joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7a40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x533d43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00524c3d
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x8f4f50
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x8f3438
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x537168]
push eax
mov ecx, edi
call fcn.0052a3b5
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0052ba07
test eax, eax
je 0x4d7b5c
mov ecx, dword [esp + 0x3c]
call fcn.0052a3e2
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x5376b8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4d7b20
push edi
mov ecx, esi
call fcn.0052799d
mov ecx, esi
call fcn.004d7cc0
cmp dword [esp + 0x38], 1
jne 0x4d7b55
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00527b07
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4da590
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4da5c3
push esi
call fcn.004dd680
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4da5bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4da649
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4da632
mov eax, dword [esi + 8]
test eax, eax
je 0x4da5e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4da62e
cmp eax, 2
je 0x4da632
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4da5da
cmp eax, 3
je 0x4da60d
cmp eax, 1
jne 0x4da5da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4da5da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4da5da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004da670
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4da658
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004da670
add esp, 4
pop esi
ret
Function at 0x4ecdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5346e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004ec980
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004eca00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004eca00
lea ecx, [esi + 0xc]
call fcn.005235a3
lea ecx, [esi + 0x10]
call fcn.005235a3
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004edf90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004edf90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004edf90
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00523618
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00523618
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4f1310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x534a48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004f1710
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x95adec
call fcn.00502418
mov ecx, dword [0x8f43fc]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.004eea70
mov esi, 0x8f4454
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4f13b7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4f13ae
cmp al, 0xff
je 0x4f13ae
dec al
mov byte [ecx], al
jmp 0x4f13b7
push ecx
call fcn.00523382
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0051f050
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x4f13fd
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4f13f4
cmp al, 0xff
je 0x4f13f4
dec al
mov byte [ecx], al
jmp 0x4f13fd
push ecx
call fcn.00523382
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0050249f
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x50523e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x480
call fcn.005013e7
mov esi, eax
pop ecx
test esi, esi
jne 0x505116
push 0x1b
call fcn.004ffafc
pop ecx
mov dword [0x961420], esi
mov dword [0x961520], 0x20
lea eax, [esi + 0x480]
cmp esi, eax
jae 0x50514e
and byte [esi + 4], 0
or dword [esi], 0xffffffff
and dword [esi + 8], 0
mov byte [esi + 5], 0xa
mov eax, dword [0x961420]
add esi, 0x24
add eax, 0x480
jmp 0x50512c
lea eax, [ebp - 0x48]
push eax
call dword [0x537254]
cmp word [ebp - 0x16], 0
je 0x505234
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x505234
mov edi, dword [eax]
lea ebx, [eax + 4]
lea eax, [ebx + edi]
mov dword [ebp - 4], eax
mov eax, 0x800
cmp edi, eax
jl 0x505184
mov edi, eax
cmp dword [0x961520], edi
jge 0x5051e2
mov esi, 0x961424
push 0x480
call fcn.005013e7
test eax, eax
pop ecx
je 0x5051dc
add dword [0x961520], 0x20
mov dword [esi], eax
lea ecx, [eax + 0x480]
cmp eax, ecx
jae 0x5051cf
and byte [eax + 4], 0
or dword [eax], 0xffffffff
and dword [eax + 8], 0
mov byte [eax + 5], 0xa
mov ecx, dword [esi]
add eax, 0x24
add ecx, 0x480
jmp 0x5051af
add esi, 4
cmp dword [0x961520], edi
jl 0x505191
jmp 0x5051e2
mov edi, dword [0x961520]
xor esi, esi
test edi, edi
jle 0x505234
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x50522a
mov al, byte [ebx]
test al, 1
je 0x50522a
test al, 8
jne 0x505207
push ecx
call dword [0x537234]
test eax, eax
je 0x50522a
mov ecx, esi
mov eax, esi
sar ecx, 5
and eax, 0x1f
mov ecx, dword [ecx*4 + 0x961420]
lea eax, [eax + eax*8]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov cl, byte [ebx]
mov byte [eax + 4], cl
add dword [ebp - 4], 4
inc esi
inc ebx
cmp esi, edi
jl 0x5051e8
xor ebx, ebx
mov ecx, dword [0x961420]
lea eax, [ebx + ebx*8]
cmp dword [ecx + eax*4], 0xffffffff
lea esi, [ecx + eax*4]
jne 0x505295
test ebx, ebx
mov byte [esi + 4], 0x81
jne 0x505255
push 0xfffffffffffffff6
pop eax
jmp 0x50525f
mov eax, ebx
dec eax
neg eax
sbb eax, eax
add eax, 0xfffffff5
push eax
call dword [0x537218]
mov edi, eax
cmp edi, 0xffffffff
je 0x505284
push edi
call dword [0x537234]
test eax, eax
je 0x505284
and eax, 0xff
mov dword [esi], edi
cmp eax, 2
jne 0x50528a
or byte [esi + 4], 0x40
jmp 0x505299
cmp eax, 3
jne 0x505299
or byte [esi + 4], 8
jmp 0x505299
or byte [esi + 4], 0x80
inc ebx
cmp ebx, 3
jl 0x505236
push dword [0x961520]
call dword [0x53721c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x505270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x480
call fcn.005013e7
mov esi, eax
pop ecx
test esi, esi
jne 0x505116
push 0x1b
call fcn.004ffafc
pop ecx
mov dword [0x961420], esi
mov dword [0x961520], 0x20
lea eax, [esi + 0x480]
cmp esi, eax
jae 0x50514e
and byte [esi + 4], 0
or dword [esi], 0xffffffff
and dword [esi + 8], 0
mov byte [esi + 5], 0xa
mov eax, dword [0x961420]
add esi, 0x24
add eax, 0x480
jmp 0x50512c
lea eax, [ebp - 0x48]
push eax
call dword [0x537254]
cmp word [ebp - 0x16], 0
je 0x505234
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x505234
mov edi, dword [eax]
lea ebx, [eax + 4]
lea eax, [ebx + edi]
mov dword [ebp - 4], eax
mov eax, 0x800
cmp edi, eax
jl 0x505184
mov edi, eax
cmp dword [0x961520], edi
jge 0x5051e2
mov esi, 0x961424
push 0x480
call fcn.005013e7
test eax, eax
pop ecx
je 0x5051dc
add dword [0x961520], 0x20
mov dword [esi], eax
lea ecx, [eax + 0x480]
cmp eax, ecx
jae 0x5051cf
and byte [eax + 4], 0
or dword [eax], 0xffffffff
and dword [eax + 8], 0
mov byte [eax + 5], 0xa
mov ecx, dword [esi]
add eax, 0x24
add ecx, 0x480
jmp 0x5051af
add esi, 4
cmp dword [0x961520], edi
jl 0x505191
jmp 0x5051e2
mov edi, dword [0x961520]
xor esi, esi
test edi, edi
jle 0x505234
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x50522a
mov al, byte [ebx]
test al, 1
je 0x50522a
test al, 8
jne 0x505207
push ecx
call dword [0x537234]
test eax, eax
je 0x50522a
mov ecx, esi
mov eax, esi
sar ecx, 5
and eax, 0x1f
mov ecx, dword [ecx*4 + 0x961420]
lea eax, [eax + eax*8]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov cl, byte [ebx]
mov byte [eax + 4], cl
add dword [ebp - 4], 4
inc esi
inc ebx
cmp esi, edi
jl 0x5051e8
xor ebx, ebx
mov ecx, dword [0x961420]
lea eax, [ebx + ebx*8]
cmp dword [ecx + eax*4], 0xffffffff
lea esi, [ecx + eax*4]
jne 0x505295
test ebx, ebx
mov byte [esi + 4], 0x81
jne 0x505255
push 0xfffffffffffffff6
pop eax
jmp 0x50525f
mov eax, ebx
dec eax
neg eax
sbb eax, eax
add eax, 0xfffffff5
push eax
call dword [0x537218]
mov edi, eax
cmp edi, 0xffffffff
je 0x505284
push edi
call dword [0x537234]
test eax, eax
je 0x505284
and eax, 0xff
mov dword [esi], edi
cmp eax, 2
jne 0x50528a
or byte [esi + 4], 0x40
jmp 0x505299
cmp eax, 3
jne 0x505299
or byte [esi + 4], 8
jmp 0x505299
or byte [esi + 4], 0x80
inc ebx
cmp ebx, 3
jl 0x505236
push dword [0x961520]
call dword [0x53721c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x519680
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x536300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.0050e5b3
mov eax, dword [0x8f83e8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.0050e4e5
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0051a170
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x519727
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x51971e
cmp al, 0xff
je 0x51971e
dec al
mov byte [ecx], al
jmp 0x519727
push ecx
call fcn.00523382
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x519758
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x51974f
cmp al, 0xff
je 0x51974f
dec al
mov byte [ecx], al
jmp 0x519758
push ecx
call fcn.00523382
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405a12
pop dword [ebp - 0x4c]
mov eax, 0x48414928
add eax, 0xb7ff10ea
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x64277348
sub dword [ebp - 0x5c], 0x15d52dfd
mov dword [ebp - 0x58], 0xe85f9194
add dword [ebp - 0x58], 0x49d3bab1
mov dword [ebp - 0x54], 0xeac94a1
sub dword [ebp - 0x54], 0xc2605073
mov dword [ebp - 0x50], 0xa48d6641
sub dword [ebp - 0x50], 0xa48d6641
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x12c09eab
sub dword [ebp - 0x5c], 0x9e4e3555
mov dword [ebp - 0x58], 0x2ec9b04
sub dword [ebp - 0x58], 0xc180398f
mov dword [ebp - 0x54], 0xf26dc3bc
sub dword [ebp - 0x54], 0x8efe5750
mov dword [ebp - 0x50], 0x256bd99c
sub dword [ebp - 0x50], 0x256bd99c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x9ec643e4
add eax, 0x617a3d1c
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x34580
push 0
call eax
mov ecx, 0x3d74
xor ebx, ebx
add ebx, eax
mov edi, 0x98ea2cd3
add edi, 0x675cb72d
add edi, dword [ebp - 0x4c]
mov edx, 0x86c58c9a
add edx, 0x9755c630
xor dword [ebp - 0x24], 0x7b12b2d3
mov esi, dword [edi]
add dword [ebp - 0x30], 0x6cc9b261
sub esi, edx
add dword [ebp - 0x10], ebx
mov dword [ebx], esi
xor dword [ebp - 0x20], edi
add ebx, 0x7309636f
add ebx, 0x8cf69c95
add edi, 0x23301fc1
sub edi, 0x23301fbd
loop 0x405b2b
add eax, 0xe8a3
xor ebx, ebx
add ebx, eax
add eax, 0xd4e92914
sub eax, 0xd4e9290f
mov ecx, 0xa1a03ccf
add ecx, 0x5e9fc331
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x411c00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c53f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a8], ecx
mov ecx, dword [ebp - 0x1a8]
call fcn.00476561
push 0
mov ecx, dword [ebp - 0x1a8]
call fcn.00412dc0
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x411ccb
push 4
lea ecx, [ebp - 0x14]
call fcn.00408330
lea ecx, [ebp - 0x14]
call fcn.00413900
mov dword [ebp - 4], 0
push 0x65
lea ecx, [ebp - 0x14]
call fcn.00413400
mov dword [ebp - 0x1b0], eax
lea ecx, [ebp - 0x14]
call fcn.00412d90
movzx eax, al
test eax, eax
jne 0x411cbc
push 0
push 0
push 0x800
mov ecx, dword [ebp - 0x1ac]
call fcn.00412e10
lea ecx, [ebp - 0x14]
call fcn.00405b90
push eax
push 0x10
push 0
mov ecx, dword [ebp - 0x1ac]
call fcn.00412e10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00413940
push 1
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ecx + 0xbc]
push edx
mov ecx, dword [ebp - 0x1a8]
call fcn.00412d60
push 0
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax + 0xbc]
push ecx
mov ecx, dword [ebp - 0x1a8]
call fcn.00412d60
lea edx, [ebp - 0x1a4]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 0x1a8]
call fcn.00411ab0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588685
mov esp, ebp
pop ebp
ret

Function at 0x4130e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x413104
xor eax, eax
jmp 0x413184
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41311b
xor eax, eax
jmp 0x413184
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x413167
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x413167
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x41313e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x413173
xor eax, eax
jmp 0x413184
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x413181
xor eax, eax
jmp 0x413184
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x422690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c65e8
mov eax, dword fs:[0]
push eax
sub esp, 0x3ec
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp + 8]
call fcn.00406750
push eax
call fcn.00430000
add esp, 8
lea ecx, [ebp - 0x3f8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004066d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588685
mov esp, ebp
pop ebp
ret
Function at 0x424560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c69a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00408330
lea ecx, [ebp - 0x1c]
call fcn.00409f00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00452600
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.0040b8c0
test eax, eax
jne 0x4245cc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b840
jmp 0x424608
cmp dword [0x6436f4], 1
jne 0x4245da
call fcn.00423d90
cmp dword [0x651f78], 0
je 0x4245f2
mov ecx, dword [0x651f78]
push ecx
call fcn.00422710
add esp, 4
push 0
call fcn.00589cc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040b840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588685
mov esp, ebp
pop ebp
ret

Function at 0x4270f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
push 0x614cb6
lea ecx, [ebp - 0x2c]
call fcn.00406640
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x14], 2
jl 0x427193
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.004300a0
add esp, 8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040f610
lea ecx, [ebp - 0x54]
call fcn.004066d0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406680
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004066d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588685
mov esp, ebp
pop ebp
ret
Function at 0x436d10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x642490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x615b78
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x230]
push edx
call fcn.004300a0
add esp, 8
mov dword [ebp - 4], 0
push 0x614db6
lea eax, [ebp - 0x230]
push eax
call fcn.0040a150
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x436dac
push 0x615b88
lea ecx, [ebp - 0x230]
call fcn.00408b60
jmp 0x436dd7
lea ecx, [ebp - 0x230]
call fcn.00406750
push eax
call fcn.0043cfc0
add esp, 4
movzx edx, al
test edx, edx
jne 0x436dd7
push 0x615b8c
lea ecx, [ebp - 0x230]
call fcn.00408b60
push 1
push 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.004305d0
lea ecx, [ebp - 0x248]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406680
mov edx, dword [ebp - 0x24c]
or edx, 1
mov dword [ebp - 0x24c], edx
lea ecx, [ebp - 0x248]
call fcn.004066d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004066d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00588685
mov esp, ebp
pop ebp
ret