joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ca6c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41cc91
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x41caa7
lea eax, [ebp - 4]
mov edx, 0x671fac
mov ecx, 0x105
call fcn.00406040
jmp 0x41cab1
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405e68
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041ca00
mov eax, dword [ebp - 8]
test eax, eax
je 0x41cac8
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x41cafc
mov edi, 1
mov eax, dword [ebp - 8]
movzx eax, byte [eax + edi - 1]
cmp al, 0x20
jb 0x41caeb
cmp al, 0x2f
je 0x41caeb
cmp al, 0x3a
je 0x41caeb
cmp al, 0x5c
jne 0x41caf8
lea eax, [ebp - 8]
call fcn.004062dc
mov byte [eax + edi - 1], 0x3f
inc edi
dec esi
jne 0x41cad3
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
push 8
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x65f3e0], eax
cmp dword [0x65f3e0], 0
je 0x41cb3a
push 0
push 0
push 0
push 6
mov eax, dword [0x65f3e0]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
jmp 0x41cb3f
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x41cc44
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x41cb8a
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x41cb8a
mov byte [0x6720d1], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [0x65f3dc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [0x6720b8], eax
mov dword [0x6720b4], 0x41c9fc
mov byte [ebp - 9], 0
jmp 0x41cc27
mov byte [0x6720d1], 1
mov dword [0x6720b4], 0x41c9f8
test bl, bl
je 0x41cba6
mov ebx, 0x4000000
jmp 0x41cba8
xor ebx, ebx
push 0
mov edi, ebx
or edi, 0x88000000
push edi
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040627c
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov dword [0x65f3dc], eax
cmp dword [0x65f3dc], 0xffffffff
jne 0x41cbff
push 0x1f4
call sub.kernel32.dll_Sleep_1
push 0
push edi
push 2
push 0
push 3
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov dword [0x65f3dc], eax
cmp dword [ebp - 0x10], 0
je 0x41cc23
cmp dword [0x65f3dc], 0xffffffff
je 0x41cc23
mov eax, dword [ebp - 0x10]
mov edx, dword [0x65f3dc]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x41c9f8
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc4b
cmp dword [ebp - 0x10], 0
je 0x41cc43
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
Function at 0x41d744
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp + 8]
cmp byte [0x671fac], 0
je 0x41d8d9
cmp dword [0x65f3dc], 0xffffffff
jne 0x41d77f
xor edx, edx
mov al, 1
call fcn.0041ca6c
test al, al
je 0x41d77f
call fcn.0041cca4
call dword [0x6720b4]
mov eax, 0x80
call fcn.004124d4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41d8d9
xor eax, eax
push ebp
push 0x41d8d2
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x41d7b7
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, eax
jmp 0x41d7b9
mov ecx, ebx
mov eax, dword [0x66c22c]
cmp ecx, dword [eax]
jne 0x41d7d9
lea eax, [ebp - 0x1c]
call fcn.00412560
mov edx, 0x671d60
lea eax, [ebp - 0x1c]
call fcn.0041257c
jmp 0x41d7e7
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00412940
mov eax, dword [ebp - 0x1c]
call fcn.004126fc
push ebp
mov eax, dword [ebp - 0x1c]
call fcn.0041cf28
pop ecx
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x41d8b5
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.0041d5b8
pop ecx
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x41d898
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [0x65f3dc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp byte [0x65f040], 0
je 0x41d882
call fcn.004202ac
test al, al
je 0x41d882
mov eax, dword [ebp - 0xc]
call fcn.0040627c
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp dword [ebp - 0x10], 0
je 0x41d882
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00406214
je 0x41d882
mov eax, dword [ebp - 0x10]
call fcn.0040627c
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d89f
mov eax, dword [ebp - 0x20]
call fcn.00411fbc
ret
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x41e130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x41e14c
test al, 0x10
jne 0x41e151
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret

Function at 0x41f5e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.0040627c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41f608
and ebx, 0xfffffff8
push ebx
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41fbdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, ebx
call fcn.0041fb8c
test al, al
je 0x41fc31
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x41fc31
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov dword [edi], eax
push esi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x41fc31
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4202cc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x420374
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004202ac
mov ebx, eax
test bl, bl
jne 0x420359
mov bl, 1
push 4
lea eax, [ebp - 4]
push eax
push 0x420384
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x420359
push 4
lea eax, [ebp - 4]
push eax
push 0x42039c
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x420359
call fcn.004039a4
mov esi, eax
test esi, esi
jle 0x420357
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00403a04
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041f130
mov eax, dword [ebp - 8]
mov edx, 0x4203b8
call fcn.00406214
je 0x420359
inc dword [ebp - 4]
dec esi
jne 0x42032c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42037b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405df4
ret
Function at 0x420560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4206d7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x672104], 0
je 0x420596
mov eax, ebx
call dword [0x672104]
movzx eax, byte [edi]
sub al, 2
jae 0x420655
mov eax, ebx
test eax, eax
je 0x4205ac
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 8]
xchg edx, eax
call fcn.0040650c
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0
je 0x4205c9
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
mov eax, ebx
call fcn.0040627c
push eax
call sub.user32.dll_CharToOemBuffA
test eax, eax
jne 0x4205f1
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405e68
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x420608
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
push esi
call sub.kernel32.dll_WriteConsoleA
test eax, eax
jne 0x420629
mov al, 1
jmp 0x420630
cmp dword [ebp - 0x10], 0
sete al
test al, al
je 0x42064c
mov eax, 0x4206f4
call fcn.00420484
test al, al
je 0x420647
mov byte [edi], 3
jmp 0x420655
mov byte [edi], 2
jmp 0x420655
mov byte [ebp - 9], 0
mov byte [edi], 1
jmp 0x4206bc
mov byte [ebp - 9], 1
cmp byte [edi], 3
jne 0x420688
mov edi, ebx
test edi, edi
je 0x420669
sub edi, 4
mov edi, dword [edi]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, edi
push eax
mov eax, ebx
call fcn.0040627c
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_FlushFileBuffers
jmp 0x4206bc
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e68
lea eax, [ebp - 4]
call fcn.004062dc
mov edx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4206a8
sub eax, 4
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push edx
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_FlushFileBuffers
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4206de
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405df4
ret
Function at 0x420924
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041f928
test eax, eax
jne 0x42094a
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x4209c6
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4209c4
xor eax, eax
push ebp
push 0x4209b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [ebp - 8]
call fcn.0040d904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4209b9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420e24
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040627c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x420e91
test ah, 4
je 0x420e8a
test bl, bl
jne 0x420e4f
mov al, 1
jmp 0x420eb8
test al, 0x10
je 0x420e57
xor eax, eax
jmp 0x420eb8
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
je 0x420e7b
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x420eb8
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x420eb8
test al, 0x10
sete al
jmp 0x420eb8
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x420eb2
cmp ebx, 3
je 0x420eb2
cmp ebx, 0x7b
je 0x420eb2
mov eax, esi
call fcn.00420de4
test al, al
jne 0x420eb6
xor eax, eax
jmp 0x420eb8
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x420ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x420edc
test al, 0x10
jne 0x420ee1
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x421c1c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x421d9b
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x421cb6
lea eax, [ebp - 4]
call fcn.00421a88
lea eax, [ebp - 0x1c]
call fcn.0040e978
lea edx, [ebp - 8]
lea eax, [ebp - 0x1c]
call fcn.004216c8
mov eax, dword [ebp - 8]
test eax, eax
je 0x421c6a
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
cmp ebx, 1
jl 0x421c99
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
cmp al, 0x7b
je 0x421c85
cmp al, 0x2d
je 0x421c85
cmp al, 0x7d
jne 0x421c94
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.00406324
dec ebx
test ebx, ebx
jne 0x421c71
push dword [ebp - 4]
push dword [ebp - 8]
push 0x421db0
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00406180
jmp 0x421d80
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.0040650c
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
push 0
mov eax, esi
call fcn.0040627c
push eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x421cfd
lea eax, [ebp - 8]
call fcn.0042126c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405e24
jmp 0x421d05
mov eax, dword [ebp - 0xc]
call fcn.00405dd0
mov eax, dword [ebp - 8]
call fcn.00422490
test al, al
jne 0x421d80
lea eax, [ebp - 4]
call fcn.00421a88
lea eax, [ebp - 0x1c]
call fcn.0040e978
lea edx, [ebp - 8]
lea eax, [ebp - 0x1c]
call fcn.004216c8
mov eax, dword [ebp - 8]
test eax, eax
je 0x421d38
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
cmp ebx, 1
jl 0x421d67
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
cmp al, 0x7b
je 0x421d53
cmp al, 0x2d
je 0x421d53
cmp al, 0x7d
jne 0x421d62
lea eax, [ebp - 8]
mov ecx, 1
mov edx, ebx
call fcn.00406324
dec ebx
test ebx, ebx
jne 0x421d3f
push dword [ebp - 4]
push esi
push dword [ebp - 8]
push 0x421db0
mov eax, dword [ebp - 0xc]
mov edx, 4
call fcn.00406180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421da2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405df4
ret

Function at 0x421db8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.004235a8
test al, al
je 0x421dcc
call fcn.00423594
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
push ebp
push 0x421dfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_TerminateThread
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x421e06
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x423810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x66bec8]
cmp byte [eax], 0
je 0x42387d
mov eax, dword [0x66b8e4]
cmp word [eax + 4], 0xd7b2
jne 0x423847
mov eax, dword [0x66b8e4]
cmp dword [eax + 0xc], 0
jbe 0x423847
mov ebx, dword [0x66b8e4]
mov ebx, dword [ebx + 0x1c]
mov eax, dword [0x66b8e4]
call ebx
push 0
lea eax, [ebp - 4]
push eax
push 0x22
push 0x65f5f4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x65f620
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x42389a
mov eax, dword [0x66c1d0]
cmp byte [eax], 0
jne 0x42389a
push 0
push 0x65f618
push 0x65f5f4
push 0
call sub.user32.dll_MessageBoxA_1
pop ebx
pop ecx
pop ebp
ret

Function at 0x4238e4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x67218c], 0
jne 0x42395a
mov eax, 0x672188
xor ecx, ecx
mov edx, 0x24
call fcn.0040d87c
push 0x672188
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [0x67218c]
mov dword [0x672150], eax
mov dword [0x672158], 0x80808080
mov eax, dword [0x672158]
xor edx, edx
div dword [0x672150]
test edx, edx
setne cl
and ecx, 0x7f
mov eax, dword [0x672158]
xor edx, edx
div dword [0x672150]
add ecx, eax
mov dword [0x672158], ecx
mov eax, dword [0x672150]
imul eax, dword [0x672158]
mov dword [0x672158], eax
pop ebp
ret
Function at 0x42395c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x2a
call sub.user32.dll_GetSystemMetrics
test eax, eax
setne byte [0x672178]
cmp dword [0x672100], 0
jne 0x423983
mov dword [0x672100], 0x4238d0
cmp dword [0x672174], 0
jne 0x423996
mov dword [0x672174], 0x422194
call fcn.004238e4
cmp dword [0x672134], 0
jne 0x423b25
push 0x423b28
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x672134], eax
push 0x423b34
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x672138], eax
push 0x423b40
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x67213c], eax
push 0x423b4c
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x672140], eax
push 0x423b58
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x672144], eax
push 0x423b64
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x672148], eax
push 0x423b74
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x67214c], eax
call fcn.00403a68
mov eax, 0xffff
call fcn.00403a90
mov ebx, eax
shl ebx, 0x10
mov eax, 0xffff
call fcn.00403a90
or ebx, eax
mov dword [0x6746fc], ebx
mov dword [0x6746f4], 0x6745d8
mov dword [0x6746f8], 0x674628
mov dword [0x672120], 0x4238a0
push 0x423b80
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x672128], eax
cmp dword [0x672128], 0
jne 0x423aa7
mov eax, 0x41f17c
mov dword [0x672128], eax
push 1
push 0x2000
call fcn.00422428
push eax
push 0xcccccccc
call dword [0x672148]
mov dword [0x674700], eax
cmp dword [0x674700], 0
je 0x423b25
mov dword [0x672164], 0xcccccccc
mov eax, dword [0x672164]
xor edx, edx
div dword [0x672150]
test edx, edx
setne cl
and ecx, 0x7f
mov eax, dword [0x672164]
xor edx, edx
div dword [0x672150]
add ecx, eax
imul ecx, dword [0x672150]
mov dword [0x672168], ecx
cmp dword [0x674700], 0
je 0x423b25
cmp dword [0x672170], 0
je 0x423b25
mov eax, dword [0x674700]
call dword [0x672170]
pop ebx
pop ebp
ret

Function at 0x423c9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x423d21
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.00420a9c
cmp dword [ebp - 0xc], 0
je 0x423d0b
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x423d0b
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov dword [edi], eax
push esi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x423d0b
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423d28
lea eax, [ebp - 0xc]
call fcn.00405dd0
ret
Function at 0x423e40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov edx, 0x40
mov eax, esi
call fcn.0041f77c
test al, al
je 0x423eb6
xor edx, edx
push ebp
push 0x423eaa
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x423e77
cmp dword [eax + 0x3c], 0
jne 0x423e81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x423eb6
mov ebx, dword [eax + 0x3c]
add ebx, esi
mov edx, 0xf8
mov eax, ebx
call fcn.0041f77c
test al, al
je 0x423e9e
cmp dword [ebx], 0x4550
je 0x423ea0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x423eb6
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x424ca8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x424cfa
test eax, edx
je 0x424cfd
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x424cbd
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x424ce3
add ecx, 4
js 0x424cd3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x424ce0
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x424d09
test edx, edx
jne 0x424cb0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x42b460
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
call fcn.0042b314
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.0040d87c
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
push 0x10
push 0x3000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov eax, dword [0x66bb1c]
mov eax, dword [eax]
call eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42b4c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
mov eax, ebx
call fcn.0042b45c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42b4d1
push 0x8000
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x66bd88]
mov eax, dword [eax]
call eax
test bl, bl
je 0x42b4f1
mov eax, dword [0x66b73c]
or dword [eax], 0x10
xor ebx, ebx
xor eax, eax
test al, al
je 0x42b574
push 4
push 0x3000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov eax, dword [0x66bb1c]
mov eax, dword [eax]
call eax
mov dword [ebp - 4], eax
mov esi, fcn.0042b45c
mov eax, esi
mov edx, 0x32
call fcn.0042afe0
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, ebx
call fcn.0040d904
mov eax, dword [ebp - 4]
xor edx, edx
push ebp
push 0x42b554
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, eax
mov eax, ebx
call esi
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42b560
push 0x8000
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x66bd88]
mov eax, dword [eax]
call eax
test bl, bl
je 0x42b58d
mov eax, dword [0x66b96c]
mov eax, dword [eax]
or eax, 2
or eax, 4
mov edx, dword [0x66b96c]
mov dword [edx], eax
call fcn.0042b408
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e16c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
mov eax, esp
xor ecx, ecx
mov edx, 0x24
call fcn.0040d87c
push esp
call sub.kernel32.dll_GetSystemInfo
mov edx, esp
mov eax, 0xdeadbeef
call fcn.0042e0e8
test al, al
jne 0x42e1f7
mov eax, dword [0x66c1ec]
cmp dword [eax], 0
je 0x42e1b3
mov dword [0x7753d4], 1
mov eax, 0xcccccccc
call fcn.0042e07c
jmp 0x42e1f7
mov edx, esp
mov eax, 0xfeeefeee
call fcn.0042e0e8
test al, al
jne 0x42e1f7
mov edx, esp
mov eax, 0xfdfdfdfd
call fcn.0042e0e8
test al, al
jne 0x42e1f7
mov edx, esp
mov eax, 0xfadedead
call fcn.0042e0e8
test al, al
jne 0x42e1f7
mov dword [0x7753d4], 1
mov eax, 0x9999
call fcn.0042e07c
add esp, 0x24
ret