joyce8/EMBER2024-capa huggingface dataset:
Function at 0x782610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7884cc]
cmp dword [eax + 0x28], 0
jne 0x782628
xor eax, eax
jmp 0x782757
mov ecx, dword [0x78843c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x788430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x78842c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x788430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x78842c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x7884b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x786680
push 0x7866d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x788428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00782550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x7825e0
mov edx, dword [0x7884cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x788434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x782757
cmp dword [ebp - 0x38], 0x12
jne 0x78274b
mov dword [0x788444], 0
call fcn.00782760
xor eax, eax
jmp 0x782757
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x78271c
mov esp, ebp
pop ebp
ret 4

Function at 0x783b30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7846cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x786168
sub eax, eax
test esi, esi
je 0x7847a4
sub eax, 1
test ecx, ecx
je 0x7847a2
test esi, 3
je 0x78470a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x7846ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x784789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x784714
mov ecx, edx
test ecx, ecx
je 0x7847a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x78478f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x7847ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0078482f
jae 0x7847ba
xor ecx, ecx
call fcn.0078482f
jae 0x7847e9
xor eax, eax
call fcn.0078482f
jae 0x7847f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0078482f
adc al, al
jae 0x7847db
jne 0x784825
stosb byte es:[edi], al
jmp 0x7847bd
call fcn.0078483b
sub ecx, ebx
jne 0x784802
call fcn.00784839
jmp 0x784821
lodsb al, byte [esi]
shr eax, 1
je 0x78484b
adc ecx, ecx
jmp 0x78481e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00784839
cmp eax, 0x7d00
jae 0x78481e
cmp ah, 5
jae 0x78481f
cmp eax, 0x7f
ja 0x784820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7847bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x78517c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x788000]
jne 0x785186
repz ret
jmp fcn.0078542d
Function at 0xb49b30
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x20], edx
call fcn.00b49892
xchg dword [esp], edx
pushal
mov word [esp + 0x1b], bp
mov byte [esp], al
lea edx, [edx + 0x1c]
jmp 0xb4991c

Function at 0xb7c8eb
Capabilities:
Hash data with md5

Disassembly:
push ax
mov word [esp], dx
jmp 0xb7c94d
mov dword [eax + 0xc], reloc.MSVCRT.dll_malloc
jmp 0xb7c95c
and dword [eax], 0
pushal
lea esp, [esp + 0x20]
mov dword [eax + 8], 0x67452301
jmp 0xb7c913
lea esp, [esp + 4]
lea esp, [esp + 2]
and dword [eax + 4], 0
clc
jmp 0xb7c929
mov dword [eax + 0x10], reloc.MSVCRT.dll_malloc
pushfd
lea esp, [esp + 4]
mov dword [eax + 0x14], 0x10325476
ret
Function at 0xc942ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0x5046
clc
pop dword [esp + 3]
std
sub esp, 1
push dword [esp + 0x10]
dec esi
mov word [esp + 0x10], bp
mov cl, byte [esp + 0xb]
push word [esp + 0xd]
jmp 0xc9428c
Function at 0xc94782
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dl
sbb ebp, esi
neg bx
mov byte [esp], bl
bsr ebp, edi
jmp 0xc94765
ror ch, 2
xchg bx, si
mov edx, dword [esp]
cpuid
rol ax, 0xb
lea edi, [ecx + 0x59]
jmp 0xc94725
cmc
xchg edi, ebp
and cx, ax
xchg bx, dx
mov byte [esp], cl
not bh
jmp 0xc947a6
lea eax, reloc.MSVCRT.dll_malloc
lea edi, [eax + ecx]
lea esi, [esi + edi]
add esp, 0
add esp, 0
lea esp, [esp]
jmp 0xc9474f
add esp, 0x14
mov byte [esp], dh
mov di, sp
btr eax, ebx
jmp 0xc9473b
mov ebp, esi
xchg byte [esp], dl
sub esp, 0x10
push word [esp + 0xe]
jmp 0xc9482f
clc
mov di, 0x5cbf
lea ebp, [edi*4]
add esp, 0
rcr edx, 0xa
lea ebx, [ebp*4]
jmp 0xc94790
bt eax, esp
xchg word [esp], cx
mov dl, al
xchg ebx, eax
bswap edx
push word [esp + 1]
jmp 0xc9480f
bsf dx, sp
xchg dword [esp], ecx
push dword [esp]
xchg byte [esp + 6], al
std
jmp 0xc947f9
popal
xchg ah, cl
lea ecx, [eax + edi]
and edi, ebx
rdtsc
dec edi
jmp 0xc947c1
mov si, 0xe7b7
cld
rdtsc
mov ch, 0x6e
lea esp, [esp + 4]
jmp 0xc9489f
push word [esp]
xchg ah, al
mov esi, 0x9fe6d7d
mov word [esp], bp
mov ecx, dword [esp]
or cx, 0x4c3d
jmp 0xc947d5
push word [esp + 0x12]
lea esp, [esp + 0xe]
mov eax, 0x622ebfb0
mov dword [esp], eax
neg edx
sub esp, 0x1b
jmp 0xc947ec
xchg cl, ch
not ah
mov bx, word [esp + 1]
lea esi, [eax*4]
call fcn.00c94847
mov eax, dword [esp + 6]
add bl, cl
btc edi, edi
xchg dl, cl
lea esp, [esp + 5]
lea esp, [esp + 2]
jmp 0xc948f5
cmp ah, 0x11
mov byte [esp + 1], ch
xchg ebx, ebp
rdtsc
push word [esp]
rol edi, cl
jmp 0xc948ca
mov bp, word [esp]
mov ah, byte [esp + 4]
pop cx
pop si
xchg dx, bx
push word [esp]
jmp 0xc9485e
mov ch, 0xab
xchg cl, al
mov ebp, edx
adc cx, 0x39f5
jmp 0xc948dd
shl di, cl
xchg edx, edi
mov bp, word [esp + 3]
setle bh
xchg bx, ax
mov cl, 0xa3
jmp 0xc948b4
lea eax, reloc.MSVCRT.dll_malloc
xchg dword [esp], edi
xchg dword [esp], ebx
neg ebx
neg bx
jmp 0xc9491e
btr edx, edi
xchg bp, di
rdtsc
push bp
mov byte [esp], cl
mov ax, word [esp]
jmp 0xc94888
mov bp, 0xa23d
or eax, eax
not bp
xor bl, 0x1f
mov dl, 0x76
xchg al, ch
jmp 0xc94931
bswap ebx
rdtsc
setg dh
push dword [esp + 1]
dec dx
bsf cx, sp
jmp 0xc94908
bswap esi
mov ch, byte [esp + 7]
mov edx, dword [esp + 1]
mov cx, 0x8a12
jmp 0xc94990
mov bp, ax
push dword [esp + 0x14]
lea ebx, [ecx*4]
jmp 0xc949c2
sub esp, 0x15
not ah
xchg dword [esp + 2], ecx
pop ebx
push sp
neg si
jmp 0xc9495b
mov si, word [esp + 1]
btr ax, bx
mov bp, cx
mov ax, word [esp + 2]
pop ecx
add esp, 1
jmp 0xc94971
mov edi, ecx
setnp bh
bsf ecx, ecx
mov dh, 0x10
xchg si, ax
xchg bp, ax
jmp 0xc949f0
mov bh, byte [esp + 0x18]
xchg dword [esp + 7], edi
mov cl, byte [esp + 7]
setae ch
mov byte [esp], dh
setp ah
jmp 0xc949a7
pop word [esp + 8]
bts eax, ecx
push dword [esp + 0xc]
pop word [esp + 5]
jmp 0xc94a03
lea esp, [esp + 2]
stc
xchg word [esp + 0x16], di
pop eax
not dh
mov ecx, dword [esp + 0x13]
jmp 0xc949d9
bsf bx, ax
pop word [esp + 3]
call fcn.00c95116
sub eax, 0xaf5c35a5
sub bl, byte [ebp - 0x2a]
inc esp
and ebx, esi
pop ecx
invalid

Function at 0xc94847
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp + 4]
mov esi, 0xc4612f5a
jmp 0xc94873
Function at 0xcf8d75
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xcf8df9
mov dh, ch
mov edx, dword [esp + 5]
bsf ax, ax
mov cl, byte [esp + 0x17]
push dword [esp + 0xf]
pop edx
jmp 0xcf8dbf
mov eax, 0x3849bee9
xchg dword [esp + 8], eax
bt esi, edi
mov di, word [esp + 0xb]
mov dword [esp + 4], edx
bswap ebx
jmp 0xcf8dd5

Function at 0xcf8ff9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg di, ax
jmp 0xcf9033
mov edx, dword [esp + 3]
xchg dword [esp], esi
not dx
push word [esp + 4]
add esp, 1
std
jmp 0xcf901d

Function at 0xcf92e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xa]
mov byte [esp + 0xf], ch
bsr bp, ax
bts edi, esp
jmp 0xcf92eb
std
jmp 0xcf92d2
xchg byte [esp + 4], al
std
xchg word [esp + 4], di
not ecx
cld
lea edi, reloc.MSVCRT.dll_malloc
jmp 0xcf9412
pop dword [esp + 3]
pop di
add esp, 2
std
mov byte [esp + 1], cl
inc eax
jmp 0xcf93a4
lea ebp, [edx*4]
and edi, ebp
bt ax, sp
lea ecx, [edx + ebp]
btr bp, di
mov eax, 0x4fc1b481
jmp 0xcf9316
mov word [esp], cx
mov ebx, esp
not si
mov byte [esp + 3], al
adc esi, esi
jmp 0xcf9384
cpuid
mov ebx, dword [esp + 1]
pushfd
lea ebx, [eax + ebp]
xchg bx, cx
xchg ebp, ebx
jmp 0xcf9347
pop edi
neg di
not esi
mov bl, byte [esp]
rdtsc
dec ax
jmp 0xcf93cd
add esp, 4
setnp bl
mov al, 0x25
std
bts eax, ebx
lea ecx, [ecx*4]
jmp 0xcf936e
xchg dword [esp], edx
xchg byte [esp], ah
mov bh, byte [esp + 2]
xchg bx, ax
mov ah, 0x89
xchg dword [esp], edx
jmp 0xcf935d
clc
ror al, cl
mov bp, bx
setp cl
stc
mov di, ax
jmp 0xcf93f4
clc
mov dl, 0x1b
rdtsc
not ebp
adc di, 0x2d44
mov edi, dword [esp]
jmp 0xcf93b7
bswap edx
mov ebx, edx
lea esi, [edi*4]
call fcn.00cf956a
das
and dword ss:[eax - 0x5d], esp
fisub dword [esi - 0x79]
into
xchg si, cx
mov ebx, 0xadbce367
neg cl
bt ebx, ebp
xchg ebx, esi
xchg bh, ch
jmp 0xcf93de
lea esp, [esp + 6]
xchg byte [esp + 3], dh
mov edi, 0x59ade189
lea esi, [edx*4]
mov dl, bh
cmc
jmp 0xcf932c

Function at 0xcf9306
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, 0xe7
sub esp, 0
xchg ebx, eax
adc ax, bx
lea ebx, reloc.MSVCRT.dll_malloc
jmp 0xcf92bd
sub esp, 0xb
pushal
lea esp, [esp + 0x4b]
xchg ah, bl
rcl cx, 3
cpuid
jmp 0xcf9101
mov ebx, dword [esp + 8]
bswap esi
and si, dx
cpuid
sub esp, 4
jmp 0xcf916d
mov bp, word [esp + 6]
add esp, 1
mov bh, ah
mov dx, 0xab3c
mov di, word [esp + 3]
xchg si, bx
jmp 0xcf9129
rdtsc
push sp
mov edi, dword [esp + 6]
mov ch, bh
mov bl, cl
add esp, 7
jmp 0xcf9196
mov bl, 0xa9
xchg bp, di
bsr esi, edx
pop dword [esp + 3]
mov dh, byte [esp + 9]
pop edx
jmp 0xcf9157
mov ah, al
mov word [esp], di
lea ebx, reloc.MSVCRT.dll_malloc
lea esp, [esp + 1]
jmp 0xcf91f5
setne ch
add esp, 2
rdtsc
sbb cx, 0xd452
bswap edi
not edi
jmp 0xcf9180
mov bp, 0x278f
dec edi
sub esp, 0xc
bswap ebp
push dword [esp + 6]
mov ah, byte [esp + 0xf]
jmp 0xcf913f
lea esp, [esp + 2]
or bx, bx
mov si, 0xe7f9
rdtsc
not ah
shr bh, cl
call fcn.00cf91d1
pushal
xchg dword [esp + 0xc], ebp
mov cx, 0xce8c
popal
mov cx, 0xbce7
cpuid
jmp 0xcf91ba
push dword [esp + 7]
mov dword [esp + 1], edx
lea ecx, [edx + edi]
jmp 0xcf9117
Function at 0xcf9685
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
jmp 0xcf96e6
not bl
push word [esp + 4]
stc
mov cx, 0x745
lea ebp, [edx*4]
jmp 0xcf9711
lea ebp, [ebx*4]
rdtsc
cmc
bsf ebx, ecx
setnp dl
mov ax, cx
jmp 0xcf96c8
push word [esp]
pop bp
mov al, byte [esp]
mov dx, word [esp + 2]
std
jmp 0xcf9764
mov edi, 0x8b9b001
rdtsc
rol dl, cl
pop edi
dec dl
mov dx, sp
jmp 0xcf96fb
add esp, 2
pushfd
mov byte [esp + 1], al
mov bl, byte [esp + 3]
xchg cx, dx
jmp 0xcf97b1
bswap esi
mov byte [esp + 1], dl
mov edi, 0xd057461a
cpuid
mov dx, word [esp + 1]
mov ch, byte [esp]
jmp 0xcf974e
mov bh, byte [esp + 3]
call 0xcf979b
aas
mov ebx, 0x3cbd4e2b
pop ss
pushfd
xor dl, byte [ebp - 0x5c]
and ebp, dword [ecx - 0x17]
jns 0xcf97e2
jmp 0xcf9825
or byte [esi - 0x79], ah
push esp
and al, 0x25
bsr esi, edi
add esp, 0x27
cpuid
jmp 0xcf9859
inc eax
daa
shl byte [edx - 0x2d], cl
dec edx
in eax, 0x14
xchg dword [esi], ebp
mov word [esp + 8], ax
mov ecx, dword [esp + 0xf]
mov word [esp + 0x12], sp
cld
call fcn.00cf97fd
push word [esp + 0xe]
pop dword [esp + 4]
bts bp, bx
not ebx
jmp 0xcf9882
neg bp
mov cx, 0x691e
lea esp, [esp + 1]
inc ah
pushal
setbe cl
jmp 0xcf9843
btr bx, sp
lea edi, [ebx + ebp]
mov edi, 0x186f67a7
call fcn.00cf98aa
pop esp
scasd eax, dword es:[edi]
mov dh, 0xa1
loopne 0xcf980d
mov bh, al
clc
mov dx, bx
pop ecx
mov word [esp + 0x10], sp
bsf eax, esi
rdtsc
jmp 0xcf986c

Function at 0xcf9986
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], bh
xchg word [esp + 1], si
mov dx, word [esp + 0x14]
jmp 0xcf99ac
lea ecx, [ebx + 0xfb]
mov bp, word [esp + 8]
mov word [esp + 0x18], sp
pop ebp
jmp 0xcf9970
bsf ax, sp
inc ebx
bts eax, eax
shl edx, 0x16
mov cx, word [esp + 0x11]
mov bl, dl
jmp 0xcf99fc
pop word [esp + 8]
mov bx, word [esp + 0xd]
mov dh, al
std
rdtsc
mov dx, 0xe613
jmp 0xcf99d5

Function at 0xcf9bb7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00cf9002
push esp
mov byte [esp], ah
mov dword [esp], edi
jmp 0xcf9bf6
pop word [esp]
push word [esp]
mov dword [esp], esi
jmp 0xcf9ba1
mov eax, dword [eax]
jmp 0xcf9c04
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xcf9be0
mov eax, dword [eax + 8]
push eax
jmp 0xcf8ffd
Function at 0x41f044
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x8785f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41f07f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41f098
lea eax, [ebp - 0x10]
mov edx, dword [0x89330c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41f0ab
lea eax, [ebp - 0x10]
mov edx, dword [0x89330c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41f0b7
adc edx, 0
mov edx, dword [edx*4 + 0x892154]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41f1c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f1b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41f1b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f1b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41f1b8
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41f1b8
cmp dx, 0x150
ja 0x41f1b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x41f1b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41f1b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41f1dd
inc ebx
cmp ebx, 0x19
jne 0x41f071
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8785fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4010d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010eb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401124
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401120
jmp 0x401110
cmp esi, eax
jae 0x401124
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401110
cmp esi, eax
jb 0x40112b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b620
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b755
mov eax, dword fs:[0]
push eax
sub esp, 0x51c
mov eax, dword [0x490120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x518], esi
mov dword [ebp - 0x524], 0
push 0x13
mov edi, 1
push 0x474b80
mov ecx, 0x491804
mov dword [ebp - 4], edi
call fcn.004031a0
call fcn.0042a6d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b694
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov edx, dword [ebp + 0xc]
push 0
push 0
lea ecx, [ebp - 0x520]
push ecx
push edx
push 0
mov dword [ebp - 0x524], edi
call sub.urlmon.dll_URLOpenBlockingStreamW
mov ebx, 0x500
jmp 0x40b6d0
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax]
lea edx, [ebp - 0x528]
push edx
push ebx
lea edx, [ebp - 0x510]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x51c], eax
call fcn.0042a6d4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40b68a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x514], eax
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, ebx
or ecx, edx
mov byte [ebp - 4], 2
jge 0x40b73c
push ebx
lea ecx, [ebp - 0x514]
call fcn.00409520
mov eax, dword [ebp - 0x514]
cmp dword [eax - 8], ebx
jl 0x40b826
mov dword [eax - 0xc], ebx
mov byte [eax + 0x500], 0
mov ecx, 0x140
lea esi, [ebp - 0x510]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [eax - 8], ebx
jl 0x40b826
mov dword [eax - 0xc], ebx
push 0x20
lea ecx, [ebp - 0x514]
mov byte [eax + 0x500], 0
call fcn.00409c40
push 8
lea ecx, [ebp - 0x514]
call fcn.00409c40
push 0xa
lea ecx, [ebp - 0x514]
call fcn.00409c40
mov esi, dword [ebp - 0x514]
mov eax, dword [esi - 0xc]
mov edi, dword [ebp - 0x518]
push eax
push esi
mov ecx, edi
call fcn.00409d70
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b7d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x51c]
test eax, eax
jl 0x40b7e3
cmp eax, 1
jne 0x40b6d0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044dcfc
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.00401090
int3
Function at 0x40d540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46bce8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x490120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x17
push 0x474e6c
mov ecx, 0x491804
mov dword [ebp - 4], 0
call fcn.004031a0
mov eax, dword [ebp + 8]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d5bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044dcfc
mov esp, ebp
pop ebp
ret 4
Function at 0x41b0b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46db89
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x490120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [eax + 0x18], 0xf
mov dword [eax + 0x14], esi
mov dword [ebp - 0x18], eax
mov byte [eax + 4], 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 1
cmp dword [ebp + 0x10], esi
je 0x41b266
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x14], cl
mov bl, byte [ebp - 0x13]
inc esi
inc eax
mov dword [ebp + 0xc], eax
cmp esi, 3
jne 0x41b195
mov al, byte [ebp - 0x14]
mov dl, al
shr dl, 2
and al, 3
shl al, 4
mov byte [ebp - 0x10], dl
mov cl, bl
shr cl, 4
add al, cl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x12]
mov dl, bl
and dl, 0xf
add dl, dl
mov cl, al
add dl, dl
shr cl, 6
add dl, cl
and al, 0x3f
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xd], al
xor esi, esi
movzx edi, byte [ebp + esi - 0x10]
cmp edi, dword [0x48e7c0]
jbe 0x41b166
call fcn.0044de68
cmp dword [0x48e7c4], 0x10
mov eax, dword [0x48e7b0]
jae 0x41b179
mov eax, 0x48e7b0
mov dl, byte [eax + edi]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], dl
mov eax, dword [ebp - 0x1c]
push eax
push 1
call fcn.00403520
inc esi
cmp esi, 4
jl 0x41b154
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x41b104
test esi, esi
je 0x41b263
cmp esi, 3
jge 0x41b1c6
mov ecx, 3
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x14]
push 0
push eax
call fcn.0044d850
mov bl, byte [ebp - 0x13]
add esp, 0xc
mov al, byte [ebp - 0x14]
mov dl, al
mov cl, bl
and al, 3
shl al, 4
shr cl, 4
add al, cl
shr dl, 2
and bl, 0xf
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x12]
add bl, bl
mov byte [ebp - 0x10], dl
mov dl, al
add bl, bl
shr dl, 6
add bl, dl
mov byte [ebp - 0xe], bl
and al, 0x3f
lea edi, [esi + 1]
xor ebx, ebx
mov byte [ebp - 0xd], al
test edi, edi
jle 0x41b246
movzx eax, byte [ebp + ebx - 0x10]
cmp eax, dword [0x48e7c0]
jbe 0x41b214
call fcn.0044de68
cmp dword [0x48e7c4], 0x10
mov ecx, dword [0x48e7b0]
jae 0x41b228
mov ecx, 0x48e7b0
movzx eax, byte [ebp + ebx - 0x10]
mov al, byte [ecx + eax]
mov byte [ebp - 0x1c], al
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
push 1
call fcn.00403520
inc ebx
cmp ebx, edi
jl 0x41b202
cmp esi, 3
jge 0x41b263
mov edi, 3
sub edi, esi
mov ecx, dword [ebp - 0x18]
push 0x3d
push 1
call fcn.00403520
sub edi, 1
jne 0x41b252
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret