joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77931e62
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x77931e84
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x77931e84
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x77931e84
ret
cmp word [ebx + 4], 0x14c
jne 0x77931e84
test word [ebx + 0x16], 2
je 0x77931e84
test word [ebx + 0x16], 0x100
je 0x77931e84
cmp word [ebx + 0x18], 0x10b
jne 0x77931e84
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x77931e84
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x77931f10
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x77931ea4
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77918def
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x77931e84
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x77931f10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x77931e84
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x77931e84
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x77931e84
ret
cmp word [ebx + 4], 0x14c
jne 0x77931e84
test word [ebx + 0x16], 2
je 0x77931e84
test word [ebx + 0x16], 0x100
je 0x77931e84
cmp word [ebx + 0x18], 0x10b
jne 0x77931e84
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x77931e84
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x77931f10
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x77931ea4
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.77918def
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x77931e84
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x77931fc7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x77932020
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x77931fc7
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x77931fd6
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77d37c79
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77932027
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77918e9d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x779320c6
add edi, 4
add eax, 2
dec ecx
jne 0x7793200c
call 0x77932073
loope 0x77932069
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x779320c3
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x779320d4
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x77932087
cmp eax, ecx
ja 0x77932087
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x77932111
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x77932107
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7791937c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x77931fd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x77932020
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x77931fc7
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x77931fd6
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77d37c79
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77932027
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77918e9d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x779320c6
add edi, 4
add eax, 2
dec ecx
jne 0x7793200c
call 0x77932073
loope 0x77932069
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x779320c3
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x779320d4
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x77932087
cmp eax, ecx
ja 0x77932087
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x77932111
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x77932107
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7791937c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40112a
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
mov ebp, ecx
mov esi, edi
mov dword [esp + 0x10], ecx
and esi, 0x1ff
add esi, 2
mov ecx, ebp
call fcn.004061ec
mov byte [ebx], al
inc ebx
sub esi, 1
jne 0x401148
mov ebp, dword [esp + 0x1c]
lea ebx, [edi - 1]
add ebx, dword [esp + 0x18]
mov esi, edi
test edi, edi
je 0x401183
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.004061ec
xor al, byte [ebx]
mov byte [ebp], al
inc ebp
dec ebx
sub esi, 1
jne 0x40116c
mov edi, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x403be6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4310d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x403c68
cmp byte [esi + 0x3d], 0
je 0x403c68
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x403c3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x403c3e
sub eax, 1
je 0x403c42
dec eax
sub eax, 1
je 0x403c68
xor al, al
jmp 0x403c6a
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403c5f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040dde6
add esp, 0x10
cmp edi, eax
jne 0x403c3a
cmp byte [esi + 0x3d], 0
sete al
jmp 0x403c6a
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004077d1
leave
ret

Function at 0x405cd8
Capabilities:
Create process on windows
Create process suspended
Move file
Resume thread

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004074eb
xor edi, edi
pop ecx
test eax, eax
je 0x405d04
push dword [0x43106c]
mov ecx, eax
push dword [0x431068]
call fcn.0040118d
mov esi, eax
jmp 0x405d06
mov esi, edi
call fcn.00405e32
cmp eax, 1
jne 0x405df9
mov ebp, 0x208
push ebp
call fcn.00407529
push ebp
mov ebx, eax
call fcn.00407529
push 0x208
mov ebp, eax
push edi
push ebp
call fcn.0040a680
add esp, 0x14
push 0x208
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x208
cmp eax, ecx
je 0x405e26
push edi
push ebx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push ebx
push esi
call fcn.00405e70
pop ecx
pop ecx
cmp al, 1
jne 0x405de6
push 0x44
pop esi
push esi
lea eax, [esp + 0x24]
push edi
push eax
call fcn.0040a680
xor eax, eax
mov dword [esp + 0x2c], esi
lea edi, [esp + 0x1c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
xor eax, eax
push eax
push eax
push 4
push 1
push eax
push eax
push dword [esp + 0x90]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405dc2
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x405dd1
push 9
push ebx
push dword [0x431060]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
push ebp
call fcn.0040751b
push 1
push ebx
call fcn.0040751b
add esp, 0x10
jmp 0x405e26
push 1
push ebp
call fcn.0040751b
push 1
push ebx
call fcn.0040751b
add esp, 0x10
sub esp, 0x18
mov ecx, esp
push dword [esp + 0x88]
call fcn.00402f57
mov ecx, esi
call fcn.0040143c
test esi, esi
je 0x405e26
mov ecx, esi
call fcn.0040143b
push 0x10
push esi
call fcn.0040751b
pop ecx
pop ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54
ret 0x10
Function at 0x405e70
Capabilities:
Encode data using xor
Move file

Disassembly:
sub esp, 0x578
mov eax, dword [0x4310d8]
xor eax, esp
mov dword [esp + 0x574], eax
push ebx
push ebp
mov ebp, dword [esp + 0x588]
push esi
push edi
mov esi, 0x80000
push esi
call fcn.0040e18c
pop ecx
mov edi, eax
mov dword [esp + 0x178], 0x1e757761
mov dword [esp + 0x17c], 0x28231206
xor ecx, ecx
mov word [esp + 0x180], 0x3f
lea eax, [ecx + 1]
movsx eax, al
imul eax, eax, 0xa
xor byte [esp + ecx + 0x178], al
inc ecx
cmp ecx, 9
jl 0x405ebf
push edi
lea eax, [esp + 0x17c]
push esi
push eax
call fcn.00401919
add esp, 0xc
mov ebx, eax
xor edx, edx
lea ecx, [edx + 1]
movsx ecx, cl
imul ecx, ecx, 0xa
xor byte [esp + edx + 0x178], cl
inc edx
cmp edx, 9
jl 0x405eeb
test ebx, ebx
je 0x406046
push 3
pop esi
push 9
push dword [0x431060]
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405f2f
push 0x14d
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x405f0c
test esi, esi
je 0x406046
push 1
lea ecx, [esp + 0xcc]
call fcn.00402e5d
push 0x40
push 0x22
push ebp
lea ecx, [esp + 0xd4]
call fcn.00406087
mov eax, ebx
lea ecx, [esp + 0xc8]
cdq
push edx
push eax
push edi
call fcn.004060d2
lea ecx, [esp + 0xc8]
call fcn.00404a4c
mov ecx, dword [0x431068]
xor ebx, ebx
mov eax, dword [0x43106c]
cmp eax, ebx
jl 0x406017
jg 0x405f93
cmp ecx, ebx
jbe 0x406017
push 1
lea ecx, [esp + 0x14]
call fcn.00402dbf
push 0x40
push 0x21
push dword [0x431060]
lea ecx, [esp + 0x1c]
call fcn.00404e52
push ebx
push dword [0x43106c]
lea ecx, [esp + 0x18]
push dword [0x431068]
call fcn.004053c3
jmp 0x405ff8
push ebx
push 0x400
lea eax, [esp + 0x18c]
push eax
call fcn.004050a7
push dword [esp + 0x1c]
lea eax, [esp + 0x188]
push dword [esp + 0x1c]
lea ecx, [esp + 0xd0]
push eax
call fcn.004060d2
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [eax + 4]
cmp dword [esp + eax + 0x1c], ebx
je 0x405fc9
call fcn.00404755
lea ecx, [esp + 0x10]
call fcn.00403712
lea ecx, [esp + 0xc8]
call fcn.00404a4c
lea ecx, [esp + 0xc8]
call fcn.00406061
push edi
call fcn.0040cd05
pop ecx
lea ecx, [esp + 0xc8]
call fcn.00403758
mov al, 1
jmp 0x406048
xor al, al
mov ecx, dword [esp + 0x584]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004077d1
add esp, 0x578
ret

Function at 0x406186
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x20
mov esi, ecx
xor ebx, ebx
pop edx
dec edx
movzx eax, dl
movzx ecx, dl
imul ecx, eax
movzx eax, dl
movzx ecx, cl
imul ecx, eax
add cl, 0xa
mov byte [edx + esi], cl
test edx, edx
jne 0x406192
mov ecx, dword [ebp + 0xc]
mov dl, bl
test ecx, ecx
je 0x4061e3
push edi
mov edi, dword [ebp + 8]
imul eax, ecx, 3
sub eax, 3
dec ecx
mov dword [ebp + 0xc], eax
mov al, byte [ebx + esi]
add al, byte [ebp + 0xc]
xor al, byte [ecx + edi]
xor dl, al
mov eax, dword [ebp + 0xc]
xor dl, 0x59
mov byte [ebx + esi], dl
inc ebx
and ebx, 0x1f
test ecx, ecx
jne 0x4061bf
pop edi
mov byte [esi + 0x20], dl
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4061ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push 7
mov edx, ecx
xor esi, esi
pop ebx
lea edi, [edx + 4]
mov eax, dword [edi + esi*4]
inc eax
add dword [edx + esi*4], eax
mov cl, byte [edx + 0x20]
mov al, cl
dec cl
mov byte [edx + 0x20], cl
and al, 0x38
jne 0x406215
xor dword [edx + esi*4], 0xa879f10d
inc esi
cmp esi, ebx
jb 0x4061f6
mov eax, dword [edx]
xor esi, esi
inc eax
add dword [edx + 0x1c], eax
inc esi
mov ecx, dword [edi - 4]
mov eax, esi
shr ecx, 7
sub eax, ecx
xor dword [edi], eax
lea edi, [edi + 4]
sub ebx, 1
jne 0x406223
mov eax, dword [edx + 0x1c]
shr eax, 7
sub esi, eax
xor dword [edx], esi
mov al, byte [edx + 1]
pop edi
add al, 0xc
xor al, byte [edx]
pop esi
pop ebx
ret

Function at 0x414f46
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414dbc
Function at 0x401660
Capabilities:
Check if file exists
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
mov esi, ecx
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x401687
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0xd0], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0058c3a0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov word [ebp - 0xa], ax
mov eax, 0x72
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x12], 0x64002e
mov dword [ebp - 0x18], 0x640064
mov dword [ebp - 0xe], 0x6c006c
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40175f
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0xd0], eax
test eax, eax
je 0x40175f
lea ecx, [ebp - 8]
push ecx
push eax
mov word [ebp - 5], 0x75
mov word [ebp - 8], 0x6153
mov byte [ebp - 6], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xd4], eax
test eax, eax
je 0x40175f
push 0
push dword [esi + 0xd0]
push eax
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0xd8], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401c35
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401c74
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401c70
lea ebx, [ebx]
cmp esi, edx
jae 0x401c74
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401c60
cmp esi, edx
jb 0x401c79
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x402640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00412414

Function at 0x4026d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 0x6c006c
mov dword [ebp - 0x18], 0x63006d
mov dword [ebp - 0xc], 0x64002e
mov dword [ebp - 0x14], 0x6c0074
mov dword [ebp - 0x10], 0x320033
mov dword [ebp - 0x1c], 0x6f0043
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esp, ebp
pop ebp
ret
Function at 0x402720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], 0x640077
mov dword [ebp - 8], 0x6c006c
mov dword [ebp - 0xc], 0x64002e
mov dword [ebp - 0x18], 0x65004e
mov dword [ebp - 0x10], 0x760065
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esp, ebp
pop ebp
ret

Function at 0x4027a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x72
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x65004b
mov dword [ebp - 0x16], 0x65006e
mov dword [ebp - 6], 0x6c
mov dword [ebp - 0x12], 0x33006c
mov dword [ebp - 0xa], 0x6c0064
mov dword [ebp - 0xe], 0x2e0032
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esp, ebp
pop ebp
ret

Function at 0x402840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.004026d0
mov edi, eax
test edi, edi
je 0x4028a6
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x14], 0x6d6d6f43
mov word [ebp - 7], 0x4573
mov dword [ebp - 0x18], 0x74696e49
mov dword [ebp - 0xf], 0x6e6f436e
mov word [ebp - 0xa], 0x6f72
mov byte [ebp - 8], 0x6c
mov word [ebp - 5], 0x78
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xb], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40289f
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4028b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00402720
mov edi, eax
test edi, edi
je 0x40293a
lea eax, [ebp - 0x24]
push eax
push edi
mov dword [ebp - 0xf], 0x616c5064
mov word [ebp - 0x1c], 0x7669
mov dword [ebp - 0x15], 0x67756c50
mov dword [ebp - 7], 0x73656369
mov dword [ebp - 0x24], 0x61647055
mov dword [ebp - 0x20], 0x72446574
mov dword [ebp - 0x19], 0x726f4672
mov word [ebp - 0x11], 0x6e41
mov word [ebp - 3], 0x57
mov word [ebp - 0xa], 0x6544
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 8], 0x76
mov byte [ebp - 0x1a], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402933
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00402760
mov edi, eax
test edi, edi
je 0x4029ad
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0xc], 0x776f646e
mov word [ebp - 2], 0x78
mov dword [ebp - 7], 0x6b6f6f48
mov dword [ebp - 0x10], 0x69576b6f
mov byte [ebp - 3], 0x45
mov dword [ebp - 0x14], 0x6f686e55
mov byte [ebp - 8], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4029a6
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4029c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00402760
mov edi, eax
test edi, edi
je 0x402a19
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0xd], 0x65676173
mov word [ebp - 0xf], 0x7365
mov dword [ebp - 0x14], 0x74736f50
mov word [ebp - 9], 0x57
mov byte [ebp - 0x10], 0x4d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a12
push esi
push esi
push ebx
push dword [ebp - 4]
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x43746547
mov word [ebp - 4], 0x656e
mov word [ebp - 7], 0x4c64
mov word [ebp - 2], 0x57
mov dword [ebp - 0xc], 0x616d6d6f
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x69
call fcn.004027a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402a78
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call fcn.004027f0
mov esi, eax
test esi, esi
je 0x402ac9
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 6], 0x657a696c
mov dword [ebp - 0x10], 0x6e556f43
mov dword [ebp - 0xa], 0x61697469
mov word [ebp - 0xc], 0x6e69
mov byte [ebp - 2], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402ac2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.004027f0
mov edi, eax
test edi, edi
je 0x402b1d
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 7], 0x657a69
mov dword [ebp - 0xc], 0x61697469
mov dword [ebp - 0x10], 0x6e496f43
mov byte [ebp - 8], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b16
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, 1
call fcn.004027f0
mov edi, eax
test edi, edi
je 0x402b9f
lea eax, [ebp - 0x14]
push eax
push edi
mov word [ebp - 6], 0x6563
mov word [ebp - 9], 0x6174
mov dword [ebp - 0xe], 0x6e496574
mov byte [ebp - 0xa], 0x73
mov dword [ebp - 0x12], 0x61657243
mov word [ebp - 0x14], 0x6f43
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b98
push dword [ebp + 0x10]
push 0x6135bc
push 0x15
push 0
push 0x613d2c
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412414
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebx + 0x78], edi
test edi, 0xffff0000
jne 0x412436
cmp dword [ebx + 0x74], 0
jne 0x412436
movzx eax, di
mov dword [ebx + 0x74], eax
call fcn.0041e6ef
mov esi, dword [eax + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004126a1
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x412470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041e6ef
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4124a7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004124c6
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8