joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
cmp dword [0x467530], 0x2e4fd3a8
je 0x4029a7
mov dword [0x460100], 0xf9710681
mov eax, dword [0x45eea4]
movzx ecx, word [0x45dfbc]
add eax, 0x8728eb52
mov edx, dword [esp + 8]
or ecx, eax
mov word [0x45dfbc], cx
add dword [0x46ab84], 0xb03cd871
inc dword [0x460670]
mov eax, dword [0x460670]
and dword [0x46365c], eax
mov eax, dword [esp + 0xc]
dec dword [0x45f8c4]
push esi
lea esi, [edx + eax*4]
mov eax, dword [0x45f8c4]
or eax, 0xffc7fefd
and eax, dword [0x469150]
mov dword [0x469150], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
movsx eax, word [0x45a7c0]
sub eax, 0x3090a7d0
cmp eax, 0x635b2fd6
jge 0x402a32
mov eax, dword [0x4656cc]
not eax
and eax, 0xa7a29702
add dword [0x469e48], eax
jmp 0x402a3c
add dword [0x469ca0], 0x73a78c3f
cmp edx, esi
je 0x402b39
jmp 0x402a50
imul eax, dword [0x467fbc], 0x54091c2e
mov ecx, 0x34edc75f
sub ecx, eax
add dword [0x4662f4], ecx
mov ecx, 0x7787da5
dec dword [0x467fbc]
mov eax, dword [esp + 4]
xor dword [edx], eax
imul eax, dword [0x467124], 0xa81977e7
ror dword [esp + 4], 6
mov dword [0x467124], eax
mov eax, dword [0x4624b8]
sub ecx, eax
mov eax, dword [0x46285c]
inc dword [0x4624b8]
cmp ecx, eax
je 0x402ac9
dec dword [0x461050]
mov eax, dword [0x461050]
imul ecx, eax, 0xf51d13ae
movzx eax, word [0x45df58]
or ecx, 0xc58e9fb8
add ecx, eax
mov word [0x45df58], cx
movzx eax, word [0x45ab4c]
add edx, 4
sub eax, 0x2020a41b
mov word [0x45ab4c], ax
mov eax, dword [esp + 4]
shr eax, 8
add al, byte [esp + 4]
mov byte [esp + 5], al
inc word [0x45cc1a]
movzx eax, word [0x45cc1a]
mov ecx, dword [0x45f50c]
cwde
sub ecx, 0xe73852f
or ecx, eax
movzx eax, word [0x45af88]
sub eax, ecx
mov word [0x45af88], ax
inc dword [0x45f50c]
mov al, byte [esp + 5]
add byte [esp + 4], al
mov dword [0x45fac8], 0x10d68529
cmp edx, esi
jne 0x402a50
mov ecx, dword [0x45fe68]
mov eax, dword [0x463408]
and ecx, 0x5aa44f63
imul eax, ecx
pop esi
mov dword [0x463408], eax
mov eax, dword [esp]
pop ecx
ret
Function at 0x405070
Capabilities:
Encode data using xor

Disassembly:
and dword [0x469430], 0x15fffe1f
sub esp, 0x10
mov ecx, dword [0x466e30]
mov eax, dword [0x466294]
sub ecx, 0x571c03f9
xor ecx, 0xfd6a8fb5
imul eax, ecx
mov dword [0x466294], eax
movsx eax, word [0x45e92e]
mov ecx, dword [0x45feec]
shl eax, 5
add eax, 0x9aee57d1
add ecx, eax
cmp ecx, 0xf57f9a7d
jge 0x4050de
inc dword [0x462450]
mov ecx, 0xa48859e8
mov edx, dword [0x462450]
mov eax, dword [0x4610d4]
sar eax, 4
sub ecx, eax
sub ecx, edx
add dword [0x460038], ecx
inc dword [0x45fa0c]
mov ecx, 0x9252257
mov eax, dword [0x45fa0c]
sub ecx, eax
add ecx, dword [0x467114]
mov dword [0x467114], ecx
mov ecx, dword [0x466294]
mov eax, dword [0x4607f4]
not ecx
imul eax, ecx
push esi
xor esi, esi
cmp eax, 0xa92b9860
je 0x405138
mov ecx, dword [0x468cb8]
movzx eax, word [0x459a26]
and ecx, 0xe6244d89
xor ecx, 0x72217ba2
imul eax, ecx
mov word [0x459a26], ax
lea eax, [esp + 4]
push eax
call dword [0x4585bc]
movzx eax, word [0x459b20]
mov edx, 0x15
movzx ecx, word [esp + 0x12]
add eax, 0x4b9384c3
mov word [0x459b20], ax
and dword [0x46b5bc], 0xdb358dfa
lea esp, [esp]
mov eax, dword [0x463f78]
add ecx, ecx
imul eax, eax, 0x4ca68a12
add esi, ecx
xor dword [0x45f57c], eax
and dword [0x467574], 0xb81b057a
add dword [0x469e78], 0xadfd00f
dec edx
jne 0x405170
inc word [0x45cb8a]
movzx eax, word [0x45cb8a]
cwde
sub eax, 0x2657ea2d
imul eax, dword [0x45fac0]
push edx
mov dword [0x45fac0], eax
call fcn.0042a720
xor esi, eax
add esp, 4
movzx eax, word [0x45cace]
add eax, 0x246f7dad
mov word [0x45cace], ax
call dword [0x458574]
dec dword [0x45f84c]
xor esi, eax
mov eax, dword [0x45f84c]
mov ecx, dword [0x461c60]
or ecx, eax
and dword [0x4699a4], ecx
push esi
call fcn.0042ba08
movzx eax, word [0x45ecd8]
add esp, 4
xor eax, 0xa4986789
mov word [0x45ecd8], ax
pop esi
add esp, 0x10
ret
Function at 0x41a470
Capabilities:
Hash data with md5

Disassembly:
add dword [0x468a4c], 0x952c756d
mov edx, ecx
mov dword [edx], 0
mov eax, dword [0x4616d8]
dec dword [0x4616d8]
cmp eax, 0xed818fc1
jne 0x41a4bc
mov eax, dword [0x4634cc]
dec dword [0x4634cc]
add eax, 0x37cfce6c
cmp eax, 0x36c4252f
jg 0x41a4b7
add dword [0x4652dc], 0x2f4f9274
jmp 0x41a4bc
mov eax, dword [0x45fc9c]
mov dword [edx + 4], 0
movzx eax, word [0x4594fa]
movsx ecx, ax
movsx eax, word [0x45b770]
add eax, ecx
or dword [0x4685ac], eax
mov dword [edx + 8], 0x67452301
movzx eax, word [0x45b2ea]
sub eax, 0x77c38731
mov word [0x45b2ea], ax
mov dword [edx + 0xc], 0xefcdab89
imul eax, dword [0x468f14], 0xaaf9c5cd
mov dword [0x468f14], eax
mov dword [edx + 0x10], 0x98badcfe
cmp dword [0x4685b0], 0x1d8a857f
jg 0x41a530
movzx eax, word [0x45c1a8]
or eax, 0x7dffe5b6
mov word [0x45c1a8], ax
mov dword [edx + 0x14], 0x10325476
inc dword [0x467af8]
mov ecx, dword [0x467af8]
inc dword [0x468104]
add ecx, 0x1400c17
mov eax, dword [0x468104]
xor ecx, eax
mov word [0x45acd4], cx
ret
Function at 0x422580
Capabilities:
Write file on windows

Disassembly:
add dword [0x461e28], 0x5752732
mov eax, dword [0x468bb0]
or eax, 0x5671ff95
cmp eax, 0x4812b939
je 0x4225ad
movzx eax, word [0x459a6c]
sub eax, 0x42c27100
mov word [0x459a6c], ax
cmp dword [0x46b9a0], 0
jne 0x422622
mov ax, word [0x45bf4a]
cwde
cmp dword [0x461a34], eax
jg 0x4225f6
mov eax, dword [0x466d78]
mov ecx, dword [0x46ace4]
sar eax, 4
imul eax, eax, 0x305afe91
xor ecx, eax
cmp ecx, 0xd9709f4c
jge 0x4225f6
dec dword [0x46561c]
mov ax, word [0x45a662]
inc word [0x45a662]
call fcn.004181e0
mov dword [0x46b9a0], eax
mov ax, word [0x459092]
mov ecx, dword [0x45f978]
cwde
xor ecx, eax
xor ecx, 0xcfe6b248
mov dword [0x45f978], ecx
dec word [0x459092]
xor dword [0x4610e4], 0x6cd0493c
push esi
push edi
push 3
push 0x1694
call fcn.00423d70
mov ecx, dword [0x46490c]
add esp, 8
sar ecx, 3
mov esi, eax
and ecx, 0xaa13483d
cmp ecx, 0x6c399d3d
jle 0x422685
mov ecx, dword [0x46a824]
sar ecx, 9
imul ecx, ecx, 0x12a62e21
add ecx, 0x40277421
cmp ecx, 0x338b33ce
jle 0x422685
mov eax, dword [0x46183c]
mov ecx, 0xc1d044ce
sub ecx, eax
add dword [0x45f85c], ecx
push esi
push dword [esp + 0x10]
call fcn.0042bf61
xor dword [0x46524c], 0xed6208b7
mov edi, eax
push esi
push 3
call fcn.00407690
add esp, 0x10
cmp dword [0x4606e4], 0xba003b12
jl 0x4226bc
or dword [0x46733c], 0x1031006
test edi, edi
jne 0x422756
xor dword [0x45fafc], 0x4402800
push 0x3e8
call dword [0x458614]
movsx eax, word [0x45d820]
sar eax, 5
cmp eax, 0xdec45b7a
jle 0x4226fd
mov eax, dword [0x468760]
xor eax, 0x66a9f800
sar eax, 6
xor dword [0x467d64], eax
push 3
push 0x1694
call fcn.00423d70
mov ecx, dword [0x461af0]
mov esi, eax
mov edx, 0xd9dddaaf
sub edx, ecx
push esi
push dword [esp + 0x18]
or edx, 0x91eac1c7
xor dword [0x46191c], edx
call fcn.0042bf61
mov edi, eax
mov eax, dword [0x4693b8]
imul eax, dword [0x46331c]
push esi
push 3
mov dword [0x4693b8], eax
call fcn.00407690
add esp, 0x18
xor dword [0x4674a4], 0xd292552f
mov eax, dword [0x46a578]
add eax, 0xe8c1b13d
or dword [0x461fb0], eax
test edi, edi
je 0x4227df
dec dword [0x466a78]
mov ecx, dword [0x466a78]
mov eax, dword [0x4654ec]
shl eax, 7
sub ecx, eax
add ecx, 0x4baf7fd0
cmp ecx, 0x272bd496
jge 0x4227a3
mov eax, dword [0x467110]
or eax, 0xb9bc3e6a
mov dword [0x462308], eax
inc dword [0x467110]
push edi
push 1
push 4
push 0x46b9a0
call fcn.0042c114
movzx eax, word [0x459276]
xor eax, 0x2f7ebfde
mov word [0x459276], ax
push edi
call fcn.0042bc36
movzx eax, word [0x45bbf2]
add esp, 0x14
and eax, 0x14885dfb
mov word [0x45bbf2], ax
movzx eax, word [0x45d660]
imul eax, eax, 0xfaf627f1
pop edi
pop esi
mov word [0x45d660], ax
ret
Function at 0x424140
Capabilities:
Terminate process

Disassembly:
movzx eax, word [0x45c860]
push dword [0x457e08]
add eax, 0x3ff06fa4
mov word [0x45c860], ax
call fcn.00419e80
add esp, 4
cmp dword [0x468138], 0x8afb2527
je 0x42418c
imul eax, dword [0x4652e0], 0x18efa97d
mov ecx, 0x49cb0a5c
sub ecx, eax
movzx eax, word [0x45acac]
or eax, ecx
mov word [0x45acac], ax
push 1
call fcn.0042b940
int3

Function at 0x425300
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [0x459164]
and eax, 0x7037a15
push esi
mov word [0x459164], ax
mov esi, ecx
call fcn.0042a420
mov eax, dword [0x46409c]
and eax, dword [0x4634c0]
mov dword [0x4634c0], eax
inc dword [0x46409c]
cmp dword [esi + 0x18], 0
jne 0x425376
jmp 0x425340
xor dword [0x45fb34], 0x21ead927
call fcn.004181e0
mov dword [esi + 0x18], eax
dec word [0x45a588]
mov ax, word [0x45a588]
cwde
or eax, 0x4e97b6d7
xor eax, dword [0x4606dc]
mov dword [0x4606dc], eax
cmp dword [esi + 0x18], 0
je 0x425340
xor dword [0x462b20], 0xc590d17e
pop esi
ret
Function at 0x42a010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [0x4603dc], 0x46a0f14c
jle 0x42a032
mov ecx, dword [0x46221c]
mov eax, 0x41add8bb
sar ecx, 6
sub eax, ecx
mov word [0x45ba86], ax
mov eax, dword [0x4646d0]
sub eax, 0x22bc386d
cmp eax, 0xea5a3b60
jge 0x42a070
mov ecx, dword [0x4623d8]
movsx eax, word [0x459ae2]
and ecx, 0xa8455a4e
dec word [0x459ae2]
xor eax, ecx
cmp eax, 0x16e98bc0
jle 0x42a070
and dword [0x467004], 0xa2c2cf06
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x42a130
push ebp
lea ebp, [esi + 0xa]
lea esp, [esp]
add dword [0x4606cc], 0xa14c83f0
test esi, esi
je 0x42a0e0
call fcn.004284d0
movzx eax, al
cdq
idiv ebp
test edx, edx
jne 0x42a0e0
mov eax, 0xffff8c21
mov word [0x45eb42], ax
call fcn.004284d0
movzx eax, al
cdq
idiv ebp
add dl, 0x30
mov byte [esi + ebx], dl
imul eax, dword [0x469b54], 0xe6a2fcc0
or eax, 0x89d4cd5d
and dword [0x468544], eax
jmp 0x42a11c
movzx eax, word [0x45a544]
imul eax, eax, 0xc0a3366a
mov word [0x45a544], ax
call fcn.004284d0
movzx eax, al
mov ecx, 0x1a
cdq
idiv ecx
add dl, 0x61
mov byte [esi + ebx], dl
movzx eax, word [0x45e1c2]
imul eax, eax, 0xcad18721
mov word [0x45e1c2], ax
inc esi
mov dword [0x4626f4], 0xbb2f6087
cmp esi, edi
jne 0x42a090
pop ebp
or dword [0x4621ec], 0x18deec40
mov byte [esi + ebx], 0
imul eax, dword [0x463df0], 0x6242003
pop edi
pop esi
pop ebx
mov dword [0x463df0], eax
ret
Function at 0x43376a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4573d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042d6ec
mov dword [ebp - 0x14], eax
cmp dword [0x46c534], esi
jne 0x43385d
push 0x800
push esi
push 0x44d268
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4337ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43393d
push esi
push esi
push 0x44d268
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43393d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43393d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x46c534], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46c538], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x46c53c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46c544], eax
test eax, eax
je 0x43385a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46c540], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x433882
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433875
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x433897
push 4
pop eax
jmp 0x43393f
cmp dword [ebp - 0x14], esi
je 0x433897
push dword [0x46c534]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43387c
mov eax, dword [0x46c540]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4338f5
cmp dword [0x46c544], edi
je 0x4338f5
push eax
call ebx
push dword [0x46c544]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4338f5
test eax, eax
je 0x4338f5
call ecx
test eax, eax
je 0x4338ea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4338ea
test byte [ebp - 8], 1
jne 0x4338f5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x433925
mov eax, dword [0x46c538]
cmp eax, edi
je 0x433922
push eax
call ebx
test eax, eax
je 0x433922
call eax
mov esi, eax
test esi, esi
je 0x433922
mov eax, dword [0x46c53c]
cmp eax, edi
je 0x433922
push eax
call ebx
test eax, eax
je 0x433922
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46c534]
call ebx
test eax, eax
je 0x43393d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43393f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043352f
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45c004]
jne 0x40100a
repz ret
jmp fcn.00401858

Function at 0x408aa5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406172
and dword [ebp - 4], 0
cmp dword [0x4620bc], 0
mov ebx, eax
jne 0x408b56
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c07
push eax
call fcn.00406100
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4620bc], eax
call esi
push eax
call fcn.00406100
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4620c0], eax
call esi
push eax
call fcn.00406100
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4620c4], eax
call esi
push eax
call fcn.00406100
pop ecx
mov dword [0x4620cc], eax
test eax, eax
je 0x408b56
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406100
pop ecx
mov dword [0x4620c8], eax
mov eax, dword [0x4620c8]
cmp eax, ebx
je 0x408bae
cmp dword [0x4620cc], ebx
je 0x408bae
push eax
call fcn.0040617b
push dword [0x4620cc]
mov esi, eax
call fcn.0040617b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bae
test edi, edi
je 0x408bae
call esi
test eax, eax
je 0x408ba5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408ba5
test byte [ebp - 0xc], 1
jne 0x408bae
or dword [ebp + 0x10], 0x200000
jmp 0x408be7
mov eax, dword [0x4620c0]
cmp eax, ebx
je 0x408be7
push eax
call fcn.0040617b
pop ecx
test eax, eax
je 0x408be7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408be7
mov eax, dword [0x4620c4]
cmp eax, ebx
je 0x408be7
push eax
call fcn.0040617b
pop ecx
test eax, eax
je 0x408be7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4620bc]
call fcn.0040617b
pop ecx
test eax, eax
je 0x408c07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b8fb
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [0x23798f4], 0x930
jne 0x40b923
push 0x459df8
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x23798f4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x2379610], eax
jne 0x40b955
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
lea eax, [ebp - 0x1c]
push eax
push str.receyodat
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
leave
ret
Function at 0x44e65d
Capabilities:
Query environment variable

Disassembly:
jmp 0x4bd0ad
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4bd0c1
xor edi, edi
jmp 0x4bd105
push ebx
push esi
call fcn.004bcfa6
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.0044f819
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4bd0f2
push ebx
push esi
push edi
call fcn.0044f959
add esp, 0xc
push 2
push 0
call fcn.0044f459
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x44f508
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4eaf30
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x517fc4], 1
jge 0x4eaf9f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4eaf75
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x4eaf75
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4eaf52
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4eaf8b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x4eaf92
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x4eb08f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x4eb060
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4eb055
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x4eb049
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x4eb050
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x4eb08f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x4eb08a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4eb073
mov eax, dword [ebx + 8]
jmp 0x4eb08f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4eb081
xor eax, eax
jmp 0x4eb08f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4eafbf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x405e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405e69
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405ea4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x405ea0
lea ebx, [ebx]
cmp esi, eax
jae 0x405ea4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405e90
cmp esi, eax
jb 0x405eaa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x406ef0
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x2054]
mov eax, 0x2054
call fcn.004fe1a0
push 0xffffffffffffffff
push 0x52085a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5a4aa8]
xor eax, ebp
mov dword [ebp + 0x2050], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 0x11], bl
lea eax, [ebp]
push eax
call fcn.00487b00
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 1
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406f6c
invalid
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
inc eax

Function at 0x407ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00406fc3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
invalid
invalid
cmpsb byte [esi], byte es:[edi]
cld