joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f2d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47f370
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov edi, 0x1000
call sub.kernel32.dll_GetEnvironmentStringsA
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 8]
call fcn.00404a88
cmp edi, ebx
jbe 0x47f34f
cmp byte [esi + ebx], 0
je 0x47f32f
lea eax, [ebp - 0xc]
mov dl, byte [esi + ebx]
call fcn.00404c70
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404d6c
jmp 0x47f34a
cmp dword [ebp - 8], 0
je 0x47f34f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 8]
call fcn.00404a88
inc ebx
cmp edi, ebx
ja 0x47f311
push esi
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f377
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404aac
ret

Function at 0x47f380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x47f43b
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x104
mov eax, esi
call fcn.0040a350
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
mov edx, ebx
call fcn.00403738
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, 0x47f454
call fcn.00404db0
push esi
push ebx
call sub.kernel32.dll_GetSystemDirectoryA
push dword [edi]
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.00404c80
push dword [ebp - 0x108]
push 0x47f454
mov eax, edi
mov edx, 3
call fcn.00404e24
mov eax, ebx
call fcn.0040a3ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f442
lea eax, [ebp - 0x108]
call fcn.00404a88
lea eax, [ebp - 4]
call fcn.00404a88
ret
Function at 0x47f6e4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov esi, eax
lea edi, [ebp - 4]
xor ecx, ecx
mov cl, byte [esi]
cmp cl, 2
jb 0x47f702
mov cl, 2
mov byte [edi], cl
inc esi
inc edi
rep movsb byte es:[edi], byte [esi]
xor eax, eax
push ebp
push 0x47f7f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.0040a350
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
lea eax, [ebp - 0x24]
call fcn.00403354
mov edx, 0x47f804
lea eax, [ebp - 0x24]
mov cl, 3
call fcn.00403324
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00404cec
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040a1cc
push 1
call sub.kernel32.dll_SetErrorMode
mov word [ebp - 8], ax
xor eax, eax
push ebp
push 0x47f7d4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47f7a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47f7b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f7db
mov eax, dword [ebp - 0xc]
call fcn.0040a3ac
movzx eax, word [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x48839c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4884c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, esi
call fcn.00404f64
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4884ad
xor eax, eax
push ebp
push 0x4884a6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 0xe
jne 0x488438
push 0
lea eax, [ebp - 0xc]
push eax
mov al, 2
call fcn.0048832c
push eax
xor eax, eax
call fcn.0048832c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x48842d
mov al, 2
call fcn.0048832c
cmp eax, dword [ebp - 0xc]
je 0x488431
xor eax, eax
jmp 0x488433
mov al, 1
mov byte [ebp - 1], al
jmp 0x488470
push 0
lea eax, [ebp - 0xc]
push eax
mov al, 2
call fcn.004882bc
push eax
xor eax, eax
call fcn.004882bc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x488467
mov al, 2
call fcn.004882bc
cmp eax, dword [ebp - 0xc]
je 0x48846b
xor eax, eax
jmp 0x48846d
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x48848f
mov eax, esi
call fcn.00404f64
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404c80
mov eax, dword [ebp - 0x10]
call fcn.00409aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4884ad
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4884ca
lea eax, [ebp - 0x10]
call fcn.00404a88
ret
Function at 0x4884d4
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48860c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.004050f0
push 0x104
lea eax, [ebp - 8]
call fcn.00404fbc
push eax
push 0x488620
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.004050f0
mov eax, dword [ebp - 8]
call fcn.00404d64
test eax, eax
jle 0x4885ee
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403470
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x488630
push ebx
push 0x488640
push esi
lea eax, [ebp - 0x60]
mov edx, 5
call fcn.00404e24
mov eax, dword [ebp - 0x60]
call fcn.00404f64
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4885ee
xor eax, eax
push ebp
push 0x4885e7
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4885ee
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488613
lea eax, [ebp - 0x60]
call fcn.00404a88
lea eax, [ebp - 8]
call fcn.00404a88
ret

Function at 0x488644
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404f64
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x488661
and eax, 0x10
cmp eax, 0x10
je 0x488665
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x490018
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x108], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49020f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
push ebx
push 0x4905ec
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.00403c0c
lea edx, [ebp - 0x208]
lea eax, [ebp - 0x108]
call fcn.00404cec
lea eax, [ebp - 0x108]
mov edx, 0x490228
call fcn.00404d6c
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x30]
call fcn.0047dd1c
cmp esi, 1
jne 0x4900f1
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x2c]
push ebx
push fcn.00488d68
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.00403c0c
lea edx, [ebp - 0x208]
lea eax, [ebp - 0x20c]
call fcn.00404cec
lea eax, [ebp - 0x20c]
mov edx, 0x490228
call fcn.00404d6c
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x30]
mov eax, 1
call fcn.0047de6c
xor eax, eax
push ebp
push 0x490149
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x210], eax
fild qword [ebp - 0x214]
fdiv dword [0x490234]
fdiv dword [0x490238]
fstp xword [ebp - 0x220]
wait
call fcn.0040b8c0
fld xword [ebp - 0x220]
fsubp st(1)
mov eax, dword [ebp - 4]
fstp qword [eax + 8]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49015e
mov eax, dword [ebp - 4]
call fcn.0048ff98
mov eax, dword [ebp - 4]
fstp xword [eax + 0x18]
wait
lea eax, [ebp - 0x224]
call fcn.0047edc8
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00404adc
lea eax, [ebp - 0x228]
call fcn.0047eeac
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00404adc
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetKeyboardState
cmp byte [ebp - 0xf0], 1
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x24], al
cmp byte [ebp - 0x74], 1
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x23], al
cmp byte [ebp - 0x73], 1
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 0x22], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490216
lea eax, [ebp - 0x228]
mov edx, 2
call fcn.00404aac
lea eax, [ebp - 0x20c]
call fcn.00404a88
lea eax, [ebp - 0x108]
call fcn.00404a88
ret
Function at 0x494704
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4947c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.00404a88
push 0x40
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4947b0
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x494790
push dword [esi]
mov eax, dword [edi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.00404c80
push dword [ebp - 0x1d4]
push 0x4947e0
mov eax, esi
mov edx, 3
call fcn.00404e24
inc ebx
cmp dword [edi + ebx*4], 0
jne 0x49475f
mov eax, dword [esi]
call fcn.00404d64
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405004
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4947d0
lea eax, [ebp - 0x1d4]
call fcn.00404a88
ret
Function at 0x49771c
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x8c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4978b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 0x4c]
push esi
push 0x497cfc
lea edx, [ebp - 0x18c]
mov eax, dword [esi]
call fcn.00403c0c
lea edx, [ebp - 0x18c]
lea eax, [ebp - 0x8c]
call fcn.00404cec
lea eax, [ebp - 0x8c]
mov edx, 0x4978c8
call fcn.00404d6c
mov eax, dword [ebp - 0x8c]
mov dl, byte [ebx + 0x50]
call fcn.0047dd1c
mov eax, dword [0x4aa944]
cmp byte [eax], 0xa
jb 0x497807
lea eax, [ebp - 0x88]
mov edx, 0x40
call fcn.00407a24
mov dword [ebp - 0x88], 0x40
lea eax, [ebp - 0x88]
push eax
call fcn.00497c4c
mov eax, dword [ebp - 0x84]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x80]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp - 0x78]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x74]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x60]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x58]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x54]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x70]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebx + 0x44], eax
mov eax, dword [ebp - 0x68]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x64]
mov dword [ebx + 0x14], eax
jmp 0x49786c
lea eax, [ebp - 0x44]
mov edx, 0x20
call fcn.00407a24
mov dword [ebp - 0x44], 0x20
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], edx
mov eax, dword [ebp - 0x38]
xor edx, edx
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], edx
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
lea eax, [ebp - 0x24]
mov edx, 0x24
call fcn.00407a24
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 8]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x48], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4978ba
lea eax, [ebp - 0x8c]
call fcn.00404a88
ret
Function at 0x49bd4c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 4]
xor ecx, ecx
mov cl, byte [esi]
cmp cl, 2
jb 0x49bd65
mov cl, 2
mov byte [edi], cl
inc esi
inc edi
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
lea eax, [ebp - 0x48]
mov edx, dword [0x47e52c]
call fcn.004054e8
xor eax, eax
push ebp
push 0x49be22
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
lea edx, [ebp - 4]
mov cl, 2
call fcn.00403360
lea edx, [ebp - 0x48]
lea eax, [ebp - 4]
call fcn.0047f808
mov al, byte [ebp - 0x45]
mov byte [ebx + 8], al
mov ax, word [ebp - 0x44]
mov word [ebx + 0x1c], ax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x38]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 0x18]
call fcn.00404adc
lea eax, [ebx + 0x28]
mov edx, dword [ebp - 0x10]
call fcn.00404adc
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00404adc
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x44], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49be29
lea eax, [ebp - 0x48]
mov edx, dword [0x47e52c]
call fcn.004055b8
ret
Function at 0x4a44f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
test dl, dl
je 0x4a4505
add esp, 0xfffffff0
call fcn.00404034
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x418864]
call fcn.00403c8c
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x418864]
call fcn.00403c8c
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push 0x4a4680
push 0x4a4684
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0xc], eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov esi, eax
xor eax, eax
push ebp
push 0x4a45ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x418b54]
call fcn.00403c8c
mov ebx, eax
mov edx, dword [ebp - 0xc]
mov ecx, esi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x10]
push 0
push 0
mov eax, ebx
call fcn.0041d4dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, ebx
call fcn.00403cbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a45b8
mov dl, 1
mov eax, dword [0x418864]
call fcn.00403c8c
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
push 0x4a4680
push 0x4a468c
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0xc], eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov esi, eax
xor eax, eax
push ebp
push 0x4a4649
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x418b54]
call fcn.00403c8c
mov ebx, eax
mov edx, dword [ebp - 0xc]
mov ecx, esi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x10]
push 0
push 0
mov eax, ebx
call fcn.0041d4dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, ebx
call fcn.00403cbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4653
mov eax, dword [ebp - 4]
call fcn.004a4874
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4a4673
call fcn.0040408c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x434098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x434176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x434171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00434a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43414a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43414a
xor eax, eax
jmp 0x434176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43408f
mov esp, ebp
pop ebp
ret

Function at 0x434a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x434a85
xor eax, eax
jmp 0x434a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x17be3149
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6ccb1d18
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40a9af
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040a893
sub ecx, ecx
sub cx, 0xff73
call 0x40a9af
rcr byte [esi - 0x7f], 0x76
push cs
outsd dx, dword [esi]
nop
sbb edi, dword [ebx - 0x1d03117d]
hlt
Function at 0x414d19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d053
xor ebx, ebx
cmp dword [0x4244a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x414dee
push 0x41cb84
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414d59
xor eax, eax
jmp 0x414eb2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41cb78
push edi
call esi
cmp eax, ebx
je 0x414d52
push eax
call fcn.0040cff0
mov dword [esp], 0x41cb68
push edi
mov dword [0x4244a8], eax
call esi
push eax
call fcn.0040cff0
mov dword [esp], 0x41cb54
push edi
mov dword [0x4244ac], eax
call esi
push eax
call fcn.0040cff0
mov dword [0x4244b0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040f0e1
test eax, eax
pop ecx
pop ecx
je 0x414dbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x414dee
push 0x41cb38
push edi
call esi
push eax
call fcn.0040cff0
cmp eax, ebx
pop ecx
mov dword [0x4244b8], eax
je 0x414dee
push 0x41cb20
push edi
call esi
push eax
call fcn.0040cff0
pop ecx
mov dword [0x4244b4], eax
mov eax, dword [0x4244b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414e67
cmp dword [0x4244b8], esi
je 0x414e67
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
je 0x414e34
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4244b8]
call fcn.0040d05c
pop ecx
call eax
test eax, eax
je 0x414e34
test byte [ebp - 0x18], 1
jne 0x414e67
lea eax, [ebp - 0xc]
push eax
call fcn.0040f118
test eax, eax
pop ecx
je 0x414e4f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040ce51
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x414e5e
or dword [ebp + 0x10], 0x200000
jmp 0x414e98
or dword [ebp + 0x10], 0x40000
jmp 0x414e98
mov eax, dword [0x4244ac]
cmp eax, esi
je 0x414e98
push eax
call fcn.0040d05c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x414e98
mov eax, dword [0x4244b0]
cmp eax, esi
je 0x414e98
push dword [ebp - 4]
push eax
call fcn.0040d05c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4244a8]
call fcn.0040d05c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret