joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b390
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c4
mov eax, dword [0x6efb00]
xor eax, esp
mov dword [esp + 0x1c0], eax
cmp byte [0x7c7460], 0
push ebx
mov ebx, dword [esp + 0x1cc]
mov dword [esp + 0x10], ebx
jne 0x50b3c9
call fcn.0052afa0
test eax, eax
je 0x50b3e1
mov byte [0x7c7460], 1
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.006193d7
add esp, 0x1c4
ret
mov eax, dword [ebx + 0x9cc]
test eax, eax
je 0x50b402
push 0x400
push eax
call fcn.0052bc50
add esp, 8
call fcn.0052afa0
test eax, eax
jne 0x50b3c9
push ebp
push esi
push edi
nop word [eax + eax]
mov ebx, 2
mov dword [esp + 0x18], 4
lea eax, [esp + 0x90]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
nop dword [eax]
lea eax, [esp + 0x40]
push eax
call fcn.004fd1c0
push 1
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x28], xmm0
call fcn.004f9720
lea eax, [esp + 0x58]
push eax
call fcn.004fd1c0
mov esi, dword [eax + 8]
lea eax, [esp + 0x6c]
push eax
call fcn.004fd1c0
add esp, 0x10
lea ebp, [ebx + 1]
mov ecx, eax
mov eax, esi
cdq
push 0
add eax, dword [ecx]
push ebp
adc edx, dword [ecx + 4]
push edx
push eax
call fcn.00619d50
movups xmm1, xmmword [esp + 0x30]
mov esi, dword [esp + 0x10]
mov edi, eax
mov ebx, edx
dec esi
movaps xmm0, xmm1
movd eax, xmm1
psrldq xmm0, 4
movd ecx, xmm0
shld ebx, edi, 8
push ecx
push eax
push 0
push esi
shl edi, 8
call fcn.00619d50
xor edi, eax
xor ebx, edx
lea eax, [esp + 0x70]
mov dword [esp + 0x20], edi
push eax
mov dword [esp + 0x28], ebx
call fcn.004fd1c0
lea esi, [eax + 8]
lea eax, [esp + 0x84]
push eax
call fcn.004fd1c0
mov edx, dword [esp + 0x18]
add esp, 8
mov ebx, ebp
mov dword [esp + 0x10], ebx
mov ecx, dword [eax]
add ecx, dword [esi]
lea eax, [edx + 2]
imul edx, dword [esp + 0x28]
imul ecx, eax
mov eax, dword [esp + 0x14]
shl ecx, 0x10
xor ecx, edx
mov dword [esp + 0x28], ecx
movups xmm0, xmmword [esp + 0x20]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
jne 0x50b430
movsd xmm0, qword [0x63eb68]
lea eax, [esp + 0x90]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.0052adf0
add esp, 0x10
call fcn.0052afa0
test eax, eax
je 0x50b410
lea eax, [esp + 0xd0]
mov byte [esp + 0xd0], 0
push 0x100
push eax
call fcn.0052ba90
add esp, 8
cmp byte [esp + 0xd0], 0
pop edi
pop esi
pop ebp
je 0x50b592
lea eax, [esp + 0xc4]
push 0x400
push eax
call fcn.0052bc50
add esp, 8
call fcn.0052afa0
test eax, eax
jne 0x50b3c9
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [esp + 0x14]
call fcn.004f6430
add esp, 8
call fcn.0052afa0
mov ecx, dword [esp + 0x1c4]
neg eax
pop ebx
sbb eax, eax
xor ecx, esp
and eax, 0xffffffdd
add eax, 0x23
call fcn.006193d7
add esp, 0x1c4
ret
Function at 0x50fe10
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1004
call fcn.00619e00
mov eax, dword [0x6efb00]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x50fe79
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x50fe79
lea eax, [esp]
push eax
call dword [0x6ec00c]
add esp, 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.006193d7
add esp, 0x1004
ret
mov ecx, dword [esp + 0x1000]
xor eax, eax
xor ecx, esp
call fcn.006193d7
add esp, 0x1004
ret
Function at 0x535170
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x20
call fcn.00619e00
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x5351b8
sub eax, 2
je 0x5351b8
sub eax, 0x15
je 0x5351b8
push 0x293
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.0052e380
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call fcn.00534f90
cmp eax, 1
jne 0x5351b0
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push ebp
push edi
xorps xmm0, xmm0
mov dword [esp + 0x10], ecx
xor edi, edi
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
test esi, esi
jne 0x5351f9
or ecx, 0x400
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x3c], 1
jne 0x535207
or ecx, 1
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x48]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x53525f
cmp esi, 8
je 0x5352a6
mov ecx, dword [esp + 0x10]
test ecx, 0x400
je 0x53526e
push ebp
lea eax, [esp + 0x14]
and ecx, 0xfffffbff
push eax
push dword [esp + 0x40]
or ecx, 4
mov edi, esi
push dword [esp + 0x40]
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x535225
mov ebx, 1
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2d4
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.0052e380
test edi, edi
cmovne esi, edi
push esi
call fcn.005356b0
push eax
push 1
call fcn.0052d9c0
add esp, 0x20
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2c5
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.0052e380
add esp, 0x14
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x5842b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00619e00
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0x10
lea eax, [edx + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x5842f4
cmp ecx, edx
jb 0x5842f4
push edi
mov ecx, esi
sub edx, esi
mov edi, 0x10
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x5842e3
pop edi
jmp 0x584301
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push 0x10
push esi
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call fcn.0055ae10
add esp, 0x14
pop esi
test eax, eax
je 0x58432b
cmp dword [esp], 0x10
jne 0x58432b
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x584470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x5844e3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x5844e3
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0xc]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x5844b3
push esi
mov esi, ebp
lea ecx, [ebx + 0x10]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x5844a0
mov eax, dword [ebx + 0xc]
pop esi
cmp edx, eax
jbe 0x5844e1
sub edx, eax
cmp edx, 0x10
jbe 0x5844c5
mov edx, 0x10
jmp 0x5844c9
test edx, edx
je 0x5844e1
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x30], al
inc ecx
cmp ecx, edx
jb 0x5844d0
pop edi
pop ebx
pop ebp
ret
Function at 0x58a240
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.00619e00
mov eax, dword [0x6efb00]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb0]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, dword [esp + 0xac]
push edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], 0
test edi, edi
je 0x58a2ad
cmp edi, eax
je 0x58a2a1
test ebp, ebp
je 0x58a320
test ebx, ebx
js 0x58a320
mov dword [esp + 0x10], 1
mov dword [esi], edi
jmp 0x58a2b3
test eax, eax
je 0x58a320
mov edi, eax
push edi
call fcn.004fd370
add esp, 4
test al, 2
jne 0x58a320
test ebp, ebp
je 0x58a42b
push edi
mov dword [esp + 0x14], 1
call fcn.0051ed90
add esp, 4
cmp eax, 0x90
jg 0x58a320
cmp eax, ebx
jge 0x58a33b
push dword [esp + 0x14]
push edi
push dword [esi + 4]
call fcn.00525690
add esp, 0xc
test eax, eax
je 0x58a320
push ebx
push ebp
push dword [esi + 4]
call fcn.00525840
add esp, 0xc
test eax, eax
je 0x58a320
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.005255f0
add esp, 0xc
test eax, eax
jne 0x58a357
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006193d7
add esp, 0x9c
ret
cmp ebx, 0x90
ja 0x58a320
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x90
je 0x58a37a
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x58a380
mov ebp, dword [esp + 0x14]
push ebp
push edi
push dword [esi + 8]
call fcn.00525690
add esp, 0xc
test eax, eax
je 0x58a438
push edi
call fcn.0051ed90
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.00525840
add esp, 0x10
test eax, eax
je 0x58a438
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x58a3d0
push ebp
push edi
push dword [esi + 0xc]
call fcn.00525690
add esp, 0xc
test eax, eax
je 0x58a438
push edi
call fcn.0051ed90
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.00525840
add esp, 0x10
test eax, eax
je 0x58a438
push dword [esi + 8]
push dword [esi + 4]
call fcn.005259d0
xor ebp, ebp
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebp, ecx
jmp 0x58a43a
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x58a40f
jmp 0x58a37e
xor ebp, ebp
test ebx, ebx
je 0x58a450
lea eax, [esp + 0x18]
push 0x90
push eax
call fcn.00401320
add esp, 8
mov eax, ebp
jmp 0x58a322
Function at 0x5c6a10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5c6a24
mov dword [esp + 0x18], fcn.005c51e0
jmp fcn.005be740
mov dword [esp + 0x18], fcn.005c4480
jmp fcn.005be440
Function at 0x60b500
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00619e00
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x60b58a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x60b58e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.00523150
push eax
call fcn.0051eda0
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x60b597
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x60b542
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x60b613
mov edx, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr edx, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov eax, esi
lea edi, [edi - 1]
sub eax, ebp
mov ecx, ebp
shr ecx, 0x1f
inc ebp
shr eax, 0x1f
xor al, cl
xor cl, dl
or al, cl
movzx ecx, byte [esp + 0x2c]
dec al
movzx edx, al
movzx eax, byte [edi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x14]
cmp ebp, dword [esp + 0x10]
jb 0x60b5d5
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [esp + 0x2c], ecx
not ecx
pop ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret
Function at 0x619002
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x619029
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x61902c
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00618fde
pop esi
leave
ret 8

Function at 0x61aa2f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x61aa6e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x61aa6e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x61aa6e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x61aa6e
cmp dword [ecx + 0x74], 0xe
jbe 0x61aa6e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401c3d
Capabilities:
Terminate process

Disassembly:
add ecx, 0x9c
call fcn.00401b7c
cmp eax, 1
jne 0x401c64
push 0
push 0
push eax
push 0
call fcn.0040b8f8
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x4022d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4022ea
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4022fc
xor eax, eax
jmp 0x40232e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x402320
cmp esi, eax
jae 0x4022f8
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402312
cmp esi, eax
jae 0x4022f8
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
Function at 0x403de1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebp
push esi
xor ebp, ebp
mov esi, ecx
cmp dword [esi + 4], ebp
push edi
mov dword [esp + 0xc], ebp
je 0x403df7
call fcn.00403c3a
call fcn.00433416
push dword [esp + 0x18]
movzx ecx, word [esp + 0x18]
mov eax, dword [eax + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebp
jne 0x403e44
call fcn.00433416
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov eax, dword [eax + 0x1c]
push 9
push 0x10
push str.CPicture_Error
push str.FindResource___Failed_t
push eax
call dword [sym.imp.USER32.dll_MessageBoxExA]
xor eax, eax
jmp 0x403f29
push ebx
call fcn.00433416
mov eax, dword [eax + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, ebp
jne 0x403e89
call fcn.00433416
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 9
push 0x10
push str.CPicture_Error
push str.LoadResource___Failed_t
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxExA]
xor eax, eax
jmp 0x403f28
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x403eb3
call fcn.00433416
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 9
push 0x10
push str.CPicture_Error
push str.LockResource___Failed_t
jmp 0x403e78
call fcn.00433416
mov eax, dword [eax + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push ebx
mov ecx, esi
call fcn.00403c5c
test eax, eax
je 0x403eda
mov dword [esp + 0x10], 1
mov eax, dword [esi + 4]
cmp eax, ebp
mov dword [esi + 0xc], edi
je 0x403f1a
mov ecx, dword [eax]
lea edi, [esi + 8]
push edi
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
add esi, 0x10
push esi
push eax
call dword [ecx + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebp, 0x9ec
push ebp
push 0x60
push dword [edi]
call ebx
push ebp
push 0x60
push dword [esi]
mov dword [edi], eax
call ebx
mov dword [esi], eax
jmp 0x403f24
mov dword [esi + 8], ebp
mov dword [esi + 0x10], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x40aef7
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x437fd7
call fcn.0041cc58
sub esp, 0x17c
mov eax, dword [0x44e660]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push 0x10
mov dword [ebp - 0x134], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x188], 0x44
lea edi, [ebp - 0x184]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0041d840
lea eax, [ebp - 0x114]
push 0x5c
push eax
call fcn.0041d810
xor ebx, ebx
add esp, 0x10
cmp dword [ebp - 0x134], ebx
mov byte [eax], bl
jne 0x40afa0
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x144]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
push dword [ebp - 0x140]
call esi
jmp 0x40b060
push ebx
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x118], 0xf
call fcn.00404001
mov edi, 0x43b1f4
push edi
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], ebx
call fcn.00404508
push esi
lea ecx, [ebp - 0x130]
call fcn.0040ae4c
push edi
lea ecx, [ebp - 0x130]
call fcn.0040ae4c
push 0x43b1f0
lea ecx, [ebp - 0x130]
call fcn.0040ae4c
push dword [ebp - 0x134]
lea ecx, [ebp - 0x130]
call fcn.0040ae4c
cmp dword [ebp - 0x118], 0x10
mov eax, dword [ebp - 0x12c]
jae 0x40b018
lea eax, [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x188]
push ecx
lea ecx, [ebp - 0x114]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x144]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
push dword [ebp - 0x140]
call esi
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.004040ef
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp edi, 1
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c04e
leave
ret
Function at 0x40d21a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jbe 0x40d246
mov eax, dword [ebp + 0xc]
push esi
movzx esi, byte [ebp + 8]
movzx edx, byte [eax]
xor edx, esi
mov esi, dword [ebp + 8]
shr esi, 8
xor esi, dword [edx*4 + 0x44c168]
inc eax
dec ecx
mov dword [ebp + 8], esi
jne 0x40d228
pop esi
mov eax, dword [ebp + 8]
pop ebp
ret

Function at 0x40d24b
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 8], 0
and dword [ecx + 4], 0
mov dword [ecx + 0xc], 0x67452301
mov dword [ecx + 0x10], 0xefcdab89
mov dword [ecx + 0x14], 0x98badcfe
mov dword [ecx + 0x18], 0x10325476
ret
Function at 0x4137c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x41381a
call fcn.00433416
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41381a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x413810
xor eax, eax
jmp 0x413933
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x41384a
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x41384a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x413930
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x413877
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.004128ba
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x413930
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4138c0
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x4138c0
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x4138ba
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.004128ba
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x413920
and dword [ebp + 0xc], 0
jmp 0x413920
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x413920
push 0xc
call fcn.0042ab3a
mov esi, eax
test esi, esi
pop ecx
je 0x413902
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x413904
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x41391b
push dword [ebp - 8]
call fcn.004298cc
jmp 0x413920
call fcn.004298a3
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x413885
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41bda5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0041bfe0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41be40
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x452820]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x41be40
cmp eax, 1
je 0x41be61
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41be40
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41be0d
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x41be3c
xor eax, eax
inc eax
jmp 0x41be80
cmp edi, eax
jae 0x41be44
xor eax, eax
jmp 0x41be80
cmp eax, esi
jae 0x41be4b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x452820]
jmp 0x41be64
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret