joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e4ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e1f4]
jne 0x40e4c4
repz ret
jmp fcn.00410bdc

Function at 0x41930a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42e1f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041067c
and dword [ebp - 0x14], 0
cmp dword [0x43068c], 0
mov dword [ebp - 0x18], eax
jne 0x4193bd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x419465
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x419465
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43068c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x430690], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x430694], eax
call edi
push eax
call esi
mov dword [0x43069c], eax
test eax, eax
je 0x4193bd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x430698], eax
mov eax, dword [0x430698]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x419416
cmp dword [0x43069c], ecx
je 0x419416
push eax
call esi
push dword [0x43069c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x419416
test ebx, ebx
je 0x419416
call edi
test eax, eax
je 0x41940d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41940d
test byte [ebp - 8], 1
jne 0x419416
or dword [ebp + 0x10], 0x200000
jmp 0x419449
mov eax, dword [0x430690]
cmp eax, dword [ebp - 0x18]
je 0x419449
push eax
call esi
test eax, eax
je 0x419449
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x419449
mov eax, dword [0x430694]
cmp eax, dword [ebp - 0x18]
je 0x419449
push eax
call esi
test eax, eax
je 0x419449
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43068c]
call esi
test eax, eax
je 0x419465
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x419467
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e4ba
leave
ret
Function at 0x420ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
xor eax, eax
xor ebx, ebx
cmp edx, 0
je 0x420c23
mov al, byte [edi]
mov bl, byte [edi + 4]
add edi, 8
lea ecx, [esi + edx]
sub ebp, esi
mov dword [esp + 0x18], ecx
inc al
cmp dword [edi + 0x100], 0xffffffff
je 0x420bf0
mov ecx, dword [edi + eax*4]
and edx, 0xfffffffc
je 0x420bc0
lea edx, [esi + edx - 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
lea esp, [esp]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov ecx, dword [edi + eax*4]
mov ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [esp + 0x20]
or ebp, dword [edi + edx*4]
ror ebp, 8
xor ebp, dword [esi]
cmp esi, dword [esp + 0x1c]
mov dword [ecx + esi], ebp
lea esi, [esi + 4]
mov ecx, dword [edi + eax*4]
jb 0x420b20
cmp esi, dword [esp + 0x18]
je 0x420c1b
mov ebp, dword [esp + 0x20]
lea esp, [esp]
nop
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov edx, dword [edi + edx*4]
xor dl, byte [esi]
lea esi, [esi + 1]
mov ecx, dword [edi + eax*4]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x420bc0
jmp 0x420c1b
movzx ecx, byte [edi + eax]
add bl, cl
movzx edx, byte [edi + ebx]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
add dl, cl
movzx edx, byte [edi + edx]
add al, 1
xor dl, byte [esi]
lea esi, [esi + 1]
movzx ecx, byte [edi + eax]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x420bf4
dec al
mov byte [edi - 4], bl
mov byte [edi - 8], al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401abb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445090]
jne 0x401ac5
repz ret
jmp fcn.00402928

Function at 0x40b544
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407895
and dword [ebp - 4], 0
cmp dword [0x4472f8], 0
mov ebx, eax
jne 0x40b5f5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b6a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b6a6
push eax
call fcn.00407823
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4472f8], eax
call esi
push eax
call fcn.00407823
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4472fc], eax
call esi
push eax
call fcn.00407823
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x447300], eax
call esi
push eax
call fcn.00407823
pop ecx
mov dword [0x447308], eax
test eax, eax
je 0x40b5f5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407823
pop ecx
mov dword [0x447304], eax
mov eax, dword [0x447304]
cmp eax, ebx
je 0x40b64d
cmp dword [0x447308], ebx
je 0x40b64d
push eax
call fcn.0040789e
push dword [0x447308]
mov esi, eax
call fcn.0040789e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b64d
test edi, edi
je 0x40b64d
call esi
test eax, eax
je 0x40b644
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b644
test byte [ebp - 0xc], 1
jne 0x40b64d
or dword [ebp + 0x10], 0x200000
jmp 0x40b686
mov eax, dword [0x4472fc]
cmp eax, ebx
je 0x40b686
push eax
call fcn.0040789e
pop ecx
test eax, eax
je 0x40b686
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b686
mov eax, dword [0x447300]
cmp eax, ebx
je 0x40b686
push eax
call fcn.0040789e
pop ecx
test eax, eax
je 0x40b686
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4472f8]
call fcn.0040789e
pop ecx
test eax, eax
je 0x40b6a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b6a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d84b
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x445090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x1bbd92c], 0x930
jne 0x40d880
push str.fecuhabe
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x1bbd92c], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x1bbd648], eax
jne 0x40d8b7
push esi
lea eax, [ebp - 0x404]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameA
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401abb
leave
ret
Function at 0x4065d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x84], 0
push edi
mov dword [ebp - 4], 0
jle 0x406640
mov edi, dword [esi]
cmp dword [edi + 0x2c], 2
jne 0x4065fd
call fcn.00405d00
mov dword [edi + 0x2c], eax
lea eax, [esi + 0xb18]
push eax
call fcn.00406000
lea ecx, [esi + 0xb24]
push ecx
call fcn.00406000
add esp, 8
mov eax, esi
call fcn.00406200
mov edx, dword [esi + 0x16a8]
mov ecx, dword [esi + 0x16ac]
add edx, 0xa
add ecx, 0xa
shr edx, 3
shr ecx, 3
mov dword [ebp - 4], eax
cmp ecx, edx
ja 0x406645
jmp 0x406643
lea ecx, [ebx + 5]
mov edx, ecx
lea eax, [ebx + 4]
cmp eax, edx
ja 0x406667
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x406667
mov edi, dword [ebp + 0x14]
push edi
push ebx
push eax
push esi
call fcn.004062d0
add esp, 0x10
jmp 0x4067b3
cmp dword [esi + 0x88], 4
je 0x406729
cmp ecx, edx
je 0x406729
mov ecx, dword [esi + 0x16bc]
mov edi, dword [ebp + 0x14]
lea edx, [edi + 4]
cmp ecx, 0xd
jle 0x4066df
mov ax, dx
shl ax, cl
mov ecx, dword [esi + 0x14]
or word [esi + 0x16b8], ax
movzx ebx, byte [esi + 0x16b8]
mov eax, dword [esi + 8]
mov byte [ecx + eax], bl
inc dword [esi + 0x14]
movzx ebx, byte [esi + 0x16b9]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 8]
mov byte [eax + ecx], bl
mov eax, dword [esi + 0x16bc]
inc dword [esi + 0x14]
mov cl, 0x10
sub cl, al
shr dx, cl
add eax, 0xfffffff3
mov dword [esi + 0x16bc], eax
mov word [esi + 0x16b8], dx
jmp 0x4066f2
shl dx, cl
or word [esi + 0x16b8], dx
add ecx, 3
mov dword [esi + 0x16bc], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0xb28]
mov edx, dword [esi + 0xb1c]
inc eax
push eax
inc ecx
push ecx
inc edx
push edx
call fcn.004056d0
lea eax, [esi + 0x988]
push eax
lea ecx, [esi + 0x94]
push ecx
mov eax, esi
call fcn.00405920
add esp, 0x14
jmp 0x4067b3
mov ecx, dword [esi + 0x16bc]
mov edi, dword [ebp + 0x14]
lea eax, [edi + 2]
cmp ecx, 0xd
jle 0x40678c
mov dx, ax
shl dx, cl
mov ecx, dword [esi + 0x14]
or word [esi + 0x16b8], dx
movzx ebx, byte [esi + 0x16b8]
mov edx, dword [esi + 8]
mov byte [ecx + edx], bl
inc dword [esi + 0x14]
movzx ebx, byte [esi + 0x16b9]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 8]
mov byte [ecx + edx], bl
mov edx, dword [esi + 0x16bc]
inc dword [esi + 0x14]
mov cl, 0x10
sub cl, dl
shr ax, cl
add edx, 0xfffffff3
mov dword [esi + 0x16bc], edx
mov word [esi + 0x16b8], ax
jmp 0x40679f
shl ax, cl
or word [esi + 0x16b8], ax
add ecx, 3
mov dword [esi + 0x16bc], ecx
push 0x5dca98
push 0x5dc618
push dword [eax + edx*2 - 0x75]
inc edi
cmp al, 0x33
test byte [ebx - 0x7487c7b4], 0x44
cmp dword [eax], esp
Function at 0x4067a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x406806
mov eax, dword [edi + 0x3c]
xor esi, esi
mov ecx, dword [eax + edi + 0x78]
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov ebp, dword [ecx + 0x18]
imul ebx, dword [eax], 0x3074ed85
mov ebx, dword [esp + 0x1c]
mov ch, byte [ebx]
mov edx, dword [eax + esi*4]
add edx, edi
mov cl, byte [edx]
cmp cl, ch
jne 0x406801
mov eax, ebx
sub edx, ebx
test cl, cl
je 0x40680e
cmp byte [eax], 0
je 0x40680e
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x4067eb
mov eax, dword [esp + 0x18]
inc esi
cmp esi, ebp
jb 0x4067dc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x406839
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edi, dword [edi]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x40684d
mov edx, dword [esp + 0x18]
test edx, edx
je 0x406860
mov dword [edx], eax
test ecx, ecx
je 0x4068a9
mov ebp, dword [edi + 0x30]
xor ebx, ebx
xor esi, esi
movzx eax, word [ebp]
mov edx, eax
test ax, ax
je 0x4068a5
nop dword [eax]
movzx ecx, ax
lea esi, [esi + 1]
movzx eax, ax
lea edx, [ecx - 0x41]
add ecx, 0x20
cmp dx, 0x19
movzx ecx, cx
cmova ecx, eax
movzx eax, cx
add ebx, eax
movzx eax, word [ebp + esi*2]
test ax, ax
jne 0x406879
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jne 0x40684d
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4068b9
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ecx
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov eax, dword [eax + 0xc]
add eax, 0xc
push edi
mov eax, dword [eax]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x4068ca
mov ebp, dword [eax + 0x18]
mov eax, dword [0x65fe59]
push 0
push eax
call fcn.00406839
mov edi, dword [0x65fe65]
add esp, 8
mov ebx, eax
mov edx, dword [edi]
test edx, edx
je 0x40693b
movzx eax, word [esi]
xor ecx, ecx
test ax, ax
je 0x406906
inc ecx
cmp word [esi + ecx*2], 0
jne 0x4068fe
cmp cl, dl
je 0x406913
cmp cl, byte [edi + 1]
jne 0x406a13
xor edx, edx
xor ecx, ecx
test ax, ax
je 0x40692d
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2]
test ax, ax
jne 0x40691c
cmp edx, dword [edi + 4]
je 0x40693b
cmp edx, dword [edi + 8]
jne 0x406a13
mov eax, dword [0x65fe55]
push 4
push 0x1000
push eax
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x65fe31], edx
jbe 0x406984
nop dword [eax + eax]
mov ecx, dword [0x65fe61]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x65fe2d]
add edx, eax
cmp edx, dword [0x65fe31]
jb 0x406969
push esi
push ebx
call fcn.004067a9
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x406a13
mov esi, dword [0x65fe49]
lea eax, [esp + 0x10]
mov ecx, dword [0x65fe31]
push eax
push ecx
mov ecx, dword [0x65fe5d]
push ecx
push esi
call ebx
mov edx, dword [0x65fe25]
mov ecx, 8
mov edi, dword [edx + ebp + 4]
add edx, ebp
cmp dword [0x65fe5d], ecx
jbe 0x4069e0
mov eax, dword [edx + ecx]
add eax, edi
mov dword [esi + ecx], eax
mov eax, dword [0x65fe2d]
add ecx, eax
cmp ecx, dword [0x65fe5d]
jb 0x4069c9
mov eax, dword [0x65fe39]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
mov eax, dword [0x65fe5d]
push eax
push esi
call ebx
mov eax, dword [0x65fe35]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x65fe35]
add ecx, esi
add esi, eax
push esi
call ecx
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x417bc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00417bd7

Function at 0x41a3d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x41e400
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00475ff0
call fcn.0041a8f0
push eax
push dword [ebp - 4]
call fcn.004770b0
mov dword [ebp - 4], eax
push 0x5c283c
push dword [eax]
call fcn.00476fb0
add esp, 0x1c
test eax, eax
jne 0x41a424
push 0x1ff
call fcn.0041a8f0
push eax
call fcn.005911f0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
call fcn.004794a0
mov eax, dword [ebp - 4]
push 0x5c
push dword [eax]
call fcn.0059bd67
mov esi, eax
mov byte [esi], 0
mov ecx, dword [ebp - 4]
push dword [ecx]
call fcn.005974a7
mov byte [esi], 0x5c
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.005974a7
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a8f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x41e400
lea eax, [ebp - 4]
lea esi, [ebp + 4]
push eax
add esi, 0xfffffffc
push esi
call fcn.00475ff0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push 0x41e400
push eax
push esi
call fcn.00475ff0
call fcn.0041a890
push eax
push dword [ebp - 0x18]
call fcn.004770b0
mov ecx, eax
add esp, 0x20
mov eax, dword [0x664c00]
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x41aaac
push dword [ecx]
push str._s_luminati
push dword [ebp - 4]
call fcn.00477140
add esp, 0xc
cmp dword [0x654010], 0
je 0x41aa97
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00479120
add esp, 4
test eax, eax
jne 0x41aa97
push 0x41e400
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00475ff0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push 0x41e400
push eax
push esi
call fcn.00475ff0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push 0x41e400
push eax
push esi
call fcn.00475ff0
call fcn.0041a890
push eax
push dword [ebp - 0xc]
call fcn.004770b0
mov ecx, dword [0x664bfc]
add esp, 0x2c
mov dword [ebp - 0xc], eax
test ecx, ecx
jne 0x41aa7f
push ebx
push edi
mov edi, dword [ebp - 0x10]
push edi
mov dword [ebp - 8], ecx
call fcn.00477230
add esp, 4
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x5c27f0
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x41aa7b
push eax
push dword [ebp - 8]
push eax
call fcn.0059748d
push eax
call fcn.00590b90
mov ebx, eax
add esp, 0x10
cmp ebx, 0xffffffff
je 0x41aa7b
push ebx
push edi
call fcn.00477260
push ebx
push dword [ebp - 8]
push dword [edi]
call fcn.0059748d
push eax
call fcn.00590b90
add esp, 0x18
cmp eax, 0xffffffff
je 0x41aa7b
push edi
call fcn.00479480
push dword [ebp - 0xc]
call fcn.004794a0
add esp, 8
push dword [eax]
push esi
call fcn.00476480
add esp, 4
push eax
call fcn.0041e390
push dword [eax]
mov eax, dword [ebp - 0x10]
push dword [eax]
push str._s_BrightData__s
push dword [ebp - 0x14]
call fcn.00477140
mov eax, dword [ebp - 0x14]
add esp, 0x18
mov ecx, dword [eax]
mov dword [0x664bfc], ecx
mov dword [eax], 0
jmp 0x41aa7d
xor ecx, ecx
pop edi
pop ebx
push ecx
push 0x664c00
call fcn.004770b0
mov eax, dword [0x664c00]
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [0x664c00], eax
mov dword [ecx], 0
mov eax, dword [0x664c00]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41c720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov dword [0x664c1c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5c3ab0
mov edi, eax
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x41c753
xor esi, esi
jmp 0x41c77b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41c763
xor esi, esi
jmp 0x41c77b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41c77b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
push esi
call fcn.00590bc0
add esp, 4
test eax, eax
jne 0x41c7b9
lea eax, [ebp + 4]
sub eax, 4
push 0x5c3b18
push eax
call fcn.00476350
push 0
push 0
push 0
push 1
push dword [eax]
push str.dll_failed_loading_mem_res
call fcn.00418ad0
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push eax
call fcn.0041fbd0
push eax
call fcn.00590bc0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41c7ff
lea eax, [ebp + 4]
sub eax, 4
push 0x5c3b18
push eax
call fcn.00476350
push esi
push esi
push esi
push 1
push dword [eax]
push str.dll_failed_loading_mem_mod
call fcn.00418ad0
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.mem_loaded_sdk_dll_0x_p
push 5
call fcn.00479a10
add esp, 0xc
mov dword [0x664c20], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x41e400
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00475ff0
add esp, 0xc
mov dword [ebp - 4], eax
call dword [sym.imp.lum_sdk32.dll__brd_sdk_get_uuid_c_0]
push eax
push 0x5c3f74
push 2
call fcn.005975bc
add esp, 4
push eax
call fcn.0041a860
add esp, 0xc
push 0
call fcn.00597173
int3

Function at 0x41eb90
Capabilities:
Terminate process

Disassembly:
push dword [0x6610cc]
push str.Brightdata_Service
push str.net_updater__OPTIONS_____s__s_n___h___print_this_message_n____updater_appid___run_init_monitor_with_provided_appid._n____install_appid___install_service_with_provided_appid_n____install_ui_appid___install_service_with_provided_appid_after_showing_dialog_and_getting_user_permission_n____check_peer_appid___validate_peer_n____uninstall_appid___remove_service_with_provided_appid__must_match_appid_used_during_install__n____start_service_appid___starts_Bright_Data_service_n____stop_service_appid___stops_Bright_Data_service_n____dlg_pos__ownerscreentop:left__n____dlg_language___language_code_e.g.__de_DE__or__de__n____dlg_bg_color_color___e.g.__ff112233__n____dlg_btn_color_color_n____dlg_txt_color_color_n____dlg_app_name_name_n____dlg_logo_link_logo_n____dlg_benefit_benefit_n____dlg_agree_btn_text_n____dlg_disagree_btn_text_n____campaign_campaign_id___optional_parameter_for_the_further_breakdown_of_the_existing_app_ID_to_monitor_the_statistics_separately_n
push 2
call fcn.005975bc
add esp, 4
push eax
call fcn.0041a860
add esp, 0x10
push 1
call fcn.00597173
int3
Function at 0x41f100
Capabilities:
Terminate process

Disassembly:
push dword [0x6610cc]
push 0x5c3f74
push 2
call fcn.005975bc
add esp, 4
push eax
call fcn.0041a860
add esp, 0xc
push 0x4d2
call fcn.00597173
int3
Function at 0x429790
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42983f
push esi
call fcn.0043dbc0
add esp, 4
test al, al
jne 0x42983f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4297b7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00447400
add esp, 0xc
test eax, eax
je 0x4297eb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00447400
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4297ed
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x42981e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0043aa30
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x429800
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret