joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4819a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.004f66e0
mov eax, dword [0x55909c]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
push edi
mov edi, dword [esp + 0x9c]
je 0x481a15
cmp ebx, dword [esi]
je 0x481a0c
test edi, edi
je 0x4819f2
cmp dword [esp + 0xa0], eax
jge 0x481a0c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004f62a5
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x481a1b
mov ebx, dword [esi]
test ebx, ebx
je 0x4819f2
test edi, edi
push ebp
je 0x481aed
push ebx
call fcn.0049c8a0
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x481a4b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.00486260
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x481aa5
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.00485700
add esp, 0xc
test eax, eax
je 0x481ba8
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.004858b0
add esp, 0xc
test eax, eax
je 0x481ba8
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.004858c0
add esp, 0xc
test eax, eax
je 0x481ba8
jmp 0x481aca
cmp eax, 0x80
ja 0x481ba8
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.004f24c0
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x481af5
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.004f0540
add esp, 0xc
jmp 0x481af5
test eax, eax
je 0x481b94
xor eax, eax
jmp 0x481b00
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x481b00
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.00485700
add esp, 0xc
test eax, eax
je 0x481ba8
push ebx
call fcn.0049c8a0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.004858b0
add esp, 0x10
test eax, eax
je 0x481ba8
xor eax, eax
jmp 0x481b50
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x481b50
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.00485700
add esp, 0xc
test eax, eax
je 0x481ba8
push ebx
call fcn.0049c8a0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.004858b0
add esp, 0x10
test eax, eax
je 0x481ba8
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.00485a20
add esp, 8
test eax, eax
jne 0x481bac
xor eax, eax
jmp 0x481bb1
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f62a5
add esp, 0x88
ret
Function at 0x486120
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.004f66e0
mov eax, dword [0x55909c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4861a7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4861a7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.004f7b7d
add esp, 0x10
test eax, eax
jge 0x48617d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004f62a5
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.004f7b7d
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x486235
call fcn.00485fe0
test eax, eax
jle 0x486235
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004f62a5
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.004f62a5
add esp, 0x108
ret
Function at 0x4d7d30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4d7d49
mov esi, edi
mov edi, eax
jmp 0x4d7d4b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4d7d5b
mov eax, ebx
jmp 0x4d7d65
push eax
push ebx
call fcn.00491360
add esp, 8
test eax, eax
jne 0x4d7d6d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4d7d8b
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x4d7d74
cmp eax, dword [esi + 4]
jge 0x4d7da2
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x4d7d90
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x4d7dc5
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4d7dc2
sub eax, 1
test eax, eax
jg 0x4d7db2
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4ed5f4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x55909c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004ed533
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004f0540
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4ed643
cmp dword [ebp - 0x1c], 5
jb 0x4ed65b
jmp 0x4ed657
cmp dword [ebp - 0x10], 1
jne 0x4ed65b
cmp dword [ebp - 0x1c], 4
ja 0x4ed657
jne 0x4ed65b
cmp dword [ebp - 0x18], 0
jbe 0x4ed65b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x53ab24
call fcn.00407d44
test eax, eax
jge 0x4ed67c
mov byte [0x560c34], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004f62a5
add ebp, 0x78
leave
ret
Function at 0x4ed8fb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x55fb90], 0
push esi
jne 0x4ed86e
call fcn.004ed799
test eax, eax
je 0x4ed8b1
mov eax, dword [0x55fb90]
cmp eax, 1
jne 0x4ed88f
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4ed8b1
pop esi
ret
push eax
call dword [0x55fb98]
test eax, eax
jne 0x4ed8f9
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4ed8b5
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x55fb90]
call dword [0x55fb98]
mov edi, eax
test edi, edi
je 0x4ed8dc
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4ed8f8
lea edi, [esi + 0xff0]
push esi
push dword [0x55fb90]
call dword [0x55fb94]
add esi, 0x10
cmp esi, edi
jb 0x4ed8e2
mov eax, esi
pop edi
pop esi
ret
jmp 0x4ed85b
Function at 0x4f027e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4f02bb
cmp dword [ebp + 0x14], edi
je 0x4f02bb
cmp ecx, edi
jne 0x4f02c2
call fcn.004f73f0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004efeaa
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4f02d6
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4f02f7
cmp ebx, 0xffffffff
je 0x4f02e6
push ebx
push edi
push ecx
call fcn.004f0540
add esp, 0xc
cmp esi, edi
je 0x4f02a3
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4f02a3
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4f0313
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4f031a
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4f040b
test word [esi + 0xc], 0x10c
je 0x4f036e
mov eax, dword [esi + 4]
test eax, eax
je 0x4f036e
jl 0x4f046c
cmp ebx, eax
mov edi, ebx
jb 0x4f033f
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4f0413
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004ef7b8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4f0403
cmp ebx, dword [ebp - 0xc]
jb 0x4f03db
cmp dword [ebp - 0xc], 0
je 0x4f0398
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4f038d
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4f0394
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4f03a3
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4f03a3
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4f043f
push eax
push dword [ebp - 8]
push esi
call fcn.004f2bbf
pop ecx
push eax
call fcn.004fee36
add esp, 0xc
test eax, eax
je 0x4f047e
cmp eax, 0xffffffff
je 0x4f046c
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4f0403
push esi
call fcn.004fe755
cmp eax, 0xffffffff
pop ecx
je 0x4f0470
cmp dword [ebp - 4], 0
je 0x4f043f
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4f0322
mov eax, dword [ebp + 0x14]
jmp 0x4f02bd
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4f042a
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004f0540
add esp, 0xc
call fcn.004f73f0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4f02b3
cmp dword [ebp + 0xc], 0xffffffff
je 0x4f0455
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004f0540
add esp, 0xc
call fcn.004f73f0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4f02b3
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4f02bd
or dword [esi + 0xc], 0x10
jmp 0x4f0470
Function at 0x4f3bfb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4f3c28
call fcn.004f7403
mov dword [eax], esi
call fcn.004f73f0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004efeaa
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4f3c04
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4f3c57
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f7416
pop ecx
call fcn.004f73f0
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4f3c7e
test al, 1
je 0x4f3c7e
test byte [esp + 0xc], 2
je 0x4f3c7e
call fcn.004f7403
mov dword [eax], 5
call fcn.004f73f0
mov dword [eax], 0xd
jmp 0x4f3c4e
xor eax, eax
pop esi
ret

Function at 0x4f62a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x55909c]
jne 0x4f62af
repz ret
jmp fcn.00507487

Function at 0x4fc008
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x559c08]
je 0x4fc023
inc edi
cmp edi, 0x17
jb 0x4fc014
cmp edi, 0x17
jae 0x4fc1a3
push ebp
push 3
call fcn.00508ff7
cmp eax, 1
pop ecx
je 0x4fc16f
push 3
call fcn.00508ff7
test eax, eax
pop ecx
jne 0x4fc057
cmp dword [0x559098], 1
je 0x4fc16f
cmp ebx, 0xfc
je 0x4fc1a2
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x55fca8
push ebp
call fcn.004f3cc4
add esp, 0xc
test eax, eax
je 0x4fc08d
push esi
push esi
push esi
push esi
push esi
call fcn.004efdae
add esp, 0x14
push 0x104
mov esi, 0x55fcc1
push esi
push 0
mov byte [0x55fdc5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4fc0d1
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004f3cc4
add esp, 0xc
test eax, eax
je 0x4fc0d1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004efdae
add esp, 0x14
push esi
call fcn.004ed990
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4fc116
push esi
call fcn.004ed990
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x55ffbc
push 0x53c33c
sub ecx, eax
push ecx
push eax
call fcn.005063c9
add esp, 0x14
test eax, eax
je 0x4fc116
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004efdae
add esp, 0x14
jmp 0x4fc118
xor esi, esi
push 0x53c338
push ebx
push ebp
call fcn.00506358
add esp, 0xc
test eax, eax
je 0x4fc138
push esi
push esi
push esi
push esi
push esi
call fcn.004efdae
add esp, 0x14
push dword [edi*8 + 0x559c0c]
push ebx
push ebp
call fcn.00506358
add esp, 0xc
test eax, eax
je 0x4fc15a
push esi
push esi
push esi
push esi
push esi
call fcn.004efdae
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00508e3a
add esp, 0xc
jmp 0x4fc1a2
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4fc1a2
cmp ebp, 0xffffffff
je 0x4fc1a2
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x559c0c]
push dword [esi]
call fcn.004ed990
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x508e3a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004fba89
xor ebx, ebx
cmp dword [0x560748], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x508f10
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x508ff0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x53cf40
push edi
call esi
cmp eax, ebx
je 0x508ff0
push eax
call fcn.004fba1b
mov dword [esp], 0x53cf30
push edi
mov dword [0x560748], eax
call esi
push eax
call fcn.004fba1b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x56074c], eax
call esi
push eax
call fcn.004fba1b
mov dword [0x560750], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004f5d03
test eax, eax
pop ecx
pop ecx
je 0x508ede
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004efdae
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x508f10
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004fba1b
cmp eax, ebx
pop ecx
mov dword [0x560758], eax
je 0x508f10
push 0x53cee8
push edi
call esi
push eax
call fcn.004fba1b
pop ecx
mov dword [0x560754], eax
mov eax, dword [0x560754]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x508f95
cmp dword [0x560758], ecx
je 0x508f95
push eax
call fcn.004fba92
push dword [0x560758]
mov esi, eax
call fcn.004fba92
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x508f95
cmp edi, ebx
je 0x508f95
call esi
cmp eax, ebx
je 0x508f62
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x508f62
test byte [ebp - 0x18], 1
jne 0x508f95
lea eax, [ebp - 0x10]
push eax
call fcn.004f5d3a
test eax, eax
pop ecx
je 0x508f7d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004efdae
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x508f8c
or dword [ebp + 0x10], 0x200000
jmp 0x508fd0
or dword [ebp + 0x10], 0x40000
jmp 0x508fd0
mov eax, dword [0x56074c]
cmp eax, dword [ebp - 8]
je 0x508fd0
push eax
call fcn.004fba92
cmp eax, ebx
pop ecx
je 0x508fd0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x508fd0
mov eax, dword [0x560750]
cmp eax, dword [ebp - 8]
je 0x508fd0
push eax
call fcn.004fba92
cmp eax, ebx
pop ecx
je 0x508fd0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x560748]
call fcn.004fba92
cmp eax, ebx
pop ecx
je 0x508ff0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x508ff2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x6c
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov eax, dword [0x46b21c]
lea ecx, [esp + 0xc]
push ebp
xor ebx, ebx
push esi
test ecx, ecx
push edi
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x65
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], bl
mov dword [esp + 0x10], eax
je 0x4010c5
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp esi, ebx
je 0x4010c5
lea eax, [esi + esi + 0xe]
push eax
call fcn.00459ded
add esp, 4
cmp eax, ebx
je 0x4010c5
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], bx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea ecx, [esi + 1]
add eax, 0xc
cmp ecx, ebx
mov dword [esp + 0x10], eax
mov esi, eax
jne 0x4010a0
cmp eax, ebx
jne 0x4010ba
push ecx
push eax
lea ecx, [esp + 0x20]
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jle 0x4010ba
mov word [esi + eax*2 - 2], bx
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00401f50
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edx
call ebp
mov edx, dword [0x46b220]
mov esi, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x401103
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x401103
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00459de2
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, ebx
je 0x401185
mov al, 0x67
mov cl, 0x73
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0x49
push eax
push esi
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], 0x44
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x62
mov byte [esp + 0x35], 0x75
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], 0x50
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x65
mov byte [esp + 0x3d], cl
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x74
mov byte [esp + 0x41], bl
call edi
cmp eax, ebx
je 0x401185
call eax
test eax, eax
je 0x401185
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
push str.ntdll.dll
mov dword [esp + 0x18], ebx
call ebp
cmp eax, ebx
je 0x4011cc
push str.NtQueryInformationProcess
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x4011cc
push ebx
lea ecx, [esp + 0x18]
push 4
push ecx
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x4011cc
cmp dword [esp + 0x14], ebx
je 0x4011cc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
Function at 0x4012c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
push esi
push edi
call fcn.004012a0
xor edx, edx
mov ecx, 0x11
div ecx
xor edi, edi
mov esi, edx
add esi, ecx
test esi, esi
jle 0x401304
call fcn.00459dfb
test eax, eax
je 0x4012f2
and eax, 0x8000000f
jns 0x4012f2
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
inc edi
cmp edi, esi
mov al, byte [edx + eax]
mov byte [esp + edi + 7], al
jl 0x4012dd
lea ecx, [esp + 8]
mov byte [esp + esi + 8], 0xd
mov byte [esp + esi + 9], 0xa
push ecx
mov byte [esp + esi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x40
ret

Function at 0x403f10
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push edi
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x403f5a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x403f51
cmp eax, 4
jne 0x403f5a
cmp dword [esp + 8], 0x5a
jb 0x403f5a
xor eax, eax
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x404260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x483658]
mov ecx, dword [esp + 4]
push esi
push 2
mov esi, dword [eax + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ax, word [eax + 0xe]
pop esi
ret
Function at 0x4084e0
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call edi
call edi
mov si, ax
and esi, 0x3ff
call edi
shr ax, 0xa
cmp si, 7
mov dword [0x4b20a8], 1
jne 0x408518
pop edi
mov dword [0x4b20a8], 0
pop esi
ret
cmp si, 0x13
jne 0x40852b
pop edi
mov dword [0x4b20a8], 4
pop esi
ret
cmp si, 1
jne 0x40853e
pop edi
mov dword [0x4b20a8], 5
pop esi
ret
cmp si, 0xa
jne 0x408565
cmp ax, 8
mov dword [0x4b20a8], 6
jne 0x4087b1
pop edi
mov dword [0x4b20a8], 0x26
pop esi
ret
cmp si, 0x1a
jne 0x408578
pop edi
mov dword [0x4b20a8], 7
pop esi
ret
cmp si, 0x18
jne 0x40858b
pop edi
mov dword [0x4b20a8], 8
pop esi
ret
cmp si, 0x1d
jne 0x40859e
pop edi
mov dword [0x4b20a8], 9
pop esi
ret
cmp si, 0x19
jne 0x4085b1
pop edi
mov dword [0x4b20a8], 0xa
pop esi
ret
cmp si, 0x15
jne 0x4085c4
pop edi
mov dword [0x4b20a8], 0xb
pop esi
ret
cmp si, 0x10
jne 0x4085d7
pop edi
mov dword [0x4b20a8], 0xc
pop esi
ret
cmp si, 8
jne 0x4085ea
pop edi
mov dword [0x4b20a8], 0xd
pop esi
ret
cmp si, 4
jne 0x408611
cmp ax, 1
mov dword [0x4b20a8], 0xe
jne 0x4087b1
pop edi
mov dword [0x4b20a8], 0x11
pop esi
ret
cmp si, 0x16
jne 0x408638
cmp ax, 1
mov dword [0x4b20a8], 0x10
jne 0x4087b1
pop edi
mov dword [0x4b20a8], 0xf
pop esi
ret
cmp si, 0xe
jne 0x40864b
pop edi
mov dword [0x4b20a8], 0x13
pop esi
ret
cmp si, 0x1e
jne 0x40865e
pop edi
mov dword [0x4b20a8], 0x14
pop esi
ret
cmp si, 0x1b
jne 0x408671
pop edi
mov dword [0x4b20a8], 0x15
pop esi
ret
cmp si, 5
jne 0x408684
pop edi
mov dword [0x4b20a8], 0x16
pop esi
ret
cmp si, 0xb
jne 0x408697
pop edi
mov dword [0x4b20a8], 0x18
pop esi
ret
cmp si, 0x2a
jne 0x4086aa
pop edi
mov dword [0x4b20a8], 0x19
pop esi
ret
cmp si, 0x21
jne 0x4086bd
pop edi
mov dword [0x4b20a8], 0x1a
pop esi
ret
cmp si, 0x1f
jne 0x4086d0
pop edi
mov dword [0x4b20a8], 0x1b
pop esi
ret
cmp si, 0x29
jne 0x4086e3
pop edi
mov dword [0x4b20a8], 0x1c
pop esi
ret
cmp si, 0x11
jne 0x4086f6
pop edi
mov dword [0x4b20a8], 0x1d
pop esi
ret
cmp si, 0x39
jne 0x408709
pop edi
mov dword [0x4b20a8], 0x1e
pop esi
ret
cmp si, 0x12
jne 0x40871c
pop edi
mov dword [0x4b20a8], 0x1f
pop esi
ret
cmp si, 0xc
jne 0x40872f
pop edi
mov dword [0x4b20a8], 0x20
pop esi
ret
cmp si, 0x24
jne 0x408742
pop edi
mov dword [0x4b20a8], 0x21
pop esi
ret
cmp si, 3
jne 0x408755
pop edi
mov dword [0x4b20a8], 0x22
pop esi
ret
cmp si, 0xd
jne 0x408768
pop edi
mov dword [0x4b20a8], 0x23
pop esi
ret
cmp si, 0x36
jne 0x40877b
pop edi
mov dword [0x4b20a8], 0x24
pop esi
ret
cmp si, 0x52
jne 0x40878e
pop edi
mov dword [0x4b20a8], 0x25
pop esi
ret
cmp si, 0x3e
jne 0x4087a1
pop edi
mov dword [0x4b20a8], 0x27
pop esi
ret
cmp si, 0x64
jne 0x4087b1
mov dword [0x4b20a8], 0x28
pop edi
pop esi
ret