joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4567e0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4ba407
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x4e2868
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString_4
push 0x4e2868
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 1
call sub.MFC42u.DLL_CString::CString_4
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 0
push 0
push 0
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0
push str.C:_
mov byte [esp + 0x3c], 2
call esi
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str._X_X
push edx
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
push 0x4dc4e4
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4568be
push 0
push 0
push 0
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0
push str.D:_
call esi
mov eax, dword [esp + 4]
lea edx, [esp + 8]
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str._X_X
push edx
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
mov esi, dword [esp + 0x24]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
call sub.MFC42u.DLL_operator
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x464750
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebp, dword [esi + 0x60]
cmp ebx, ebp
jle 0x464858
mov al, byte [esi + 6]
test al, al
je 0x464858
mov ecx, dword [esi + 0x5c]
lea eax, [ebx + ebx*2]
shl eax, 4
push eax
push ecx
call fcn.004592b0
mov edx, eax
add esp, 8
test edx, edx
jne 0x464795
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
ret
lea eax, [ebp + ebp*2]
shl eax, 4
lea edi, [eax + edx]
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x14], edi
lea ecx, [eax + eax*2]
xor eax, eax
shl ecx, 4
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
mov ebx, dword [esp + 0x18]
and ecx, 3
cmp ebp, ebx
rep stosb byte es:[edi], al
mov dword [esi + 0x5c], edx
jge 0x464858
mov ecx, dword [esp + 0x14]
lea edi, [ecx + 0x18]
mov edx, dword [esi + 0x18]
mov dword [edi - 4], edx
mov eax, dword [esi + 0x40]
cmp dword [eax], 0
je 0x4647f9
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
test eax, eax
jl 0x4647f9
jg 0x4647f1
test ecx, ecx
jbe 0x4647f9
mov dword [edi - 0x18], ecx
mov dword [edi - 0x14], eax
jmp 0x464809
mov ecx, dword [esi + 0x94]
mov dword [edi - 0x18], ecx
mov dword [edi - 0x14], 0
mov edx, dword [esi + 0x34]
mov dword [edi], edx
mov eax, dword [esi + 0x18]
push eax
call fcn.0045f790
add esp, 4
mov dword [edi - 8], eax
test eax, eax
je 0x46478b
push esi
call fcn.0045f9c0
add esp, 4
test eax, eax
je 0x464845
mov edx, dword [esi + 0xd0]
lea ecx, [edi + 4]
push ecx
push edx
call fcn.004648d0
add esp, 8
lea eax, [ebp + 1]
add edi, 0x30
mov ebp, eax
mov dword [esi + 0x60], eax
cmp ebp, ebx
jl 0x4647d3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4754f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
test ecx, ecx
jne 0x4755a9
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor eax, eax
mov ecx, dword [ebx + 0x40]
mov ebp, dword [ebx + 0x38]
lea edi, [ecx + edx*2]
xor ecx, ecx
mov cl, byte [ebx + 5]
xor edx, edx
mov ah, byte [edi]
mov esi, ecx
mov al, byte [edi + 1]
mov dword [esp + 0x14], esi
mov dh, byte [esi + ebp + 5]
mov dl, byte [esi + ebp + 6]
cmp eax, edx
jb 0x475596
mov ecx, dword [esp + 0x1c]
lea edx, [eax + ecx]
mov ecx, dword [ebx + 0x34]
cmp edx, dword [ecx + 0x24]
ja 0x475596
mov edx, dword [esp + 0x1c]
push edx
push eax
push ebx
call fcn.004755b0
add esp, 0xc
test eax, eax
jne 0x4755a3
mov eax, dword [ebx + 0x40]
xor edx, edx
mov dx, word [ebx + 0x10]
lea ecx, [eax + edx*2 - 2]
cmp edi, ecx
jae 0x475575
sub ecx, edi
lea esi, [edi + 2]
inc ecx
shr ecx, 1
rep movsw word es:[edi], word [esi]
mov esi, dword [esp + 0x14]
dec word [ebx + 0x10]
mov ax, word [ebx + 0x10]
xor ecx, ecx
pop edi
mov cl, ah
mov byte [esi + ebp + 3], cl
mov dl, byte [ebx + 0x10]
mov byte [esi + ebp + 4], dl
add word [ebx + 0xe], 2
pop esi
pop ebp
pop ebx
ret
push 0xd7d6
call fcn.004a9a80
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x475b50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov eax, dword [esi + 0x34]
mov ecx, dword [eax]
push ecx
call fcn.00475d10
mov ebp, dword [esi + 0x38]
xor ecx, ecx
mov cx, word [esi + 0x10]
mov ebx, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x34]
xor edx, edx
xor eax, eax
mov dl, byte [esi + 5]
mov ax, word [esi + 0xc]
mov esi, dword [ecx + 0x24]
xor ecx, ecx
mov ch, byte [edx + ebp + 5]
mov dword [esp + 0x14], esi
mov cl, byte [edx + ebp + 6]
mov dword [esp + 0x28], ebx
mov edi, ecx
mov ecx, esi
sub ecx, edi
add esp, 4
lea esi, [edi + ebp]
add edi, ebx
mov ebx, ecx
mov dword [esp + 0x2c], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x10]
and ecx, 3
mov dword [esp + 0x18], 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
lea edi, [eax + ecx*2]
mov dword [esp + 0x20], edi
jle 0x475c85
add eax, ebp
mov dword [esp + 0x14], eax
jmp 0x475be7
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
xor edx, edx
mov dh, byte [eax]
mov dl, byte [eax + 1]
mov esi, edx
cmp esi, edi
mov dword [esp + 0x28], esi
jl 0x475cef
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
cmp esi, eax
jg 0x475cef
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
add esi, ecx
push esi
push edx
call fcn.00474c10
and eax, 0xffff
add esp, 8
sub ebx, eax
cmp ebx, edi
jl 0x475cda
mov ecx, dword [esp + 0x28]
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
jg 0x475cda
mov ecx, eax
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 3
add eax, 2
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov byte [eax - 1], bl
sar ecx, 8
mov byte [eax - 2], cl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x475bdf
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
mov eax, ebx
sar eax, 8
mov byte [edx + ebp + 5], al
mov byte [edx + ebp + 6], bl
sub ebx, edi
mov byte [edx + ebp + 1], 0
mov byte [edx + ebp + 2], 0
mov ecx, ebx
mov byte [edx + ebp + 7], 0
mov edx, ecx
xor eax, eax
add edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x34]
xor eax, eax
mov ax, word [ecx + 0xe]
cmp ebx, eax
je 0x475d04
push 0xc63d
call fcn.004a9a80
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0xc62c
call fcn.004a9a80
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push 0xc620
call fcn.004a9a80
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x4794b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x48]
push ebx
push ebp
xor ebp, ebp
mov ebx, dword [eax]
push esi
push edi
mov dword [esp + 0x14], ebp
mov cl, byte [ebx + 4]
mov dword [esp + 0x10], ebp
mov byte [esp + 0x43], cl
mov ecx, dword [esp + 0x54]
mov edx, dword [ebx]
mov dword [esp + 0x20], ebx
mov al, byte [ecx]
mov dword [esp + 0x24], edx
cmp al, 0x80
jae 0x4794f2
and eax, 0xff
mov ecx, 1
mov dword [esp + 0x18], eax
jmp 0x47950b
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.00466500
add esp, 8
and eax, 0xff
mov ecx, eax
mov eax, dword [esp + 0x18]
and ecx, 0xff
mov esi, eax
mov edi, ecx
cmp edi, eax
jae 0x47963f
add ebx, 0xc
mov edx, dword [esp + 0x58]
xor ecx, ecx
mov cx, word [edx + 4]
mov edx, dword [esp + 0x14]
cmp edx, ecx
jge 0x47963f
mov eax, dword [esp + 0x54]
lea ecx, [edi + eax]
mov al, byte [edi + eax]
cmp al, 0x80
jae 0x479556
and eax, 0xff
mov ecx, eax
mov eax, 1
mov dword [esp + 0x1c], ecx
jmp 0x47956d
lea edx, [esp + 0x1c]
push edx
push ecx
call fcn.00466500
mov ecx, dword [esp + 0x24]
add esp, 8
and eax, 0xff
mov edx, dword [esp + 0x50]
and eax, 0xff
add edi, eax
lea eax, [ecx + esi + 2]
cmp eax, edx
jbe 0x47959b
push ecx
call fcn.00478fe0
mov ecx, dword [esp + 0x54]
add eax, esi
add esp, 4
cmp eax, ecx
ja 0x47963b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x24]
push edx
push ecx
lea ecx, [esi + eax]
push ecx
call fcn.004790d0
mov edx, dword [ebx]
add esi, eax
mov eax, dword [esp + 0x64]
push edx
lea edx, [esp + 0x34]
mov ecx, dword [eax + 0x10]
add ecx, ebp
push ecx
push edx
call fcn.00478ae0
mov ecx, eax
add esp, 0x18
test ecx, ecx
mov dword [esp + 0x10], ecx
jne 0x4795f1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
add ebx, 4
add ebp, 0x28
cmp edi, eax
mov dword [esp + 0x14], ecx
jb 0x479520
jmp 0x47963f
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
mov edx, dword [eax + 8]
cmp byte [edx + esi], 0
je 0x479608
neg ecx
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x58]
mov al, byte [edx + 6]
test al, 4
je 0x479631
xor edi, edi
mov di, word [edx + 4]
dec edi
cmp esi, edi
jne 0x479631
and al, 0xfb
mov byte [edx + 6], al
mov eax, dword [esp + 0x34]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [edx + 0xc], eax
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x3c
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x58]
mov cl, byte [ecx + 6]
test cl, 1
je 0x47965f
pop edi
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
test cl, 2
jne 0x479670
cmp edi, eax
jae 0x479670
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x47b450
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, dword [eax + 8]
mov eax, dword [eax + 0x48]
mov edi, dword [eax + 0x34]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47b477
mov ecx, dword [esp + 0x20]
push edi
push eax
push ecx
push esi
call fcn.00479390
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47b4a8
mov cx, word [esi + 6]
xor eax, eax
mov word [edi + 4], cx
and ecx, 0xffff
jle 0x47b4a4
mov edx, dword [edi + 0x10]
add edx, 0x1c
test byte [edx], 1
jne 0x47b4c4
inc eax
add edx, 0x28
cmp eax, ecx
jl 0x47b497
or byte [edi + 6], 2
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push edi
push eax
push ecx
call fcn.004794b0
mov edx, dword [esp + 0x30]
add esp, 0xc
pop edi
pop esi
mov dword [edx], eax
ret
mov edx, dword [esp + 0x24]
pop edi
pop esi
mov dword [edx], 0xffffffff
ret

Function at 0x47cff0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x47d01c
mov ecx, dword [esp + 8]
push ebx
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx]
mov bl, byte [edx + 0x4bd464]
lea edx, [eax*8]
xor ebx, edx
xor eax, ebx
inc ecx
dec esi
jne 0x47d000
pop ebx
pop esi
ret
Function at 0x48c3a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x48c3b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ebp, dword [esp + 0x14]
push 0xc
push ebp
call fcn.00459430
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
jne 0x48c3d1
pop edi
pop esi
pop ebp
pop ebx
ret
mov cl, byte [esp + 0x1c]
mov dword [edi + 4], 0
mov eax, dword [ebx]
test cl, 1
mov dword [edi], eax
jne 0x48c3f6
mov ecx, dword [ebx]
mov eax, 1
cmp ecx, eax
jle 0x48c3f6
add eax, eax
cmp eax, ecx
jl 0x48c3f0
lea eax, [eax + eax*2]
shl eax, 3
push eax
push ebp
call fcn.00459430
mov esi, eax
add esp, 8
test esi, esi
mov dword [edi + 8], esi
jne 0x48c420
push edi
push ebp
call fcn.004591b0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov edi, dword [ebx + 8]
xor ebx, ebx
cmp dword [ecx], 0
jle 0x48c497
mov edx, dword [esp + 0x1c]
mov eax, dword [edi]
push edx
push eax
push ebp
call fcn.0048c000
mov dword [esi], eax
mov eax, dword [edi + 4]
push eax
push ebp
call fcn.0046b810
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
push ecx
push ebp
call fcn.0046b810
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
mov dl, byte [edi + 0xc]
and al, 0xfe
mov byte [esi + 0xc], dl
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x10]
add esp, 0x1c
xor ecx, eax
add esi, 0x18
and ecx, 2
add edi, 0x18
xor ecx, eax
inc ebx
mov dword [esi - 8], ecx
mov dx, word [edi - 4]
mov ecx, dword [esp + 0x18]
mov word [esi - 4], dx
mov ax, word [edi - 2]
mov word [esi - 2], ax
mov eax, dword [ecx]
cmp ebx, eax
jl 0x48c42e
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4acf00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4acf12
call fcn.004acfc0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4acf28
pop esi
add esp, 0x10
ret 8
mov word [esp + 4], 2
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x1c]
push ecx
mov eax, dword [edx]
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
mov dword [esi + 8], eax
ja 0x4acf6f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
xor eax, eax
pop esi
add esp, 0x10
ret 8
lea edx, [esp + 4]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4acfa5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov dword [esi + 0x10], 1
mov dword [esi + 0xc], 1
mov eax, 1
pop esi
add esp, 0x10
ret 8

Function at 0x4ad040
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4ad07c
mov eax, dword [esi + 8]
test eax, eax
je 0x4ad07c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ad075
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop esi
ret 0xc
or eax, 0xffffffff
mov dword [esi + 4], eax
pop esi
ret 0xc

Function at 0x4afd80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4baeaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004af7c0
mov eax, dword [esi + 8]
mov dword [esp + 0x30], 1
test eax, eax
mov dword [esp + 8], eax
je 0x4afe0e
mov edi, dword [esp + 0x3c]
add esi, 4
lea eax, [esp + 8]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004afe60
mov edx, dword [eax + 4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x18], eax
call fcn.004af800
lea ecx, [esp + 0x10]
call fcn.004af810
cmp eax, edi
je 0x4afe06
mov eax, dword [esp + 8]
test eax, eax
je 0x4afe0e
jmp 0x4afdc7
mov dword [esp + 8], 0
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0xc], 1
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi], 0x4c0e60
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.004af800
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x1000a8bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000a8ca
pop dword [ebp - 0x10]
mov eax, 0x7ca72cec
sub eax, 0x6ca68422
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x42be8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x60e475b7
add ecx, 0x9f1bdc56
xor edx, edx
add edx, eax
mov ebx, 0x1004bc00
add ebx, dword [ebp - 0x10]
mov esi, 0x5a587a35
sub dword [ebp - 0xc], 0x8744adff
mov edi, dword [ebx]
xor dword [ebp - 4], ebx
xor edi, esi
sub dword [ebp - 0xc], 0x817397fe
mov dword [edx], edi
add dword [ebp - 4], esi
add edx, 0x75a5ad41
sub edx, 0x75a5ad3d
add ebx, 0x7fc778e1
sub ebx, 0x7fc778dd
loop 0x1000a91a
add eax, 0x27f9d849
sub eax, 0x27f89d42
xor ebx, ebx
add ebx, eax
add eax, 0xdf7f7eb6
add eax, 0x2080814f
mov ecx, 0xb9d7f5a0
sub ecx, 0xa9d7f5a0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000a8bb
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000a8bb
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x40f1c6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404e35
mov dword [ebp - 0x14], eax
cmp dword [0x43a0c8], esi
jne 0x40f2b9
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f246
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f399
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f399
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f399
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43a0c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43a0cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43a0d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43a0d8], eax
test eax, eax
je 0x40f2b6
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43a0d4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2de
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2d1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2f3
push 4
pop eax
jmp 0x40f39b
cmp dword [ebp - 0x14], esi
je 0x40f2f3
push dword [0x43a0c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2d8
mov eax, dword [0x43a0d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f351
cmp dword [0x43a0d8], edi
je 0x40f351
push eax
call ebx
push dword [0x43a0d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f351
test eax, eax
je 0x40f351
call ecx
test eax, eax
je 0x40f346
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f346
test byte [ebp - 8], 1
jne 0x40f351
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f381
mov eax, dword [0x43a0cc]
cmp eax, edi
je 0x40f37e
push eax
call ebx
test eax, eax
je 0x40f37e
call eax
mov esi, eax
test esi, esi
je 0x40f37e
mov eax, dword [0x43a0d0]
cmp eax, edi
je 0x40f37e
push eax
call ebx
test eax, eax
je 0x40f37e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43a0c8]
call ebx
test eax, eax
je 0x40f399
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f39b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040af
mov esp, ebp
pop ebp
ret
Function at 0x4370a0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x4370d2
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebp
push esi
seto cl
neg ecx
or ecx, eax
push edi
push ecx
call fcn.004371bf
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x14], 0
mov ebp, eax
mov dword [esp + 0x20], ebp
test ecx, ecx
je 0x43716c
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [eax + ebp]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.004371bf
add esp, 4
mov edi, eax
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [ebp - 4], edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
jne 0x437111
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push ebx
mov dword [ebp + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push dword [esp + 0x14]
call fcn.00416a30
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x4371aa
mov ecx, dword [ebp + esi*4]
test ecx, ecx
je 0x4371aa
push ecx
call fcn.004371c8
inc esi
add esp, 4
cmp esi, dword [esp + 0x10]
jne 0x437192
push ebp
call fcn.004371c8
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10