joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47123c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x471253
add esp, 0xfffffff0
call fcn.00403c68
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042630c
mov eax, dword [0x4b0afc]
cmp word [eax + 2], 0
jne 0x47127b
mov eax, dword [0x4b0afc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004729bc
mov eax, dword [0x4b0c0c]
cmp word [eax + 2], 0
jne 0x471295
mov eax, dword [0x4b0c0c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00472bb4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41b180]
call fcn.004038d4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41b180]
call fcn.004038d4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x428858]
call fcn.0042fcfc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x47141c
mov eax, dword [0x4b09a0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004300cc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x473164
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b09a0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ddc0
test eax, eax
je 0x47138a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409904
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dde8
test eax, eax
je 0x47139e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a68
mov eax, dword [0x4b07dc]
cmp byte [eax], 0
jne 0x4713d2
mov eax, ebx
call fcn.00471544
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00473340
mov eax, ebx
call fcn.00473d04
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x471412
call fcn.00403cc0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4717c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b1bf4]
cmp dword [eax + 0x30], 0
je 0x47186e
cmp dword [ebx + 0x94], 0
jne 0x471868
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x471754
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x471868
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47182e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x471868
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041da2c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x47183d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4723d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x472405
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004048e8
jmp 0x472412
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040484c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x47351c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47355d
mov eax, esi
call fcn.00459954
test al, al
je 0x47355d
mov eax, dword [ebx + 0x84]
call fcn.00459650
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47355d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00459650
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x47a8a8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41a964]
call fcn.00405300
xor eax, eax
push ebp
push 0x47a9ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b0214], 0
jne 0x47a8fb
mov ecx, dword [0x4b0800]
mov dl, 1
mov eax, dword [0x407f5c]
call fcn.0040d064
call fcn.00404194
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403150
mov eax, ebx
call fcn.004050b8
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47a9fc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004065ac
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050c8
test eax, eax
jle 0x47a993
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x47a98c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a80
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a68
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e2c
test eax, eax
jne 0x47a98c
mov ebx, 0x15
jmp 0x47a998
mov ebx, 0x10
jmp 0x47a998
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b0214]
call fcn.0047a800
mov eax, dword [ebp - 8]
call fcn.0047a800
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004065c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a9f3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040481c
lea eax, [ebp - 0x10]
mov edx, dword [0x41a964]
call fcn.004053d0
ret

Function at 0x49097c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4909a1
cmp dword [esp + 4], 5
jb 0x4909a1
mov al, 1
jmp 0x4909a3
xor eax, eax
add esp, 0x94
ret
Function at 0x408fd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x4989d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea edx, [ebp - 0x3f4]
push edx
push 0x20019
push 0
push str.TypeLib
push SysReAllocStringLen
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x400], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocStringLen
mov esi, eax
call edi
test esi, esi
je 0x409037
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x3f4]
push edx
mov esi, eax
call edi
test esi, esi
jne 0x409025
mov edx, dword [ebp - 0x3f0]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x3ec]
push ecx
push esi
push edx
mov dword [ebp - 0x3f8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
mov eax, dword [ebp - 0x3f0]
push eax
call edi
test esi, esi
jne 0x409025
mov ecx, dword [ebp - 0x400]
mov edx, dword [ebp - 0x3fc]
push ecx
push edx
lea eax, [ebp - 0x3ec]
push 0x481b00
push eax
call fcn.0045c6d7
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
Function at 0x4090d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2720
call fcn.00471de0
mov eax, dword [0x4989d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2720], eax
mov eax, dword [0x481ebc]
mov esi, ecx
mov ecx, dword [str.SoftwareClasses_]
mov ebx, edx
mov edx, dword [0x481eb8]
push 0x26fe
mov dword [ebp - 0x270c], eax
mov dword [ebp - 0x2714], ecx
mov ecx, dword [0x481ec0]
mov dword [ebp - 0x2710], edx
mov dx, word [0x481ec4]
lea eax, [ebp - 0x2702]
push 0
push eax
mov byte [ebp - 0x2715], 0
mov dword [ebp - 0x2708], ecx
mov word [ebp - 0x2704], dx
call fcn.00465290
mov eax, esi
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409154
push edi
lea edi, [ebp - 0x2714]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409165
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x4091c8
lea edi, [ebp - 0x2714]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409186
mov cx, word [0x481ec8]
mov eax, ebx
mov word [edi], cx
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4091a0
lea edi, [ebp - 0x2714]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4091b2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea edx, [ebp - 0x271c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x2714]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
test eax, eax
jne 0x40926d
mov esi, dword [ebp - 0x2720]
test esi, esi
je 0x409227
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409204
mov ecx, dword [ebp - 0x271c]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409248
mov edx, dword [ebp - 0x271c]
push edx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x271c]
mov bl, byte [ebp - 0x2715]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x2715]
pop esi
xor ecx, ebp
pop ebx
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
Function at 0x409290
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2714
call fcn.00471de0
mov eax, dword [0x4989d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x481ebc]
mov eax, dword [str.SoftwareClasses_]
push esi
push edi
mov esi, ecx
mov ecx, dword [0x481eb8]
push 0x26fe
mov dword [ebp - 0x270c], edx
mov dword [ebp - 0x2714], eax
mov eax, dword [0x481ec0]
mov dword [ebp - 0x2710], ecx
mov cx, word [0x481ec4]
lea edx, [ebp - 0x2702]
push 0
push edx
mov dword [ebp - 0x2708], eax
mov word [ebp - 0x2704], cx
call fcn.00465290
mov eax, esi
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409301
lea edi, [ebp - 0x2714]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409311
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x2714]
push eax
and ecx, 3
push SysReAllocStringLen
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
Function at 0x40e3f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c41b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x4989d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov ecx, dword [0x481298]
mov dword [esi + 0xc], ecx
mov edx, dword [0x48129c]
mov dword [esi + 0x10], edx
mov ecx, dword [0x4812a0]
mov dword [esi + 0x14], ecx
mov edx, dword [0x4812a4]
mov dword [esi + 0x18], edx
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov dword [esi + 0x30], edi
cmp edi, ebx
je 0x40e4c4
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push esi
push edi
call ecx
cmp eax, ebx
mov eax, dword [esi + 0x30]
jl 0x40e4b5
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x30]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp + 8]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
cmp eax, ebx
jl 0x40e4c4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [esi + 4]
push eax
mov eax, dword [edx + 0x20]
push ecx
call eax
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40e4c4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp + 8], ebx
jmp 0x40e4c4
cmp eax, ebx
je 0x40e4c4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x30], ebx
push 8
call fcn.0045b876
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x40e4f5
mov dword [ebx], vtable.tcomxTypeHandler.0
mov dword [ebx + 4], edi
test edi, edi
je 0x40e4f7
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push edi
call ecx
jmp 0x40e4f7
xor ebx, ebx
mov dword [esi + 0x28], ebx
lea eax, [esi + 0x34]
mov ecx, 0x96
mov dword [eax], 0
add eax, 0x10
dec ecx
jne 0x40e502
mov eax, dword [0x49b1f0]
mov dword [esi + 0x994], eax
inc eax
mov dword [0x49b1f0], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x418230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
lea eax, [edx + 5]
push esi
cmp eax, 4
ja case.0x418243.2
jmp dword [eax*4 + 0x4182ec]
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 0xffffffc0
cmp edx, 0xfffffffc
sete al
push eax
call fcn.00418970
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 8]
push eax
call edx
test byte [esi + 0x68], 4
je 0x4182a1
mov eax, dword [esi + 0x5c]
and dword [esi + 0x68], 0xfffffffb
test eax, eax
je 0x4182a1
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x4182a1
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, str.FAIL
test edx, edx
jle 0x4182ce
push 0x30b
push 0x49a244
call fcn.00417730
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x317
push str.Unrecognized_Negative_verb_in_DoVerb__.__bad.
call fcn.00417730
add esp, 8
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x41d740
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4989d4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0041d630
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41d7c1
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x41d787
mov edx, dword [ebp - 0x18]
push edx
jmp 0x41d7bb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004413e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
Function at 0x41ddf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
test esi, esi
jne 0x41de08
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test esi, esi
jne 0x41de26
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x41de1d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41de1d
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41de1d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov edi, eax
push edi
push edx
call fcn.0041c570
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov eax, 0x482aa0
push esi
sub eax, 0xbc
push edi
mov dword [esp + 0x14], 0xbc
mov dword [esp + 0x1c], eax
jmp 0x430998
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [eax + ecx]
mov eax, esi
mov dword [esp + 0x10], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4309a8
sub eax, edx
mov edi, eax
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0x18], edi
mov edx, edi
cmp edi, ecx
jb 0x4309e8
movzx eax, byte [esi + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
mov esi, dword [esp + 0x10]
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x4309c5
mov dword [esp + 0x18], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x430a56
lea ecx, [ecx]
cmp dword [eax + 0xc], edi
jne 0x430a50
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x430a24
nop
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x430a48
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x430a10
test ecx, ecx
je 0x430a96
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x430a48
cmp ecx, 1
jbe 0x430a96
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x430a48
cmp ecx, 2
jbe 0x430a96
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x430a96
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x430a00
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, ebx
call fcn.00431ff0
add esp, 8
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
mov esi, dword [edx + 0x10]
mov dword [ecx + esi], eax
mov edx, dword [edx + 0x10]
mov eax, dword [ecx + edx]
or byte [eax + 5], 0x20
add ecx, 4
mov dword [esp + 0x14], ecx
cmp ecx, 0x100
jl 0x430994
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x430a65
xor cl, 3
mov byte [eax + 5], cl
jmp 0x430a65
Function at 0x4320c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0xc], edi
mov edx, edi
cmp edi, ecx
jb 0x432101
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x4320df
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x43216a
cmp dword [eax + 0xc], edi
jne 0x432164
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x43213c
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x432160
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x432128
test ecx, ecx
je 0x432183
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x432160
cmp ecx, 1
jbe 0x432183
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x432160
cmp ecx, 2
jbe 0x432183
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x432183
mov ebx, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x432116
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov eax, ebx
call fcn.00431ff0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov cl, byte [eax + 5]
movzx edx, byte [edx + 0x14]
movzx ebx, cl
not edx
and ebx, 3
test bl, dl
je 0x43217c
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4989d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x41c], ecx
lea ecx, [ebp - 0x40c]
push edi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], 0
mov edi, 0x400
jmp 0x4489a6
mov eax, dword [ebp - 0x410]
lea edx, [ebp - 0x40c]
sub ecx, edx
mov dword [ebp - 0x424], ecx
je 0x448a10
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x44]
mov esi, eax
cmp edx, dword [ecx + 0x40]
jb 0x4489c8
call fcn.0042c500
mov eax, dword [ebp - 0x424]
mov ebx, dword [esi + 8]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push esi
call fcn.004320c0
mov dword [ebx], eax
mov dword [ebx + 8], 4
add dword [esi + 8], 0x10
inc dword [ebp - 0x414]
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [ebp - 0x40c]
push eax
mov dword [ebp - 0x418], edx
call fcn.0041fee0
add esp, 4
mov ebx, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x448a19
mov edi, ebx
mov ecx, dword [ebp - 0x41c]
push ecx
push edi
lea edx, [ebp - 0x40c]
push 1
push edx
call fcn.00461aa5
mov ecx, dword [ebp - 0x418]
add ecx, eax
add esp, 0x10
sub ebx, eax
mov dword [ebp - 0x418], ecx
mov dword [ebp + 0xc], ebx
je 0x448a4f
cmp eax, edi
je 0x4489a0
lea eax, [ebp - 0x40c]
sub ecx, eax
mov edi, ecx
je 0x448aa9
mov eax, dword [ebp - 0x410]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x44]
mov esi, eax
cmp edx, dword [ecx + 0x40]
jb 0x448a73
call fcn.0042c500
mov ebx, dword [esi + 8]
push edi
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.004320c0
mov dword [ebx], eax
mov dword [ebx + 8], 4
add dword [esi + 8], 0x10
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x40c]
add esp, 0xc
inc dword [ebp - 0x414]
mov dword [ebp - 0x418], ecx
mov eax, dword [ebp - 0x414]
mov esi, dword [ebp - 0x410]
call fcn.0041d0f0
mov dword [ebp - 0x414], 1
test ebx, ebx
je 0x448b26
mov edi, dword [ebp - 0x420]
mov esi, dword [edi + 8]
mov eax, dword [esi - 8]
sub esi, 0x10
add eax, 0xfffffffd
cmp eax, 4
ja case.0x448adf.6
jmp dword [eax*4 + 0x448b3c]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
jmp 0x448b0f
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
jmp 0x448b0f
mov eax, dword [esi]
call fcn.0042a920
jmp 0x448b0f
call fcn.0042c730
test eax, eax
je 0x448b0d
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
jmp 0x448b0f
xor eax, eax
test eax, eax
jne 0x448b26
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459ed3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00459ed3
mov esp, ebp
pop ebp
ret