joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431238]
jne 0x4071f6
repz ret
jmp fcn.0040c4f5

Function at 0x40cfef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a708
and dword [ebp - 4], 0
cmp dword [0x434278], 0
mov ebx, eax
jne 0x40d0a0
push 0x4024a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d151
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402498
push edi
call esi
test eax, eax
je 0x40d151
push eax
call fcn.0040a696
mov dword [esp], 0x402488
push edi
mov dword [0x434278], eax
call esi
push eax
call fcn.0040a696
mov dword [esp], 0x402474
push edi
mov dword [0x43427c], eax
call esi
push eax
call fcn.0040a696
mov dword [esp], 0x402458
push edi
mov dword [0x434280], eax
call esi
push eax
call fcn.0040a696
pop ecx
mov dword [0x434288], eax
test eax, eax
je 0x40d0a0
push 0x402440
push edi
call esi
push eax
call fcn.0040a696
pop ecx
mov dword [0x434284], eax
mov eax, dword [0x434284]
cmp eax, ebx
je 0x40d0f8
cmp dword [0x434288], ebx
je 0x40d0f8
push eax
call fcn.0040a711
push dword [0x434288]
mov esi, eax
call fcn.0040a711
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d0f8
test edi, edi
je 0x40d0f8
call esi
test eax, eax
je 0x40d0ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d0ef
test byte [ebp - 0xc], 1
jne 0x40d0f8
or dword [ebp + 0x10], 0x200000
jmp 0x40d131
mov eax, dword [0x43427c]
cmp eax, ebx
je 0x40d131
push eax
call fcn.0040a711
pop ecx
test eax, eax
je 0x40d131
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d131
mov eax, dword [0x434280]
cmp eax, ebx
je 0x40d131
push eax
call fcn.0040a711
pop ecx
test eax, eax
je 0x40d131
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x434278]
call fcn.0040a711
pop ecx
test eax, eax
je 0x40d151
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d153
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404fa0
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, 0x143c
call fcn.00416610
mov eax, dword [0x70b7ec]
mov ecx, dword [0x7086f4]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x405113
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebp, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov esi, dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x70b7ec], 0x959
jne 0x4050f9
push 0
push 0
call edi
lea eax, [esp + 0x28]
push eax
call ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x84c]
push ecx
push 0
push 0x403708
push 0x403728
push 0x403748
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
push 0
lea eax, [esp + 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 0x44c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
call esi
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0x403758
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
push 0
push 0x40375c
push 0x403768
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0
push 0
push 0
call esi
mov edx, dword [esp + 0x14]
push edx
call fcn.00404dc0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x404fe4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x143c
ret
Function at 0x408b4d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a208]
jne 0x408b57
repz ret
jmp fcn.00410d0c

Function at 0x4147e1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e136
and dword [ebp - 4], 0
cmp dword [0x44da38], 0
mov ebx, eax
jne 0x414892
push 0x402da0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x414943
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402d94
push edi
call esi
test eax, eax
je 0x414943
push eax
call fcn.0040e0c4
mov dword [esp], 0x402d84
push edi
mov dword [0x44da38], eax
call esi
push eax
call fcn.0040e0c4
mov dword [esp], 0x402d70
push edi
mov dword [0x44da3c], eax
call esi
push eax
call fcn.0040e0c4
mov dword [esp], 0x402d54
push edi
mov dword [0x44da40], eax
call esi
push eax
call fcn.0040e0c4
pop ecx
mov dword [0x44da48], eax
test eax, eax
je 0x414892
push 0x402d3c
push edi
call esi
push eax
call fcn.0040e0c4
pop ecx
mov dword [0x44da44], eax
mov eax, dword [0x44da44]
cmp eax, ebx
je 0x4148ea
cmp dword [0x44da48], ebx
je 0x4148ea
push eax
call fcn.0040e13f
push dword [0x44da48]
mov esi, eax
call fcn.0040e13f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4148ea
test edi, edi
je 0x4148ea
call esi
test eax, eax
je 0x4148e1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4148e1
test byte [ebp - 0xc], 1
jne 0x4148ea
or dword [ebp + 0x10], 0x200000
jmp 0x414923
mov eax, dword [0x44da3c]
cmp eax, ebx
je 0x414923
push eax
call fcn.0040e13f
pop ecx
test eax, eax
je 0x414923
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x414923
mov eax, dword [0x44da40]
cmp eax, ebx
je 0x414923
push eax
call fcn.0040e13f
pop ecx
test eax, eax
je 0x414923
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44da38]
call fcn.0040e13f
pop ecx
test eax, eax
je 0x414943
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414945
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10032080
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10032244
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x100320aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100320b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100320a0
mov eax, 1
add ebx, ebx
jne 0x100320c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100320b8
jne 0x100320d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100320b8
xor ecx, ecx
sub eax, 3
jb 0x100320e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1003215a
mov ebp, eax
add ebx, ebx
jne 0x100320f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10032100
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10032124
inc ecx
add ebx, ebx
jne 0x10032110
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10032105
jne 0x10032121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10032105
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10032144
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10032135
jmp 0x100320a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10032144
add edi, ecx
jmp 0x100320a6
pop esi
mov edi, esi
mov ecx, 0x4f3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10032162
cmp byte [edi], 5
jne 0x10032162
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10032167
lea edi, [esi + 0x2f000]
mov eax, dword [edi]
or eax, eax
je 0x100321d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32168]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x321f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10032194
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x321f4]
or eax, eax
je 0x100321d0
mov dword [ebx], eax
add ebx, 4
jmp 0x100321b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10032207
cmp al, 0xef
ja 0x100321fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100321dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100321e9
mov ebp, dword [esi + 0x321f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1003223b
sub esp, 0xffffff80
jmp 0x10006ba8
Function at 0x5f8bdc
Capabilities:
Encode data using xor

Disassembly:
test al, dl
iretd
ror bh, 1
dec eax
ljmp 0xb816
cvtps2pd xmm5, xmm6
add al, 0x5f
cdq
dec esi
cli
jo 0x5f8bca
cmp al, 0x2d
enter 0x16f9, 0xffffffffffffff9b
xchg esp, eax
leave
enter 0xffffffffffffd99f, 0xe
fcomi st(6)
xchg byte [edx + 0xe], dh
push esp
cwde
neg byte [eax + 6]
mov bh, 0x6e
dec esp
insb byte es:[edi], dx
aad 0x88
pop ecx
mov ch, 0xea
movsb byte es:[edi], byte [esi]
push edx
movsd dword es:[edi], dword [esi]
or byte [esi + 0x75c6f018], ch
mov ecx, 0x181a78de
cmp byte [ecx], bl
loope 0x5f8c7d
das
or byte [ecx + 0x25], cl
sub byte [ebx], cl
jns 0x5f8bc9
sub al, byte [esi + 0x6894e19e]
or al, ch
std
pushfd
call 0xdb3a0eca
fild qword [eax]
cli
mov byte [ecx], cl
leave
pop ds
and edi, dword [ebx + edx*2]
cmp esp, ebp
insd dword es:[edi], dx
popal
mov edx, 0xe8d94d76
rcl ebx, 0x89
sti
mov esp, 0x898af4f8
cmpsb byte [esi], byte es:[edi]
sub al, 0x42
test dword [ebx + ebp], esi
inc edx
add byte [ecx], bl
mov ecx, 0x5b7b029c
cmp dword [eax + 0x46], ebx
pop ecx
push ebp
xor byte [ecx - 0x7a9fc123], 0x68
enter 0xffffffffffffa2bf, 0x49
jnp 0x5f8c3e
add bl, cl
lodsb al, byte [esi]
fisub dword [eax]
push ecx
jns 0x5f8c74
or byte [eax], ch
clc
cmp byte [edi + 0x38], dh
mov dl, 0x38
mov edx, 0x82856846
mov dl, 0x50
inc esi
push 0x50b28285
mov bh, cl
test eax, 0x8ce7e99c
lodsb al, byte [esi]
imul ecx, edx, 0xffffffd1
cwde
clc
sub al, 0xf
sbb esi, dword [eax - 0x24e8f0f8]
mov al, 0x41
push 0x55
jp 0x5f8cae
mov al, 8
invalid
int1
insb byte es:[edi], dx
xchg edi, eax
pop ecx
mov ebx, 0x909a3299
jle 0x5f8cd2
lcall 0x4ce6, 0xed297e90
in eax, dx
out 0x4c, al
sti
adc eax, 0x610bed30
and byte [ecx + 0x29], bl
mov edx, 0x9242f9f
xor ch, ch
or esp, dword [ecx + 0x20]
pop ecx
sub dword [edx + 0x9242f9f], edi
xchg dword [esi + 0x59], edx
and byte [esi], bh
xchg esi, eax
outsb dx, byte [esi]
jecxz 0x5f8cff
cmp byte [ecx - 0x23ac5028], 0x38
add cl, ah
mov ecx, 0x388a379a
cmp al, 0x18
rol al, cl
sal byte [eax + 0x5ae64af2], 0x7a
push 0xffffffffffffff9c
jle 0x5f8ca5
jge 0x5f8c93
xchg ecx, eax
cmp eax, 0xef93db4f
mov ecx, 0x700d11fa
push esp
sbb eax, 0x302f692e
or byte [esi], dl
xchg ecx, eax
ljmp 0x3bc8
xchg byte [eax], bh
in al, dx
stosd dword es:[edi], eax
fsubr dword [edi + 0x3b31efc9]
test ebp, 0x4fddd3c7
add ch, byte [edi]
test eax, 0x36084928
push 0x101c6867
push 0x695c8557
stosd dword es:[edi], eax
pop ecx
mov eax, 0x20ab840a
wait
out 0xa6, al
cli
mov al, cl
or eax, ebp
pop ds
invalid

Function at 0x64383c
Capabilities:
Encode data using xor

Disassembly:
pop ds
sbb byte [edi + 0x7d], bh
pop edi
xchg ecx, eax
push ebp
call 0x79e2199f
push edx
xchg edx, eax
out dx, al
dec esi
nop
insb byte es:[edi], dx
cld
and eax, 0x36cf678c
out dx, eax
sub al, 0xb4
sbb byte [esp + ebx*2 + 0x67], ch
popal
out dx, eax
cmpsd dword [esi], dword es:[edi]
mov ebx, 0xc94f18d6
xchg esp, eax
xor dword [edi + 0x441ec9e2], esp
loop 0x6438ea
push edi
rcl byte [edi + 0x26]
inc ebx
invalid
scasd eax, dword es:[edi]
xchg dword [edi - 0x7f], eax
sbb eax, 0x9b1e9df7
push ds
out dx, al
mov dl, 0xff
imul ebp, dword [edi + ebx*2], 0x2c7b5ee1
mov ecx, 0x5ebeb81e
invalid
Function at 0x6d9ccc
Capabilities:
Encode data using xor

Disassembly:
add al, 0x7e
ret 0xdbe5
cmp ch, ch
outsb dx, byte [esi]
sbb al, 0xa
mov eax, dword [0xb3633b55]
or ah, byte [ecx - 0x4c9cc4ab]
fdivr st(7)
rcr byte [eax - 0x55], cl
js 0x6d9c5d
jle 0x6d9c65
mov esp, 0x13153c84
sub al, 0xde
invalid
loope 0x6d9c20
xor bl, ah
sbb ah, bh
adc ebx, edx
wait
xchg esp, eax
test dword [esi + eax*4 - 0x4b], esp
nop
fidiv word [ebp - 0x6a578d4e]
mov ecx, 0x97008d30
pop edx
out dx, eax
lds ebx, [edx - 0x7fb33864]
invalid
fidivr dword [edi - 0x5d]
jno 0x6d9c66
and al, 0x88
jnp 0x6d9c16
insb byte es:[edi], dx
jae 0x6d9c24
lodsd eax, dword [esi]
push edi
test dword [eax - 0x50], eax
mov al, 0xeb
insb byte es:[edi], dx
xchg ebp, eax
pop ds
salc
pop eax
sbb dl, byte [eax]
xor dword [eax], 0x4a
ud2
lodsd eax, dword [esi]
push ds
aam 0xdf
inc ecx
fild qword cs:[eax + 8]
inc esp
js 0x6d9c86
xor ebx, dword [esi + 0x10]
inc esi
sub dl, bl
mov bl, 0x32
xchg edi, eax
and bh, byte [esi - 0x59487abb]
jae 0x6d9c9c
test dword [esi + 0x33a3f3e5], esp
arpl bx, ax
les eax, [eax]
outsb dx, byte [esi]
mov ecx, 0x6ae4a2b6
out dx, al
or eax, dword [edi]
mov ecx, 0xfa883516
cmpsd dword [esi], dword es:[edi]
pushfd
wait
mov esi, eax
nop
jno 0x6d9d3a
mov byte [0x83a03208], al
jo 0x6d9d4c
nop
pop edi
push ecx
jb 0x6d9cfa
in al, 0x1d
inc ecx
xor eax, 0x4740419e
sbb eax, 0x419e3541
inc eax
inc edi
adc dword [esi - 0xef3ece7], edi
dec dword [eax - 0x11]
dec ebx
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
and byte [ebp - 0x36b1fc01], ch
pop esi
add ch, byte [esp + edi*4 - 0x44]
dec edx
xlatb
lea esi, [edi - 0x342e277d]
cmp eax, 0x30472a12
je 0x6d9d15
fcom st(1)
retf
movsb byte es:[edi], byte [esi]
aad 0xc6
lcall 0x4022, 0xb02e8967
xlatb
and al, byte [eax - 0x29]
mov dl, 0xe7
sbb ebx, ebp
fisub word [ecx + 0x50]
add bh, byte [ebx]
push ebx
sbb ax, 0x2661
inc edx
mov esp, 0x7f07749e
les edi, [ecx]
imul ebp, edx, 0xffffffa6
pop esp
into
mov al, byte [0x82e0a352]
les eax, [ebx]
pop ax
xor al, 0x23
xlatb
or byte [edi + eax*2 + 0x34], dl
xor byte [edi], ah
xchg edi, eax
rcl bl, 1
xchg esp, eax
pop ds
mov cl, 0xae
popfd
xlatb
or al, 0x99
dec ecx
mov ecx, 0xb38f67e8
and dh, byte [ecx]
jmp 0x6d9dfb
popfd
cli
nop
dec eax
mov ch, 0x83
stosd dword es:[edi], eax
hlt
Function at 0x4283e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42849c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428497
mov ecx, dword [ebp - 8]
push ecx
call fcn.00428990
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428456
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428456
xor eax, eax
jmp 0x42849c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283ef
mov esp, ebp
pop ebp
ret
Function at 0x4028c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4028db
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402914
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x402910
jmp 0x402900
cmp esi, eax
jae 0x402914
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402900
cmp esi, eax
jb 0x40291b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x417917
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41795f
call fcn.0041713c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41795f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4179a2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41798b
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41798b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41799f
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41eeeb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41ef32
call fcn.0041713c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ef32
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41ef4e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041ea63
mov esi, eax
test edi, edi
je 0x41ef4c
test ebx, ebx
je 0x41ef4c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41fd5c
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x495be0
call fcn.004318b7
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41fd81
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41fdc7
lea ecx, [ebp - 0x10]
call fcn.00403050
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041f5e5
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00403080
mov eax, esi
call fcn.0043198f
ret 8
Function at 0x42265a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42267e
cmp dword [edi + 0x54], 0
jne 0x42267e
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041713c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042261b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42d184
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c95f8]
jne 0x42d18e
repz ret
jmp fcn.00433a41

Function at 0x43ebb7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004333a5
and dword [ebp - 4], 0
cmp dword [0x4cee30], 0
mov ebx, eax
jne 0x43ec68
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43ed19
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49c9c0
push edi
call esi
test eax, eax
je 0x43ed19
push eax
call fcn.00433333
mov dword [esp], 0x49c9b0
push edi
mov dword [0x4cee30], eax
call esi
push eax
call fcn.00433333
mov dword [esp], 0x49c99c
push edi
mov dword [0x4cee34], eax
call esi
push eax
call fcn.00433333
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4cee38], eax
call esi
push eax
call fcn.00433333
pop ecx
mov dword [0x4cee40], eax
test eax, eax
je 0x43ec68
push 0x49c968
push edi
call esi
push eax
call fcn.00433333
pop ecx
mov dword [0x4cee3c], eax
mov eax, dword [0x4cee3c]
cmp eax, ebx
je 0x43ecc0
cmp dword [0x4cee40], ebx
je 0x43ecc0
push eax
call fcn.004333ae
push dword [0x4cee40]
mov esi, eax
call fcn.004333ae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43ecc0
test edi, edi
je 0x43ecc0
call esi
test eax, eax
je 0x43ecb7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43ecb7
test byte [ebp - 0xc], 1
jne 0x43ecc0
or dword [ebp + 0x10], 0x200000
jmp 0x43ecf9
mov eax, dword [0x4cee34]
cmp eax, ebx
je 0x43ecf9
push eax
call fcn.004333ae
pop ecx
test eax, eax
je 0x43ecf9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43ecf9
mov eax, dword [0x4cee38]
cmp eax, ebx
je 0x43ecf9
push eax
call fcn.004333ae
pop ecx
test eax, eax
je 0x43ecf9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4cee30]
call fcn.004333ae
pop ecx
test eax, eax
je 0x43ed19
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ed1b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x444ba0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.004319d0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x444e10
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.004319d0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret