joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb53d6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.00b57590
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0xb53eab
lea ecx, [esp + 0x74]
call fcn.00b54deb
mov esi, eax
test esi, esi
jne 0xb53eab
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.00b54cd1
mov esi, eax
pop ecx
test esi, esi
jne 0xb53eab
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00b54dac
mov esi, eax
test esi, esi
jne 0xb53eab
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00b57590
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0xb53e56
cmp eax, dword [edi + 4]
jne 0xb53e56
cmp byte [edi + 0x76], 1
je 0xb53ec9
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0xb53e5d
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0xb53e98
test ebx, ebx
je 0xb53e98
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0xb53e8b
push 0x20
push eax
push ebp
call fcn.00b57590
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00b53d5e
jmp 0xb53e98
push ebx
push eax
push ebp
call fcn.00b57590
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0xb53dcb
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.00b3e31f
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0xb53ebe

Function at 0xb545c5
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0xb54571
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00b57b10
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0xb545cf
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0xb54563
Function at 0xb54cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0xb54cfe
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0xb54d4b
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00b57b10
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.00b54539
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00b545d7
test eax, eax
jne 0xb54da7
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00b57b10
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.00b54539
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00b57590
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00b57590
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00b545d7
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0xb54dac
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0xb54de3
test edi, edi
je 0xb54de3
call fcn.00b54cf0
test eax, eax
jne 0xb54de8
push 0x20
mov edx, esi
mov ecx, esi
call fcn.00b54539
push 0x20
push esi
push edi
call fcn.00b57590
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0xb54563
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0xb54e9b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0xb54f35
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0xb54f35
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.00b5057e
mov dword [esp + 0xc], eax
test eax, eax
jne 0xb54f3a
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0xb54efb
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00b54e85
mov ecx, ebx
mov esi, eax
call fcn.00b54e85
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0xb54ed5
jmp 0xb54f20
mov ecx, dword [esp + 0x10]
jmp 0xb54f20
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00b54e85
mov ecx, ebx
mov esi, eax
call fcn.00b54e85
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0xb54f01
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0xb54f3a
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0xb6cd66
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00b6cbe5
Function at 0x402530
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push edi
test edx, edx
je 0x4026aa
mov edi, dword [ebp + 8]
test edi, edi
je 0x4026aa
mov dword [edi + 0xf0], 0xa
mov ecx, dword [edx]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
push ebx
mov ebx, 0xff00ff
and ecx, ebx
or eax, ecx
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, ebx
or eax, ecx
push esi
lea esi, [edi + 4]
mov dword [esi], eax
mov ecx, dword [edx + 8]
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, ebx
or eax, ecx
mov dword [edi + 8], eax
mov eax, dword [edx + 0xc]
mov edx, eax
rol eax, 8
and eax, ebx
ror edx, 8
and edx, 0xff00ff00
mov ebx, 0xff
or edx, eax
mov eax, edx
mov dword [edi + 0xc], edx
shr eax, 0x10
and eax, ebx
mov ecx, dword [eax*4 + 0x5e3c50]
mov eax, edx
shr eax, 8
xor ecx, 0x1000000
and eax, ebx
and ecx, 0xff000000
mov eax, dword [eax*4 + 0x5e3850]
and eax, 0xff0000
xor ecx, eax
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x5e4450]
and eax, 0xff00
xor ecx, eax
mov eax, dword [esi]
xor ecx, dword [edi]
xor eax, ecx
mov dword [edi + 0x10], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 0x14], eax
xor ecx, eax
mov eax, edx
mov dword [edi + 0x18], ecx
xor eax, ecx
mov dword [edi + 0x1c], eax
mov edi, 0x5e2724
lea esi, [esi + 0x10]
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 8
and eax, ebx
mov edx, dword [eax*4 + 0x5e3850]
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
and eax, ebx
mov eax, dword [eax*4 + 0x5e3c50]
and eax, 0xff000000
xor edx, eax
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x5e4050]
xor edx, eax
movzx eax, cl
mov eax, dword [eax*4 + 0x5e4450]
and eax, 0xff00
xor edx, eax
xor edx, dword [esi - 4]
xor edx, dword [edi]
add edi, 4
mov dword [esi + 0xc], edx
mov eax, dword [esi]
xor eax, edx
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 4]
xor ecx, eax
mov dword [esi + 0x14], ecx
mov eax, dword [esi + 8]
xor eax, ecx
mov dword [esi + 0x18], eax
cmp edi, 0x5e2748
jne 0x40262b
pop esi
xor eax, eax
pop ebx
jmp 0x4026ad
or eax, 0xffffffff
pop edi
pop ebp
ret
Function at 0x4026b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00402530
pop ecx
test eax, eax
js 0x40288c
push esi
push edi
mov edi, dword [ebx + 0xf0]
shl edi, 2
test edi, edi
jle 0x40271f
lea edx, [ebx + 8]
lea esi, [ebx + 8]
xor ebx, ebx
lea edx, [edx + edi*4]
mov ecx, dword [esi - 8]
add ebx, 4
mov eax, dword [edx - 8]
sub edi, 4
mov dword [esi - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], ecx
mov ecx, dword [esi - 4]
mov dword [esi - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], ecx
mov ecx, dword [esi]
mov dword [esi], eax
lea esi, [esi + 0x10]
mov eax, dword [edx + 4]
mov dword [edx], ecx
lea edx, [edx - 0x10]
mov ecx, dword [esi - 0xc]
mov dword [esi - 0xc], eax
mov dword [edx + 0x14], ecx
cmp ebx, edi
jl 0x4026e0
mov ebx, dword [ebp + 8]
xor edi, edi
inc edi
cmp dword [ebx + 0xf0], edi
jle 0x402888
lea esi, [ebx + 2]
lea esi, [esi + 0x10]
mov edx, dword [esi - 2]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x5e4050]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x5e3450]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2c50]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e3050]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2850]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x5e4050]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x5e3450]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2c50]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e3050]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2850]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x5e4050]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x5e3450]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2c50]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e3050]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2850]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x5e4050]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x5e3450]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2c50]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e3050]
movzx eax, dl
movzx eax, byte [eax*4 + 0x5e4050]
xor ecx, dword [eax*4 + 0x5e2850]
inc edi
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402731
pop edi
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403bfe
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x595a48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x610490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x10]
call fcn.00403e94
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00403b9d
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.0040412f
mov dword [esi], vtable.std::system_error.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410096
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x610490]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
lea edx, [ebp - 0x3ec]
cmovae ecx, dword [ebp + 8]
call fcn.00417c71
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040412f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005599c5
mov esp, ebp
pop ebp
ret
Function at 0x4101ea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5972ce
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x610490]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push esi
push edi
mov eax, dword [0x610490]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov ebx, edx
mov dword [esp + 0x14], ebx
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.MYDATA
movzx edx, bx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
test esi, esi
jne 0x410329
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x5e264d
call fcn.00403e94
and dword [esp + 0x100], esi
lea ecx, [esp + 0x90]
mov edx, dword [esp + 0x28]
call fcn.00404abc
mov esi, eax
mov edx, ebx
mov byte [esp + 0x100], 1
lea ecx, [esp + 0x30]
call fcn.00404b03
push eax
mov edx, str.FindResource_err
mov byte [esp + 0x104], 2
lea ecx, [esp + 0x64]
call fcn.00404c2b
mov byte [esp + 0x104], 3
lea ecx, [esp + 0xc4]
mov edx, eax
mov dword [esp], str.ierr
call fcn.00404c5b
sub esp, 0x14
mov byte [esp + 0x118], 4
mov ecx, esp
mov edx, eax
push esi
call fcn.00404c8d
pop ecx
mov byte [esp + 0x118], 8
call fcn.0042fd7c
add esp, 0x30
lea ecx, [esp + 0xa8]
xor esi, esi
xor ebx, ebx
inc ebx
push esi
push ebx
call fcn.0040412f
push esi
push ebx
lea ecx, [esp + 0x50]
call fcn.0040412f
push esi
push ebx
lea ecx, [esp + 0x20]
call fcn.0040412f
lea ecx, [esp + 0x78]
jmp 0x410423
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x410356
test ebx, ebx
je 0x410356
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
mov dword [edi + 4], ebx
jmp 0x41042f
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x5e264d
call fcn.00403e94
mov edx, ebx
mov dword [esp + 0x100], 9
lea ecx, [esp + 0xd8]
call fcn.0040ff91
mov esi, eax
mov byte [esp + 0x100], 0xa
lea ecx, [esp + 0xa8]
mov edx, dword [esp + 0x2c]
call fcn.00404b03
push eax
mov edx, str.FindResource_err
mov byte [esp + 0x104], 0xb
lea ecx, [esp + 0x7c]
call fcn.00404c2b
mov byte [esp + 0x104], 0xc
lea ecx, [esp + 0x4c]
mov edx, eax
mov dword [esp], str.nResSize
call fcn.00404c5b
sub esp, 0x14
mov byte [esp + 0x118], 0xd
mov ecx, esp
mov edx, eax
push esi
call fcn.00404c8d
pop ecx
mov byte [esp + 0x118], 0x11
call fcn.0042fd7c
add esp, 0x30
lea ecx, [esp + 0x30]
xor esi, esi
xor ebx, ebx
inc ebx
push esi
push ebx
call fcn.0040412f
push esi
push ebx
lea ecx, [esp + 0x68]
call fcn.0040412f
push esi
push ebx
lea ecx, [esp + 0x98]
call fcn.0040412f
lea ecx, [esp + 0xc0]
push esi
push ebx
call fcn.0040412f
mov dword [edi + 4], esi
mov dword [edi], esi
mov eax, edi
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.005599c5
mov esp, ebp
pop ebp
ret
Function at 0x410dad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xcc
mov eax, 0x597550
call fcn.0055d8e8
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 2
push 0x85
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
jne 0x410e93
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x5e264d
call fcn.00403e94
and dword [ebp - 4], esi
lea ecx, [ebp - 0x90]
mov edx, ebx
call fcn.00404abc
mov esi, eax
xor ebx, ebx
lea ecx, [ebp - 0x30]
inc ebx
mov edx, 0x85
mov byte [ebp - 4], bl
call fcn.00404b03
push eax
mov edx, str.FindResource_err
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00404c2b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc0]
mov edx, eax
mov dword [esp], str._ierr
call fcn.00404c5b
sub esp, 0x14
mov byte [ebp - 4], 4
mov ecx, esp
mov edx, eax
push esi
call fcn.00404c8d
pop ecx
mov byte [ebp - 4], 8
call fcn.0042fd7c
add esp, 0x30
lea ecx, [ebp - 0xc0]
xor esi, esi
push esi
push ebx
call fcn.0040412f
push esi
push ebx
lea ecx, [ebp - 0x60]
call fcn.0040412f
push esi
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040412f
lea ecx, [ebp - 0x90]
jmp 0x410f6d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x410ec0
test ebx, ebx
je 0x410ec0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
mov dword [edi + 4], ebx
jmp 0x410f79
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x5e264d
call fcn.00403e94
mov edx, ebx
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xd8]
call fcn.0040ff91
mov esi, eax
mov edx, 0x85
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa8]
call fcn.00404b03
push eax
mov edx, str.FindResource_err
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x78]
call fcn.00404c2b
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x48]
mov edx, eax
mov dword [esp], str._nResSize
call fcn.00404c5b
sub esp, 0x14
mov byte [ebp - 4], 0xd
mov ecx, esp
mov edx, eax
push esi
call fcn.00404c8d
pop ecx
mov byte [ebp - 4], 0x11
call fcn.0042fd7c
add esp, 0x30
lea ecx, [ebp - 0x48]
xor esi, esi
xor ebx, ebx
inc ebx
push esi
push ebx
call fcn.0040412f
push esi
push ebx
lea ecx, [ebp - 0x78]
call fcn.0040412f
push esi
push ebx
lea ecx, [ebp - 0xa8]
call fcn.0040412f
lea ecx, [ebp - 0xd8]
push esi
push ebx
call fcn.0040412f
mov dword [edi + 4], esi
mov dword [edi], esi
mov eax, edi
call fcn.0055d897
ret
Function at 0x412ce6
Capabilities:
Accept command line arguments

Disassembly:
push 0x7c
mov eax, 0x597b08
call fcn.0055d8e8
mov ebx, ecx
mov dword [ebp - 0x80], ebx
xor esi, esi
mov dword [ebp - 4], esi
push 0x5e264d
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x7c], esi
call fcn.00403e94
xor edi, edi
mov dword [ebp - 4], esi
inc edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.00417cc3
mov dword [ebp - 4], edi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
push 0x5e5868
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00403e94
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.00417999
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
pop ecx
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
sub eax, edi
cdq
mov dword [ebp - 0x78], 0x18
idiv dword [ebp - 0x78]
test eax, eax
je 0x412ded
mov ebx, dword [ebp - 0x78]
mov esi, eax
push edi
lea ecx, [ebp - 0x44]
call fcn.00403e6e
mov edx, 0x5e264d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.004057ed
test al, al
jne 0x412dcf
mov edx, 0x5e58d0
lea ecx, [ebp - 0x44]
call fcn.004057ed
test al, al
jne 0x412dcf
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e1a2
push 0
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.0040412f
add edi, ebx
dec esi
jne 0x412d94
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x80]
sub ecx, esi
mov eax, ecx
cdq
idiv dword [ebp - 0x78]
cmp eax, 2
jb 0x412e0d
lea eax, [esi + 0x18]
cmp ebx, eax
je 0x412e0d
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.0040409b
lea ecx, [ebp - 0x20]
call fcn.004057b5
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.0040412f
lea ecx, [ebp - 0x2c]
call fcn.004057b5
push 0
push 1
lea ecx, [ebp - 0x74]
call fcn.0040412f
mov eax, ebx
call fcn.0055d897
ret

Function at 0x4141e1
Capabilities:
Receive data
Receive data on socket
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jl method.AgentAppLink.virtual_0
ret
cmp byte [ecx + 0x61], 0
jne 0x42e179
cmp byte [ecx + 0x60], 0
je 0x42e179
mov byte [ecx + 0x60], 0
jmp fcn.0042e17a
ret
Function at 0x417159
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x14c
mov eax, 0x5980c7
call fcn.0055d8e8
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x5e264d
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], ebx
call fcn.00403e94
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x154], 1
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, str.unknown_OperatingSystem.
mov dword [ebp - 0x150], 0x11c
push edi
call fcn.004035ea
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004042b9
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4172ef
mov eax, dword [ebp - 0x14c]
sub eax, 4
je 0x41729f
dec eax
je 0x417245
dec eax
jne 0x4172ef
mov eax, dword [ebp - 0x148]
sub eax, ebx
je 0x41722b
dec eax
je 0x417211
dec eax
jne 0x4172ef
cmp byte [ebp - 0x36], 1
jne 0x4172ef
mov edi, str.Microsoft_Windows_10
jmp 0x4172df
cmp byte [ebp - 0x36], 1
jne 0x417221
mov edi, str.Microsoft_Windows_7
jmp 0x4172df
mov edi, str.Microsoft_Windows_Server_2008_R2
jmp 0x4172df
cmp byte [ebp - 0x36], 1
jne 0x41723b
mov edi, str.Microsoft_Windows_Vista
jmp 0x4172df
mov edi, str.Microsoft_Windows_Server_2008
jmp 0x4172df
mov eax, dword [ebp - 0x148]
sub eax, ebx
je 0x417298
dec eax
je 0x417291
dec eax
jne 0x4172ef
cmp byte [ebp - 0x36], 1
jne 0x41726d
cmp word [ebp - 0x34], 9
jne 0x41726d
mov edi, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x4172df
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call edi
test eax, eax
jne 0x417282
mov edi, str.Microsoft_Windows_Server_2003
jmp 0x4172df
push 0x59
call edi
test eax, eax
je 0x4172ef
mov edi, str.Microsoft_Windows_Server_2003_R2
jmp 0x4172df
mov edi, str.Microsoft_Windows_XP
jmp 0x4172df
mov edi, str.Microsoft_Windows_2000
jmp 0x4172df
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x4172c1
cmp eax, 0xa
je 0x4172ba
cmp eax, 0x5a
jne 0x4172ef
mov edi, str.Microsoft_Windows_Me
jmp 0x4172df
mov edi, str.Microsoft_Windows_98
jmp 0x4172df
cmp dword [ebp - 0x140], 2
jne 0x4172d1
mov edi, str.Microsoft_Windows_NT_4.0
jmp 0x4172df
cmp dword [ebp - 0x140], 1
jne 0x4172ef
mov edi, str.Microsoft_Windows_95
push edi
call fcn.004035ea
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004042b9
mov eax, esi
call fcn.0055d897
ret
Function at 0x4175c4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [ebp - 0x18], edx
cmp byte [ecx], 0
je 0x4176c8
add ecx, 2
push ebx
mov dword [ebp - 0x14], ecx
push edi
or dword [ebp - 8], 0xffffffff
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov bh, byte [ecx - 2]
xor bl, bl
mov dl, byte [ebp - 8]
cmp byte [edi], bh
movzx eax, bl
movzx edx, dl
cmove edx, eax
inc bl
inc edi
cmp bl, 0x40
jb 0x4175f2
mov bh, byte [ecx - 1]
xor bl, bl
mov dword [ebp - 0x10], edx
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dl, byte [ebp - 7]
cmp byte [edi], bh
movzx eax, bl
movzx edx, dl
cmove edx, eax
inc bl
inc edi
cmp bl, 0x40
jb 0x417615
mov bl, byte [ebp - 6]
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dword [ebp - 0xc], edx
xor dl, dl
mov dh, byte [ecx]
cmp byte [edi], dh
movzx eax, dl
movzx ebx, bl
cmove ebx, eax
inc dl
inc edi
cmp dl, 0x40
jb 0x417637
mov al, byte [ecx + 1]
mov edi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov dl, byte [ebp - 5]
mov ch, al
mov byte [ebp - 1], 0
mov cl, byte [ebp - 1]
mov byte [ebp - 2], al
cmp byte [edi], ch
movzx eax, cl
movzx edx, dl
cmove edx, eax
inc cl
inc edi
cmp cl, 0x40
jb 0x417661
mov al, byte [ebp - 0xc]
shl byte [ebp - 0x10], 2
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
shr al, 4
and al, 3
or al, byte [ebp - 0x10]
mov byte [esi + edi], al
inc esi
cmp byte [ecx], 0x3d
je 0x4176c6
shl byte [ebp - 0xc], 4
mov al, bl
shr al, 2
and al, 0xf
or al, byte [ebp - 0xc]
mov byte [esi + edi], al
inc esi
cmp byte [ecx + 1], 0x3d
je 0x4176c6
and dl, 0x3f
shl bl, 6
or dl, bl
add ecx, 4
mov byte [esi + edi], dl
inc esi
mov dword [ebp - 0x14], ecx
cmp byte [ecx - 2], 0
jne 0x4175e1
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret