joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ef30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43dec6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], 0
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x270], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x274]
mov edx, dword [esp + 0x278]
push edx
lea edx, [esp + 0x64]
mov ecx, dword [eax]
mov dword [esp + 0x2c], str.XStudioSync
push ecx
push str._s__s
push edx
mov dword [esp + 0x58], 1
mov word [esp + 0x5c], 5
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x60]
push eax
push ecx
push 0
push 0
push 0x30
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x42f07c
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_3
mov byte [esp + 0x268], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 4]
push str.Cant_Execute_Version_Management_Program__ErrCode___d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0xc]
add esp, 0xc
push 0
push 0
push ecx
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp]
mov byte [esp + 0x268], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x268], 0xffffffff
call sub.MFC42.DLL_CString::CString
or ax, 0xffff
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
add esp, 0x26c
ret 8
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
mov dword [esp + 0x26c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x264]
xor ax, ax
pop esi
mov dword fs:[0], ecx
add esp, 0x26c
ret 8
Function at 0x42f560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push esi
push edi
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 8]
and ecx, 0xffff
push 0x44e5ec
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x42f592
pop edi
pop esi
add esp, 8
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
ja 0x42f5b2
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42f5ce
pop edi
pop esi
add esp, 8
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x42f5e3
pop edi
pop esi
add esp, 8
ret 4
lea edx, [esp + 8]
mov dword [esp + 8], 0
push edx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [esp + 8]
test eax, eax
jne 0x42f60a
pop edi
pop esi
add esp, 8
ret 4
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push edi
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [esp + 8]
push 0
push eax
call fcn.0042f670
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jne 0x42f640
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x42f660
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, esi
pop edi
pop esi
add esp, 8
ret 4
Function at 0x4353f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4353fb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4354fe
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x442ed8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x442ed8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x442ed8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x442ed8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x442ed8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x442ed8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x442ed8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x442ed8]
xor eax, edx
inc ecx
dec edi
jne 0x435416
pop edi
test esi, esi
je 0x435520
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x442ed8]
xor eax, edx
inc ecx
dec esi
jne 0x435502
pop esi
pop ebx
not eax
ret

Function at 0x435e70
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x435eb1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x435ea6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x435ec4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x436e40
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x436ef8
cmp dword [ebp + 4], 0xffffffff
jne 0x436ef8
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x44a0a4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x436ebd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x436ebd
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.00435c00
add esp, 0x10
test eax, eax
jne 0x436ee0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.00436140
add esp, 4
mov dword [ebp], eax
mov eax, dword [0x4513e0]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x437330
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
je 0x4373f8
mov al, byte [ebx]
test al, al
je 0x4373f8
push esi
push edi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x43735e
cmp al, 0x5c
jne 0x437360
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x437356
mov edi, dword [esp + 0x218]
cmp esi, ebx
je 0x437395
sub esi, ebx
lea eax, [esp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.00437330
add esp, 0x14
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x438020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x43802b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x43812e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4432e0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4432e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4432e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4432e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4432e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4432e0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4432e0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4432e0]
xor eax, edx
inc ecx
dec edi
jne 0x438046
pop edi
test esi, esi
je 0x438150
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4432e0]
xor eax, edx
inc ecx
dec esi
jne 0x438132
pop esi
pop ebx
not eax
ret
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push 0x42030c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420300
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], 0x4202f0
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], 0x4202dc
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], 0x4202c0
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push 0x4202a8
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x99b799c
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x51c746dd
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4043a4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.004042e5
cmp eax, esi
jne 0x40441c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4043e5
lea eax, [ebp - 0x110]
push eax
call fcn.004043a4
cmp eax, esi
jne 0x40441b
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x4043d5
call fcn.004042ce
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.004042ce
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x4047f4
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x4047ff
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4060e2
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
mov esi, ecx
pop ebp
cmp dword [esi + 0x3c], ebp
jb 0x4060f5
mov eax, dword [esi + 0x28]
jmp 0x4060f8
lea eax, [esi + 0x28]
push eax
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [esi + 0x58], ebp
jb 0x40610e
mov eax, dword [esi + 0x44]
jmp 0x406111
lea eax, [esi + 0x44]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push eax
push 0x3ec
push dword [edi]
call ebx
cmp dword [esi + 0x74], ebp
jb 0x40612b
mov eax, dword [esi + 0x60]
jmp 0x40612e
lea eax, [esi + 0x60]
push eax
push 0x3ed
push dword [edi]
call ebx
lea eax, [esi + 0xb0]
cmp dword [eax + 0x18], ebp
jb 0x406148
mov eax, dword [eax + 4]
jmp 0x40614b
add eax, 4
push eax
push 0x3eb
push dword [edi]
call ebx
cmp dword [esi + 0x90], ebp
jb 0x406162
mov eax, dword [esi + 0x7c]
jmp 0x406165
lea eax, [esi + 0x7c]
push eax
push 0x3ea
push dword [edi]
call ebx
lea eax, [esi + 0x94]
cmp dword [eax + 0x18], ebp
jb 0x40617f
mov eax, dword [eax + 4]
jmp 0x406182
add eax, 4
push eax
mov ebp, 0x3e8
push ebp
push dword [edi]
call ebx
cmp byte [esi + 0x20], 0
jne 0x4061b7
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push dword [edi]
call esi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3ed
push dword [edi]
call esi
push 0
push eax
call ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, edi
call fcn.004061d1
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret 0x10

Function at 0x407097
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 1], 0
jb 0x4070ad
mov eax, dword [eax + 4]
jmp 0x4070b0
add eax, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x4070be
mov ecx, dword [ecx + 4]
jmp 0x4070c1
add ecx, 4
push esi
push eax
push ecx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x407121
push edi
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp + 0x14]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407120
test edi, edi
je 0x407120
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40711f
mov esi, dword [ebp + 0x10]
push 0
push edi
mov ecx, esi
call fcn.00406c85
mov esi, dword [esi + 4]
push edi
push ebx
push esi
call fcn.00415530
add esp, 0xc
mov byte [ebp - 1], 1
pop ebx
pop edi
mov al, byte [ebp - 1]
pop esi
leave
ret
Function at 0x408259
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4267fb
call fcn.00415e78
sub esp, 0x30
push esi
push edi
push 0x20
lea ecx, [ebp - 0x18]
call fcn.00406bf0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00407bc3
mov dword [ebp - 0x3c], 0x428360
mov esi, dword [ebp - 0x10]
push 8
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
push esi
mov byte [ebp - 4], 1
call dword [0x42838c]
lea ecx, [ebp - 0x3c]
call fcn.00401fe2
mov ecx, dword [ebp + 0xc]
push 0x10
mov eax, esi
sub ecx, esi
pop edi
mov dl, byte [eax + 0x10]
xor dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x4082ad
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push esi
call fcn.00401522
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40a483
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x426b79
call fcn.00415e78
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0xf
call fcn.00401ba2
push dword [esi + 0x4c]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.00402c22
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40a4ce
lea eax, [ebp - 0x28]
inc edi
push edi
push eax
lea eax, [esi + 0x48]
add esi, 0x4c
neg eax
sbb eax, eax
and eax, esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00402ce4
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402028
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40c99e
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x18]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
mov edi, eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
test eax, eax
mov dword [ebp - 4], eax
jne 0x40c9f5
push str.HMAC:_can_only_be_used_with_a_block_based_hash_function
lea ecx, [ebp - 0x20]
call fcn.00404ee2
lea eax, [ebp - 0x20]
push eax
push 1
lea ecx, [ebp - 0x4c]
call fcn.00404e65
push 0x432fe8
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], 0x427990
call fcn.00414e4d
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
mov eax, dword [esi]
mov ecx, esi
ja 0x40ca12
push ebx
push dword [ebp + 8]
call dword [eax + 0x4c]
push eax
call fcn.00415530
add esp, 0xc
jmp 0x40ca3b
call dword [eax + 0x48]
mov edx, dword [esi]
push ebx
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
mov ecx, esi
mov dword [ebp + 8], eax
call dword [edx + 0x4c]
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x2c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ebx, eax
mov eax, dword [ebp - 4]
sub eax, ebx
push eax
mov eax, dword [esi]
xor edi, edi
push edi
mov ecx, esi
call dword [eax + 0x4c]
add eax, ebx
push eax
call fcn.00414e90
add esp, 0xc
cmp dword [ebp - 4], edi
jbe 0x40ca84
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
mov bl, byte [eax + edi]
mov eax, dword [esi]
mov ecx, esi
xor bl, 0x5c
call dword [eax + 0x50]
mov byte [eax + edi], bl
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x4c]
add eax, edi
xor byte [eax], 0x36
inc edi
cmp edi, dword [ebp - 4]
jb 0x40ca5b
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40d74e
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x41138d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jbe 0x4113b6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
sub ecx, eax
sub edx, eax
push edi
mov edi, dword [ecx + eax]
xor edi, dword [eax]
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x4113a7
pop edi
pop esi
ret

Function at 0x4113b8
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
jbe 0x4113d7
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
sub ecx, eax
push esi
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x4113cb
pop esi
ret

Function at 0x4113d8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, eax
or ebx, edx
or ebx, ecx
test bl, 3
pop ebx
jne 0x411400
shr ecx, 2
push ecx
push edx
push eax
call fcn.004113b8
add esp, 0xc
ret
test ecx, ecx
jbe 0x411413
push esi
sub edx, eax
mov esi, ecx
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x411409
pop esi
ret

Function at 0x411414
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, esi
or ebx, edx
or ebx, eax
or ebx, ecx
test bl, 3
jne 0x411444
shr ecx, 2
push ecx
push eax
push edx
push esi
call fcn.0041138d
add esp, 0x10
jmp 0x41145c
test ecx, ecx
jbe 0x41145c
push edi
sub edx, eax
sub esi, eax
mov edi, ecx
mov cl, byte [edx + eax]
xor cl, byte [eax]
mov byte [esi + eax], cl
inc eax
dec edi
jne 0x41144f
pop edi
pop esi
pop ebx
ret