joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1644
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b167c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004af694
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004af66c
jmp 0x4b1688
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b2d35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b2d77
call fcn.004b8abd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b2d77
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b2d6e
xor eax, eax
jmp 0x4b2d7f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b2d85
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b8fed
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b901b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9039
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b8f53
jmp 0x4b9039
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b9039
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b8f53
test edi, edi
mov eax, edi
jne 0x4b9023
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000112d
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0x104
call fcn.1001c015
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push 0x104
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001bb10
add esp, 0xc
push 0x104
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100011ac
cmp dword [ebp - 0x10], 0
je 0x100011a4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1001c00a
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
jmp 0x10001303
push 0x1002b068
mov edx, dword [ebp - 0x10]
push edx
call fcn.1001bd80
add esp, 8
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x1002b078
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001bd80
add esp, 8
push 6
mov edx, dword [ebp + 8]
push edx
call section..text
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001bd80
add esp, 8
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x6f
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xb
ja case.0x10001227.5
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dl, byte [eax + 0x10001321]
jmp dword [edx*4 + 0x10001309]
push str.pb_mob.dat
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001bd80
add esp, 8
jmp case.0x10001227.5
push str.pb_sim.dat
mov edx, dword [ebp - 0x10]
push edx
call fcn.1001bd80
add esp, 8
jmp case.0x10001227.5
push str._sms_mob.dat
mov eax, dword [ebp - 0x10]
push eax
call fcn.1001bd80
add esp, 8
jmp case.0x10001227.5
push str._sms_sim.dat
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001bd80
add esp, 8
jmp case.0x10001227.5
push str._vcs_mob.dat
mov edx, dword [ebp - 0x10]
push edx
call fcn.1001bd80
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.1001bd70
add esp, 8
push 0x1002b0c4
mov edx, dword [ebp - 0x10]
push edx
call fcn.1001bff7
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100012c8
mov eax, dword [ebp - 0x14]
push eax
call fcn.1001bf49
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0
je 0x100012e1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001be60
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x10], 0
je 0x10001300
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.1001c00a
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b180
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x1000b197
jmp 0x1000b2a7
push 0x104
push 0x1003124c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x1003124c
call fcn.1001ccc0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000b1c9
mov edx, dword [ebp - 4]
mov byte [edx], 0
push 0
push 0
push 0x1002b8c0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 8], eax
push 0x1003124c
call fcn.1001c8b0
add esp, 4
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2 + 0x40]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call fcn.1001bb68
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000b2a7
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1001bb10
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x1002b8c8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x1002b8d0
mov edx, dword [ebp - 4]
push edx
call fcn.1001bd80
add esp, 8
push 0x1003124c
mov eax, dword [ebp - 4]
push eax
call fcn.1001bd80
add esp, 8
push 0x1002b8d4
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001bd80
add esp, 8
push 0x1003124c
mov edx, dword [ebp - 4]
push edx
call fcn.1001bd80
add esp, 8
push str.msmplugs
mov eax, dword [ebp - 4]
push eax
call fcn.1001bd80
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp - 4]
push edx
call fcn.1001be60
add esp, 4
mov dword [ebp - 4], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000e82a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
mov dword [0x10031570], 0
mov ecx, 0x10030ec8
call fcn.10003924
test eax, eax
jne 0x1000e856
mov eax, 0xfffffff7
jmp 0x1000ea7f
mov ecx, 0x10030ec8
call fcn.100037ba
test eax, eax
jne 0x1000e878
mov ecx, 0x10030ec8
call fcn.10003aac
mov eax, 0xfffffff9
jmp 0x1000ea7f
mov dword [ebp - 0x10c], 0xffffffc0
lea eax, [ebp - 0x110]
push eax
push 0x8d
mov ecx, 0x10030ec8
call fcn.10003ad8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jge 0x1000e8bc
mov ecx, 0x10030ec8
call fcn.10003aac
mov eax, dword [ebp - 0x10c]
jmp 0x1000ea7f
push 0x3e8
push 0x1002c068
push 0x1000
push 0x800
call sub.BaseLib.dll_MemBuf_new__
add esp, 0x10
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x110]
call dword [eax + 0x34]
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jge 0x1000e935
mov ecx, dword [ebp - 0x108]
push ecx
call sub.BaseLib.dll_MemBuf_delete
add esp, 4
mov dword [ebp - 0x108], 0
mov ecx, 0x10030ec8
call fcn.10003aac
mov eax, dword [ebp - 0x10c]
jmp 0x1000ea7f
push 0x1002c0a4
mov edx, dword [ebp - 0x108]
push edx
call fcn.10010b8b
add esp, 8
test eax, eax
je 0x1000e965
push str.getFile
mov eax, dword [ebp - 0x108]
push eax
call fcn.10010b8b
add esp, 8
test eax, eax
jne 0x1000e992
mov ecx, dword [ebp - 0x108]
push ecx
call sub.BaseLib.dll_MemBuf_delete
add esp, 4
mov dword [ebp - 0x108], 0
mov ecx, 0x10030ec8
call fcn.10003aac
mov eax, 0xffffffa1
jmp 0x1000ea7f
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x2f
mov edx, dword [ebp + 8]
push edx
call fcn.1001ccc0
add esp, 8
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1001bd70
add esp, 8
lea eax, [ebp - 0x104]
push eax
call fcn.1001c8b0
add esp, 4
movsx ecx, byte [ebp + eax - 0x105]
cmp ecx, 0x5c
je 0x1000ea11
push str._.._
lea edx, [ebp - 0x104]
push edx
call fcn.1001bd80
add esp, 8
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1001bd80
add esp, 8
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1000f1c8
add esp, 0xc
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
push eax
call sub.BaseLib.dll_MemBuf_delete
add esp, 4
mov dword [ebp - 0x108], 0
mov ecx, 0x10030ec8
call fcn.10003aac
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10012d88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10012a1c
push eax
push esi
push dword [ebp + 8]
call fcn.100129d1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
invalid

Function at 0x10012e04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov dword [0xa445c624], eax
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
Function at 0x10013239
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10012a1c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100129d1
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10012a1c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100129d1
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.10012a1c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100129d1
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.10012a0c
push edx
adc eax, 0xa580dc5b
int3
Function at 0x100197dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push edi
mov dword [ebp - 0x354], ecx
push str._____Load_Plug_Info_
call fcn.1001992d
add esp, 4
mov byte [ebp - 0x244], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x243]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x34c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x34b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str..plug
mov eax, dword [ebp - 0x354]
add eax, 0x218
push eax
push 0x1002d638
lea ecx, [ebp - 0x244]
push ecx
call fcn.1001bab6
add esp, 0x10
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x140], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x13c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x350], 0
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x10019915
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x354]
add edx, 0x218
push edx
push 0x1002d648
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bab6
add esp, 0x10
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x34c]
push edx
mov ecx, dword [ebp - 0x354]
call fcn.10019d11
mov eax, dword [ebp - 0x350]
add eax, 1
mov dword [ebp - 0x350], eax
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100198a0
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str._____Finish_Plug_Info_
call fcn.1001992d
add esp, 4
mov eax, dword [ebp - 0x350]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x44449d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
or ebx, 0xffffffff
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ebx
call dword [0x412070]
mov esi, eax
cmp dword [ebp - 4], esi
je 0x4444df
lea ecx, [ebp - 4]
call fcn.0043f84a
mov dword [ebp - 4], esi
push edi
push edi
push edi
push 2
push edi
push dword [ebp - 4]
call dword [0x412144]
mov esi, eax
cmp dword [ebp - 8], esi
je 0x444500
lea ecx, [ebp - 8]
call fcn.00439485
mov dword [ebp - 8], esi
cmp dword [ebp - 8], edi
jne 0x444524
cmp dword [ebp - 4], ebx
je 0x4445d3
push dword [ebp - 4]
mov esi, dword [fcn.00412084]
call esi
cmp dword [ebp - 8], edi
mov dword [ebp - 4], ebx
jmp 0x4445cc
push edi
push edi
push edi
push 4
push dword [ebp - 8]
call dword [0x412140]
mov edi, eax
test edi, edi
jne 0x444551
cmp dword [ebp - 4], ebx
mov esi, dword [fcn.00412084]
je 0x4445c8
push dword [ebp - 4]
call esi
mov dword [ebp - 4], ebx
jmp 0x4445c8
cmp word [edi], 0x5a4d
jne 0x444581
mov esi, dword [edi + 0x3c]
push 0xf8
add esi, edi
push esi
call dword [0x4121d8]
test eax, eax
jne 0x4445ae
cmp dword [esi], 0x4550
jne 0x4445ae
push esi
push edi
call fcn.00444457
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
cmp dword [ebp - 4], ebx
mov esi, dword [fcn.00412084]
je 0x444594
push dword [ebp - 4]
call esi
mov dword [ebp - 4], ebx
push edi
call dword [fcn.0041213c]
cmp dword [ebp - 8], 0
je 0x4445a6
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
mov esi, dword [fcn.00412084]
je 0x4445c1
push dword [ebp - 4]
call esi
mov dword [ebp - 4], ebx
push edi
call dword [fcn.0041213c]
cmp dword [ebp - 8], 0
je 0x4445d3
push dword [ebp - 8]
call esi
xor eax, eax
jmp 0x4445a9

Function at 0xf410ec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf410f6
pushal
call 0xf410fc
pop ebp
sub ebp, 0x10
sub ebp, 0xb410ec
jmp 0xf41112
mov eax, 0xb410ec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d5
mov edx, 0x99f7f7ae
xor byte [eax], dl
inc eax
dec ecx
jne 0xf41129
jmp 0xf4113c
and eax, 0x92272563
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
das
outsd dx, dword [esi]
push esi
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
lodsd eax, dword [esi]
arpl word [esi], dx
stosb byte es:[edi], al
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
adc al, 0x86
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
pop ecx
dec esp
lodsd eax, dword [esi]
and ax, 0xa22f
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
lodsd eax, dword [esi]
imul esp, dword [ebx], 0xffffffca
mov dl, byte [edx + 0x27]
stosb byte es:[edi], al
mov ah, byte [ebx]
retf 0x528a
Function at 0x4039a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416e86
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x421054]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], 0
push 0x404
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x420]
movq qword [ebp - 0x1c], xmm0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.00408da0
add esp, 0xc
mov dword [ebp - 0x420], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x403a64
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x403a64
call fcn.004020c0
mov esi, eax
jmp 0x403b51
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x403a87
call fcn.004020c0
jmp 0x403b44
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
test ebx, ebx
jne 0x403aa5
call fcn.004020c0
jmp 0x403b44
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x403ac6
mov esi, 0x8007000e
jmp 0x403b46
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.00401c00
jmp 0x403af0
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x403b07
mov esi, 0x8007000e
jmp 0x403b46
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x403b27
call fcn.004020c0
jmp 0x403b44
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.004037b0
mov esi, eax
test edi, edi
je 0x403b51
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x403b70
lea ecx, [ebp - 0x420]
call fcn.00402cd0
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004068f6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x404519
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404525
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x404520
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x404575
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404580
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x404670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x421054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x4046a7
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004068f6
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x402db0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4046d0
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004068f6
mov esp, ebp
pop ebp
ret

Function at 0x405010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x421054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x818]
push 0x44
push 0
push eax
call fcn.00408da0
push esi
lea eax, [ebp - 0x7d4]
mov dword [ebp - 0x818], 0x44
xorps xmm0, xmm0
push 0x418a34
push eax
movups xmmword [ebp - 0x828], xmm0
call fcn.00405690
add esp, 0x18
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4050a3
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004068f6
mov esp, ebp
pop ebp
ret 0xc
cmp word [ebp + 0x10], 0xffff
jne 0x4050b8
push 0xffffffffffffffff
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x828]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x824]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004068f6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4050f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405100
sub ecx, edx
sar ecx, 1
jne 0x40511b
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x405145
mov eax, dword [ebp + 8]
push 0
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x405170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x421054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push 0x38
push 0
push eax
call fcn.00408da0
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004068f6
mov esp, ebp
pop ebp
ret 8