joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8f80
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5a9104
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a90df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov esi, eax
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, esi
call fcn.004568c0
xor ecx, ecx
mov edx, 0x5a911c
mov eax, esi
call fcn.00456a04
test al, al
jne 0x5a903e
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
xor edx, edx
call fcn.00413a78
mov eax, dword [0x6456e0]
cmp byte [eax], 0
je 0x5a9023
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a9154
call fcn.00413a78
jmp 0x5a903e
mov eax, dword [0x65a224]
mov eax, dword [eax + 0x2ec]
mov eax, dword [eax + 0x208]
mov edx, 0x5a918c
call fcn.00413a78
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00456ed8
mov eax, dword [0x65a23c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a90a2
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, esi
call fcn.00457068
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408f80
mov edx, dword [ebp - 0xc]
mov eax, dword [0x65a23c]
call fcn.00413a78
inc dword [ebp - 8]
dec ebx
jne 0x5a9069
mov eax, esi
call fcn.00403170
mov eax, dword [ebp - 4]
call fcn.00403170
mov eax, dword [0x65a224]
cmp dword [eax + 0xc74], 0
jne 0x5a90d5
mov eax, dword [0x65a23c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, dword [0x65a224]
mov dword [edx + 0xc74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a90e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a910b
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f34
ret
Function at 0x5a91e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5a9306
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5a92e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov esi, eax
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov dword [ebp - 4], eax
mov edx, 0x80000001
mov eax, esi
call fcn.004568c0
mov cl, 1
mov edx, 0x5a931c
mov eax, esi
call fcn.00456a04
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00456ed8
mov eax, dword [0x65a24c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a92a4
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, esi
call fcn.00457068
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408f80
mov edx, dword [ebp - 0xc]
mov eax, dword [0x65a24c]
call fcn.00413a78
inc dword [ebp - 8]
dec ebx
jne 0x5a926b
mov eax, esi
call fcn.00403170
mov eax, dword [ebp - 4]
call fcn.00403170
mov eax, dword [0x65a224]
cmp dword [eax + 0xc7c], 0
jne 0x5a92d7
mov eax, dword [0x65a24c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, dword [0x65a224]
mov dword [edx + 0xc7c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a92eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a930d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f34
ret

Function at 0x5aa2e8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
push esp
push eax
mov eax, dword [0x6454e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDList
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a168
add esp, 0x104
pop ebx
ret
Function at 0x5aa328
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x5aa4bd
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0050a2e8
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.0050a308
jmp 0x5aa48f
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404140
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409c00
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408f80
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408f80
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004042a0
je 0x5aa44b
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404140
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408f80
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408f80
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004042a0
jne 0x5aa486
push 0
mov eax, dword [esi + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x150]
call fcn.004093dc
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, 0x5aa4d4
call fcn.004041dc
mov eax, dword [ebp - 0x14c]
call fcn.00404354
push eax
call sub.kernel32.dll_WinExec
mov edx, esi
mov eax, ebx
call fcn.0050a328
test eax, eax
jne 0x5aa3ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa4c4
lea eax, [ebp - 0x150]
mov edx, 9
call fcn.00403f34
lea eax, [ebp - 4]
call fcn.00403f10
ret

Function at 0x5aa7b0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00403f10
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x5aa80a
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x5aa7fe
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a168
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x5aa7ef
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c7e18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
xor eax, eax
push ebp
push 0x5c7ea1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403fa8
mov eax, dword [ebp - 4]
call fcn.00404190
mov esi, eax
test esi, esi
jle 0x5c7e7c
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404360
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x5c7e5f
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7ea8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f34
ret
Function at 0x5ca404
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ca487
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402db8
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x5ca4a0
mov edx, ebx
call fcn.004041dc
mov eax, dword [ebp - 0x24]
call fcn.00404354
mov dword [ebp - 0x16], eax
mov eax, 0x5ca4a4
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperation
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca48e
lea eax, [ebp - 0x24]
call fcn.00403f10
ret

Function at 0x6175b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x61763c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65a27c]
mov eax, dword [eax + 0x318]
mov edx, dword [eax]
call dword [edx + 0x40]
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x617620
lea eax, [ebp - 4]
mov edx, ebx
add dl, 0x41
call fcn.004040b8
lea eax, [ebp - 4]
mov edx, 0x617650
call fcn.00404198
mov edx, dword [ebp - 4]
mov eax, dword [0x65a27c]
mov eax, dword [eax + 0x318]
call fcn.00413a78
inc ebx
cmp ebx, 0x1a
jne 0x6175e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x617643
lea eax, [ebp - 4]
call fcn.00403f10
ret

Function at 0x617888
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.00409634
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6178cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6178d4
mov eax, dword [ebp - 8]
call fcn.00409734
ret
Function at 0x61c2ec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404344
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x61c44f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0050a2e8
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.0050a308
jmp 0x61c421
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404140
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409c00
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408f80
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408f80
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004042a0
je 0x61c403
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404140
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408f80
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408f80
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004042a0
jne 0x61c418
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.0050a328
test eax, eax
jne 0x61c364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c456
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403f34
lea eax, [ebp - 4]
call fcn.00403f10
ret
Function at 0x620b74
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x6450fc]
mov eax, dword [eax]
cmp dword [eax + 0x314], 1
jne 0x620a6d
push 3
push 0
push 0
lea ecx, [ebp - 0x10]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620c74
call fcn.00597218
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620ce8
call fcn.00597218
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620d4c
call fcn.00597218
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620da4
call fcn.00597218
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404250
mov eax, dword [ebp - 0xc]
call fcn.00404354
push eax
push 0x620df4
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x6450fc]
mov eax, dword [eax]
cmp dword [eax + 0x314], 2
jne 0x620aee
push 3
push 0
push 0
lea ecx, [ebp - 0x24]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620e04
call fcn.00597218
push dword [ebp - 0x24]
lea ecx, [ebp - 0x28]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620e78
call fcn.00597218
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620edc
call fcn.00597218
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x20]
call fcn.00404354
push eax
push 0x620df4
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x6450fc]
mov eax, dword [eax]
cmp dword [eax + 0x314], 3
jne 0x620b6f
push 3
push 0
push 0
lea ecx, [ebp - 0x34]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620f34
call fcn.00597218
push dword [ebp - 0x34]
lea ecx, [ebp - 0x38]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x620fa4
call fcn.00597218
push dword [ebp - 0x38]
lea ecx, [ebp - 0x3c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x621000
call fcn.00597218
push dword [ebp - 0x3c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x30]
call fcn.00404354
push eax
push 0x620df4
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x620bcf
mov edi, 0x457456
add edi, dword [esp + 0x38]
pop edx
lea edx, [edx + ecx + 0x1c]
sub edx, ecx
sbb edi, 0x1b1460ca
push edx
xor edi, dword [esp + 8]
rcl edi, 0xf5
pop edi
lea edx, [edx + ecx + 0x19a]
sub edx, ecx
sub ecx, dword [edi]
lea edi, [edi + eax + 3]
sub edi, eax
cmp edi, edx
jb 0x620b9f
pop edi
cmp ecx, 0x435580e
pop edx
pop ecx
nop
jmp 0x6209d1
jmp 0x620bff
mov eax, dword [0x6450fc]
mov eax, dword [eax]
call fcn.00450e20
mov eax, dword [0x6450fc]
mov eax, dword [eax]
call fcn.00435a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620c46
lea eax, [ebp - 0x3c]
mov edx, 0xd
call fcn.00403f34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f34
ret
Function at 0x622368
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
mov word [ebp - 6], cx
mov dword [ebp - 4], edx
xor esi, esi
lea eax, [ebp - 0x106]
mov edx, esi
mov byte [eax], dl
inc esi
inc eax
cmp esi, 0x100
jne 0x622382
mov esi, 0x7f
lea ecx, [ebp - 0x87]
movzx eax, word [ebp - 6]
mov edx, esi
dec edx
mov ebx, edx
cdq
idiv ebx
mov eax, edx
inc eax
mov dl, byte [ecx]
xor ebx, ebx
mov bl, al
mov bl, byte [ebp + ebx - 0x106]
mov byte [ecx], bl
and eax, 0xff
mov byte [ebp + eax - 0x106], dl
movzx eax, word [ebp - 6]
mov edx, esi
dec edx
mov ebx, edx
cdq
idiv ebx
mov eax, edx
add al, 0x80
mov dl, byte [ecx + 0x7f]
xor ebx, ebx
mov bl, al
mov bl, byte [ebp + ebx - 0x106]
mov byte [ecx + 0x7f], bl
and eax, 0xff
mov byte [ebp + eax - 0x106], dl
dec esi
dec ecx
cmp esi, 1
jne 0x62239b
cmp byte [ebp + 0xc], 0
jne 0x622434
lea edx, [ebp - 0x206]
lea eax, [ebp - 0x106]
mov ecx, pe_nt_image_headers32
call fcn.004029c8
xor esi, esi
lea eax, [ebp - 0x206]
mov edx, esi
xor ecx, ecx
mov cl, byte [eax]
mov byte [ebp + ecx - 0x106], dl
inc esi
inc eax
cmp esi, 0x100
jne 0x62241d
mov eax, dword [ebp - 4]
call fcn.00404190
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.004044c4
mov eax, dword [ebp - 4]
call fcn.00404190
mov ebx, eax
test ebx, ebx
jle 0x622478
mov esi, 1
mov eax, dword [ebp + 8]
call fcn.00404360
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
mov dl, byte [ebp + edx - 0x106]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x622459
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x636b40
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x636c28
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004568c0
xor eax, eax
push ebp
push 0x636be0
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x636c40
mov eax, dword [ebp - 4]
call fcn.00456a04
test bl, bl
je 0x636bc9
lea edx, [ebp - 8]
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.00454428
lea eax, [ebp - 8]
mov edx, 0x636c78
call fcn.00404198
mov ecx, dword [ebp - 8]
mov edx, 0x636c88
mov eax, dword [ebp - 4]
call fcn.0045703c
jmp 0x636bd6
mov edx, 0x636c88
mov eax, dword [ebp - 4]
call fcn.00456d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x636c02
mov eax, dword [ebp - 4]
call fcn.00456890
mov eax, dword [ebp - 4]
call fcn.00403170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636c2f
lea eax, [ebp - 8]
call fcn.00403f10
ret
Function at 0x63bee4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x63bfb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
push 0x63bfcc
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.004093dc
push dword [ebp - 0x2c]
push 0x63bfe4
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404250
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.00404198
push dword [ebp - 4]
push 0x63bff4
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
call fcn.0063bc74
mov ecx, dword [ebp - 0x34]
mov eax, dword [0x644f6c]
mov eax, dword [eax]
mov edx, 0x63c00c
call fcn.0050afe0
push dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404250
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63bfbe
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00403f34
lea eax, [ebp - 4]
call fcn.00403f10
ret
Function at 0x6f2677
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x6f2694
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6f2685
add dl, dl
jne 0x6f269f
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6f26eb
xor eax, eax
add dl, dl
jne 0x6f26ac
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6f2788
add dl, dl
jne 0x6f26bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f26c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f26d1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f26dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6f26e6
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x6f268b
mov eax, 1
add dl, dl
jne 0x6f26f9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6f2704
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6f26f0
sub eax, 2
jne 0x6f2733
mov ecx, 1
add dl, dl
jne 0x6f2719
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6f2724
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6f2710
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f268b
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6f274a
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6f2755
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6f2741
cmp eax, 0x7d00
jae 0x6f2778
cmp eax, 0x500
jb 0x6f2773
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f268b
cmp eax, 0x7f
ja 0x6f277b
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f268b
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6f27a4
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6f268b
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x406ad0
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0xc]
lea esi, [eax + 1]
push esi
call fcn.00406a4a
push esi
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.00406aa7
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x40918e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4091e7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4091d8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4091d4
cmp esi, ecx
jae 0x4091d8
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x4091c2
cmp esi, ecx
jb 0x4091dc
xor eax, eax
jmp 0x4091e6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40f2f9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [esp + 8], edx
jbe 0x40f31f
push esi
mov esi, dword [esp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [esp + 0xc]
jb 0x40f30b
pop esi
mov eax, ecx
ret