joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417117
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00416837
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
inc dword [edx]
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
push eax
cld
invalid
inc dword [ebx]
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00416882
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00416837
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
invalid
call dword [ecx]
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00416882
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00416837
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00416872
popfd
dec esi
adc byte [eax - 0x5335b], al
inc dword [eax]
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
aam 0xc6
test ecx, edx
cli
invalid
invalid
sti
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
test esi, edx
cli
invalid
push esi
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
invalid
sti
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.00416882
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00416837
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.00416872
into
cmp dword [edx], ebp
mov dword [0xf99ca580], eax
invalid
Function at 0x41e3b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x41e3ce
mov edi, dword [esi + 0xc]
jmp 0x41e40e
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41e3e7
call fcn.0040ea98
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x41e3fc
call fcn.0040ea98
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x41e40e
call fcn.0040ea98
call fcn.00403835
cmp dword [eax + 0x3c], 0
je 0x41e423
push edi
mov ecx, ebx
call fcn.0041daed
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0041e600
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x41e44c
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x41e458
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42df95
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0040b2bc
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42dfd1
call fcn.0042e1b7
mov dword [esi + 0xc], 1
jmp 0x42dfd6
call fcn.0042e1b7
cmp dword [esi], 0
je 0x42e01f
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x42dff9
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00405c18
jmp 0x42e00a
push 0xff
mov ecx, esi
call fcn.004022e0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004084a3
jmp 0x42e043
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x42e043
push dword [esi]
push dword [ebp - 4]
call fcn.0041c574
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42e10c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042e1b7
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42e154
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00405c18
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004084a3
jmp 0x42e15f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041c574
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4355b9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5dcc38], 0
push edi
mov edi, ecx
jne 0x4355d2
xor eax, eax
jmp 0x43566c
push ebx
push esi
xor ebx, ebx
push ebx
push 0x40
push ebx
call fcn.0040b817
push ebx
push 1
mov ecx, edi
call fcn.00435555
push eax
call fcn.0040cad6
push eax
mov ecx, edi
call fcn.00402dc0
push 1
push ebx
mov ecx, edi
call fcn.00435555
push eax
call fcn.0040cad6
push eax
mov ecx, edi
call fcn.00402dc0
mov eax, dword [edi]
mov esi, dword [eax + 0x194]
mov ecx, esi
call fcn.005457e6
mov ecx, edi
call esi
cmp dword [edi + 0x154], ebx
jne 0x435667
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
js 0x435667
mov eax, dword [edi]
lea ecx, [ebp - 0xc]
push ecx
mov esi, dword [eax + 0x188]
mov ecx, esi
call fcn.005457e6
mov ecx, edi
call esi
push dword [ebp - 8]
mov ecx, dword [0x5dcc38]
call fcn.0047a701
xor eax, eax
pop esi
inc eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4465d8
Capabilities:
Get common file path

Disassembly:
push 0x78
mov eax, 0x56b46e
call fcn.00545823
mov ebx, ecx
cmp dword [0x5dcc38], 0
jne 0x4465f4
call fcn.0040df25
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push esi
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jns 0x44660c
xor eax, eax
jmp 0x446717
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x446605
push 0xc
push 0x40
mov dword [ebp - 0x40], 0x67
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4465ef
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
push dword [ebp - 0x14]
mov ecx, dword [0x5dcc38]
call fcn.0047a672
mov dword [edi], esi
lea ecx, [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebx]
push edi
push ecx
mov dword [ebp - 0x1c], edi
mov esi, dword [eax + 0x164]
mov ecx, esi
call fcn.005457e6
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
and dword [ebp - 4], 0
push dword [eax - 0xc]
call fcn.004022e0
mov dword [ebp - 0x30], eax
mov eax, dword [ebx]
push 0
push edi
mov esi, dword [eax + 0x168]
mov ecx, esi
call fcn.005457e6
mov ecx, ebx
call esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebx]
push 1
push edi
mov esi, dword [eax + 0x168]
mov ecx, esi
call fcn.005457e6
mov ecx, ebx
call esi
push 0xa
pop ecx
mov dword [ebp - 0x24], eax
lea esi, [ebp - 0x40]
lea eax, [ebp - 0x84]
mov dword [ebp - 0x20], 1
push eax
push 0
push 0x1100
push dword [ebx + 0x20]
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x80], 0xffff0002
mov dword [ebp - 0x84], 0xffff0000
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 2
push 0x1102
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call fcn.005457e6
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401f40
xor eax, eax
inc eax
call fcn.005457ec
ret
Function at 0x45447c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x454495
call fcn.00403835
mov esi, dword [eax + 0xc]
push 0x582684
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x4544eb
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4544ea
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4544cb
xor esi, esi
jmp 0x4544e1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004544f3
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4e6859
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x571d86
call fcn.00545857
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403300
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x579ed4
call fcn.004113ab
cmp eax, 0xffffffff
jne 0x4e6924
push 0
push 0x582640
lea ecx, [ebp - 0x278]
call fcn.004113ab
cmp eax, 0xffffffff
jne 0x4e6924
push 0
push 0x579e40
lea ecx, [ebp - 0x278]
call fcn.004113ab
cmp eax, 0xffffffff
jne 0x4e6924
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00403300
mov edi, eax
pop ecx
mov dword [ebp - 0x27c], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x280], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x114]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4e6901
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005457e6
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.00401f40
jmp 0x4e695c
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.00402480
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00401f40
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4e694a
mov edi, dword [ebp - 0x274]
jmp 0x4e695c
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.005457e6
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00401f40
mov eax, edi
call fcn.00545801
ret

Function at 0x549cf9
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x5a1bbc
push str.FlsAlloc
push 0
call fcn.00549c79
mov esi, eax
add esp, 0x10
test esi, esi
je 0x549d2b
push dword [ebp + 8]
mov ecx, esi
call fcn.005457e6
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x549d6d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x5a1be0
push str.FlsGetValue
push 2
call fcn.00549c79
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x549d9e
mov ecx, esi
call fcn.005457e6
call esi
jmp 0x549da4
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x549da7
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x5a1bf4
push str.FlsSetValue
push 3
call fcn.00549c79
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x549ddb
mov ecx, esi
call fcn.005457e6
call esi
jmp 0x549de1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x55e73f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055e3ff

Function at 0x562e50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5d4e64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x9c
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x562eab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Microsoft_Windows
push 0x100
push esi
call fcn.0054cc60
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544e9b
mov esp, ebp
pop ebp
ret
movzx eax, word [ebp - 0x8c]
push ebx
mov ebx, dword [ebp - 0x11c]
push edi
mov edi, dword [ebp - 0x118]
test eax, eax
je 0x562ee2
push eax
push edi
push ebx
push str._Version__d._d_Service_Pack__d_
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00401ad0
add esp, 0x18
jmp 0x562efd
push edi
push ebx
push str._Version__d._d_
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00401ad0
add esp, 0x14
cmp ebx, 5
jne 0x562f40
test edi, edi
jne 0x562f17
lea eax, [ebp - 0x84]
push eax
push str.Windows_2000__s
jmp 0x562fb3
cmp edi, 1
jne 0x562f2d
lea eax, [ebp - 0x84]
push eax
push str.Windows_XP__s
jmp 0x562fb3
cmp edi, 2
jne 0x562fa7
lea eax, [ebp - 0x84]
push eax
push str.Windows_2003__s
jmp 0x562fb3
cmp ebx, 6
jne 0x562f90
test edi, edi
jne 0x562f57
lea eax, [ebp - 0x84]
push eax
push str.Windows_Vista__s
jmp 0x562fb3
cmp edi, 1
jne 0x562f6a
lea eax, [ebp - 0x84]
push eax
push str.Windows_7__s
jmp 0x562fb3
cmp edi, 2
jne 0x562f7d
lea eax, [ebp - 0x84]
push eax
push str.Windows_8__s
jmp 0x562fb3
cmp edi, 3
jne 0x562fa7
lea eax, [ebp - 0x84]
push eax
push str.Windows_8.1__s
jmp 0x562fb3
cmp ebx, 0xa
jne 0x562fa7
test edi, edi
jne 0x562fa7
lea eax, [ebp - 0x84]
push eax
push str.Windows_10__s
jmp 0x562fb3
lea eax, [ebp - 0x84]
push eax
push str.Windows__s
push 0x100
push esi
call fcn.00401ad0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
mov eax, 1
pop edi
pop ebx
pop esi
call fcn.00544e9b
mov esp, ebp
pop ebp
ret
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x41aedc
pop dword [ebp - 0x3c]
mov eax, 0x10dd5d67
add eax, 0xef645175
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3afa4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x4eae
xor edi, edi
add edi, eax
mov ebx, 0x9fac1368
sub ebx, 0x9f685b68
add ebx, dword [ebp - 0x3c]
mov esi, 0x8b335eb6
add dword [ebp - 4], 0xaad29cbf
mov edx, dword [ebx]
xor dword [ebp - 8], 0x8a99ed4d
add edx, esi
xor dword [ebp - 0x2c], 0x481f0273
mov dword [edi], edx
mov dword [ebp - 0x14], 0x885ef0dd
add edi, 0xe2e3c85
sub edi, 0xe2e3c81
add ebx, 0xf2d2d418
add ebx, 0xd2d2bec
loop 0x41af2c
add eax, 0x12d8b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xdf015b1e
add ecx, 0x213ea4e2
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x434080
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x434098
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x434176
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x434171
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00434a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x43414a
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x43414a
xor eax, eax
jmp 0x434176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x43408f
mov esp, ebp
pop ebp
ret

Function at 0x434a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x434a85
xor eax, eax
jmp 0x434a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.004046ee
mov ebx, eax
test ebx, ebx
jne 0x401c30
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x401d03
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401d03
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d03
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x401c94
cmp esi, ecx
jae 0x401d03
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x401c82
cmp esi, ecx
jae 0x401d03
movzx eax, word [esi]
test ax, ax
je 0x401d03
mov ebx, dword [ebp - 4]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov edx, dword [ebx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x401cca
push edi
mov ecx, ebx
call fcn.00401d20
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x401ccd
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0041db74
push eax
call fcn.00401280
mov eax, dword [ebx]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x401d0e
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
pop esi
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401310
int3
Function at 0x4029e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x402aea
test eax, 0xffff0000
jne 0x402aea
push esi
push edi
movzx edi, ax
push edi
call fcn.004046ee
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x402ae6
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402ae6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402ae6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402ae6
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402a79
cmp esi, ecx
jae 0x402ae6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402a67
cmp esi, ecx
jae 0x402ae6
movzx eax, word [esi]
test ax, ax
je 0x402ae6
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402aac
push edi
mov ecx, ebx
call fcn.00401d20
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x402aaf
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0041db74
add esp, 0x10
cmp eax, 0x50
ja case.0x402acd.1
movzx eax, byte [eax + 0x402b18]
jmp dword [eax*4 + 0x402b08]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402afd
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0040404c
call fcn.00404066
push 0x80070057
call fcn.00401310
nop
aam 0x2a
inc eax
add al, bh
sub al, byte [eax]
sub al, byte [eax]
sub al, byte [eax]
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3