joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc0e1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x4fc124
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4fc122
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004fbf9c
jmp 0x4fc159
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004fc680
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4fc159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004fbf9c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4fc132
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8
Function at 0x508d08
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x508dab
cmp dword [ebp + 8], 0
je 0x508dab
lea edx, [ebp - 0xc]
push edx
push 0x60642c
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edx, dword [ebp - 0x10]
push edx
call fcn.00501a0e
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52d16f
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x55
push str.oledrop1.cpp
mov eax, dword [ebp - 0x24]
push eax
call fcn.004986d0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x38], 0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x52d1d3
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x38]
or al, 1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x34]
or al, 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], eax
jmp 0x52d200
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x52d200
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x38]
or ecx, 2
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x34]
or ecx, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.004e8f14
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x30], 0
jne 0x52d2da
call fcn.004e8f03
cmp eax, dword [ebp + 8]
je 0x52d22d
jmp 0x52d2da
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x52d265
push 1
push 0x108
push 0x100
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x52d2ba
cmp dword [ebp - 0x1c], 0x202
je 0x52d289
cmp dword [ebp - 0x1c], 0x205
je 0x52d289
cmp dword [ebp - 0x1c], 0x201
je 0x52d289
cmp dword [ebp - 0x1c], 0x204
jne 0x52d28b
jmp 0x52d2da
cmp dword [ebp - 0x1c], 0x100
jne 0x52d29c
cmp dword [ebp - 0x18], 0x1b
jne 0x52d29c
jmp 0x52d2da
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
call fcn.004eee06
neg eax
sbb eax, eax
inc eax
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [0x612490]
jbe 0x52d2d5
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x30], 1
jmp 0x52d211
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x30]
mov esp, ebp
pop ebp
ret 4
Function at 0xb2b108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b2b258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb2b12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb2b11a
add dl, dl
jne 0xb2b139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb2b18c
xor eax, eax
add dl, dl
jne 0xb2b146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb2b22d
add dl, dl
jne 0xb2b155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2b160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2b16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2b176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb2b182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb2b125
mov eax, 1
add dl, dl
jne 0xb2b19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb2b1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb2b191
sub eax, ebx
mov ebx, 1
jne 0xb2b1d8
mov ecx, 1
add dl, dl
jne 0xb2b1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb2b1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb2b1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb2b125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb2b1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb2b1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb2b1e6
cmp eax, 0x7d00
jae 0xb2b21d
cmp eax, 0x500
jb 0xb2b218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb2b125
cmp eax, 0x7f
ja 0xb2b220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb2b125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb2b24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb2b125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100318cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x100319c7
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x1003149c
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
test dword [esi + 0x4fffff8], eax
cmp dword [ebp - 0x6fc], 1
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.1002f921
sti
sti
xchg ebp, eax
int 0xff
mov ch, 0x60
cld
invalid
inc dword [eax]
je 0x10031904
lea eax, [ebp - 0x714]
push eax
call fcn.1002f931
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1002f8e6
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x10031904
jmp 0x100312c3
cmp dword [ebp - 0x37c], 0
je 0x10031912
jmp 0x100319c7
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1003196b
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x10031970
jmp 0x100312c3
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x100319b7
lea eax, [ebp - 0x714]
push eax
call fcn.1002f931
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1002f8e6
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x100319c2
jmp 0x100319c7
jmp 0x100312c3
cmp dword [ebp - 0x37c], 0
jne 0x10031a71
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
stc
invalid
dec dword [ecx - 0x7e37b]
invalid
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
invalid
invalid
Function at 0x4092a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push ecx
nop
push edx
nop
push ebx
push esp
push ebp
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 4], 9
mov dword [ebp - 8], 4
mov ebx, 9
mov dword [ebp - 0x10], 0xb
mov edi, 0xa
mov dword [ebp - 0x14], 0x2c9f
jmp 0x4094fa
mov eax, ebx
add eax, dword [ebp - 8]
sub eax, 0xd
mov dword [ebp - 0x2c], eax
jmp 0x40944f
mov dword [ebp - 0x34], 0x2511877f
jmp 0x4092db
add dword [ebp - 0xc], 0xd91
jmp 0x4092eb
mov dword [ebp - 0x3c], 0x43b000
jmp 0x40930b
dec dword [ebp - 0x34]
jmp 0x4092fd
mov eax, dword [ebp - 4]
add eax, ebx
sub eax, 0xf
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jbe 0x409370
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, ebx
sub edx, 8
sub eax, edx
mov edx, dword [ebp - 0xc]
mov al, byte [edx + eax]
mov byte [ebp - 0x15], al
movzx edx, byte [ebp - 0x15]
mov dword [ebp - 0x74], edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov edx, eax
shr edx, 1
add ecx, edx
mov edx, ecx
and edx, 0xff
mov ecx, dword [ebp - 0x74]
xor ecx, edx
mov edx, ecx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x1c]
mov edx, edi
add edx, ebx
sub edx, 0x12
sub eax, edx
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp - 0x15]
mov byte [edx + eax], cl
jmp 0x409316
mov dword [ebp - 0x48], 0x4126d7
jmp 0x40941a
mov dword [ebp - 0x4c], 0x42fad7
mov dword [ebp - 0x50], 0x474000
jmp 0x409398
add dword [ebp - 0x14], 0x63fa
jmp 0x409306
mov eax, dword [ebp - 0x10]
add eax, ebx
sub eax, 0x14
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x48]
mov al, byte [edx + eax]
mov byte [ebp - 0x15], al
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, ebx
sub edx, 8
sub eax, edx
mov edx, dword [ebp - 0x3c]
mov cl, byte [ebp - 0x15]
mov byte [edx + eax], cl
mov eax, 0x1d2d4
cmp eax, dword [ebp - 0x20]
jbe 0x4093dd
jmp 0x4093a3
add dword [ebp - 0x14], 0x1ed67
jmp 0x4092f4
mov dword [ebp - 0x54], 0x10000000
mov esi, 0x4370d7
mov eax, edi
add eax, dword [ebp - 8]
sub eax, 0xe
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov cl, byte [ecx + eax]
mov byte [edx + eax], cl
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x6f30
jb 0x4093f4
inc dword [ebp - 0x2c]
jmp 0x40945b
add dword [ebp - 0xc], 0x7f6f
jmp 0x40938c
mov eax, edi
sub eax, 7
cmp eax, dword [ebp - 0x2c]
jbe 0x40937c
jmp 0x4092fd
mov dword [ebp - 0x44], 0x4095d7
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
jmp 0x4093d1

Function at 0x409b74
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40a2e8
call fcn.0040a018
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409bd4
cmp eax, 0xffffffff
je 0x409bd4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x409bcd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x409bcd
cmp edx, 0x10000000
jae 0x409bcd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x409bca
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0040a05d
ret 4
Function at 0x409c20
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x409c5e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x409c56
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x409c60
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x409c46
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409d30
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x409d46
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x409d61
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x100026d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002731
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100026f2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x401a4c
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b02
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4645cc
call sub.KERNEL32.DLL_WinExec
cmp byte [0x46404d], 0
je 0x401a7a
push 0x4645cc
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x4645ec
call fcn.00401410
mov eax, 0x4645fc
call fcn.00401410
mov eax, 0x464628
call fcn.00401410
push 0xff8
push 0
call sub.KERNEL32.DLL_VirtualQuery
mov dword [0x464624], eax
cmp dword [0x464624], 0
je 0x401ae1
mov eax, 3
mov edx, dword [0x464624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401ab7
mov eax, 0x46460c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x464618], eax
mov byte [0x4645c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b09
cmp byte [0x46404d], 0
je 0x401b01
push 0x4645cc
call sub.KERNEL32.DLL_WriteFileEx
ret

Function at 0x402138
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4645c4], 0
jne 0x402155
call fcn.00401a4c
test al, al
je 0x40215d
cmp ebx, 0x7ffffff8
jle 0x402167
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022bb
xor ecx, ecx
push ebp
push 0x4022b4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x46404d], 0
je 0x402188
push 0x4645cc
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402198
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402237
mov eax, ebx
test eax, eax
jns 0x4021ad
add eax, 3
sar eax, 2
mov edx, dword [0x464624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402237
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021e8
mov eax, ebx
test eax, eax
jns 0x4021d7
add eax, 3
sar eax, 2
mov ecx, dword [0x464624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40220e
mov ecx, ebx
test ecx, ecx
jns 0x4021f1
add ecx, 3
sar ecx, 2
mov edi, dword [0x464624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4645b4]
sub ebx, 4
add dword [0x4645b8], ebx
call fcn.00403e14
jmp 0x4022bb
cmp ebx, dword [0x46461c]
jg 0x402289
sub dword [0x46461c], ebx
cmp dword [0x46461c], 0xc
jge 0x40225b
add ebx, dword [0x46461c]
xor eax, eax
mov dword [0x46461c], eax
mov eax, dword [0x464620]
add dword [0x464620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4645b4]
sub ebx, 4
add dword [0x4645b8], ebx
call fcn.00403e14
jmp 0x4022bb
mov eax, ebx
call fcn.00402044
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022bb
cmp byte [0x46404d], 0
je 0x4022b3
push 0x4645cc
call sub.KERNEL32.DLL_WriteFileEx
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4645c8], eax
cmp byte [0x4645c4], 0
jne 0x402300
call fcn.00401a4c
test al, al
jne 0x402300
mov dword [0x4645c8], 8
mov dword [ebp - 4], 8
jmp 0x402461
xor ecx, ecx
push ebp
push 0x40245a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x46404d], 0
je 0x402321
push 0x4645cc
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40233c
mov dword [0x4645c8], 9
jmp 0x402431
dec dword [0x4645b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4645b8], eax
test bl, 1
je 0x40239c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40236c
test edx, 0x80000003
je 0x40237b
mov dword [0x4645c8], 0xa
jmp 0x402431
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402393
mov dword [0x4645c8], 0xa
jmp 0x402431
add ebx, edx
mov esi, eax
call fcn.00401bf0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x464620]
jne 0x4023dc
sub dword [0x464620], ebx
add dword [0x46461c], ebx
cmp dword [0x46461c], 0x3c00
jle 0x4023cd
call fcn.00401ee0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403e14
jmp 0x402461
mov edx, dword [eax]
test dl, 2
je 0x4023ff
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023fa
mov dword [0x4645c8], 0xb
jmp 0x402431
or dword [eax], 1
jmp 0x402428
mov eax, edi
cmp dword [eax + 4], 0
je 0x402412
cmp dword [eax], 0
je 0x402412
cmp dword [eax + 8], 0xc
jge 0x40241e
mov dword [0x4645c8], 0xb
jmp 0x402431
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401bf0
mov edx, ebx
mov eax, esi
call fcn.00401e58
mov eax, dword [0x4645c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402461
cmp byte [0x46404d], 0
je 0x402459
push 0x4645cc
call sub.KERNEL32.DLL_WriteFileEx
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40423c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x464638
mov esi, section.DATA
mov edi, 0x464048
cmp byte [ebx + 0x28], 0
jne 0x40426b
cmp dword [edi], 0
je 0x40426b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x40425a
cmp dword [0x462004], 0
je 0x404285
call fcn.00404124
call fcn.004041b0
xor eax, eax
mov dword [0x462004], eax
cmp byte [ebx + 0x28], 2
jne 0x404295
cmp dword [esi], 0
jne 0x404295
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403fb4
cmp byte [ebx + 0x28], 1
jbe 0x4042a5
cmp dword [esi], 0
je 0x4042c6
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4042c6
call fcn.00405b9c
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x4042c6
test eax, eax
je 0x4042c6
push eax
call sub.KERNEL32.DLL_MulDiv
call fcn.00403f8c
cmp byte [ebx + 0x28], 1
jne 0x4042d4
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x4042df
call fcn.00404180
cmp dword [ebx], 0
jne 0x4042fb
cmp dword [0x464028], 0
je 0x4042f3
call dword [0x464028]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_LoadResource
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x404285

Function at 0x4049e4
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x4049f8
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x4049dc
ret
Function at 0x405678
Capabilities:
Clear file content
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x40580c
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
test esi, esi
je 0x4056e0
push 0x40581c
push esi
call sub.KERNEL32.DLL_SetErrorMode
mov ebx, eax
test ebx, ebx
je 0x4056e0
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x4056e0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetLastError
jmp 0x405802
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405720
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405802
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405664
mov esi, eax
cmp byte [esi], 0
je 0x405802
lea eax, [esi + 1]
call fcn.00405664
mov esi, eax
cmp byte [esi], 0
je 0x405802
jmp 0x405726
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetLastError
jmp 0x4057e5
lea eax, [esi + 1]
call fcn.00405664
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405802
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetLastError
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
cmp esi, 0xffffffff
je 0x405802
push esi
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405802
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetLastError
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x405744
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetLastError
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret