joyce8/EMBER2024-capa huggingface dataset:
Function at 0x603f30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ecx + 8]
mov dword [esp], 0x14
call fcn.004cba30
mov ecx, dword [ebx]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], ecx
mov edi, eax
sub esp, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 4]
mov dword [esp], 0xd
mov dword [ebp - 0x24], eax
call fcn.004cba30
mov dword [eax + 4], 0
add eax, 0xc
sub esp, 4
mov dword [eax - 4], 0
mov dword [eax - 0xc], 0
mov byte [eax], 0
test edi, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
je 0x603fc8
mov eax, dword [ebp - 0x2c]
lea ecx, [edi + 4]
mov dword [edi], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.005f4c40
mov eax, dword [ebp - 0x20]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x24]
lock sub dword [eax - 4], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 8]
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x48], eax
test edi, edi
mov ecx, edi
mov dword [ebp - 0x40], edi
je 0x6040a9
add ecx, eax
mov esi, 0x811c9dc5
movsx edx, byte [eax]
add eax, 1
xor edx, esi
imul esi, edx, 0x1000193
cmp eax, ecx
jne 0x603ff0
mov ebx, dword [ebp - 0x50]
xor edx, edx
mov eax, esi
mov edi, dword [ebx + 4]
div edi
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x3c], edx
test eax, eax
je 0x604038
mov ebx, dword [eax]
mov ecx, dword [ebx + 0x10]
nop
cmp ecx, esi
je 0x604063
mov ebx, dword [ebx]
test ebx, ebx
je 0x604038
mov ecx, dword [ebx + 0x10]
xor edx, edx
mov eax, ecx
div edi
cmp dword [ebp - 0x3c], edx
je 0x604020
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00604230
mov edx, 1
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0x40]
mov edx, dword [eax - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
cmp edx, ecx
cmovbe ecx, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [ebp - 0x44], edx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x604024
mov edx, dword [ebp - 0x44]
cmp dword [ebp - 0x40], edx
jne 0x604024
mov eax, dword [ebp - 0x48]
lock sub dword [eax - 4], 1
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov esi, 0x811c9dc5
jmp 0x604002

Function at 0x60b440
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call fcn.0060b2c0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebp, eax
je 0x60b480
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x60b451
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x6491b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
xor eax, edi
cmp edi, 3
jbe 0x64923f
lea ecx, [edi - 4]
shr ecx, 2
lea esi, [edx + ecx*4 + 4]
imul ebx, dword [edx], 0x5bd1e995
add edx, 4
mov ecx, ebx
shr ecx, 0x18
xor ecx, ebx
imul ebx, eax, 0x5bd1e995
imul eax, ecx, 0x5bd1e995
xor eax, ebx
cmp edx, esi
jne 0x6491d0
and edi, 3
cmp edi, 2
je 0x649229
cmp edi, 3
je 0x649220
cmp edi, 1
je 0x649232
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0x5bd1e995
pop ebx
pop esi
pop edi
mov eax, edx
shr eax, 0xf
xor eax, edx
ret
movzx edx, byte [esi + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [esi + 1]
shl edx, 8
xor eax, edx
movzx edx, byte [esi]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x649204
mov esi, edx
jmp 0x6491f5
Function at 0x4a42b0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a42e8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a233d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a2315
jmp 0x4a42f4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a59a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a59e4
call fcn.004ab5e5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a59e4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a59db
xor eax, eax
jmp 0x4a59ec
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a59f2
pop edi
pop esi
pop ebx
ret 4

Function at 0x4abb15
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4abb43
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4abb61
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004aba7b
jmp 0x4abb61
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4abb61
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004aba7b
test edi, edi
mov eax, edi
jne 0x4abb4b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401e00
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov eax, 0x10064
call fcn.00410890
mov edx, dword [0x43f1f0]
mov eax, dword [0x43f1e8]
mov ecx, dword [0x43f1ec]
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
mov dword [esp + 0x2c], edx
push esi
mov dword [esp + 0x28], eax
mov eax, dword [0x43f1f4]
mov dword [esp + 0x2c], ecx
mov cx, word [0x43f1f8]
push esi
lea edx, [esp + 0x40]
push esi
push edx
mov dword [esp + 0x40], eax
mov word [esp + 0x44], cx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
cmp edi, esi
mov dword [esp + 0x18], edi
jne 0x401e6d
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x10064
ret 8
push esi
lea eax, [esp + 0x24]
push 0x84000100
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x10080]
lea ecx, [esp + 0x28]
push eax
push ecx
push edx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
cmp edi, esi
jne 0x401eab
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10064
ret 8
mov eax, dword [esp + 0x1007c]
push 0x43f1e4
push eax
call fcn.00410e2f
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x401ed8
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x10064
ret 8
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x18]
push ecx
push edx
push 0x20000005
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x401f03
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x78]
push 0x4000
push ecx
push edi
call ebp
test eax, eax
je 0x401f54
mov eax, dword [esp + 0x10]
push ebx
test eax, eax
je 0x401f6f
push eax
lea edx, [esp + 0x7c]
push 1
push edx
call fcn.00410cc5
mov eax, dword [esp + 0x20]
add esp, 0x10
add esi, eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x78]
push 0x4000
push ecx
push edi
call ebp
test eax, eax
jne 0x401f1f
push ebx
call fcn.00410c48
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10064
ret 8
call fcn.00410ae2
push ebx
call fcn.00410c48
mov edx, dword [esp + 0x20]
add esp, 8
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10064
ret 8

Function at 0x402a60
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push 0x43f264
push 1
push 0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402aaf
push 0x43f250
push 0
mov bl, 1
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402aaf
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test edi, edi
je 0x402aba
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
pop edi
pop esi
sete al
pop ebx
ret
Function at 0x402f60
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x290
push ebx
push ebp
mov ebp, dword [esp + 0x2a0]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x2a0]
test ebp, ebp
push edi
jle 0x402f86
mov ecx, ebp
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x402ff6
lea ecx, [esp + 0x10]
push 0x100
push ecx
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
je 0x402ff6
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x402ff0
xor edx, edx
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + edx]
mov ecx, dword [ecx]
test ecx, ecx
je 0x402fd5
mov dword [esi], ecx
inc ebx
add esi, 4
cmp ebx, ebp
jge 0x402ff0
mov ecx, dword [eax + 0xc]
movsx edi, word [eax + 0xa]
mov ecx, dword [ecx + edx]
add ecx, edi
mov edi, dword [eax]
cmp ecx, edi
jae 0x402ff0
add edx, 4
jmp 0x402fc3
call dword [sym.imp.WSOCK32.dll_WSACleanup]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x290
ret

Function at 0x4030d0
Capabilities:
Get routing table

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 8]
push esi
mov ecx, dword [edi]
push eax
push ecx
mov dword [esp + 0x14], 0
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x403108
push 0x43f284
call fcn.00410fda
add esp, 4
xor eax, eax
pop edi
pop esi
pop ecx
ret
cmp eax, 0x7a
jne 0x403128
mov edx, dword [esp + 8]
push edx
call fcn.0041069f
add esp, 4
lea ecx, [esp + 8]
mov dword [edi], eax
push esi
push ecx
push eax
call sub.iphlpapi.dll_GetIpForwardTable
pop edi
pop esi
pop ecx
ret

Function at 0x403260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push ecx
push edx
mov dword [esp + 0x1c], 0x63
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40329b
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 4]
lea eax, [esp + 8]
lea edx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push 0
push eax
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4032da
test esi, esi
je 0x4032d3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 8
ret
test esi, esi
je 0x4032e5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x4074d0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [esp + 0x108]
test eax, eax
je 0x407547
lea ecx, [esp]
push edi
push ecx
push 0x43f424
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x14]
push 0x43f264
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
add esp, 0x104
ret 4
lea edx, [esp]
push edx
push 0x43f424
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esp]
push 0x43f264
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x104
ret 4

Function at 0x4075c0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push esi
push edi
push eax
mov edi, ecx
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x407670
mov ax, word [esp + 0x18]
cmp al, 2
jne 0x407670
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x407670
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
push 0x43
mov esi, eax
mov dword [esp + 0x10], 0
mov word [esp + 0xc], 2
call dword [sym.imp.WSOCK32.dll_ntohs]
cmp esi, 0xffffffff
mov word [esp + 0xa], ax
je 0x407670
lea edx, [esp + 8]
push 0x10
push edx
push esi
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
je 0x407669
call dword [sym.imp.WSOCK32.dll_WSACleanup]
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov eax, dword [edi + 0x1c]
push 0x4403b4
push 3
push 0x466
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov eax, 1
pop esi
add esp, 0x1a0
ret
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
call dword [sym.imp.WSOCK32.dll_WSACleanup]
pop edi
xor eax, eax
pop esi
add esp, 0x1a0
ret
Function at 0x407880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x431000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
push 0xd05
push ecx
lea eax, [esi + 0x2d8]
xor edi, edi
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov dword [esi + 0x60], edi
call fcn.00421943
lea ecx, [esp + 0x24]
call fcn.00401840
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], edi
call fcn.004018f0
test eax, eax
je 0x407a65
push 0x4446fc
lea ecx, [esp + 0x14]
call fcn.00421c3c
mov ebx, 1
push 0x4446fc
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], bl
call fcn.00421c3c
mov eax, dword [esi + 0x78]
mov byte [esp + 0x38], 2
cmp eax, edi
jbe 0x407931
cmp dword [esi + 0x74], edi
jbe 0x407931
mov ecx, dword [esi + 0xd4]
mov edx, dword [esi + 0xd0]
push eax
push ecx
push edx
lea eax, [esp + 0x18]
push 0x440474
push eax
call fcn.00420ce1
add esp, 0x14
jmp 0x407951
mov ecx, dword [esi + 0xd4]
mov edx, dword [esi + 0xd0]
push ecx
push edx
lea eax, [esp + 0x14]
push 0x43f7f0
push eax
call fcn.00420ce1
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00421943
push ecx
mov byte [esp + 0x44], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x440460
call fcn.00421c3c
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 2
call fcn.00401970
lea ecx, [esp + 0x1c]
call fcn.00401c90
mov eax, dword [esp + 0x10]
push 0x440454
push eax
call fcn.004107d9
add esp, 8
test eax, eax
jne 0x4079b7
mov ecx, dword [esi + 0x1c]
push edi
push edi
push 0x464
push ecx
jmp 0x4079e6
mov edx, dword [esp + 0x10]
push 0x440440
push edx
call fcn.004107d9
add esp, 8
test eax, eax
jne 0x407a37
push edi
push edi
push 0x440434
mov ecx, esi
call fcn.00423c02
mov eax, dword [esi + 0x1c]
push edi
push edi
push 0x464
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
or edi, 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], edi
mov byte [esp + 0x38], bl
call fcn.00421bce
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.00421bce
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], edi
call fcn.004017d0
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push 0x10
push 0x440428
push 0x44041c
mov ecx, esi
call fcn.00423c02
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.00421bce
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.00421bce
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004017d0
mov ecx, dword [esp + 0x30]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret
Function at 0x42be9d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4314f3
call fcn.00411604
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004276a2
mov eax, dword [0x440588]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x446c98
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.0042bd3d
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.00421d57
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.00408887
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00421d07
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.00421bce
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x403966
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0x120
mov eax, 0x431c76
call fcn.00415339
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x18], eax
push 0xa
movzx eax, ax
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x3c], esi
push ecx
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x403b4c
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4039cd
push str.LoadResource_failed
lea ecx, [ebp - 0x38]
call fcn.00404628
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x38]
jmp 0x403b73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x403b78
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x403a04
push str.SizeofResource_failed
lea ecx, [ebp - 0x38]
call fcn.00404628
mov dword [ebp - 4], 4
jmp 0x4039c5
xor eax, eax
mov dword [esi], eax
cmp dword [edi + 0x14], 8
jb 0x403a10
mov edi, dword [edi]
push eax
push 0x80
push 1
push eax
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x20], 1
cmp eax, 0xffffffff
jne 0x403a53
push str.CreateFileW_failed
lea ecx, [ebp - 0x38]
call fcn.00404628
mov dword [ebp - 4], 5
jmp 0x4039c5
push ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403a83
push str.WriteFile_failed
lea ecx, [ebp - 0x38]
call fcn.00404628
mov dword [ebp - 4], 6
jmp 0x4039c5
cmp ebx, dword [ebp - 0x14]
je 0x403b3d
mov edx, ebx
lea ecx, [ebp - 0x84]
call fcn.00404d1d
mov edi, eax
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], 7
call fcn.00404c32
mov esi, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb4]
mov edx, dword [ebp - 0x14]
call fcn.00404d1d
push eax
mov edx, str.Wrote
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xcc]
call fcn.00404cea
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe4]
mov edx, eax
mov dword [esp], str._bytes_for_resource_ID
call fcn.00404bf6
push esi
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xfc]
call fcn.00404c17
push str._of_size
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x114]
call fcn.00404bf6
push edi
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x12c]
call fcn.00404c17
add esp, 0x10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.00402625
jmp 0x403b85
mov ecx, esi
call fcn.004038bb
mov eax, esi
call fcn.004152e8
ret
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x54]
call fcn.00404c32
push eax
mov edx, str.FindResourceW_failed_for_ID
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.00404cea
pop ecx
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004038a9
push str.LockResource_failed
lea ecx, [ebp - 0x2c]
call fcn.00402649
push 0x444c6c
lea eax, [ebp - 0x2c]
push eax
call fcn.004163e1
int3
Function at 0x403b94
Capabilities:
Get common file path

Disassembly:
push 0x268
mov eax, 0x431cbb
call fcn.00415339
mov esi, ecx
mov dword [ebp - 0x220], esi
push 0x208
xor edi, edi
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.004169e0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403c79
cmp eax, ebx
ja 0x403c79
push eax
lfence
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x238], edi
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], 7
call fcn.00404724
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.004044e6
mov eax, dword [ebp - 0x224]
cmp eax, 8
jb 0x403c71
mov ecx, dword [ebp - 0x238]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x220], ecx
cmp eax, 0x1000
jb 0x403c68
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00402505
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x220]
push eax
push ecx
call fcn.00414f1d
pop ecx
pop ecx
mov eax, esi
call fcn.004152e8
ret
mov edx, eax
lea ecx, [ebp - 0x25c]
call fcn.00402534
push eax
mov edx, str.GetSystemDirectoryW_failed:_returned_size
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x274]
call fcn.00404cea
pop ecx
push eax
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.00402625
push 0x444c6c
lea eax, [ebp - 0x244]
push eax
call fcn.004163e1
int3