0
mov eax, edx
push ecx
push eax
call fcn.004bf4bc
add esp, 8
mov dword [esi + 0x10], 0
xor eax, eax
mov word [esi], ax
mov dword [esi + 0x14], 7
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea ecx, [esp + 0x14]
call fcn.00403880
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004bf929
add esp, 0x22c
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x230]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004bf929
add esp, 0x22c
ret
call fcn.004c4cda
int3
Function at 0x4aa470
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7968
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x50a0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x30]
cmp ecx, eax
je 0x4aa4d3
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x4aa4c7
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040b6e0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], esi
push eax
push 0x4aa600
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
cmp edx, 8
jb 0x4aa525
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa51b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa541
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf929
mov esp, ebp
pop ebp
ret
call fcn.004c4cda
int3

Function at 0x4aa550
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push dword [esp + 0x20]
lea eax, [esp + 0x10]
push dword [esp + 0x20]
push eax
call fcn.004a9e70
mov ebx, dword [esp + 0x18]
add esp, 0xc
mov ebp, dword [esp + 0x10]
mov esi, ebx
cmp esi, ebp
je 0x4aa5b3
push edi
lea ebx, [ebx]
push dword [esi]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4aa5ab
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, ebp
jne 0x4aa580
pop edi
test ebx, ebx
je 0x4aa5e4
mov ecx, dword [esp + 0x14]
mov eax, ebx
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4aa5da
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aa5eb
push ecx
push ebx
call fcn.004bf4bc
add esp, 8
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call fcn.004c4cda
int3
Function at 0x4aa860
Capabilities:
Check os version

Disassembly:
sub esp, 0x51c
mov eax, dword [0x50a0b0]
xor eax, esp
mov dword [esp + 0x518], eax
push ebx
push esi
mov esi, dword [esp + 0x528]
lea eax, [esp + 0x120]
push edi
push 0x400
push 0
push eax
mov dword [esp + 0x18], esi
call fcn.004c2200
push 0x110
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004c2200
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x28]
add esp, 0x18
mov dword [esp + 0x10], 0x114
push eax
call edi
cmp dword [esp + 0x14], 6
ja 0x4aa8d6
jne 0x4aa8cf
cmp dword [esp + 0x18], 1
ja 0x4aa8d6
mov ebx, 2
jmp 0x4aa8db
mov ebx, 3
push 0x110
lea eax, [esp + 0x18]
push 0
push eax
call fcn.004c2200
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call edi
cmp dword [esp + 0x14], 6
ja 0x4aa912
jne 0x4aa90e
cmp dword [esp + 0x18], 1
ja 0x4aa912
xor edi, edi
jmp 0x4aa917
mov edi, 0x20
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x4aa96c
push eax
push str.CoInitializeEx_failed:__x
lea eax, [esp + 0x12c]
push 0x400
push eax
call fcn.004a0800
lea ecx, [esp + 0x134]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
add esp, 0x10
mov byte [esi], 0
jmp 0x4aa960
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa960
jmp 0x4aa9f7
push 0
push edi
push 0
push ebx
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x4aa9cb
push eax
push str.CoInitializeSecurity_failed:__x
lea eax, [esp + 0x12c]
push 0x400
push eax
call fcn.004a0800
add esp, 0x10
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x124]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa9c2
jmp 0x4aa9f7
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x124]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4aa9f0
sub ecx, edx
lea eax, [esp + 0x124]
push ecx
push eax
mov ecx, esi
call fcn.0040b5f0
mov ecx, dword [esp + 0x524]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bf929
add esp, 0x51c
ret

Function at 0x4d9c83
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d9c05
Function at 0x4a7417
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xfb83743c
mov dword [ebp + 4], eax
push 0x8537fb38
call 0x4a6e83
mov esi, 0x753468bc
movzx ecx, si
dec esp
mov esi, dword [edi + ecx*2 - 0xd178]
movsx ebp, cx
dec eax
lea edi, [edi + esi - 0x753468b4]
dec ebp
mov edi, esi
inc esp
mov edx, esi
dec eax
sal ecx, 0x57
jae 0x45bde8
mov cl, byte [eax]
cmc
cmp eax, esp
cmp cl, 0xe1
jmp 0x4eb738

Function at 0x4cf4a6
Capabilities:
Encode data using xor

Disassembly:
bswap edx
not word [esp + 0x18]
xor ebx, edx
sub ebp, 4
call fcn.00457021
test eax, 0xa0834bea
fnstsw word [ecx - 0x63f8bb25]
jp 0x4cf50a
push cs
jp 0x4cf4fa
mov bh, 0x92
sub ecx, dword [ecx + 0x3d318c]
call 0xff4d6afc
push esi
aaa
add ebp, dword [0xd5b82959]
inc edx
xor dword [ebx + esi*4 + 0x5b], 0xe32674cb
invalid
push ecx
inc eax
or dword [edi], 0xbd485505
popfd
inc esi
xchg ebx, eax
in al, dx
sbb byte [ecx], 0xa8
fimul dword [eax - 0x75]
insb byte es:[edi], dx
and al, 0
dec eax
mov ebp, dword [esp]
dec eax
mov dword [esp], 0x5ff62495
call fcn.004adedb
ret

Function at 0x4eaacc
Capabilities:
Encode data using xor

Disassembly:
push eax
call fcn.0049d550
lodsb al, byte [esi]
mov edi, 0xa1d78db2
xor dh, byte [0x28715692]
push eax
push cs
test dword [edx - 0x22093ecb], ebx
mov eax, dword [edi]
fisub dword [ecx - 0x68d661db]
xor dword [edx + ebx*4 - 0x5e], 0xffffffc8
pop ebp
xor al, 0xe0
enter 0xffffffffffffcb74, 0xffffffffffffff9d
or esi, dword [ebp - 0x1356db8c]
lodsb al, byte [esi]
or esi, dword [ebp + 0xb1ffa74]
mov ch, 0x74
fld qword [ecx + ecx - 0x68cf8b4b]
jecxz 0x4eab66
push esp
or esi, dword [ebp - 0x370e948c]
mov edi, 0xaa4561dd
mov cl, 0x59
mov dword [0x7680212c], eax
xor byte [edx + ebx*2 + 0x2c116983], bh
cmp dword [esi], eax
adc dword [ecx + edi], ebp
push es
sahf
push esp
imul ebx, dword [eax + 0x4f95925], 0x9a375154
mov bl, 0xdb
push edi
sub bl, ch
test eax, 0x4e7b19b8
mov eax, dword [0x6f15b0b9]
inc esi
test eax, 0x75318899
or dl, byte [ecx - 0x2104c666]
loope 0x4eab11
fild word [edx + 0xb]
xchg esi, eax
jl 0x4eab9d
sbb byte [eax + 0x10], ah
adc dword [ebp + edi + 0x26102d19], 0xb50a1a1b
je 0x4eab29
sbb ebx, dword [edx]
or dh, byte [ebp - 0x12bf428c]
inc eax
in eax, dx
xchg edi, eax
scasb al, byte es:[edi]
inc ecx
imul esi, dword [eax - 0x33], 0x525cacf
or al, 0xc9
mov ebx, 0x51696986
or al, 0x68
push es
popfd
mov eax, 0xe3dae101
mov ebx, 0xf6575acb
cmp byte [ecx], bl
dec edx
xor al, 0x72
int1
sub cl, byte [ebx - 0x3bb31228]
or dh, byte [ebp - 0x3f1a738c]
in eax, 0xc0
daa
or esp, dword [edx - 0x69]
in eax, 0xe8
pop es
aas
test dword cs:[ebp + 0x565f6384], 0x436409d3
and byte [esi + 4], cl
adc dword [eax + 0x4d], 5
int3
Function at 0x100017ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000901c]
jne 0x100017d8
repz ret
jmp fcn.10001842
Function at 0x10002eff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1000901c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push edi
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 8], 0
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0xc], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10002f8f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExA
push edi
call esi
push str.RegQueryValueExA
push edi
mov dword [ebp - 0x18], eax
call esi
push str.RegCloseKey
push edi
mov dword [ebp - 0x30], eax
call esi
mov dword [ebp - 0x24], eax
pop esi
lea eax, [ebp - 0x1c]
push eax
push 0xf013f
push 0
push dword [ebp - 0x28]
push 0x80000002
call dword [ebp - 0x18]
pop edi
test eax, eax
jne 0x10002fcd
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x18], 0x190
push dword [ebp - 0x1c]
call dword [ebp - 0x30]
push dword [ebp - 0x1c]
call dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.100017ce
leave
ret
Function at 0x10003a79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x15c
mov eax, 0x100042d5
call fcn.10003f43
mov esi, 0x1000
push esi
xor ebx, ebx
call fcn.100017bc
mov dword [ebp - 0x148], eax
pop ecx
lea eax, [ebp - 0x168]
push eax
call fcn.10002a4f
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x18], 0x2e
mov byte [ebp - 0x19], 0x32
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x20], 0x4b
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
cmp eax, ebx
je 0x10003b5e
lea ecx, [ebp - 0x38]
push ecx
push eax
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x37], 0x33
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x35], 0x45
mov byte [ebp - 0x38], 0x4b
mov byte [ebp - 0x36], 0x32
mov byte [ebp - 0x2a], 0x4d
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x27], 0x75
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x34], 0x6e
mov byte [ebp - 0x32], 0x6d
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x31], 0x50
mov byte [ebp - 0x33], 0x75
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x2f], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
lea eax, [ebp - 0x150]
push eax
push esi
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
call ecx
test eax, eax
je 0x10003c75
test dword [ebp - 0x150], 0xfffffffc
mov dword [ebp - 0x144], ebx
jbe 0x10003c75
mov ecx, dword [ebp - 0x144]
push 0x104
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x148]
push dword [eax + ecx*4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10003c5a
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
xor edi, edi
lea ecx, [ebp - 0x168]
mov esi, eax
call fcn.10001b59
mov edx, eax
mov ecx, esi
call fcn.100030f3
test eax, eax
jne 0x10003be6
mov bl, 1
xor edi, edi
inc edi
lea ecx, [ebp - 0x168]
call fcn.10001b59
mov edx, eax
mov ecx, esi
call fcn.100030f3
test eax, eax
jne 0x10003c03
mov bl, 1
push 2
pop edi
lea ecx, [ebp - 0x168]
call fcn.10001b59
mov edx, eax
mov ecx, esi
call fcn.100030f3
test eax, eax
jne 0x10003c20
mov bl, 1
push 3
pop edi
lea ecx, [ebp - 0x168]
call fcn.10001b59
mov edx, eax
mov ecx, esi
call fcn.100030f3
test eax, eax
jne 0x10003c3d
mov bl, 1
push 4
pop edi
lea ecx, [ebp - 0x168]
call fcn.10001b59
mov edx, eax
mov ecx, esi
call fcn.100030f3
test eax, eax
jne 0x10003c5a
mov bl, 1
mov eax, dword [ebp - 0x150]
inc dword [ebp - 0x144]
shr eax, 2
cmp dword [ebp - 0x144], eax
jb 0x10003b92
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x148]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
or dword [ebp - 4], 0xffffffff
pop ecx
lea eax, [ebp - 0x168]
push eax
call fcn.100010e7
mov al, bl
call fcn.10003fc6
ret
Function at 0x4027d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4027e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402826
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402822
nop word [eax + eax]
cmp esi, edx
jae 0x402826
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402810
cmp esi, edx
jb 0x40282b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x41ef5b
Capabilities:
Get disk information

Disassembly:
push 0x268
mov eax, 0x5591b6
call fcn.005367ed
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
mov edi, dword [ebp + 0x10]
setne al
mov dword [ebp - 0x264], esi
test eax, eax
jne 0x41ef89
call fcn.0041c062
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x41ef84
lea eax, [ebp - 0x268]
push eax
push esi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x41efd1
push 0xffffffffffffffff
push ebx
push 0x104
push esi
call fcn.0053fcd1
push eax
call fcn.00402620
add esp, 0x14
push ebx
push edi
call fcn.0041ef2e
xor eax, eax
jmp 0x41f0f4
cmp eax, 0x104
jb 0x41efee
test edi, edi
je 0x41efca
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.00409e40
jmp 0x41efca
call fcn.0041c899
push eax
lea ecx, [ebp - 0x26c]
call fcn.00409c80
and dword [ebp - 4], 0
lea eax, [ebp - 0x26c]
push eax
push esi
call fcn.0041e876
mov esi, dword [ebp - 0x26c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x41f0e9
xor ecx, ecx
lea eax, [ebp - 0x270]
push ecx
push ecx
push eax
lea eax, [ebp - 0x274]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x41f059
push ebx
push edi
call fcn.0041ef2e
lea ecx, [esi - 0x10]
call fcn.00402870
jmp 0x41efca
mov eax, dword [ebp - 0x270]
test al, 2
jne 0x41f075
push dword [ebp - 0x264]
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, dword [ebp - 0x270]
test al, 4
jne 0x41f0e9
lea eax, [ebp - 0x260]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x41f0e9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x41f045
cmp eax, dword [ebp - 0x264]
jbe 0x41f045
lea eax, [ebp - 0x234]
push eax
call fcn.0053fcdc
mov edx, dword [ebp - 0x268]
sub edx, dword [ebp - 0x264]
sar edx, 1
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x41f0fc
lea eax, [ebp - 0x234]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x268]
call fcn.0053fdd6
push eax
call fcn.00402620
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.00402870
xor eax, eax
inc eax
call fcn.00536797
ret 0xc
test edi, edi
je 0x41f04c
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.00409e40
jmp 0x41f04c
Function at 0x422e41
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004232d5
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x422e7d
call fcn.00423060
mov dword [esi + 0xc], 1
jmp 0x422e82
call fcn.00423060
cmp dword [esi], 0
je 0x422ecb
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x422ea5
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0041ceaf
jmp 0x422eb6
push 0xff
mov ecx, esi
call fcn.00409b40
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0041ced2
jmp 0x422eef
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x422eef
push dword [esi]
push dword [ebp - 4]
call fcn.00423725
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422fb5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00423060
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x422ffd
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041ceaf
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0041ced2
jmp 0x423008
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00423725
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x423346
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x558f88
call fcn.005367b9
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x74], esi
jne 0x42336c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4233c0
call fcn.0041c899
push eax
lea ecx, [ebp - 0x10]
call fcn.00409c80
mov ecx, dword [edi + 0x74]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], esi
mov eax, dword [ecx]
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0053fcd1
push eax
call fcn.00402620
add esp, 0x14
test edi, edi
je 0x4233b3
push edi
call fcn.0053fcdc
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402870
mov eax, esi
call fcn.00536782
ret 8