joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47dc50
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xb5
adc eax, 0x70e2e1b4
jb 0x47dbfd
neg esp
and byte [esp + esi*8 + 0x5b], ch
imul byte [edx - 0x24]
mov bh, 0xa
je 0x47dbf6
in al, dx
out dx, al
add byte [eax + eax*8], dh
add al, 0x1f
pushal
xor ch, al
add dword [esi], 0x8cb55868
xor byte [edi - 0x4fcd0260], 0x25
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
test dword [esi], ebp
inc ebx
arpl word [edi + 0x10], di
xor al, 0x34
loope 0x47dc09
push eax
mov al, 0x5f
xchg byte [ebx + 0x26e92911], al
sahf
or al, 0x5f
bound ebx, qword [edi + 0x521babf6]
test dword [edx - 0x3fa64d3b], esi
scasb al, byte es:[edi]
je 0x47dc3a
imul byte [ebx - 0x4d7aade5]
lds esi, [edx + 0x74aec059]
adc byte [ebx - 0x7785df19], ch
adc byte [ebx - 0x7785df19], ch
sub dword [esi + ecx + 0x31972939], eax
sub al, 0x33
cmp dword [ecx], ebp
xchg edi, eax
xor dword [ebx + esi], ebp
popal
mov bh, 0xea
movsb byte es:[edi], byte [esi]
sub esp, edx
cld
add eax, 0xd9346ce5
pop ecx
and dl, byte [eax - 0x4f]
js 0x47dbf4
pop es
add eax, 0x6bc6a0e1
mov eax, 0x5b077d8
xor eax, eax
pushfd
mov al, byte [0x4d52f268]
inc eax
loopne 0x47dcd3
pop es
fiadd word [edx]
pop esi
insd dword es:[edi], dx
mov edx, 0x62da2814
xor cl, byte [eax]
call 0x29463a30
xor ch, ah
loope 0x47dc94
in eax, 0x55
push ebp
xchg ebp, eax
cli
sbb al, 0xe0
fsub st(0)
out dx, al
test eax, 0x347090d0
shl dword [ecx + 0x26], 4
test al, 0xe6
mov dword [edi - 0x5283b251], ebx
pop ecx
out 0xa3, eax
sbb bl, byte [ebp + 0x247c1c66]
sar byte [edx + 0x4050ba4b], 0xac
loopne 0x47dc98
and byte [ecx], ah
jae 0x47dd05
mov dword [0xeaf0b5be], eax
invalid
and eax, 0xb47d3777
add byte [ebx - 0x5e], ch
loope 0x47dd01
nop
lcall 0x31a1, 0x4bf48860
add dh, byte [ebp - 0x1b]
mov eax, dword [0xe72d9676]
sub eax, 0xa1913a70
xchg ebp, eax
mov al, 0x6d
cmp dl, byte [ecx + 0x6db095a1]
test eax, 0x697a9d66
adc ah, byte [ebp + edi*2 + 0x3354be61]
int1
adc dh, ah
jno 0x47dcef
jmp 0xb7a5c633
sub ecx, ebp
pop ebp
mov bh, 0xef
invalid

Function at 0x47f890
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push es
xchg ebx, eax
cmp byte [eax - 0x6bbddcfb], 0x2b
sub al, 0x4e
xchg edx, eax
repe cmpsd dword [esi], dword es:[edi]
mov dl, 0xe5
and byte [ebp + 0x16], ch
pop es
rcl byte [esp - 0x1e391c91]
jecxz 0x47f8c0
pop ss
invalid
adc dh, byte [ecx + 0xff0d7e0]
aas
pop ss
dec eax
mov bl, 0x38
inc edx
mov ah, 0xe8
pop edi
mov gs, word [ecx]
push edi
rcr ebx, cl
sub byte [edi + 0x28944d78], dl
adc al, 0xc8
push eax
mov ecx, 0xf80adb50
pop ebp
push es
xchg edx, eax
push es
or al, 0x37
mov edx, 0xc186eda4
mov bl, 0x23
dec ebx
invalid
Function at 0x493f10
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
pop edx
adc dword [esp + edx*4 - 0x6f], ebx
push ds
pop ebx
fstp dword [ebx]
leave
out dx, eax
cmp al, 0xcd
and eax, 0x387a6c3
insd dword es:[edi], dx
add al, 0x95
leave
mov ch, 0xc9
or dword [eax - 0x22a0c78d], 0x47
loope 0x493f64
dec ecx
mov bl, 0x46
jns 0x493fb0
mov edx, dword [ebp - 0x7a]
inc ecx
adc ecx, edi
pop edi
push 0x9f0f499b
cmp edi, 0x3136993f
push esi
int 0xe8
or al, byte [edi - 0x77]
push es
popfd
adc al, 0x1c
xor eax, 0xa8e212d5
dec ebp
out 0x4c, eax
sahf
jle 0x493f7a
jb 0x493f64
add esp, dword [ecx]
mov ah, 0x6b
cmpsd dword [esi], dword es:[edi]
invalid
int 0xc7
push ebp
push cs
sar dword [ecx - 0x25347cd7], cl
sub dword [ebx + 0x7877dacb], eax
pop ecx
xor eax, 0x76a5ef2c
mov byte [edi], dl
push cs
dec byte [edx - 0x6d]
jp 0x493fb1
or cl, dl
xchg ecx, eax
mov ax, word [0x511859c3]
pop ds
fstp dword [ebx - 0x3f]
xchg edi, eax
fdiv qword [ebx - 0x4f1bd476]
sbb ecx, dword [ecx]
invalid
mov cs, word [eax - 0xc6ae48e]
or bl, byte [ecx + ecx*2 + 0xf]

Function at 0x494430
Capabilities:
Encode data using xor

Disassembly:
hlt
jnp 0x4943e8
push ss
cli
mov ah, 0x57
call [esi]
inc eax
aaa
lds edi, [esi + 0x25]
pop ss
invalid

Function at 0x496490
Capabilities:
Encode data using xor

Disassembly:
iretd
in al, 0xb9
js 0x49648f
jno 0x496417
cmp byte [ebp - 0x98c0ab0], ch
invalid
in eax, 0x60
xor eax, 0x286d7cd3
leave
pop ebx
invalid
jne 0x4964d4
inc ebx
fldenv [edi + ebx*8 - 0xe]
mov esp, 0x932770ee
je 0x496454
arpl ax, bp
pushal
add bh, byte [ecx + 0x70]
jb 0x496478
xor ah, byte [ecx + 0x20126498]
scasb al, byte es:[edi]
in al, 0x20
xor byte [eax + 0x10], dh
push esp
test al, 0xb5
out 0x43, eax
pop ds
mov al, 0x10
test al, 0xc8
jno 0x496491
cwde
jge 0x4964e9
movsd dword es:[edi], dword [esi]
sub byte [eax + 0x50], cl
popal
sahf
clc
jbe 0x4964ed
out dx, al
fst qword [ebx - 0x21]
jge 0x4964c6
test dword [0xcaf3dbbe], ecx
fsubr dword [ebx - 0x24]
xchg dl, cl
push 0xffffffffffffffda
dec ebp
or dword [eax + ebx*8 - 0x36], edx
js 0x4964cc
xor dword [ebp - 0x38], ebx
adc ecx, ebp
add edi, edi
cwde
iretd
call [eax - 0x13f84031]
pop es
in al, dx
dec esi
dec ebx
push ss
mov eax, dword [0x58417386]
add edi, 0xca74685d
push ebx
retf

Function at 0x4ad750
Capabilities:
Encode data using xor

Disassembly:
push es
mov ebp, 0x50e0e561
mov dh, 0x1e
sbb dword [ebx - 0x10d03fef], ebx
salc
add bh, byte [edi + 0x1a8e6c0a]
push edx
add dword [eax + 0x7a22f6a4], esp
or eax, 0x9a96dae9
mov ecx, 0xfe21c7ef
out dx, al
pushal
xor cl, byte [ecx]
jge 0x4ad776
out 0x21, eax
mov edi, eax
test eax, 0x8afe3b5b
imul ebx, dword [eax + 0x14ddf646], 0xffffffa9
mov eax, dword [0xf66d43d6]
inc esp
mov eax, dword [0x5de73869]
daa
call 0x8d5ec6d
sub dword [ecx + 0x3181197d], ecx
in al, 0xb0
mov ecx, dword [ebx]
call 0xce5e8836
mov dword [0x849a33b3], eax
pop esp
cmp eax, 0x45128542
iretd

Function at 0x4af0ac
Capabilities:
Encode data using xor

Disassembly:
pop ebp
call 0xfd76c9ce
mov dword [0xba1c6bf], eax
cmp eax, 0xfd523d6a
mov edi, 0x3d0ba1c6
push 0x3d
push edx
std
xor dl, byte [ebx]
inc edx
jge 0x4af0b3
rol dword [edi + ecx*4 - 0x209423c], cl
Function at 0x4af28d
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
inc edi
test ah, bl
invalid
popfd
cwde
test byte [esi], ch
jne 0x4af2b0
xor esp, edx
sbb dword [ebx + 0x44], ebp
mov dword [0xa57eb57b], eax
out dx, al
and ebx, dword [0x6a76a2bf]
sbb eax, 0x6a76a2bf
outsd dx, dword [esi]
cmpsd dword fs:[esi], dword es:[edi]
ljmp 0xf095
push ss
std
shr byte [edx + 0x21], 1
pop edx
outsd dx, dword [esi]
jge 0x4af303
inc eax
xor dword [edi], 0x6c6c61a0
add dword [eax + 0x6a8c03a8], eax
dec ebx
mov byte [0x1c8bd61d], al
rcl eax, 0x1d
mov al, byte [0x781d80fd]
push ecx
in al, dx
jno 0x4af264
push ecx
in al, dx
jno 0x4af2e8
xor byte [ecx - 0x60], ah
fisttp qword [edi]
test al, 0xb1
aam 0x4e
xchg ebp, eax
loopne 0x4af29f
leave
sar dword [edx + 0x40], cl
iretd

Function at 0x4bb031
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb053
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb044
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb181
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb15b
test eax, eax
jne 0x4bb084
cmp dword [0x4c22bc], 1
je 0x4bb15b
cmp edx, 0xfc
je 0x4bb181
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb0bb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbea0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb0fe
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbea0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c072c
push edi
call fcn.004bdd70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4c070c
push eax
call fcn.004bba20
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdce4
add esp, 0x2c
pop edi
jmp 0x4bb181
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbea0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5bb71a
Capabilities:
Encode data using xor

Disassembly:
aas
loopne 0x5bb547
call 0x2662e928
aas
invalid
sbb bl, byte [esi - 0x6f]
nop
push ebx
mov eax, 0x1d571bd6
je 0x5bb509
je 0x5bb509
invalid
imul edx, ebp, 0x8252835b
push 0x9c2e6bc9
push esi
in eax, dx
push es
ret 0x1c9f
loop 0x5bb5f5
enter 0xffffffffffff8238, 0xffffffffffffffd7
jne 0x5bb552
frstor dword [edx]
pop ebp
jle 0x5bb61d
insd dword es:[edi], dx
std
push 0xffffffffffffff8d
sub eax, 0x5cd2f5b3
daa
pop esi
and dword [ebx + 0x344c3e73], edi
idiv esi
xchg cx, ax
jne 0x5bb5cb
out dx, eax
movsb byte es:[edi], byte [esi]
xor dl, ah
push ebx
retf 0x59c0
je 0x5bb61c
mov eax, 0xfea13ef3
scasd eax, dword es:[edi]
dec ebp
mov edx, 0x283c97b3
ja 0x5bb587
mov ch, 0x12
in eax, dx
xor al, 0x13
push ebp
fcom qword [esi + 0x32]
jnp 0x5bb68d
mov bl, 0xc6
scasb al, byte es:[edi]
wait
adc dword [esi - 0x67], ebp
cmc
invalid
out 0x68, al
pop edx
dec esp
pop ds
mov cl, 0xfe
mov esp, 0xdf5e908b
arpl dx, sp
cmc
push ebp
sub al, 0xef
adc al, 0x57
push 0x3df4dc6b
dec edi
iretd
push 0xb11f4c5a
invalid
push es
sub al, 0xc3
adc al, 0x77
sbb ebp, dword [ebx + 0x4e772950]
cmp al, 0x9a
mov al, byte [eax + 0x1fa9c20e]
int1
add dh, dl
xlatb
aam 0xea
sar dword [edi], cl
adc eax, 0xf447b7db
xchg ah, ah
sub esi, dword [edi + 0x4e939bd8]
mov byte [0x3c34c508], al
pop edx
lahf
dec eax
xor edx, ecx
sbb dh, byte [esp + ebp*4 + 0x70a23d8]
enter 0x44ec, 0xd
js 0x5bb6b7
mov al, 0x26
adc ecx, dword [edx + 0x61]
adc ecx, dword es:[edx + 0x61]
lodsb al, byte [esi]
mov edx, 0xb08d5970
jl 0x5bb64d
mov al, byte [0x1e07c0d]
jae 0x5bb718
cld
popfd
inc edx
mov eax, dword [0x934d40f5]
lahf
sar dword [esi - 0x386c59cc], cl
aad 0x5c
salc
jge 0x5bb67a
push es
sbb dword [edi + ebx*4 - 0x23744d77], esp
invalid
lahf
mov dword [edx - 0x2f232375], esi
hlt
daa
sub eax, 0xd94187f2
mov ecx, 0x39084e2c
invalid
mov dword [0x85a1411f], eax
daa
ja 0x5bb720
push ebp
jp 0x5bb6c8
push ebp
jmp 0x5bb763
int 0x35
jns 0x5bb7d1
pop dword [ebp - 0x24cfd504]
test byte [eax + 0x2d7f8b35], bl
mov esi, 0x6825dec6
sbb eax, 0xfab19042
in al, 0x2c
sbb bh, byte [edi]
sti
mov dh, 0x52
dec ecx
xor al, 0x21
pop es
out 0x65, al
call 0xef95582
rcl esi, 1
jno 0x5bb74e
std
sbb ecx, dword [ecx + 0x627df943]
xchg ebx, eax
salc
mov edx, 0xbfe884c7
mov dword [0xf545db88], eax
xchg ebx, eax
das
int3
std
mov edx, 0xcaa4d688
or dh, byte [edx + 0xa]
and eax, 0x5e4e33bf
sbb byte [ebx], bh
dec esi
mov dword [ecx + 0x531e0bdc], esi
in eax, dx
scasd eax, dword es:[edi]
mov bl, 1
and edx, dword [edx]
invalid

Function at 0x5d619d
Capabilities:
Encode data using xor

Disassembly:
loopne 0x5d61f2
mov ebx, 0x27ebe355
shl ebx, 3
and ebx, 0x757f8dda
push ecx
mov ecx, 0xcaa0f77c
mul dword [eax + 0x59cb01ca]
add eax, ebx
pop ebx
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
jmp 0x5efbd6
dec eax
ror esp, cl
cld
mov edx, 0xf17cc76e
mov byte [0x85a61108], al
push edx
invalid
Function at 0x5ed94a
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xacb80b52
adc al, 0x9a
mov ebx, dword [edi]
xor al, 0x8c
mov dh, cl
xchg esi, eax
xchg esp, eax
daa
cmp bh, cl
pop esi
lodsd eax, dword [esi]
adc dword [ecx + ebp + 0x6fae8627], edx
mov edx, 0xcba9d07e
pop ecx
adc cl, cl
bswap eax
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
dec eax
stosb byte es:[edi], al
and eax, 0xb2916085
xchg ecx, eax
mov dl, 0x30
and byte [ebx + 0x63a08ec], ch
xchg ecx, eax
mov dl, 0x30
and byte [ebx + 0x63a08ec], ch
mov ebx, 0x8cdf7c28
cmc
cmp cl, ch
das
or ebx, dword [eax + 0x7f24b1e7]
push cs
in eax, dx
mov bh, 0xad
add esi, ebp
imul edx, dword [esi], 0xffffffe6
pop ss
stosb byte es:[edi], al
lds edi, [edi]
mov esi, 0x411223c9
pushfd
mov bh, 0xcb
mov dword [edx], 0x3e7cc711
loop 0x5ed91c
sub bh, byte [eax]
stosd dword es:[edi], eax
sbb esp, edx
jl 0x5ed98f
adc ebx, dword [esi - 0x4ca0c5c3]
pop ebx
rcl byte [ebp - 0x2531a5da]
lea edi, [eax + 0x39892c46]
cld
movsd dword es:[edi], dword [esi]
pop edx
into
fimul dword [ebp - 0x76d3b948]
cmp esp, edi
pop ebx
stosb byte es:[edi], al
xchg ecx, eax
retf
Function at 0x10006807
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10006816
pop dword [ebp - 0x40]
mov eax, 0xaf63bdcc
sub eax, 0x9f6355b6
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x36522
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xf977e166
add ecx, 0x6885840
xor ebx, ebx
add ebx, eax
mov edi, 0x36b28398
add edi, 0xd94fc068
add edi, dword [ebp - 0x40]
mov edx, 0x8c1a5ad0
mov esi, dword [edi]
xor dword [ebp - 0x1c], 0x43373de4
add esi, edx
add dword [ebp - 0x14], 0x4aa7e270
mov dword [ebx], esi
mov dword [ebp - 0x2c], 0x4361b3fb
add ebx, 4
add edi, 0xcd50a391
sub edi, 0xcd50a38d
loop 0x1000686c
add eax, 0x7fb11c40
add eax, 0x804fbd2b
xor ebx, ebx
add ebx, eax
add eax, 0xf42c4bff
sub eax, 0xf42c4bfa
mov ecx, 0x5a507c7e
sub ecx, 0x4a507c7e
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x5205d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x103000]
push edi
jmp 0x5205ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5205f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5205e0
mov eax, 1
add ebx, ebx
jne 0x520603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x520614
jne 0x520633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x520633
dec eax
add ebx, ebx
jne 0x520620
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5205f8
add ebx, ebx
jne 0x52062f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x520685
xor ecx, ecx
sub eax, 3
jb 0x52064b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5206ba
sar eax, 1
mov ebp, eax
jmp 0x520656
add ebx, ebx
jne 0x520656
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x520624
inc ecx
add ebx, ebx
jne 0x520664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x520624
add ebx, ebx
jne 0x520671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x520666
jne 0x520682
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x520666
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5206a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x520696
jmp 0x5205e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5206a4
add edi, ecx
jmp 0x5205e6
pop esi
mov edi, esi
mov ecx, 0x40f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5206c2
cmp byte [edi], 7
jne 0x5206c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5206c7
lea edi, [esi + 0x11d000]
mov eax, dword [edi]
or eax, eax
je 0x520736
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x131fec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x132088]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5206f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x132090]
or eax, eax
je 0x520730
mov dword [ebx], eax
add ebx, 4
jmp 0x520711
call dword [esi + 0x13208c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x520767
cmp al, 0xef
ja 0x52075a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52073c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x520749
mov ebp, dword [esi + 0x132094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52079b
sub esp, 0xffffff80
jmp 0x40325c
Function at 0x401c3b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x540024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [ebp - 0x214], eax
push edi
mov edi, ecx
test esi, esi
je 0x401d5a
xor eax, eax
cmp word [esi], ax
je 0x401d5a
push 4
push 0x485db4
push esi
call fcn.0046b971
add esp, 0xc
test eax, eax
jne 0x401c8b
add esi, 8
push 2
push 0x485dc0
push esi
call fcn.0046b971
add esp, 0xc
test eax, eax
jne 0x401ca2
add esi, 4
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00469920
push 0x104
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.0046ba79
lea eax, [ebp - 0x210]
push 0x2e
push eax
call fcn.00469149
mov esi, eax
add esp, 0x24
test esi, esi
je 0x401d13
xor eax, eax
mov word [esi], ax
inc esi
add esi, 1
je 0x401d13
push str.HTML
push esi
call fcn.0046b454
pop ecx
pop ecx
test eax, eax
je 0x401d13
push 0x485dd4
push esi
call fcn.0046b454
pop ecx
pop ecx
test eax, eax
je 0x401d13
push esi
jmp 0x401d15
push 0x17
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401d5a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401d5a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
test eax, eax
je 0x401d5a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
test eax, eax
je 0x401d5a
mov al, 1
jmp 0x401d5c
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004679dc
leave
ret

Function at 0x4021d3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x540024]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
cmp dword [ebp + 0xc], ebx
jbe 0x402247
mov esi, eax
test ebx, ebx
je 0x402212
push 0x485e24
call edi
push 1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00401620
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x14]
call fcn.00402ae6
inc ebx
add esi, 0x10
cmp ebx, dword [ebp + 0xc]
jb 0x402207
mov esi, dword [esp + 0x10]
push 0x485e28
call edi
call fcn.00401b39
push esi
mov ecx, dword [eax + 0x204]
call ecx
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004679dc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405a26
Capabilities:
Get graphical window text

Disassembly:
push 0x30
mov eax, 0x47daa6
call fcn.0046850a
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ecx]
sub eax, 0xfd
je 0x405a7c
sub eax, 1
je 0x405a4f
xor al, al
jmp 0x405aef
push 0
lea eax, [ebp - 0x28]
add ecx, 8
push eax
call fcn.00401620
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x28]
call fcn.00402ae6
jmp 0x405aed
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov esi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00467d4b
pop ecx
push esi
mov ebx, eax
push ebx
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push ebx
lea ecx, [ebp - 0x38]
call fcn.004058ce
mov edi, eax
mov esi, dword [ebp - 0x3c]
and dword [ebp - 4], 0
add esi, 8
call fcn.00401b39
push edi
push esi
mov ecx, dword [eax + 0x210]
call ecx
mov dword [ebp - 4], 1
call fcn.00401b39
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [eax + 0x208]
call ecx
push ebx
call fcn.004679ea
pop ecx
mov al, 1
call fcn.004684b9
ret 8

Function at 0x4075f8
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x47dfee
call fcn.004684d7
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
push 8
call fcn.00467bf8
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov dword [esi], 0x407377
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40763d
mov dword [esi + 4], ecx
xor eax, eax
lea ecx, [edi + 4]
mov eax, dword [ecx]
push ecx
mov eax, dword [eax]
call eax
pop ecx
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x407675
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
test eax, eax
je 0x40766f
lea ecx, [eax + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
call fcn.004684a5
ret

Function at 0x407b47
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x47e0bb
call fcn.004684d7
mov ebx, ecx
push 8
call fcn.00467bf8
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
mov dword [esi], edx
mov ecx, dword [ecx]
test ecx, ecx
je 0x407b81
mov dword [esi], ecx
add ecx, 4
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop ecx
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [ebp + 0xc], esi
lea edi, [ebx + 4]
mov dword [ebp - 4], 1
push edi
push edx
push esi
push 0x407c2d
push edx
push edx
call fcn.0046db09
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x407bc0
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
call fcn.00407bcb
call fcn.004684a5
ret 8
and dword [edi], 0
push 6
call fcn.00467317
int3