joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ee30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x536af0]
xor edx, edx
cmp eax, edx
jne 0x46ee56
xor eax, eax
mov byte [eax + 0x5369f0], al
inc eax
cmp eax, 0x100
jl 0x46ee3e
mov dword [0x536af0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5369f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x46eee7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46eeba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x46ee88
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46ef60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x46efb3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46ef9a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b77ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00476280
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4c9274
call fcn.004a7ed4
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4759f3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a7ed4
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4759ec
push 0
mov ecx, eax
call fcn.0046ca80
mov dword [esi + 0xc], eax
jmp 0x4759f5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4759f5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x49e290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b87e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00493109
mov eax, dword [0x4cc978]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.0049303b
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0049ed50
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x49e337
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49e32e
cmp al, 0xff
je 0x49e32e
dec al
mov byte [ecx], al
jmp 0x49e337
push ecx
call fcn.004a7efd
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x49e368
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49e35f
cmp al, 0xff
je 0x49e35f
dec al
mov byte [ecx], al
jmp 0x49e368
push ecx
call fcn.004a7efd
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4aa561
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4aa599
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a85ee
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a85c6
jmp 0x4aa5a5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4abc52
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4abc94
call fcn.004b19c7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4abc94
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4abc8b
xor eax, eax
jmp 0x4abc9c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004abca2
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b1ef7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b1f25
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b1f43
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b1e5d
jmp 0x4b1f43
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b1f43
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b1e5d
test edi, edi
mov eax, edi
jne 0x4b1f2d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5c2e5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
pop dword [esp]
pop word [esp]
lea esp, [esp + 1]
jmp 0x5c2e30
push edx
jmp 0x5c2e47

Function at 0x5c2e81
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 0x278dd6c5
jmp 0x5c2f76
mov byte [esp + 1], dh
mov byte [esp + 2], ah
mov dword [esp + 0x64], esi
push edx
call fcn.005c2e5e
rdtsc
lea edx, [ecx + 0x93]
jmp 0x5c2eb4
mov esi, dword [esp + 0x28]
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0x5c355d
mov cl, 0x9a
jmp 0x5c2bdb
mov cl, 0x9a
call fcn.005c2ee1
std
int3
mov ebx, esi
rdtsc
mov ecx, edx
xor dl, ch
jae 0x5c2f01
jb 0x5c2eda
sub esp, 0x10
jmp 0x5c2f5f
lea ecx, reloc.WINMM.dll_midiStreamOut
pop cx
lea esp, [esp + 2]
jmp 0x5c2f90
bts ecx, ebx
jg 0x5c2f56
sub esp, 0x10
lea ecx, reloc.WINMM.dll_midiStreamOut
pop cx
lea esp, [esp + 2]
jmp 0x5c2f90
jmp 0x5c2f4a
mov ebp, esp
cpuid
mov ax, dx
mov dl, byte [esp]
neg eax
jns 0x5c314d
js 0x5c2f4a
lea ebp, [ebp - 0x20]
lea edx, [esp + ebp]
sub esp, 2
cmc
mov edx, 0xbe3d5d46
pop dx
jmp 0x5c33cf
push dword [esp + 0x44]
ret 0x48
xchg dword [esp + 4], ebp
pushal
xchg word [esp + 7], dx
pushal
mov byte [esp + 0xe], ah
mov dh, byte [esp + 0x25]
jmp 0x5c33b2
not ah
mov ebx, dword [esp]
mov al, 0x2e
sub esp, 0xc0
jmp 0x5c3317
not eax
mov al, ah
lea ebx, [esp + esi]
lea edi, [esp]
xchg ch, dl
jmp 0x5c3422

Function at 0x5c3b2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
and edx, ecx
ja 0x5c3b51
jbe 0x5c3b7f
not dh
xor dl, ch
jmp 0x5c3beb
lea edx, [ebp*4]
bsr ax, bp
xchg word [esp + 1], ax
jmp 0x5c3b30
mov ax, word [esp + 2]
pop word [esp]
mov byte [esp], ch
jmp 0x5c3c3a
lea esp, [esp + 2]
jmp 0x5c3cc3
rdtsc
mov eax, edx
clc
neg ax
xor dl, ch
mov eax, 0x1040726
jmp 0x5c3c68
bswap edx
xchg dh, dl
stc
jb 0x5c3c1b
lea esp, [esp + 2]
jmp 0x5c3cc3
xchg ah, dh
call 0x5c3cd3
nop
setg dl
or dword [esi + reloc.WINMM.dll_midiStreamOut], esp
mov al, byte [0xbfac5d66]
neg ax
xor dl, ch
jmp 0x5c3c2e
rdtsc
mov eax, edx
clc
jmp 0x5c3c7e
dec cl
not ax
btc eax, edi
jp 0x5c3c24
jnp 0x5c3c98
bswap edx
or eax, eax
neg dx
mov edx, 0x27d24556
setno dh
jmp 0x5c3d4b
mov dx, word [esp]
xchg dword [esp + 4], ebx
lea edx, [ebp + 0xaf]
clc
rcl dx, cl
mov al, 0xc6
jmp 0x5c3dc1
lea esp, [esp + 2]
lea ebx, [ebx + 0x30]
mov eax, 0xffd9d230
or edx, ebp
mov ax, 0xc70f
not ax
jmp 0x5c3d03
xchg dword [esp], ebx
sub esp, 6
mov dl, dh
inc ax
ror ah, 1
neg ax
jmp 0x5c3d1f
sub esp, 0
push dword [esp + 4]
ret 8

Function at 0x5c4a20
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts eax, esp
mov ax, 0x6421
lea eax, [ebx + edi]
call fcn.005c49e6
push esp
salc
inc esp
and ebx, esi
sbb eax, 0xbedb4bc6
dec ebp
cld
insb byte es:[edi], dx
in al, dx
bound eax, qword [0x897945f4]
adc al, 0x29
Function at 0x6d4fe7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dl, ch
lea ebp, [ebx*4]
cpuid
mov eax, dword [esp]
cpuid
jmp 0x6d5b35
lea esp, [esp + 3]
lea esp, [esp + 4]
pushal
setl ah
jmp 0x6d4fd0
mov ecx, 0x8d147ba4
xchg bp, ax
bswap eax
rol dx, cl
mov ax, word [esp]
setno bh
jmp 0x6d5045
mov bx, word [esp]
bsf bp, si
btc ebp, edi
mov ebp, ecx
jmp 0x6d4ff5
sub esp, 0xa
lea esp, [esp + 0x46]
bsr dx, bp
mov cx, 0x8b83
neg ah
mov bx, word [esp]
jmp 0x6d5016
shr ebx, 1
neg eax
neg cx
sub bl, ah
not ebx
inc bx
jmp 0x6d50f4
mov dword [esp + 1], ebp
mov ebx, dword [esp + 0x19]
mov bl, bh
btr ecx, esp
bsr dx, cx
add edi, ebp
jmp 0x6d502e
bswap eax
inc bl
setno ch
call fcn.006d50d6
insd dword es:[edi], dx
imul esp, dword [ecx + ebp*2 + 0x53], 0x61657274
insd dword es:[edi], dx
dec edi
jne 0x6d510d
add byte [ebx - 0x20b3823e], ch
inc edx
mov al, ah
cpuid
ror esi, 0x19
mov si, 0x7fed
rdtsc
jmp 0x6d5080
lea ebx, [ecx + 3]
xchg bh, cl
mov ebx, esi
mov dx, 0x3fb9
mov edx, 0xecbfd960
mov ebx, esi
jmp 0x6d509f
cmc
lea ecx, [ecx + edx]
lea edi, [esi*4]
bswap eax
xchg bh, cl
not eax
jmp 0x6d50c2
pop esp
and al, 6
inc bp
sub esp, 8
mov si, word [esp + 0xa]
bsr bp, bp
jmp 0x6d515d
lea esi, [edx*4]
ror bh, 3
mov dword [esp + 0x11], esi
lea ebx, [ecx*4]
mov byte [esp + 0xe], bh
xchg dword [esp], ecx
jmp 0x6d5229
cld
not di
xchg dword [esp + 0xa], eax
mov esi, 0x7c41bf8c
xchg byte [esp + 0x32], al
lea edx, [eax + edi]
jmp 0x6d506b
inc al
mov byte [esp + 1], dh
bswap edi
lea eax, [ecx + edx]
sete ch
call fcn.006d5201
ja 0x6d5212
jbe 0x6d5218
dec edi
jne 0x6d522a
push edx
jae 0x6d521f
je 0x6d51bc
scasb al, byte es:[edi]
add bx, 0xd236
push word [esp + 2]
mov word [esp], bx
clc
bswap esi
jmp 0x6d519c
pop ecx
mov ebp, 0x49b77008
xchg bp, di
setge bh
mov ax, 0x8607
bsr si, cx
jmp 0x6d51bd
xchg byte [esp + 2], dl
mov byte [esp + 1], dh
lea edx, [ebp - 0x67]
mov bl, bh
push esp
pop ebp
jmp 0x6d51d4
mov ch, byte [esp + 6]
mov di, word [esp]
cmp al, 0x24
mov ebx, dword [esp + 4]
jmp 0x6d5243
and edx, dword [esp + ebp*2 + 0x73]
inc esi
jb 0x6d528b
add byte gs:[ecx], ah
mov edi, 0xfa432990
nop
sub dword [ebx - 6], eax
xchg si, di
lea esp, [esp + 0x13]
xchg dword [esp], edx
mov eax, dword [esp + 5]
mov eax, 0x95254f9a
jmp 0x6d51f0
mov edi, 0x6485eef4
not ch
lea edx, [ecx + edi]
lea ecx, [eax - 0x69]
xchg dword [esp + 0xa], eax
cmc
jmp 0x6d52cb
mov cx, bx
xchg dword [esp + 4], ebx
inc ebx
cmc
rdtsc
push word [esp + 0x2b]
jmp 0x6d5183
mov ax, 0xc3d
mov byte [esp + 5], bh
setns ah
add esp, 0
jmp 0x6d52b5
jmp 0x6d5274
stc
neg ebp
xchg word [esp + 2], bp
mov eax, esi
mov bx, word [esp + 8]
call fcn.006d528a
mov edx, dword [esp + 0xf]
setg dh
bsr bx, bp
call int.006d52e0
sub byte [ebx - 0x1e], cl
sbb eax, 0xcf0f7f6c
bswap edi
bsf dx, ax
rdtsc
pop word [esp + 5]
bsr bp, bp
cpuid
jmp 0x6d52a1
mov bl, 0xd0
cpuid
cpuid
sub esp, 0x16
push edx
xchg byte [esp + 0xa], cl
jmp 0x6d525f
mov cl, ch
xchg ah, bl
pushal
stc
inc al
mov dl, dh
jmp 0x6d52fd
rdtsc
not bh
bsf ax, si
mov di, 0x8b49
mov cl, 0xa2
rcr esi, 0x11
jmp 0x6d5556
Function at 0x6d58bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [esi + edi]
and ebx, ecx
lea ebx, [eax + 0xe1]
mov edx, dword [esp + 5]
xchg word [esp + 3], ax
jmp 0x6d584d

Function at 0x6d593e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
mov al, 6
pushal
jmp 0x6d598c
push dword [esp + 0x14]
mov di, 0xacad
rdtsc
cpuid
pop bp
Function at 0x6da701
Capabilities:
Parse pe header

Disassembly:
jmp 0x6da75a
lea esp, [esp + 9]
mov byte [esp + 1], dh
lea esp, [esp + 3]
mov dword [esp + 0x60], ebp
Function at 0x484cff
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x484a08
mov edx, 0x30e895bf
and edx, edx
add edx, esi
call fcn.00484d45
or esi, esi
xor dword [ebx], eax
add esi, 0x1a98af9c
mov edx, 0x97d13033
add esi, 0xa49fd411
add ebx, 2
and esi, edx
mov edx, 0x962e51cc
mov esi, esi
cmp ebx, ecx
jl fcn.00484cff
add edx, 0x48d600f5
add edx, edx
ret
Function at 0x4021d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
push ebx
cmp eax, 0xffffffff
push esi
je 0x402272
mov esi, dword [esp + 0x10]
test esi, esi
je 0x402272
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x402272
mov al, byte [ecx + 0x54]
test al, al
je 0x402272
push ebp
push edi
push 0x1020
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, eax
xor ecx, ecx
push 0
push eax
mov dword [edx], ecx
push 0
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, ebx
lea edx, [eax + 0x1c]
mov ebp, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [eax + 0x18], edx
lea ecx, [eax + 0x14]
mov byte [eax + 0x101c], 1
lea eax, [esp + 0x24]
push eax
push 1
mov dword [ecx], ebx
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
pop edi
cmp eax, 0xffffffff
pop ebp
jne 0x40226b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x402272
pop esi
mov al, 1
pop ebx
ret 0xc
pop esi
xor al, al
pop ebx
ret 0xc
Function at 0x402680
Capabilities:
Copy file
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4045a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x130]
push 0x104
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.SkinPPWTL.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x130]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, 3
lea eax, [ebp - 0x130]
and ecx, ebx
push eax
push 0x407150
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x234]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x14]
push edx
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp + 8]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ecx
mov eax, dword [eax + 0x6c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov edx, dword [eax + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test edi, edi
mov esi, eax
je 0x4027d2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebp - 0x2c]
mov edi, eax
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
mov eax, dword [ebp - 0x14]
push 0x1001
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CFile::CFile
mov edx, dword [ebp - 0x24]
push esi
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call dword [edx + 0x40]
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CFile::Flush
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0040414c
mov dword [ebp - 4], 1
call sub.MFC42.DLL_AfxTryCleanup
push 0
push 0x100
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.SkinPPWTL.dll_Ordinal_3]
mov ecx, dword [ebp - 0x14]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401557
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00401623
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.00401652
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x4015e3
call fcn.00401623
add esp, 0xc
xor eax, eax
jmp 0x401620
call fcn.00401623
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x40161d
dec eax
je 0x4015fd
dec eax
je 0x40160f
jmp 0x4015df
cmp dword [ebp - 0xa0], ebx
jne 0x401609
push 4
jmp 0x40161f
jbe 0x40160f
push 5
jmp 0x40161f
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x401620
push 3
pop eax
pop ebx
leave
ret

Function at 0x401652
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00401623
mov eax, dword [0x424034]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x4016b5
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x424034], eax
leave
ret

Function at 0x4016b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
push 0x4000000
push 1
push esi
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1a], 0x2e
mov byte [ebp - 0x19], 0x5c
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x39
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0x10], 0x58
mov byte [ebp - 0xf], 0x44
call fcn.00401763
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x401728
mov eax, 0xc357
jmp 0x40175f
push ebx
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xc]
push 8
push eax
push esi
push esi
push 2
push edi
call fcn.004017ee
push edi
mov ebx, eax
call fcn.0040188c
add esp, 0x24
cmp ebx, esi
pop ebx
je 0x40175a
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 8]
mov byte [eax], cl
xor eax, eax
jmp 0x40175f
mov eax, 0xc358
pop edi
pop esi
leave
ret
Function at 0x403efe
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x1c]
cmp ecx, 1
jle 0x403fd9
add eax, 0x32
push esi
dec ecx
movzx edx, byte [eax + 1]
movzx esi, byte [eax - 1]
mov edx, dword [edx*4 + 0x426f38]
xor edx, dword [esi*4 + 0x426738]
movzx esi, byte [eax]
add eax, 0x10
xor edx, dword [esi*4 + 0x426b38]
movzx esi, byte [eax - 0x12]
xor edx, dword [esi*4 + 0x426338]
mov dword [eax - 0x12], edx
movzx edx, byte [eax - 0xb]
movzx esi, byte [eax - 0xc]
mov edx, dword [edx*4 + 0x426f38]
xor edx, dword [esi*4 + 0x426b38]
movzx esi, byte [eax - 0xd]
xor edx, dword [esi*4 + 0x426738]
movzx esi, byte [eax - 0xe]
xor edx, dword [esi*4 + 0x426338]
mov dword [eax - 0xe], edx
movzx edx, byte [eax - 7]
movzx esi, byte [eax - 8]
mov edx, dword [edx*4 + 0x426f38]
xor edx, dword [esi*4 + 0x426b38]
movzx esi, byte [eax - 9]
xor edx, dword [esi*4 + 0x426738]
movzx esi, byte [eax - 0xa]
xor edx, dword [esi*4 + 0x426338]
mov dword [eax - 0xa], edx
movzx edx, byte [eax - 3]
movzx esi, byte [eax - 4]
mov edx, dword [edx*4 + 0x426f38]
xor edx, dword [esi*4 + 0x426b38]
movzx esi, byte [eax - 5]
xor edx, dword [esi*4 + 0x426738]
movzx esi, byte [eax - 6]
xor edx, dword [esi*4 + 0x426338]
dec ecx
mov dword [eax - 6], edx
jne 0x403f13
pop esi
ret
Function at 0x4057a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00401623
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x424038], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x405808
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x424038], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00401623
mov eax, dword [0x424038]
add esp, 0xc
leave
ret

Function at 0x40581f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.004057a6
test eax, eax
je 0x4058ad
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4058b1
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00401623
add esp, 0xc
mov eax, esi
pop esi
leave
ret