joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011f9
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001100
call fcn.010013e4
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1001236
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001236
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100124e
cmp eax, 0x20b
je 0x100123b
mov dword [ebp - 0x1c], ebx
jmp 0x1001262
cmp dword [ecx + 0x84], 0xe
jbe 0x1001236
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x100125c
cmp dword [ecx + 0x74], 0xe
jbe 0x1001236
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100201c], 0xffffffff
or dword [0x1002020], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1002018]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002014]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002024], eax
call fcn.010013de
cmp dword [section..data], ebx
jne 0x10012bd
push fcn.010013de
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010013cc
push 0x100106c
push 0x1001068
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002010]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x100200c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001064
push 0x1001060
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x1001353
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1001327
cmp al, 0x22
jne 0x1001319
cmp byte [esi], 0x22
jne 0x1001330
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x100133a
cmp al, 0x20
jbe 0x100132c
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x100135e
movzx eax, word [ebp - 0x48]
jmp 0x1001361
cmp byte [esi], 0x20
jbe 0x1001330
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1001353
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100137e
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10013b3
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100141d
ret

Function at 0x434221
Capabilities:
Encode data using xor

Disassembly:
push dword [ebp - 0x78]
call fcn.0042ef07
mov eax, edi
pop edi
pop esi
pop ebx
leave
mov al, byte [0x8b559510]
push ebp
mov ebp, esp
push ebp
mov ebp, esp
xchg ecx, eax
push esi
xor edi, eax
jne 0x434210
sub eax, 0x4d741041
lea eax, [ebp - 5]
push eax
fcmovne st(0), st(6)
push dword [ebp + 0x10]
call fcn.0043402d
push ebx
invalid
Function at 0x40229e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [esi + 0xd0]
test ecx, ecx
je 0x4022ca
call fcn.00404ab9
and dword [esi + 0xd0], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push eax
call fcn.0052d270
pop ecx
pop ecx
lea edx, [ebp - 0x22c]
call fcn.004049a5
pop ecx
lea ecx, [ebp - 0x22c]
call fcn.004046ec
push 0x6c
pop ecx
push 0x64
pop edx
push 0x2e
pop eax
mov word [ebp - 0x1e], ax
xor eax, eax
mov word [ebp - 0x16], ax
push 0x72
mov word [ebp - 0x18], cx
mov word [ebp - 0x1c], dx
mov word [ebp - 0x22], dx
mov word [ebp - 0x24], dx
lea edx, [ebp - 0x24]
mov word [ebp - 0x1a], cx
lea ecx, [ebp - 0x22c]
pop eax
mov word [ebp - 0x20], ax
call fcn.0040476a
lea ecx, [ebp - 0x22c]
call fcn.004047da
test eax, eax
je 0x4023af
lea ecx, [ebp - 0x22c]
call fcn.00404a5f
mov dword [esi + 0xd0], eax
test eax, eax
je 0x4023af
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xe], 0x69746163
push ecx
push eax
mov word [ebp - 0x14], 0x6f4d
mov word [ebp - 0x11], 0x6669
mov dword [ebp - 9], 0x44426e
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xf], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xd4], eax
test eax, eax
je 0x4023af
push ecx
push dword [esi + 0xd0]
mov edx, eax
call fcn.004045d9
pop ecx
pop ecx
mov dword [esi + 0xd8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x40418f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00403e7c
mov esi, eax
test esi, esi
je 0x4041ff
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6d6d6f43
push eax
push esi
mov word [ebp - 0xb], 0x4573
mov dword [ebp - 0x1c], 0x74696e49
mov dword [ebp - 0x13], 0x6e6f436e
mov word [ebp - 0xe], 0x6f72
mov byte [ebp - 0xc], 0x6c
mov word [ebp - 9], 0x78
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0xf], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4041f8
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x404212
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push edi
mov edi, edx
mov dword [ebp - 0x30], eax
call fcn.00403ef6
mov esi, eax
test esi, esi
je 0x4042b2
lea eax, [ebp - 0x28]
mov dword [ebp - 0x13], 0x616c5064
push eax
push esi
mov word [ebp - 0x20], 0x7669
mov dword [ebp - 0x19], 0x67756c50
mov dword [ebp - 0xb], 0x73656369
mov dword [ebp - 0x28], 0x61647055
mov dword [ebp - 0x24], 0x72446574
mov dword [ebp - 0x1d], 0x726f4672
mov word [ebp - 0x15], 0x6e41
mov word [ebp - 7], 0x57
mov word [ebp - 0xe], 0x6544
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xc], 0x76
mov byte [ebp - 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4042ab
push dword [ebp - 0x30]
push 1
push dword [ebp - 0x2c]
push edi
push ebx
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x4042c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00403f5f
mov esi, eax
test esi, esi
je 0x40432c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0x776f646e
push eax
push esi
mov word [ebp - 6], 0x78
mov dword [ebp - 0xb], 0x6b6f6f48
mov dword [ebp - 0x14], 0x69576b6f
mov byte [ebp - 7], 0x45
mov dword [ebp - 0x18], 0x6f686e55
mov byte [ebp - 0xc], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404325
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x40433f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
call fcn.00403f5f
mov esi, eax
test esi, esi
je 0x4043a2
lea eax, [ebp - 0x14]
mov dword [ebp - 0xd], 0x65676173
push eax
push esi
mov word [ebp - 0xf], 0x7365
mov dword [ebp - 0x14], 0x74736f50
mov word [ebp - 9], 0x57
mov byte [ebp - 0x10], 0x4d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40439b
push ebx
push ebx
push edi
push dword [ebp - 0x18]
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x4043b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x43746547
push eax
xor ebx, ebx
mov word [ebp - 8], 0x656e
mov word [ebp - 0xb], 0x4c64
mov word [ebp - 6], 0x57
mov dword [ebp - 0x10], 0x616d6d6f
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 9], 0x69
call fcn.00403fce
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404408
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x404419
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.00404047
mov esi, eax
test esi, esi
je 0x40446c
lea eax, [ebp - 0x14]
mov dword [ebp - 0xa], 0x657a696c
push eax
push esi
mov dword [ebp - 0x14], 0x6e556f43
mov dword [ebp - 0xe], 0x61697469
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404465
call eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x40447b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
inc edi
call fcn.00404047
mov esi, eax
test esi, esi
je 0x4044d0
lea eax, [ebp - 0x14]
mov dword [ebp - 0xb], 0x657a69
push eax
push esi
mov dword [ebp - 0x10], 0x61697469
mov dword [ebp - 0x14], 0x6e496f43
mov byte [ebp - 0xc], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4044c9
push 0
call eax
mov edi, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x4044e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
inc edi
call fcn.00404047
mov esi, eax
test esi, esi
je 0x40455b
lea eax, [ebp - 0x18]
mov word [ebp - 0xa], 0x6563
push eax
push esi
mov word [ebp - 0xd], 0x6174
mov dword [ebp - 0x12], 0x6e496574
mov byte [ebp - 0xe], 0x73
mov dword [ebp - 0x16], 0x61657243
mov word [ebp - 0x18], 0x6f43
mov byte [ebp - 8], 0
mov byte [ebp - 0xb], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404554
push ebx
push 0x58a6f0
push 0x15
push 0
push 0x58a720
call eax
mov edi, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x4045d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
call fcn.00403f5f
mov esi, eax
test esi, esi
je 0x404657
lea eax, [ebp - 0x18]
mov dword [ebp - 0xa], 0x577845
push eax
push esi
mov word [ebp - 0xe], 0x6f48
mov word [ebp - 0x14], 0x6e69
mov word [ebp - 0x17], 0x7465
mov word [ebp - 0x11], 0x776f
mov byte [ebp - 0x18], 0x53
mov word [ebp - 0xc], 0x6b6f
mov byte [ebp - 0x15], 0x57
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0xf], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404650
push ebx
push dword [ebp - 0x1c]
push edi
push 3
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x40466a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x1c], edx
mov edi, ecx
xor ebx, ebx
call fcn.004040ac
mov esi, eax
test esi, esi
je 0x4046d9
lea eax, [ebp - 0x18]
mov word [ebp - 0xd], 0x6f54
push eax
push esi
mov word [ebp - 0x13], 0x646e
mov dword [ebp - 0x18], 0x6d6d6f43
mov dword [ebp - 0xa], 0x57766772
mov dword [ebp - 0x11], 0x656e694c
mov byte [ebp - 0xb], 0x41
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 6], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4046d2
push dword [ebp - 0x1c]
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x4046ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.0040411c
mov esi, eax
test esi, esi
je 0x404757
lea eax, [ebp - 0x18]
mov dword [ebp - 9], 0x57636570
push eax
push esi
mov dword [ebp - 0xf], 0x6c694665
mov dword [ebp - 0x16], 0x65526874
mov word [ebp - 0x12], 0x6f6d
mov word [ebp - 0xb], 0x5365
mov byte [ebp - 5], bl
mov word [ebp - 0x18], 0x6150
mov byte [ebp - 0x10], 0x76
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404750
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x40476a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov edi, ecx
xor ebx, ebx
call fcn.0040411c
mov esi, eax
test esi, esi
je 0x4047c7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x68746150
push eax
push esi
mov dword [ebp - 0xa], 0x646e6570
mov word [ebp - 6], 0x57
mov word [ebp - 0xc], 0x7041
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4047c0
push dword [ebp - 0x14]
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x4047da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.0040411c
mov esi, eax
test esi, esi
je 0x404838
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x73697845
push eax
push esi
mov dword [ebp - 0x12], 0x69466874
mov dword [ebp - 8], 0x577374
mov word [ebp - 0x14], 0x6150
mov word [ebp - 0xe], 0x656c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404831
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x40484b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4c746547
push eax
xor ebx, ebx
mov dword [ebp - 0xb], 0x726f72
mov dword [ebp - 0xf], 0x72457473
mov byte [ebp - 0x10], 0x61
call fcn.00403fce
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40488f
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x4048a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00403f5f
mov esi, eax
test esi, esi
je 0x404916
lea eax, [ebp - 0x1c]
mov word [ebp - 0x10], 0x776f
push eax
push esi
mov dword [ebp - 0x15], 0x6e695772
mov word [ebp - 0x1a], 0x6967
mov word [ebp - 0x17], 0x6574
mov dword [ebp - 0xd], 0x61737365
mov word [ebp - 0x1c], 0x6552
mov byte [ebp - 0x18], 0x73
mov dword [ebp - 9], 0x576567
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xe], 0x4d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40490f
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x404929
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.00403f5f
mov esi, eax
test esi, esi
je 0x404992
lea eax, [ebp - 0x14]
mov word [ebp - 0xd], 0x776f
push eax
push esi
mov dword [ebp - 0xb], 0x736f50
mov dword [ebp - 0x12], 0x6e695774
mov word [ebp - 0x14], 0x6553
mov byte [ebp - 0xe], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40498b
push ebx
push 1
push 1
mov ecx, 0xffffd8f0
push ecx
push ecx
push 1
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x4049a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x4d746547
push eax
mov esi, edx
mov word [ebp - 0xb], 0x614e
xor ebx, ebx
mov dword [ebp - 9], 0x57656d
mov word [ebp - 0x13], 0x7564
mov dword [ebp - 0x10], 0x6c694665
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x14], 0x6f
call fcn.00403fce
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404a07
push 0x104
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x404a5f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xf], 0x61726269
push eax
mov esi, ecx
mov dword [ebp - 0x13], 0x4c64616f
xor ebx, ebx
mov dword [ebp - 0xb], 0x577972
mov byte [ebp - 0x14], 0x4c
call fcn.00403fce
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404aa7
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret

Function at 0x404b69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b01b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov edi, ecx
xor ebx, ebx
call fcn.00403f5f
mov esi, eax
test esi, esi
je 0x404bcd
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe], 0x54776f64
push eax
push esi
mov dword [ebp - 0x13], 0x69577465
mov dword [ebp - 9], 0x577478
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x14], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404bc6
push dword [ebp - 0x18]
push edi
call eax
mov ebx, eax
mov ecx, esi
call fcn.00404ab9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b85c
mov esp, ebp
pop ebp
ret
Function at 0x41242e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041cbb2
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412465
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00412486
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x416cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x416d15
call fcn.0041cbb2
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x416d15
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x416d31
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0048666a
mov ebx, eax
test edi, edi
je 0x416d2f
test esi, esi
je 0x416d2f
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f187c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041b6c8
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4f18b8
call fcn.004f1a9b
mov dword [esi + 0xc], 1
jmp 0x4f18bd
call fcn.004f1a9b
cmp dword [esi], 0
je 0x4f1906
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4f18e0
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00411d17
jmp 0x4f18f1
push 0xff
mov ecx, esi
call fcn.00402f42
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00411d3a
jmp 0x4f192a
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4f192a
push dword [esi]
push dword [ebp - 4]
call fcn.0041dc6a
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f19f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004f1a9b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4f1a38
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00411d17
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00411d3a
jmp 0x4f1a43
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041dc6a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4f3610
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005274e4
call fcn.0041cc06
cmp dword [eax + 0x14], 0
jne 0x4f362b
mov ecx, esi
pop esi
jmp fcn.004f29de
pop esi
ret

Function at 0x524ff0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00418e5d
call fcn.0041cc06
cmp dword [eax + 0x14], 0
jne 0x52500b
mov ecx, esi
pop esi
jmp fcn.0052487b
pop esi
ret