joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000567b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001ae0c
call fcn.1001a6e0
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100056f8
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x100056f8
call fcn.10003dca
mov esi, eax
jmp 0x100057fe
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000571b
call fcn.10003dca
jmp 0x100057f1
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10005711
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000574e
mov esi, 0x8007000e
jmp 0x100057f3
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x1000582c
jb 0x10005769
cmp eax, 0xffffffff
ja 0x1000582c
cmp eax, 0x400
jbe 0x1000577e
push eax
lea ecx, [ebp - 0x418]
call fcn.10007021
jmp 0x100057a0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x100057a0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10005744
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10005711
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10007021
mov esi, eax
test edi, edi
je 0x100057fe
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10005817
lea ecx, [ebp - 0x418]
call fcn.10003d92
lea ecx, [ebp - 0x428]
call fcn.10004436
mov eax, esi
call fcn.1001a631
ret 0x10
push 0x80070216
call fcn.10007021
int3
Function at 0x10005e6b
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1001aed0
call fcn.1001a63e
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x20
call fcn.10007021
mov esi, eax
pop ecx
test esi, esi
je 0x10005eab
and dword [esi + 4], 0
lea ecx, [esi + 8]
mov edi, ecx
xor eax, eax
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
and dword [esi + 0x18], 0
mov edi, dword [ebp - 0x10]
jmp 0x10005ead
xor esi, esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
jne 0x10005ec2
mov ebx, 0x8007000e
jmp 0x10005fa1
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [esi], edi
test edi, edi
je 0x10005f1b
test ebx, ebx
je 0x10005f9c
cmp dword [ebp + 8], 0
jne 0x10005f9c
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call ebx
mov edi, eax
mov eax, dword [esi + 4]
cmp edi, eax
je 0x10005f15
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x10005f0f
push edi
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x10005fe5
jmp 0x10005f37
and dword [esi + 4], 0
xor eax, eax
test eax, eax
jne 0x10005f37
jmp 0x10005eb8
test ebx, ebx
jne 0x10005f9c
cmp dword [ebp + 8], ebx
je 0x10005f9c
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantChangeType]
mov ebx, eax
test ebx, ebx
js 0x10005fa1
lea ecx, [esi + 0x18]
call fcn.10007021
mov ebx, eax
test ebx, ebx
js 0x10005fa1
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fef
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x10006064
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10005f8b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10005f8f
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x10005fa1
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10005fa1
mov ebx, 0x80070057
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10005fdb
mov dword [ebp - 4], 8
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fc1
and dword [esi + 0x18], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esi + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call fcn.10007021
pop ecx
mov eax, ebx
call fcn.1001a60f
ret 4
push 0x8007000e
call fcn.10007021
push 0
push 0x152139a
call fcn.10007021
int3
Function at 0x10007021
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007030
pop dword [ebp - 0x34]
mov eax, 0x10007030
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe4926318
sub dword [ebp - 0x44], 0x96401dcd
mov dword [ebp - 0x40], 0xf0fd6622
sub dword [ebp - 0x40], 0xbeca19dd
mov dword [ebp - 0x3c], 0xf1aa6488
sub dword [ebp - 0x3c], 0xa55e205a
mov dword [ebp - 0x38], 0xda060b72
sub dword [ebp - 0x38], 0xda060b72
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xfa6433a8
add dword [ebp - 0x44], 0x7a0e35ae
mov dword [ebp - 0x40], 0x117d8953
sub dword [ebp - 0x40], 0xd01127de
mov dword [ebp - 0x3c], 0xec1baa00
add dword [ebp - 0x3c], 0x7753c26c
mov dword [ebp - 0x38], 0x7d5454f1
sub dword [ebp - 0x38], 0x7d5454f1
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x3d279ef6
add eax, 0xd2da2152
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39774
push 0
call eax
mov ecx, 0x81056f1b
sub ecx, 0x81052ffe
xor esi, esi
add esi, eax
mov edx, 0xafd3d6b6
sub edx, 0x9fd13cb6
add edx, dword [ebp - 0x34]
mov ebx, 0xe2f67b2d
add ebx, 0x91cacf61
xor dword [ebp - 0x18], 0xa08cc0d5
mov edi, dword [edx]
add dword [ebp - 0x14], ebx
xor edi, ebx
sub dword [ebp - 0x28], 0x59899257
mov dword [esi], edi
add esi, 4
add edx, 0x1aed008f
add edx, 0xe512ff75
loop 0x1000714a
add eax, 0x85014832
sub eax, 0x850058eb
xor ebx, ebx
add ebx, eax
add eax, 0x624000de
sub eax, 0x624000d9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x409610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5414f8
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5de7dc]
cmp eax, dword [ecx + 4]
jle 0x4096d8
push 0x5de7dc
call fcn.00521b77
add esp, 4
cmp dword [0x5de7dc], 0xffffffff
jne 0x4096d8
mov dword [ebp - 4], 1
xor eax, eax
mov dword [0x5de7f0], 0
mov dword [0x5de7f4], 0
mov dword [0x5de7f0], 0
mov dword [0x5de7f4], 7
mov word [0x5de7e0], ax
mov byte [ebp - 4], 1
push 0x577280
call fcn.00521a2f
add esp, 4
mov byte [ebp - 4], 0
push 0x5de7dc
call fcn.00521b2d
add esp, 4
cmp dword [0x5de7f0], 0
jne 0x40978d
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40978d
add eax, eax
cmp eax, 0x208
jae 0x4097c6
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409744
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c80
mov dword [ebp - 4], 4
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x5de7e0
call fcn.00486790
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f50
push 0x5de7e0
mov ecx, esi
call fcn.00406c70
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521781
mov esp, ebp
pop ebp
ret
call fcn.00521d6e
int3
Function at 0x4098a0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541679
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x238], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x234], 0
cmp dword [edx + 0x14], 8
jb 0x4098f0
mov edx, dword [edx]
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40992f
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 1
jmp 0x409a10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409985
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c80
mov dword [ebp - 4], 3
lea eax, [ebp - 0x230]
push 1
sub esp, 0x18
mov dword [ebp - 0x238], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.00406c70
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00486860
add esp, 0x18
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.00486c90
mov byte [ebp - 4], 3
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521781
mov esp, ebp
pop ebp
ret
Function at 0x409fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54199b
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov eax, dword [0x5de7f8]
cmp eax, dword [edi + 4]
jle 0x40a02b
push 0x5de7f8
call fcn.00521b77
add esp, 4
cmp dword [0x5de7f8], 0xffffffff
jne 0x40a02b
mov dword [ebp - 4], 0
mov ecx, 0x5de7fc
call fcn.0040a1b0
mov byte [ebp - 4], 0
push 0x5772d0
call fcn.00521a2f
mov dword [ebp - 4], 0xffffffff
push 0x5de7f8
call fcn.00521b2d
add esp, 8
mov eax, dword [0x5de7c0]
cmp eax, dword [edi + 4]
jle 0x40a0a7
push 0x5de7c0
call fcn.00521b77
add esp, 4
cmp dword [0x5de7c0], 0xffffffff
jne 0x40a0a7
mov dword [ebp - 4], 2
xor eax, eax
mov dword [0x5de7d4], 0
mov dword [0x5de7d8], 0
mov dword [0x5de7d4], 0
mov dword [0x5de7d8], 7
mov word [0x5de7c4], ax
mov byte [ebp - 4], 2
push 0x577230
call fcn.00521a2f
mov dword [ebp - 4], 0xffffffff
push 0x5de7c0
call fcn.00521b2d
add esp, 8
cmp dword [esi + 0x14], 8
mov edi, esi
mov ebx, dword [esi + 0x10]
jb 0x40a0b4
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x40a0d1
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x40a0c0
push edx
push esi
lea eax, [ebp - 0x64]
mov ecx, 0x5de7fc
push eax
call fcn.0040add0
mov eax, dword [eax + 4]
test eax, eax
je 0x40a0f5
cmp eax, dword [0x5de800]
je 0x40a0f5
add eax, 0x20
jmp 0x40a0fa
mov eax, 0x5de7c4
cmp dword [eax + 0x10], 0
jne 0x40a18c
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x40a10e
mov edx, dword [esi]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004097d0
add esp, 4
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x40]
push esi
call fcn.00406c70
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
push eax
call fcn.00406c70
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x64]
mov ecx, 0x5de7fc
push eax
call fcn.0040a4e0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.00407f50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00407f50
mov esi, dword [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407f50
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521781
mov esp, ebp
pop ebp
ret
Function at 0x40b890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541e3d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [edi], 0
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
sub eax, 0x200
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x40b914
push 0x10
call ebx
bt ax, 0xf
jb 0x40b9b8
push 0x11
call ebx
bt ax, 0xf
jb 0x40b9b8
push 0x12
call ebx
bt ax, 0xf
jb 0x40b9b8
mov eax, dword [esi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x40b9fe
push 0x11
call ebx
bt ax, 0xf
jae 0x40b942
mov eax, dword [esi + 8]
cmp eax, 0x58
je 0x40b942
cmp eax, 0x43
je 0x40b942
cmp eax, 0x56
jne 0x40b9b8
push 0x12
call ebx
bt ax, 0xf
jae 0x40b95a
mov eax, dword [esi + 8]
cmp eax, 0x25
je 0x40b9b8
cmp eax, 0x27
je 0x40b9b8
cmp dword [esi + 4], 0x100
jne 0x40b9fe
mov eax, dword [esi + 8]
cmp eax, 8
jne 0x40b9b0
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.00415410
mov dword [ebp - 0x54], eax
test eax, eax
je 0x40b987
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x40b9c5
mov dl, 1
call fcn.004154f0
test al, al
je 0x40b9c5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b640
mov eax, dword [esi + 8]
add eax, 0xffffff90
cmp eax, 0xb
ja 0x40b9fe
mov dword [edi], 1
mov eax, 1
jmp 0x40ba07
mov dword [edi], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b640
mov eax, 1
jmp 0x40ba07
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00521781
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cc90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5424ad
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x40cdca
mov eax, dword [0x5de4fc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d100
mov dword [ebp - 4], 0
mov edx, eax
mov ecx, 0x5de4fc
call fcn.0040d060
mov bl, al
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40cd11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x40cd6a
mov eax, dword [0x5de4fc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d290
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cdab
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40cdab
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd6a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040d1c0
mov dword [ebp - 4], 5
mov ecx, 0x5856dc
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cde0
test dx, dx
je 0x40cda7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cde0
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cd85
xor edi, edi
jmp 0x40cde5
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cdca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb edi, edi
or edi, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40ce04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40cdca
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4150c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540e70
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x415145
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x415145
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x415127
cmp esi, edx
jae 0x415145
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x415115
cmp esi, edx
jae 0x415145
cmp word [esi], 0
je 0x415145
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4155d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543d70
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5d8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x44], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5de848]
cmp eax, dword [ecx + 4]
jle 0x4156c7
push 0x5de848
call fcn.00521b77
add esp, 4
cmp dword [0x5de848], 0xffffffff
jne 0x4156c7
mov dword [ebp - 4], 1
mov dword [0x5de84c], 0
mov dword [0x5de850], 0
mov dword [0x5de854], 0
mov byte [ebp - 4], 2
mov dword [0x5de858], 0
mov dword [0x5de85c], 0
mov dword [0x5de860], 0
mov byte [ebp - 4], 3
mov dword [0x5de864], 0
mov dword [0x5de868], 0
mov dword [0x5de86c], 0
mov byte [ebp - 4], 1
push 0x577580
call fcn.00521a2f
mov byte [ebp - 4], 0
push 0x5de848
call fcn.00521b2d
add esp, 8
push 0x585ef8
push str.html
mov edx, 0x585f0c
lea ecx, [ebp - 0x28]
call fcn.00409a30
add esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00486580
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x415700
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x50], 0x5853a8
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
call fcn.00407f50
cmp edi, 0xffffffff
jne 0x41576e
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 5
push edi
mov dword [ebp - 0x50], 0x5853a8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
jmp 0x4157f3
mov eax, dword [0x5de850]
lea ecx, [ebp - 0x28]
push ecx
cmp eax, dword [0x5de854]
je 0x415796
mov ecx, eax
mov dword [ebp - 0x58], eax
call fcn.00406c70
mov byte [ebp - 4], 8
add dword [0x5de850], 0x18
jmp 0x4157a1
push eax
mov ecx, 0x5de84c
call fcn.00490260
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x4157ab
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x48]
push 0
push edx
add eax, eax
mov dword [ebp - 0x48], 0
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0x28]
call fcn.00486580
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 5
mov dword [ebp - 0x50], 0x5853a8
test edi, edi
je 0x4157f3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407f50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521781
mov esp, ebp
pop ebp
ret
Function at 0x416240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5440ad
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5d8024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x41627a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41629b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x416287
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.0040add0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4162cc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x5d1745d
je 0x41642f
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x14], 0
call fcn.005217c3
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406c70
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movq qword [edi + 0x20], xmm0
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x59f4b0]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x59f4b0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4163bf
divss xmm0, xmm3
call fcn.0040ae60
call fcn.0053fd90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4163a3
cmp eax, 0x200
jae 0x4163a1
shl eax, 3
cmp eax, ecx
jae 0x4163a3
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00416580
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040add0
mov edx, dword [eax]
jmp 0x4163c2
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4163f5
mov dword [ecx + eax*8], edi
jmp 0x416407
cmp esi, edx
jne 0x4163fe
mov dword [ecx + eax*8], edi
jmp 0x41640b
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41640b
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0051f895
int3