joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f3e2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0046009a
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f542
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f52c
test ebx, ebx
jl 0x45f4d0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd15846
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f4f1
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f4e3
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00460eb2
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00460eb2
add esp, 8
mov ebx, 0x80070057
jmp 0x45f4d0
Function at 0x475fe2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476c9a
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00476142
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x47612c
test ebx, ebx
jl 0x4760d0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c446
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4760f1
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4760e3
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477ab2
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477ab2
add esp, 8
mov ebx, 0x80070057
jmp 0x4760d0
Function at 0x48de92
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048eb4a
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048dff2
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48dfdc
test ebx, ebx
jl 0x48df80
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd442f6
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48dfa1
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48df93
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048f962
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048f962
add esp, 8
mov ebx, 0x80070057
jmp 0x48df80
Function at 0x4a4b52
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a580a
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a4cb2
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a4c9c
test ebx, ebx
jl 0x4a4c40
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5afb6
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a4c61
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a4c53
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a6622
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a6622
add esp, 8
mov ebx, 0x80070057
jmp 0x4a4c40
Function at 0x4b8e61
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4b8e83
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4b8e74
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4b8fb1
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4b8f8b
test eax, eax
jne 0x4b8eb4
cmp dword [0x4c3264], 1
je 0x4b8f8b
cmp edx, 0xfc
je 0x4b8fb1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b8eeb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9840
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9cd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b8f2e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9cd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bee84
push edi
call fcn.004bbba0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9840
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9850
lea eax, [ebp - 0xa0]
push 0x4bee64
push eax
call fcn.004b9850
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9850
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbb14
add esp, 0x2c
pop edi
jmp 0x4b8fb1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004b9cd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40103b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401072
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40106e
jmp 0x401060
cmp esi, eax
jae 0x401072
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401060
cmp esi, eax
jb 0x401079
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401f60
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x1048
lea esi, [ecx + 4]
push 0x589000
push esi
mov dword [ebp - 4], ecx
call fcn.005520f0
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp ecx, 0x48
jle 0x401f8f
mov ecx, 0x48
mov edi, dword [ebp + 0xc]
add ecx, edi
mov eax, edi
add esi, 8
mov dword [ebp + 8], 6
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x401faa
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x401fb9
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x401fc8
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x401fd7
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x401fe4
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x401ff3
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x402002
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x402011
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x40201e
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x40202d
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x40203c
mov eax, edi
movzx ebx, byte [eax]
shl edx, 8
inc eax
or edx, ebx
cmp eax, ecx
jb 0x40204b
mov eax, edi
xor dword [esi], edx
add esi, 0xc
dec dword [ebp + 8]
jne 0x401fa0
mov ebx, dword [ebp - 4]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
xor esi, esi
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
call fcn.00401700
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], ecx
mov dword [ebx + esi*4 + 8], edx
add esi, 2
cmp esi, 0x12
jl 0x402066
xor esi, esi
lea esp, [esp]
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
call fcn.00401700
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [ebx + esi*4 + 0x4c], ecx
mov dword [ebx + esi*4 + 0x50], edx
add esi, 2
cmp esi, 0x400
jl 0x402090
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404f80
Capabilities:
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x80], eax
call fcn.00404520
mov edx, dword [esi + 0x70]
add edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x84]
add ecx, 4
shl edx, 4
push 0x400000
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
call fcn.004575d3
mov ecx, dword [esi + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 4
push 0
mov ebx, eax
lea eax, [ebp + 0xc]
push eax
push 4
push 0x5d9e48
push ecx
call edi
mov ecx, dword [esi + 0x8c]
push 0
lea edx, [ebp + 0xc]
push edx
push 4
lea eax, [ebp - 0x10]
push eax
push ecx
call edi
mov eax, dword [esi + 0x8c]
push 0
lea edx, [ebp + 0xc]
push edx
push 4
push 0x5d9e60
push eax
call edi
mov ecx, dword [esi + 0x8c]
push 2
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x90]
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x8c]
push 0
lea eax, [ebp + 0xc]
push eax
push 4
push 0x5d9e64
push ecx
call edi
mov ecx, dword [esi + 0x8c]
push 0
lea edx, [ebp + 0xc]
push edx
push 4
lea eax, [ebp - 8]
push eax
push ecx
call edi
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp eax, 0x400000
jbe 0x4050ba
add eax, 0xffbfffff
shr eax, 0x16
inc eax
mov dword [ebp - 0xc], eax
jmp 0x405080
mov eax, dword [esi + 0x90]
push 0
lea edx, [ebp - 0x14]
push edx
push 0x400000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esi + 0x8c]
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0x400000
push ebx
push edx
call edi
sub dword [ebp - 4], 0x400000
dec dword [ebp - 0xc]
jne 0x405080
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x90]
push 0
lea eax, [ebp - 0x14]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x8c]
push 0
lea eax, [ebp + 0xc]
push eax
push ecx
push ebx
push edx
call edi
mov eax, dword [esi + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x90]
push ecx
call edi
mov edx, dword [esi + 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
call edi
mov eax, dword [ebp + 8]
push eax
call edi
test ebx, ebx
je 0x40511d
push ebx
call fcn.004575de
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x405138
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x11c]
call fcn.0040ae20
mov ecx, dword [esi + 0x120]
call fcn.0040bfb0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4057d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5e1da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x114], 0
push edi
mov dword [ebp - 0x20], eax
jne 0x405800
mov ecx, dword [ebp + 0x24]
mov dword [esi + 0x114], ecx
mov dx, word [ebp + 0x4c]
inc dword [esi + 0x70]
lea ecx, [eax + 9]
shr ecx, 1
add ecx, ecx
add dword [esi + 0x84], ecx
mov ecx, dword [esi + 0x88]
mov word [esi + 0x118], dx
mov edx, dword [0x5d9e5c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
cmp byte [eax + ebx - 1], 0
je 0x405840
mov dword [ebp - 8], eax
jmp 0x40585c
cmp byte [eax + ebx - 2], 0
je 0x40584c
lea edx, [eax - 1]
jmp 0x405859
cmp byte [eax + ebx - 3], 0
lea edx, [eax - 2]
jne 0x405859
lea edx, [eax - 3]
mov dword [ebp - 8], edx
mov edx, dword [esi + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
inc eax
shr eax, 1
push 0
lea eax, [ecx + eax*2 + 8]
lea ecx, [ebp - 0x1c]
push ecx
push 4
push 0x5d9e5c
push edx
mov dword [esi + 0x88], eax
call edi
mov edx, dword [esi + 0x8c]
push 0
lea eax, [ebp - 0x1c]
push eax
push 4
lea ecx, [ebp - 0x20]
push ecx
push edx
call edi
mov ecx, dword [ebp - 0x20]
mov edx, dword [esi + 0x8c]
push 0
lea eax, [ebp - 0x1c]
push eax
push ecx
push ebx
push edx
call edi
test byte [ebp - 0x20], 1
je 0x4058cd
mov edx, dword [esi + 0x8c]
push 0
lea eax, [ebp - 0x1c]
push eax
push 1
lea ecx, [ebp - 0x15]
push ecx
push edx
mov byte [ebp - 0x15], 0
call edi
mov edx, dword [esi + 0x90]
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edx
call edi
push fcn.004011c0
push 0x12
push 4
lea eax, [ebp + 0x45c]
push eax
call fcn.00552a95
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.005520da
mov esp, ebp
pop ebp
ret 0x4ac
Function at 0x4079f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.0045b519
mov edi, dword [eax + 0xc]
movzx eax, word [ebp + 8]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
movzx eax, word [edi + 0xe]
mov ecx, eax
dec ecx
je 0x407a47
sub ecx, 3
je 0x407a40
sub ecx, 4
je 0x407a39
xor edx, edx
jmp 0x407a4c
mov edx, 0x100
jmp 0x407a4c
mov edx, 0x10
jmp 0x407a4c
mov edx, 2
mov ecx, dword [edi + 0x14]
test ecx, ecx
jne 0x407a60
shr eax, 3
imul eax, dword [edi + 8]
imul eax, dword [edi + 4]
mov ecx, eax
mov eax, dword [edi]
lea ebx, [eax + edx*4]
add ebx, ecx
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 0x184], eax
test eax, eax
jne 0x407a98
push esi
push 0x58a9cc
add esi, 0x104
push esi
call fcn.0055404e
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
mov dword [esi + 0x188], eax
call fcn.005520f0
mov eax, dword [esi + 0x188]
add esp, 0xc
mov ecx, esi
mov dword [esi + 0x164], eax
mov dword [esi + 0x168], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x170], eax
call fcn.00407820
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4

Function at 0x4087f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, eax
test edi, edi
jle 0x4087fc
movzx eax, di
jmp 0x408803
neg eax
and eax, 0x1fff
mov edx, 0x58ace0
xor ecx, ecx
push ebx
jmp 0x408810
mov bx, word [edx]
add edx, 2
cmp ax, bx
jl 0x408821
inc ecx
cmp ecx, 0xf
jl 0x408810
add ecx, 0xfffffffa
movzx edx, cx
pop ebx
test ax, ax
jne 0x408834
mov eax, 0x20
jmp 0x40884b
test dx, dx
js 0x408841
mov cx, dx
sar ax, cl
jmp 0x408848
mov ecx, edx
neg ecx
shl ax, cl
movzx eax, ax
mov ecx, esi
sar ecx, 6
and ecx, 0xf
lea edx, [ecx + edx - 0xd]
movzx ecx, dx
cwde
mov edx, esi
and edx, 0x3f
imul edx, eax
add edx, 0x30
sar edx, 4
movzx eax, dx
test cx, cx
js 0x40887e
shl ax, cl
mov ecx, 0x7fff
and ax, cx
jmp 0x408883
neg cl
sar ax, cl
movzx eax, ax
xor edi, esi
pop edi
cwde
jge 0x40888e
neg eax
ret
Function at 0x4088f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
movsx eax, word [edi + 0x10]
movsx esi, word [edi + 0x20]
sar eax, 2
call fcn.004087f0
add edi, 0x12
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 5
jmp 0x408920
movsx ebx, word [edi + 0x10]
movsx edi, word [edi]
sar edi, 2
test edi, edi
jle 0x408933
movzx edx, di
jmp 0x40893d
mov edx, edi
neg edx
and edx, 0x1fff
mov esi, 0x58ace0
xor ecx, ecx
mov ax, word [esi]
add esi, 2
cmp dx, ax
jl 0x408955
inc ecx
cmp ecx, 0xf
jl 0x408944
add ecx, 0xfffffffa
movzx esi, cx
test dx, dx
jne 0x408967
mov edx, 0x20
jmp 0x40897e
test si, si
js 0x408974
mov cx, si
sar dx, cl
jmp 0x40897b
mov ecx, esi
neg ecx
shl dx, cl
movzx edx, dx
mov ecx, ebx
sar ecx, 6
and ecx, 0xf
lea eax, [ecx + esi - 0xd]
movzx ecx, ax
movsx edx, dx
mov eax, ebx
and eax, 0x3f
imul eax, edx
add eax, 0x30
sar eax, 4
movzx edx, ax
test cx, cx
js 0x4089b3
shl dx, cl
mov eax, 0x7fff
and dx, ax
jmp 0x4089b8
neg cl
sar dx, cl
xor edi, ebx
movzx ecx, dx
movsx ecx, cx
jge 0x4089c4
neg ecx
mov edi, dword [ebp - 8]
add dword [ebp - 4], ecx
add edi, 2
dec dword [ebp - 0xc]
mov dword [ebp - 8], edi
jne 0x408920
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret