joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4528d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522b5b
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x580ca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x430], 0
push 0
mov eax, dword [ebp - 0x430]
push eax
call dword [0x52d2b0]
mov dword [ebp - 0x418], eax
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [0x52d2ac]
mov dword [ebp - 0x430], eax
push 0
mov edx, dword [ebp - 0x430]
push edx
call dword [0x52d2b0]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
push eax
push 0x20
lea ecx, [ebp - 0x42c]
call fcn.0043f4e0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x434]
push ecx
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x418]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00428150
push eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [0x52d2b4]
mov edx, dword [ebp - 0x430]
push edx
call dword [0x52d2fc]
push 0xffffffffffffffff
lea ecx, [ebp - 0x42c]
call fcn.00452c10
mov dword [ebp - 0x424], 0x4c10db7
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x41c], 0
jmp 0x4529e2
mov eax, dword [ebp - 0x41c]
add eax, 1
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x100
jge 0x452a67
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x440], 0
jmp 0x452a15
mov edx, dword [ebp - 0x440]
add edx, 1
mov dword [ebp - 0x440], edx
cmp dword [ebp - 0x440], 8
jge 0x452a4f
mov eax, dword [ebp - 0x420]
and eax, 1
je 0x452a3f
mov ecx, dword [ebp - 0x420]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 0x420], ecx
jmp 0x452a4d
mov edx, dword [ebp - 0x420]
shr edx, 1
mov dword [ebp - 0x420], edx
jmp 0x452a06
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x420]
mov dword [ebp + eax*4 - 0x414], ecx
jmp 0x4529d3
mov dword [ebp - 0x10], 0xffffffff
mov edx, dword [ebp - 0x418]
mov dword [ebp - 0x428], edx
lea ecx, [ebp - 0x42c]
call fcn.00429580
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x428]
sub ecx, 1
mov dword [ebp - 0x428], ecx
test eax, eax
je 0x452ad8
mov edx, dword [ebp - 0x10]
shr edx, 8
mov eax, dword [ebp - 0x10]
and eax, 0xff
mov ecx, dword [ebp - 0x438]
movzx ecx, byte [ecx]
xor eax, ecx
xor edx, dword [ebp + eax*4 - 0x414]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x438]
add edx, 1
mov dword [ebp - 0x438], edx
jmp 0x452a8b
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
mov dword [ebp - 0x444], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.00426800
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x452b10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x40c], 0
jmp 0x452b3e
mov eax, dword [ebp - 0x40c]
add eax, 1
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x100
jge 0x452bc3
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x418], 0
jmp 0x452b71
mov edx, dword [ebp - 0x418]
add edx, 1
mov dword [ebp - 0x418], edx
cmp dword [ebp - 0x418], 8
jge 0x452bab
mov eax, dword [ebp - 0x410]
and eax, 1
je 0x452b9b
mov ecx, dword [ebp - 0x410]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 0x410], ecx
jmp 0x452ba9
mov edx, dword [ebp - 0x410]
shr edx, 1
mov dword [ebp - 0x410], edx
jmp 0x452b62
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x408], ecx
jmp 0x452b2f
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x452c06
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
xor edx, eax
xor ecx, dword [ebp + edx*4 - 0x408]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x452bca
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x474b20
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov cl, 0xc1
push es
cmpsd dword [esi], dword es:[edi]
or eax, 0x38e179f4
jp 0x474b9a
push esi
pop ecx
mov dl, dh
dec esp
mov bh, 0xcd
jbe 0x474b0f
cmp ebp, dword [edx]
iretd
invalid
push ebx
add cl, dh
pop edi
push 0xfffffffffffffffa
push ebp
mov eax, dword [0xfc7340f0]
cli
je 0x474b54
dec ecx
add byte [ebx - 0x1ba2af7b], ah
adc byte [eax - 0x55], dl
test al, 0xb3
test byte [eax + 0x38], ch
popfd
mov dword [ebp + 0x5d], esp
js 0x474b8b
les edi, [ebx + 0x77]
nop
mov ebx, 0x81dbd82
sub al, 0x7c
ja 0x474bb6
sbb eax, 0x777c2c08
cli
mov eax, 0x268b120c
invalid

Function at 0x4bf725
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], ebp
lea edx, [ecx + 0x15]
and eax, 0x933ad869
in eax, 0x73
mov ebx, 0xc2927b3
cdq
ror dword fs:[edi + 0x1f], 0x1c
dec edi
pop ds
sbb al, 0xd2
push edi
dec ecx
dec edi
pop ds
sbb al, 0xd2
push edi
dec ecx
xchg esp, eax
sti
dec ebx
jbe 0x4bf710
int 0xa3
iretd

Function at 0x4c4e3d
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx + 0x13], dh
imul esp, dword [ebx], 0xffffffb0
and esi, dword [eax + 0x52121a00]
pop eax
and esi, dword [eax + 0x52121a00]
pop eax
leave
xchg esi, eax
ja 0x4c4e39
and cl, byte [eax]
mov al, byte [0xb01247ea]
dec edi
or dl, byte [esi - 0x1756fd3a]
mov ecx, 0x2edbaf21
cld
test al, 0xa4
retf 0xb256
Function at 0x401412
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4488f0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4014a7
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x401464
cmp dword [ebp + 0x10], ebx
jne 0x40149b
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401412
test eax, eax
jne 0x401476
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x40144b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405e58
cmp eax, ebx
je 0x4014ae
push ebx
push dword [0x4488f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x4014a7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x4488f0], ebx
jne 0x4014a4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4014a4
jmp 0x4014a7
Function at 0x4031b4
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x4031d1
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x4031e0
mov ebx, 0x418908
mov eax, dword [ebp + 8]
test eax, eax
jl 0x4031f5
mov ecx, dword [0x448858]
add ecx, eax
push ecx
call fcn.0040319d
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.0040316b
test eax, eax
jne 0x40320c
push 0xfffffffffffffffd
pop eax
jmp 0x403365
test dword [ebp + 0x14], 0x80000000
je 0x403344
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x428910
mov dword [ebp - 0xc], eax
call fcn.00406676
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403362
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x40324c
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x414908
push edi
call fcn.0040316b
test eax, eax
je 0x403204
sub dword [ebp + 0x14], esi
mov dword [0x428928], edi
mov dword [0x42892c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x428910
mov dword [0x428930], ebx
mov dword [0x428934], eax
call fcn.00406696
mov dword [ebp - 0x14], eax
test eax, eax
jl 0x403336
mov esi, dword [0x428930]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x4488f4], 1
mov edi, eax
je 0x4032ea
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x4032b7
cmp dword [ebp + 0x14], 0
jne 0x4032ea
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404bfa
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x40332b
cmp dword [ebp + 0x10], eax
jne 0x403313
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40333d
cmp dword [ebp - 0x10], esi
jne 0x40333d
add dword [ebp - 4], esi
jmp 0x40331f
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x428930]
cmp dword [ebp - 0x14], 1
jne 0x40326b
jmp 0x403362
cmp dword [ebp + 0x14], eax
jg 0x40323f
jmp 0x403362
push 0xfffffffffffffffc
jmp 0x403206
push 0xfffffffffffffffe
jmp 0x403206
test edi, edi
je 0x4033ab
cmp dword [ebp + 0x14], esi
jge 0x403350
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040316b
test eax, eax
je 0x403204
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403377
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x414908
push edi
call fcn.0040316b
test eax, eax
je 0x403204
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40333d
cmp esi, dword [ebp + 0x10]
jne 0x40333d
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x40336c
jmp 0x403362
Function at 0x405891
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x43a9e0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x43a9e0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4058cc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405a13
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405a30
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405a33
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405a62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405aa6
test edi, edi
jne 0x405a6d
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405aa0

Function at 0x405aaa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b1b
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x2000
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405b0a
cmp dword [ebp + 0x14], 1
je 0x405b0c
cmp dword [ebp + 0x14], 2
je 0x405b0c
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405c7f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x405ca4
mov eax, dword [0x40a058]
cmp eax, 0xffffffff
je 0x405c9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a058], 0xffffffff
jmp 0x405d19
cmp dword [0x43fb68], ebx
je 0x405d19
cmp byte [0x444380], bl
je 0x405ce3
cmp dword [0x40a058], 0xffffffff
jne 0x405cec
push 4
push 0x40000000
push 0x444380
call fcn.00405a33
mov dword [0x40a058], eax
cmp eax, 0xffffffff
je 0x405d19
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a058], 0xffffffff
je 0x405d19
push esi
push 0x408cc4
mov esi, 0x43fb80
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push dword [0x40a058]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x405f16
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x43aa28
push esi
call fcn.00405bc3
push esi
call fcn.0040599c
mov edi, eax
test edi, edi
jne 0x405f37
xor eax, eax
jmp 0x405f8f
push edi
call fcn.00405be5
test byte [0x448868], 0x80
je 0x405f50
mov al, byte [edi]
test al, al
je 0x405f33
cmp al, 0x5c
je 0x405f33
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x405f70
push esi
call fcn.00405e31
test eax, eax
je 0x405f6a
test byte [eax], 0x10
je 0x405f94
push esi
call fcn.00405eef
push esi
call ebx
cmp eax, edi
jg 0x405f5b
push esi
call fcn.00405ec2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405f8e
Function at 0x406248
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e58
mov esi, dword [esp + 0x18]
test eax, eax
je 0x40626c
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4063a5
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ca28], 0x4c554e
mov edi, 0x400
mov ebp, 0x43ca28
test esi, esi
je 0x4062b0
push 1
push 0
push esi
call fcn.00405a33
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4063ab
cmp eax, edi
jg 0x4063ab
push edi
mov esi, 0x43d368
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4063ab
cmp eax, edi
jg 0x4063ab
push esi
push ebp
push str._s_s_r_n
push 0x43ce28
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4487ec]
push dword [eax + 0x150]
push esi
call fcn.00405fee
push 4
push 0xc0000000
push esi
call fcn.00405a33
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x4063a5
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40639e
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40639e
cmp edi, dword [esp + 0x18]
jne 0x40639e
push str._Rename__r_n
push esi
call fcn.00405f98
test eax, eax
jne 0x4063b2
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.00405bc3
add edi, 0xa
mov eax, edi
push ebx
push 0x43ce28
add eax, esi
push eax
call fcn.004059ef
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4488d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x408d70
add eax, 0xa
push eax
call fcn.00405f98
test eax, eax
je 0x406369
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x4063d9
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4063ce
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x40636b
Function at 0x406605
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43f76c], 0
jne 0x406643
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406619
mov dword [ecx*4 + 0x43f768], eax
inc ecx
cmp ecx, 0x100
jl 0x406614
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406670
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43f768]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406651
not eax
pop ebp
ret 0xc
Function at 0x402400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402415
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402454
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402450
lea ebx, [ebx]
cmp esi, edx
jae 0x402454
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402440
cmp esi, edx
jb 0x402459
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4032c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0041f960
call fcn.0041bcc0
mov esi, dword [ebp + 0xc]
mov edi, eax
mov ebx, dword [ebp + 8]
push 5
push esi
push ebx
call fcn.0040a1d0
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x4033a4
push 0xf0
push esi
push ebx
call fcn.0040a1d0
mov ecx, dword [sym.imp.KERNEL32.dll_LoadResource]
add esp, 0xc
mov dword [ebp - 4], 0
test eax, eax
je 0x403326
push eax
push ebx
call ecx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
push dword [ebp - 8]
xor esi, esi
push ebx
call ecx
test eax, eax
je 0x403391
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x403391
push dword [ebp - 4]
push eax
call fcn.004181e0
add esp, 8
mov ebx, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov edi, eax
push edi
call fcn.004126f0
add esp, 4
test al, al
jne 0x403378
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebx, dword [ebp - 8]
je 0x403399
test ebx, ebx
je 0x403399
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x403399
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4033a4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fb84
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x44f1f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x58], esi
mov dword [esi], 0x443290
mov dword [esi + 0x28], 0x4432a4
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov word [ebp - 0x40], ax
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], 2
lea ecx, [eax + 0x72]
mov dword [ebp - 0x1c], 0x690042
mov eax, dword [esi + 0x46c]
mov dword [ebp - 0x18], 0x68006c
mov dword [ebp - 0x14], 0x75
mov dword [ebp - 0x50], 0x690048
mov dword [ebp - 0x4c], 0x6a0074
mov dword [ebp - 0x48], 0x670075
mov dword [ebp - 0x44], 0x6f0074
mov dword [ebp - 0x3c], 0x65004a
mov dword [ebp - 0x38], 0x79006a
mov dword [ebp - 0x34], 0x69006c
mov dword [ebp - 0x30], 0x6b0072
mov dword [ebp - 0x28], 0x690058
mov dword [ebp - 0x24], 0x670072
mov dword [ebp - 0x20], 0x68
test eax, eax
je 0x40735c
push eax
call edi
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
call fcn.00401450
mov ecx, 0x450c80
call fcn.00417840
mov eax, dword [esi + 0x468]
test eax, eax
je 0x40737f
push eax
call edi
push ecx
lea eax, [ebp - 0x50]
mov ecx, esp
push eax
call fcn.00401450
mov ecx, 0x450c80
call fcn.00417840
mov eax, dword [esi + 0x470]
test eax, eax
je 0x4073a2
push eax
call edi
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00401450
mov ecx, 0x450c80
call fcn.00417840
mov eax, dword [esi + 0x464]
test eax, eax
je 0x4073c5
push eax
call edi
push ecx
lea eax, [ebp - 0x3c]
mov ecx, esp
push eax
call fcn.00401450
mov ecx, 0x450c80
call fcn.00417840
lea ecx, [esi + 0x47c]
call fcn.00407020
lea ecx, [esi + 0x418]
call fcn.00406d40
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00406aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004258e7
mov esp, ebp
pop ebp
ret
Function at 0x407620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x42507e
mov eax, dword [0x450df4]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0x42509a
call fcn.00425157
test eax, eax
je 0x4250d8
mov eax, dword [0x450df4]
cmp eax, 1
jne 0x4250b5
push 0xd
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4250d8
jmp 0x425127
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x425127
push 0x40
mov eax, 0x1000
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4250ea
push ebx
push ebx
push ebx
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi]
push dword [0x450df4]
call edi
mov edi, eax
test edi, edi
je 0x42510b
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x425127
lea edi, [esi + 0xff0]
push esi
push dword [0x450df4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x425111
mov eax, esi
pop edi
pop esi
pop ebx
ret