joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a836
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x58d984]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x41cf0c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x41cf0c
call fcn.0040ad60
mov edi, eax
jmp 0x41d02b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41cf2f
call fcn.0040ad60
jmp 0x41d01e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x41cf4d
call fcn.0040ad60
jmp 0x41d01e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x41cf6e
mov edi, 0x8007000e
jmp 0x41d020
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x41d064
jb 0x41cf8c
cmp eax, 0xffffffff
ja 0x41d064
cmp eax, 0x400
jbe 0x41cfa1
push eax
lea ecx, [ebp - 0x418]
call fcn.0041c050
jmp 0x41cfc7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x41cfc7
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x41cfde
mov edi, 0x8007000e
jmp 0x41d020
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x41cffe
call fcn.0040ad60
jmp 0x41d01e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0041ccc0
mov edi, eax
test esi, esi
je 0x41d02b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x41d044
lea ecx, [ebp - 0x418]
call fcn.0041c3b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004eda39
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00404520
int3
Function at 0x41e640
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a958
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x58d984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push esi
push 0x548a70
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00410c10
add esp, 0xc
mov ecx, esi
xor edi, edi
call fcn.0041eb90
test al, al
je 0x41e7e9
xor eax, eax
mov dword [ebp - 0x44], vtable.WTL::CMessageLoop.0
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov edi, dword [0x597d10]
add edi, 0x10
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x597d6c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi]
call fcn.005158fc
add esp, 0xc
test eax, eax
je 0x41e737
mov dword [esi], eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi + 4]
call fcn.005158fc
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x41e737
mov eax, dword [esi + 8]
mov dword [esi + 4], ecx
lea edx, [eax*4]
mov eax, dword [esi]
add eax, edx
je 0x41e728
mov dword [eax], ebx
mov ecx, dword [esi + 4]
lea eax, [edx + ecx]
test eax, eax
je 0x41e734
lea ecx, [ebp - 0x44]
mov dword [eax], ecx
inc dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
xor esi, esi
mov ebx, 1
jmp 0x41e750
test ebx, ebx
je 0x41e779
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x41e779
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
push esi
inc esi
mov edx, dword [eax + 8]
call edx
test eax, eax
jne 0x41e754
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x41e750
test eax, eax
je 0x41e7cd
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x44]
call dword [eax + 4]
test eax, eax
jne 0x41e7b7
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x44]
call dword [eax + 0xc]
test eax, eax
je 0x41e750
jmp 0x41e744
mov edi, dword [ebp - 0x20]
mov ecx, 0x597d38
call fcn.0041e510
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.0041e390
call fcn.00448e30
call dword [sym.imp.ole32.dll_OleUninitialize]
call fcn.00408270
mov ecx, eax
call fcn.0040a4e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4286b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx + 9]
push eax
lea ecx, [esi + 0x44]
mov dword [ebp - 4], esi
call fcn.004277d0
movzx eax, byte [ebx + 8]
lea ecx, [esi + 0x50]
push eax
call fcn.004277d0
lea edi, [esi + 0x74]
mov ecx, edi
call fcn.00427860
push 0x88
call fcn.004ed767
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x4287b4
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [esi + 0x4c], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi], vtable.NCoderMixer2::CCoderMT.0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov byte [esi + 0x68], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
jmp 0x4287b6
xor esi, esi
mov ecx, dword [edi + 4]
lea eax, [ecx + 1]
mov dword [edi + 4], eax
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x20], eax
mov edi, dword [ebx]
test edi, edi
je 0x4287d6
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4287e3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x18], edi
mov edi, dword [ebx + 4]
test edi, edi
je 0x4287f3
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x428800
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [esi + 0x1c], edi
pop edi
mov al, byte [eax + 0x5c]
mov byte [esi + 0x68], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c73c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub dword [esp + 4], 0xc
jmp method.CFilterCoder.virtual_0

Function at 0x42d910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b40b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x58d984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.ICompressSetFinishMode.0
mov dword [esi + 8], vtable.ICompressGetInStreamProcessedSize2.0
mov dword [esi + 0xc], vtable.ICompressSetInStream2.0
mov dword [esi + 0x10], vtable.ISequentialInStream.0
mov dword [esi + 0x14], vtable.ICompressSetOutStreamSize.0
mov dword [esi + 0x18], vtable.ICompressSetBufSize.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x48], 0x40000
mov dword [esi + 0x24], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x4c], 0x40000
mov dword [esi + 0x28], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x50], 0x40000
mov dword [esi + 0x2c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x54], 0x40000
mov dword [esi + 0x30], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x58], 0x40000
push 0x418af0
push 0x42d900
push 4
push 4
lea eax, [esi + 0xa0]
mov dword [ebp - 4], 0
push eax
mov dword [esi], vtable.NCompress::NBcj2::CDecoder.0
mov dword [esi + 4], vtable.NCompress::NBcj2::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NBcj2::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NBcj2::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NBcj2::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NBcj2::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NBcj2::CDecoder.6.0
call fcn.004edae4
mov word [esi + 0xb0], 0
mov eax, esi
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431470
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b4d8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x58d984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00432090
add esp, 4
cmp eax, 0xffffffff
je 0x4314c1
test al, 0x10
je 0x4314c1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004327c0
add esp, 4
test al, al
je 0x4314e2
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00432570
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
push esi
call fcn.00430a70
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.004310f0
test eax, eax
js 0x43152c
mov edx, dword [ebp - 0x18]
lea ecx, [edx - 1]
cmp eax, ecx
jne 0x43152c
cmp edx, 1
jne 0x431520
mov bl, dl
jmp 0x43166e
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x18], ecx
mov word [eax + ecx*2], dx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00430a10
mov esi, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x1c]
jmp 0x431550
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43161c
call ebx
cmp eax, 0xb7
jne 0x4315b7
lea ecx, [ebp - 0x60]
call fcn.004317c0
lea ecx, [ebp - 0x38]
call fcn.00430ad0
push 0
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.00431980
mov byte [ebp - 4], 1
push dword [ebp - 0x38]
test al, al
jne 0x43159e
call fcn.004eda86
add esp, 4
jmp 0x4315b7
mov ebx, dword [ebp - 0x40]
shr ebx, 4
call fcn.004eda86
add esp, 4
and bl, 1
jne 0x43161c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x43168d
lea ecx, [ebp - 0x1c]
call fcn.004310f0
mov esi, eax
test esi, esi
js 0x43168d
je 0x43168d
mov edi, dword [ebp - 0x1c]
cmp esi, 1
jne 0x4315f9
movzx eax, word [edi]
cmp eax, 0x5c
je 0x43168d
cmp eax, 0x2f
je 0x43168d
lea eax, [esi + 1]
cmp dword [ebp - 0x10], eax
jae 0x43168d
cmp esi, dword [ebp - 0x18]
jae 0x431550
xor eax, eax
mov dword [ebp - 0x18], esi
mov word [edi + esi*2], ax
jmp 0x431545
cmp esi, dword [ebp - 0x24]
jge 0x431661
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x28]
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.004324c0
add esp, 4
test eax, eax
jns 0x431642
mov esi, dword [ebp - 0x24]
jmp 0x431645
inc esi
add esi, eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.00431130
push 0
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x43168d
cmp esi, dword [ebp - 0x24]
jl 0x431627
mov bl, 1
push dword [ebp - 0x28]
call fcn.004eda86
add esp, 4
push dword [ebp - 0x1c]
call fcn.004eda86
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
jmp 0x431663
Function at 0x4316a0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00432090
add esp, 4
cmp eax, 0xffffffff
je 0x4316cc
test al, 0x10
jne 0x4316cc
test al, 1
je 0x4316cc
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4316dc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4316dc
mov al, 1
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x4316f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, 0xf0000000
je 0x431702
and eax, 0x3fff
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret
Function at 0x432090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4320a3
or eax, eax
pop ebp
ret

Function at 0x4323d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebx], 0
lea esp, [esp]
mov eax, esi
cmp esi, 0x400000
jbe 0x4323ff
mov eax, 0x400000
push 0
lea edx, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [ebx], ecx
test eax, eax
je 0x432437
test ecx, ecx
je 0x43242c
add edi, ecx
sub esi, ecx
mov ecx, dword [ebp - 4]
jne 0x4323f0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x432cb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x432d3f
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x432d3f
push ebx
push edi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov edx, 2
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea ebx, [ebx]
lea ecx, [edx - 2]
mov eax, esi
shr eax, cl
lea ecx, [edx - 1]
and eax, 1
add edi, eax
mov eax, esi
shr eax, cl
mov ecx, edx
and eax, 1
add dword [ebp - 8], eax
mov eax, esi
shr eax, cl
lea ecx, [edx + 1]
and eax, 1
add edx, 4
add dword [ebp - 4], eax
mov eax, esi
shr eax, cl
and eax, 1
lea ecx, [edx - 2]
add ebx, eax
cmp ecx, 0x20
jb 0x432cf0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add ecx, ebx
add eax, ecx
add eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x43391d
pop edi
xor eax, eax
pop esi
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add edx, ebx
mov dword [ebp + 0xc], edx
lea ecx, [ecx]
lea eax, [edi + ebx]
cmp eax, edx
jae 0x433946
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x433946
inc eax
cmp eax, edx
jb 0x433937
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x433a3c
cmp ecx, 2
jbe 0x433999
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x433a28
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 0x10]
add ecx, edi
cmp dword [ebp + 0x18], 0
je 0x4339c3
add ebx, ecx
jmp 0x4339c5
shr esi, cl
test esi, esi
je 0x43395f
cmp esi, 4
ja 0x4339b8
cmp esi, 3
je 0x4339b8
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x43395f
or esi, 8
shr esi, 1
inc edi
jmp 0x433930
sub ebx, ecx
test esi, esi
je 0x4339fb
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x4339f6
mov edx, 0x100
shl edx, cl
mov ecx, dword [ebp + 0x10]
dec edx
xor ebx, edx
add ecx, edi
cmp dword [ebp + 0x18], 0
je 0x4339f4
add ebx, ecx
jmp 0x4339f6
sub ebx, ecx
mov edx, dword [ebp + 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp + 8]
add edi, eax
jmp 0x433930
mov ebx, dword [ebp + 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x433930
shr esi, cl
mov eax, 2
cmp eax, ecx
mov eax, dword [ebp + 0x14]
pop ebx
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x439080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.00515649
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x4390ab
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4390ba
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4414a3
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x53bc5a
call fcn.004ee459
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004419a0
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4415ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44151c
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004418e3
test eax, eax
je 0x441551
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4415ef
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4415ef
push 0x5c0
call fcn.00441791
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x441574
push edi
mov ecx, eax
call fcn.00441613
jmp 0x441576
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4415f7
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.0044195c
pop ecx
test eax, eax
jne 0x44152a
mov dword [ebp - 0xa8], 3
push 0x57f8e8
lea eax, [ebp - 0xa8]
jmp 0x44160c
mov eax, esi
call fcn.004ee3a6
ret
mov dword [ebp - 0xa4], 1
push 0x57f8e8
lea eax, [ebp - 0xa4]
push eax
call fcn.0050de50
int3

Function at 0x441613
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x53bc8d
call fcn.004ee3b7
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.00441474
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x44165f
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004ee380
ret 4
push 0x57f8e8
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.0050de50
int3

Function at 0x448c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x59a3f0]
mov esi, eax
test ecx, ecx
je 0x448c61
push ecx
call fcn.0045a0a0
add esp, 4
mov dword [0x59a3f0], 0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0x10]
push esi
push eax
call fcn.0045add0
add esp, 0xc
mov dword [0x59a3f0], eax
neg eax
sbb eax, eax
and eax, 0xfffffffc
pop edi
add eax, 4
pop esi
pop ebp
ret
Function at 0x44afa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44afce
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 8]
push 0x10
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
ret 4
Function at 0x44efe0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x44f097
mov eax, dword [ebp + 0xc]
cmp eax, 9
jne 0x44f123
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x44f066
mov ecx, dword [esi + 0xac]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x44f066
push 0
push 0x5902f8
push 0x590298
push 0
push dword [esi + 0xac]
call fcn.0050e825
add esp, 0x14
test eax, eax
je 0x44f066
push 0
push 0x5902f8
push 0x590298
push 0
push dword [esi + 0xac]
call fcn.0050e825
add esp, 0x14
mov ecx, eax
call fcn.0047ce30
test al, al
jne 0x44f097
push ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns bl
cmp byte [esi + 0xe0], 0
je 0x44f0a0
test bl, bl
je 0x44f0a0
push 0
push 0
push dword [esi + 0xc]
mov byte [esi + 0xe1], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x10]
push edi
xor eax, eax
movzx edi, bl
push 0
push 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xac]
push SysReAllocStringLen
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
mov eax, dword [ecx]
push edx
push 0x44e440
call dword [eax + 0x60]
test eax, eax
jne 0x44f109
test bl, bl
je 0x44f102
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x20]
push 0
push 0
push SysReAllocStringLen
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ecx]
push edx
push 0x44e440
call dword [eax + 0x60]
jmp 0x44f105
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x44f111
push eax
mov ecx, esi
call fcn.0044db40
pop edi
pop ebx
mov byte [esi + 0xe1], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
fldz
push ecx
fstp dword [esp]
push 0
push 0
push eax
push dword [ebp + 0x10]
mov dword [esi + 0xbc], ecx
push eax
push 3
call fcn.00476de0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10