joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72506c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov esi, eax
mov ebp, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [esp]
dec eax
test eax, eax
jl 0x7250e2
inc eax
mov dword [esp + 8], eax
inc ebp
mov eax, ebp
movzx eax, al
movzx edi, byte [esi + eax + 8]
mov eax, edi
movzx eax, al
movzx eax, byte [esi + eax + 8]
add eax, edi
movzx ecx, al
movzx ecx, byte [esi + ecx + 8]
push ecx
mov ecx, ebp
movzx ecx, cl
pop ebx
mov byte [esi + ecx + 8], bl
movzx ecx, al
mov ebx, edi
mov byte [esi + ecx + 8], bl
mov ecx, eax
shr ecx, 8
add cl, al
movzx eax, cl
movzx eax, byte [esi + eax + 8]
add dword [esp + 4], eax
movzx eax, byte [esp + 4]
xor byte [edx], al
inc edx
dec dword [esp + 8]
jne 0x72508e
mov dword [esi], ebp
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7250f4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
xor esi, esi
lea eax, [ebp + 8]
mov edx, esi
mov byte [eax], dl
inc esi
inc eax
cmp esi, 0x100
jne 0x725109
xor edi, edi
mov dword [esp + 8], 3
xor esi, esi
lea ebx, [ebp + 8]
mov eax, esi
cdq
idiv dword [esp + 4]
mov eax, dword [esp]
movzx eax, byte [eax + edx]
movzx ecx, byte [ebx]
movzx edx, cl
add edi, edx
add eax, edi
mov edi, eax
mov eax, ecx
mov edx, edi
movzx edx, dl
movzx edx, byte [ebp + edx + 8]
mov byte [ebx], dl
mov edx, edi
movzx edx, dl
mov byte [ebp + edx + 8], al
inc esi
inc ebx
cmp esi, 0x100
jne 0x725126
dec dword [esp + 8]
jne 0x725121
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 4], edi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x725c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, ecx
shr eax, 2
test eax, eax
jle 0x725c4a
mov ebx, dword [edx]
xor dword [esi], ebx
add esi, 4
add edx, 4
dec eax
jne 0x725c3d
mov eax, ecx
and eax, 3
test eax, eax
jle 0x725c5d
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0x725c53
pop esi
pop ebx
ret

Function at 0x72e9a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov esi, 1
call fcn.004c3bfc
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe]
lea eax, [esp + 0xc]
call fcn.004c37fc
mov ebp, esi
mov dword [ebx + 4], ebp
mov ecx, 0xf
and ecx, esi
mov edi, ebp
shl edi, cl
movzx eax, word [esp]
or ax, word [esp + 4]
movzx eax, ax
shl eax, 0x10
movzx edx, word [esp + 2]
or dx, word [esp + 6]
movzx edx, dx
or eax, edx
xor edi, eax
mov dword [ebx + 4], edi
mov esi, edi
inc esi
test edi, edi
je 0x72e9ae
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x76a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov byte [ebp - 5], al
mov al, byte [edx]
mov bl, al
xor bl, byte [ebp + 0xc]
lock cmpxchg byte [edx], bl
jne 0x76a465
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
movzx eax, al
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x76a9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov word [ebp - 6], ax
mov ax, word [edx]
mov bx, ax
xor bx, word [ebp + 0xc]
lock cmpxchg word [edx], bx
jne 0x76a9f8
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
movzx eax, ax
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x76af40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edx]
mov ebx, eax
xor ebx, dword [ebp + 0xc]
lock cmpxchg dword [edx], ebx
jne 0x76af55
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop ebp
ret

Function at 0x76c3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, edx
mov ebx, eax
xor ebx, dword [esp + 0x10]
xor ecx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
jne 0x76c3d1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [esp + 4]
mov edx, dword [esp]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x76dbb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x24]
call fcn.0076eea8
test bh, 0xc0
jne 0x76dbd3
mov eax, dword [0x7b38ac]
mov ecx, 0xc000
and ecx, dword [eax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
mov ecx, eax
shr ecx, 8
mov esi, 3
cmp ecx, 6
ja 0x76dbf7
sar eax, 6
mov esi, dword [eax + 0x7b3308]
test bh, 1
je 0x76dc1a
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov al, byte [0x7b3328]
and al, byte [esp + 0x28]
mov ebp, 0x80
js 0x76dc2c
mov ebp, 1
jmp 0x76dc2c
push dword [esp + 0x20]
call sub.KERNEL32.DLL_GetFileAttributesA
xor ebp, ebp
cmp eax, 0xffffffff
je 0x76dc2c
mov ebp, eax
mov eax, ebx
and al, 3
je 0x76dc45
cmp al, 2
je 0x76dc4c
cmp al, 1
jne 0x76dd20
mov edi, 0x40000000
jmp 0x76dc51
mov edi, 0x80000000
jmp 0x76dc51
mov edi, 0xc0000000
mov edx, ebx
and edx, 0x70
add edx, 0xfffffff0
shr edx, 4
cmp edx, 3
jb 0x76dc66
mov edx, 3
xor ecx, ecx
cmp edi, 0x80000000
sete al
test bl, 4
je 0x76dc7a
mov cl, al
mov edx, ecx
mov dword [esp], 0xc
mov dword [esp + 4], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [esp + 8], eax
mov eax, esp
push 0
push ebp
push esi
push eax
push edx
push edi
push dword [esp + 0x38]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x76dcff
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
push esi
call fcn.0076db34
add esp, 4
test eax, eax
je 0x76dcd1
or edi, 0x2000
and edi, 0xfffff8ff
push edi
push esi
call fcn.0076f038
add esp, 8
mov edi, eax
cmp edi, 0xffffffff
jne 0x76dd2c
push 4
call fcn.0076f3e0
add esp, 4
push esi
call sub.KERNEL32.DLL_CloseHandle
mov edi, 0xffffffff
jmp 0x76dd2c
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
test bh, 1
mov ecx, 0x50
jne 0x76dd16
mov ecx, 2
cmp eax, 0x6e
je 0x76dd1d
mov ecx, eax
push ecx
jmp 0x76dd22
push 1
call fcn.0076f3e0
add esp, 4
mov edi, eax
call fcn.0076eee8
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x76e344
Capabilities:
Read file on windows

Disassembly:
push eax
mov eax, dword [esp + 8]
cmp dword [0x7b37dc], eax
jbe 0x76e374
mov ecx, esp
push 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [eax*4 + 0x7c0e64]
call sub.KERNEL32.DLL_ReadFile
cmp eax, 1
jne 0x76e378
mov eax, dword [esp]
pop ecx
ret
push 6
jmp 0x76e389
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x76e388
pop ecx
ret
push ecx
call fcn.0076f3e0
add esp, 4
pop ecx
ret

Function at 0x76e39c
Capabilities:
Write file on windows

Disassembly:
push eax
mov eax, dword [esp + 8]
cmp dword [0x7b37dc], eax
jbe 0x76e3cc
mov ecx, esp
push 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [eax*4 + 0x7c0e64]
call sub.KERNEL32.DLL_WriteFile
cmp eax, 1
jne 0x76e3d8
mov eax, dword [esp]
pop ecx
ret
push 6
call fcn.0076f3e0
add esp, 4
pop ecx
ret
call fcn.0076f470
pop ecx
ret
Function at 0x773864
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push dword [esp + 8]
call sub.KERNEL32.DLL_GetFileAttributesA
mov ecx, eax
cmp ecx, 0xffffffff
je 0x76d9f7
xor eax, eax
test bl, 2
je 0x76d9f5
and ecx, 1
je 0x76d9f5
call fcn.0077b658
mov dword [eax], 5
mov eax, 0xffffffff
pop ebx
ret
pop ebx
jmp fcn.0076f470
jmp 0x76d9c4
Function at 0x775078
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x204
mov dword [esp], edx
mov esi, ecx
lea ebp, [esp + 4]
push pe_nt_image_headers32
push ebp
push 0x1001
push dword [esi + 4]
call sub.KERNEL32.DLL_GetLocaleInfoA
push ebp
call fcn.0076d774
add esp, 4
mov word [esp + eax + 4], 0x5f
mov edi, dword [esi + 4]
push ebp
call fcn.0076d774
add esp, 4
lea ecx, [esp + eax + 4]
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
push ecx
push 0x1002
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
push ebp
call fcn.0076d774
add esp, 4
mov word [esp + eax + 4], 0x2e
mov edi, dword [esi]
push ebp
call fcn.0076d774
add esp, 4
lea eax, [esp + eax + 4]
push 0xa
push eax
push edi
call fcn.007789b4
add esp, 0xc
mov edi, dword [esi + 0x24]
test edi, edi
je 0x775149
push edi
call fcn.0076d774
add esp, 4
mov ebx, eax
push dword [esp]
call fcn.0076d774
add esp, 4
mov ecx, ebp
mov ebp, eax
push ecx
call fcn.0076d774
add esp, 4
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 4]
push eax
push edi
call fcn.0076c958
add esp, 8
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x775196
jmp 0x7751d9
push dword [esp]
call fcn.0076d774
add esp, 4
mov ebx, eax
mov edi, ebp
push ebp
call fcn.0076d774
add esp, 4
mov ebp, eax
lea eax, [ebx + ebp + 3]
push eax
call fcn.0076c940
add esp, 4
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x7751d9
push dword [esp]
call fcn.0076d774
add esp, 4
lea eax, [eax + ebp + 3]
push eax
push 0
push ebx
call fcn.0076d60f
add esp, 0xc
mov ebp, edi
push dword [esp]
push ebx
call fcn.0076d628
add esp, 8
mov edi, dword [esi + 0x24]
push edi
call fcn.0076d774
add esp, 4
mov word [edi + eax], 0x3d
push ebp
push dword [esi + 0x24]
call fcn.0076d628
add esp, 8
mov esi, dword [esi + 0x24]
push esi
call fcn.0076d774
add esp, 4
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x7751db
xor eax, eax
add esp, 0x204
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x776a30
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
push esi
call fcn.0076c940
add esp, 4
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
push esi
call fcn.0076c940
add esp, 4
mov dword [edi], eax
test edi, edi
je 0x776a9b
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x776aa4
push 0xe
call sub.KERNEL32.DLL_SetLastError
xor ecx, ecx
and ecx, ebx
mov dword [esp], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
push esi
call fcn.0076c940
add esp, 4
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
push esi
call fcn.0076c940
add esp, 4
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
push esi
call fcn.0076c940
add esp, 4
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp]
push 4
call fcn.0076c940
add esp, 4
mov esi, eax
test esi, esi
je 0x776b7a
push 4
push esi
push 0x11
push dword [esp + 0x24]
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x776b83
push esi
call fcn.00778124
add esp, 4
mov word [edi + 0x14], ax
push esi
call fcn.0076c950
add esp, 4
mov eax, 1
jmp 0x776b8e
push 0xe
call sub.KERNEL32.DLL_SetLastError
jmp 0x776b8c
push esi
call fcn.0076c950
add esp, 4
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x77b59c
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x40]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
test edi, edi
je 0x77b650
mov eax, esp
push eax
call sub.KERNEL32.DLL_GetLocalTime
movzx eax, word [esp + 2]
mov dword [esp + 0x10], eax
movzx ecx, word [esp + 6]
movzx edx, word [esp]
movzx ebp, word [esp + 8]
movzx eax, word [esp + 0xa]
movzx esi, word [esp + 0xc]
movzx ebx, word [esp + 0xe]
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x28]
push str._02d__02d__04d__02d:_02d:_02d._03d
push 0x7c1170
call fcn.0078e35e
add esp, 0x24
push 0x7c1170
call fcn.0076d774
add esp, 4
push 0
lea ebx, [esp + 4]
push ebx
push eax
push 0x7c1170
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x2c]
push esi
call fcn.0076d774
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x77b678
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x84
mov edi, dword [esp + 0x94]
mov eax, dword [0x7c1190]
test eax, eax
mov ecx, dword [0x7c118c]
jne 0x77b726
test ecx, ecx
jne 0x77b726
cmp dword [0x7b56c0], 0
je 0x77b756
lea esi, [esp + 4]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
push esi
call fcn.0077ae3c
add esp, 8
test eax, eax
jne 0x77b6df
push 0x3a
push esi
call fcn.0077ae3c
add esp, 8
test eax, eax
je 0x77b6e2
inc eax
mov esi, eax
mov dword [esp], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x77b71a
call sub.KERNEL32.DLL_GetCurrentThreadId
mov ecx, esp
push ecx
push 0x77b7d8
push eax
call fcn.0078dfe6
cmp dword [esp], 0
mov ecx, 0x11010
je 0x77b71a
mov ecx, 0x12010
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x77b797
cmp ecx, 0xffffffff
je 0x77b797
test ecx, ecx
je 0x77b73a
push edi
call ecx
add esp, 4
mov eax, dword [0x7c1190]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x77b797
cmp byte [eax], 0
je 0x77b797
push edi
push eax
call fcn.0077b59c
add esp, 0x8c
jmp 0x77b79d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov esi, eax
lea ebx, [esp + 4]
push 0
push ebx
push 2
push 0x7b51c8
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.0076d774
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x7b51c8
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0x84
pop esi
pop edi
pop ebx
ret
Function at 0x77daa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x50
mov esi, dword [esp + 0x5c]
push 0x7c5274
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, dword [0x7c8724]
cmp eax, 0x232
jl 0x77db09
mov eax, dword [esp + 0x60]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 0x20726f72
mov dword [esp + 8], 0x72652065
mov dword [esp + 4], 0x726f6870
mov dword [esp], 0x616d6553
mov edi, esp
push eax
push edi
call fcn.0076d628
add esp, 8
push edi
call fcn.0077b7b8
add esp, 4
mov eax, dword [0x7c8724]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x7c5274]
push eax
call sub.KERNEL32.DLL_InitializeCriticalSection
mov eax, dword [0x7c8724]
lea ecx, [eax + 1]
mov dword [0x7c8724], ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x7c5274]
mov dword [esi], eax
push 0x7c5274
call sub.KERNEL32.DLL_LeaveCriticalSection
add esp, 0x50
pop esi
pop edi
ret

Function at 0x77db48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x50
mov eax, dword [esp + 0x58]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 0x20726f72
mov dword [esp + 8], 0x72652065
mov dword [esp + 4], 0x726f6870
mov dword [esp], 0x616d6553
mov esi, esp
push eax
push esi
call fcn.0076d628
add esp, 8
push esi
call fcn.0077b7b8
add esp, 0x54
pop esi
ret
Function at 0x7862f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 6
mov edi, 0x10
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], edx
cdq
idiv edi
add eax, 1
mov di, ax
movzx eax, di
mov edi, esp
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
mov dword [edi + 8], 6
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], esi
call sub.KERNEL32.DLL_FindResourceA
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x786469
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_LoadResource
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x786467
mov eax, dword [ebp - 0x18]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_LockResource
sub esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x786455
mov eax, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x48]
idiv ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add ecx, 2
mov dword [ebp - 0x1c], ecx
movzx eax, word [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov ecx, eax
add ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
cmp eax, 0
je 0x7863e6
jmp 0x7863d8
mov eax, dword [ebp - 0x20]
shl eax, 1
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x7863b5
cmp dword [ebp - 0x20], 0
je 0x786453
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00785694
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 0xffffffff
mov dword [ebp - 0x2c], ecx
cmp eax, 0
je 0x78643d
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov dx, word [eax]
mov eax, dword [ebp - 0x28]
mov ecx, eax
add ecx, 2
mov dword [ebp - 0x28], ecx
mov word [eax], dx
jmp 0x78640f
cmp dword [ebp - 0x20], 0
jbe 0x786451
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov word [ecx + edx*2], 0
jmp 0x786453
jmp 0x786455
mov eax, dword [ebp - 0x14]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_FreeResource
sub esp, 4
mov dword [ebp - 0x50], eax
jmp 0x786469
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x789d41
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.004a7e3c
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4c1075
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4c106f
test ah, 4
je 0x4c106f
test al, 0x10
je 0x4c106f
mov eax, esi
call fcn.004a7e3c
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4c1075
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x4c1020
Function at 0x78a6b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x78a72d
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, 8
mov eax, dword [ebp - 4]
call sym.a1runscanner.exe__Mathtool_BlowfishEncryptECB_qqrr22Mathtool_TBlowfishDatapvt2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov edx, dword [ebp - 4]
add edx, 8
mov eax, dword [ebp - 4]
add eax, 9
mov ecx, 7
call fcn.004a3cf8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov byte [edx + 0xf], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x78a6da
mov esp, ebp
pop ebp
ret 4

Function at 0x78a734
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x78a7af
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, 8
mov eax, dword [ebp - 4]
call sym.a1runscanner.exe__Mathtool_BlowfishEncryptECB_qqrr22Mathtool_TBlowfishDatapvt2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov edx, dword [ebp - 4]
add edx, 8
mov eax, dword [ebp - 4]
add eax, 9
mov ecx, 7
call fcn.004a3cf8
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x19]
mov byte [eax + 0xf], dl
inc dword [ebp - 0x10]
dec dword [ebp - 0x20]
jne 0x78a756
mov esp, ebp
pop ebp
ret 4

Function at 0x78a830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x78a890
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, 8
mov eax, dword [ebp - 4]
call sym.a1runscanner.exe__Mathtool_BlowfishEncryptECB_qqrr22Mathtool_TBlowfishDatapvt2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov eax, dword [ebp - 4]
add eax, 8
mov edx, 8
call sym.a1runscanner.exe__Tools_IncBlock_qqrp32System__StaticArray_uci_i32768__i
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x78a852
mov esp, ebp
pop ebp
ret 4