joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6f3c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4f6f54
mov eax, ebx
call fcn.004f67b8
cmp dword [ebx + 0x68], 0
jne 0x4f6f61
mov eax, ebx
call fcn.004f6714
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4f7111
cmp dword [ebx + 0x68], 0
je 0x4f7111
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004f6584
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004f8cc0
cmp eax, dword [esp]
je 0x4f6fe3
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004f8cd4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f6fbf
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.004f8cc0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f6fd8
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4f6ff6
mov eax, dword [eax + 0x18]
call fcn.0044a4a8
mov esi, eax
jmp 0x4f6ff9
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4f700e
or esi, 0xffffffff
jmp 0x4f7018
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00443418
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.0044343c
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00443464
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00443488
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00406b88
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044a4a8
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044a4a8
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044a4a8
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00427b88
call fcn.004236bc
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044a4a8
push eax
call dword [0x525f00]
push 4
mov eax, dword [ebx + 0x68]
call fcn.0044a4a8
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f7350
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00403310
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4f753c
push 0
push 0x4f7544
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f753c
push 0
push 0x4f7554
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f753c
push 0
push 0x4f7564
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f753c
push 0
push 0x4f7574
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x4f753c
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4f753c
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4f753c
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4f753c
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x4f753c
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4f7528
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4f751e
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4f751e
test byte [esp + 0x1d], 0xd
jne 0x4f751e
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x4f751e
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4f751e
cmp dword [esp + 0xc], 0
je 0x4f751e
mov eax, dword [0x524414]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x4f751e
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4f74fa
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x4f7528
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.00406bcc
jmp 0x4f7528
cmp ebx, dword [esp + 4]
jl 0x4f745e
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f9704
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.004095e8
test al, al
je 0x4f978b
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403310
or esi, 0x100
test esi, esi
jns 0x4f973f
call fcn.004038d4
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404bec
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4f978b
mov dl, 1
mov eax, dword [0x421760]
call fcn.00429154
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00429560
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4f978b
mov eax, esp
call fcn.0040e610
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret

Function at 0x4fe3cc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4fe3fa
mov eax, ebx
call fcn.004fee80
cmp dword [ebx + 0x40], 0
je 0x4fe3f3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4fe46b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4fe45d
cmp dword [ebx + 8], 0
je 0x4fe41c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4fe42e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fe45d
cmp dword [ebx + 8], 0
je 0x4fe40f
cmp eax, 3
je 0x4fe441
dec eax
jne 0x4fe40f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4fe40f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4fe40f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4fe489
cmp dword [ebx + 0x14], 0xcc
je 0x4fe489
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fe494
pop ebx
ret
Function at 0x50f9f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x50fa1d
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x50fa9c
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0050ea68
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x50fa6a
mov cx, word [esp]
sub cx, si
jmp 0x50fa6c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50fa53
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x50fa92
mov cx, word [esp]
sub cx, si
jmp 0x50fa94
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x50fa7b
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x50faf9
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0050f6ec
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x50fae4
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x50faf9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x50f9fa
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x514f88
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5260bc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x514faa
shr eax, 1
xor eax, 0xedb88320
jmp 0x514fac
shr eax, 1
dec edx
jne 0x514f98
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x514f91
mov byte [0x5264bc], 1
pop esi
pop ebx
ret

Function at 0x514fc8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5264bc], 0
jne 0x514fdf
call fcn.00514f88
mov eax, edi
dec eax
test eax, eax
jl 0x515008
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5260bc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x514fe9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5175dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x51760d
dec al
je 0x517649
dec al
je 0x51768d
dec al
je 0x5176f8
jmp 0x517782
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x517782
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x51761d
jmp 0x517782
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x517782
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x517659
jmp 0x517782
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x517782
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5176bb
xor ebp, ebp
jmp 0x5176cc
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5176d5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51769d
jmp 0x517782
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x517782
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x517750
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00515010
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51770c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51addc
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bdc
xor eax, eax
push ebp
push 0x51ae76
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.advapi32.dll_CryptAcquireContextW
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_CryptCreateHash
push 0
mov eax, dword [ebp - 4]
call fcn.004049ec
push eax
lea eax, [ebp - 4]
call fcn.00404c44
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptHashData
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push esi
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_CryptDeriveKey
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyHash
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ae7d
lea eax, [ebp - 4]
call fcn.0040472c
ret

Function at 0x51ae88
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404bdc
mov eax, dword [ebp - 8]
call fcn.00404bdc
xor eax, eax
push ebp
push 0x51af96
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0051addc
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0051acc0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.004047c4
mov eax, dword [ebp - 4]
call fcn.004049ec
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402a54
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00404c44
mov edi, ebx
mov edx, edi
mov ecx, dword [ebp - 0xc]
call fcn.00402c74
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CryptDecrypt
test eax, eax
je 0x51af57
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00404d78
mov eax, esi
call fcn.00404c44
mov edx, eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
call fcn.00402c74
mov eax, esi
mov ecx, 1
mov edx, 1
call fcn.00404c8c
jmp 0x51af61
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404780
mov eax, ebx
call fcn.00402a84
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CryptReleaseContext
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51af9d
lea eax, [ebp - 0x18]
call fcn.0040472c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404750
ret
Function at 0x401720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401744
xor eax, eax
jmp 0x4017c4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40175b
xor eax, eax
jmp 0x4017c4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4017a7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x4017a7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40177e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x4017b3
xor eax, eax
jmp 0x4017c4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x4017c1
xor eax, eax
jmp 0x4017c4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x41b510
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d20d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x44d040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 4
lea ecx, [ebp - 0x14]
call fcn.00402120
lea ecx, [ebp - 0x14]
call fcn.00403230
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x41b5d9
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00403260
push eax
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x41b5d9
push 0x43e340
push 0x43e344
lea ecx, [ebp - 0x14]
call fcn.0041b000
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041ad10
mov edx, dword [ebp - 0x1c]
or edx, 1
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403210
mov eax, dword [ebp + 8]
jmp 0x41b601
push 0x43e34c
mov ecx, dword [ebp + 8]
call fcn.0041ad30
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403210
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d509
mov esp, ebp
pop ebp
ret
Function at 0x41b790
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x44d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43e7e4]
mov dword [ebp - 0xc], eax
mov cx, word [0x43e7e8]
mov word [ebp - 8], cx
mov edx, 0x41
mov word [ebp - 0x268], dx
jmp 0x41b7d6
mov ax, word [ebp - 0x268]
add ax, 1
mov word [ebp - 0x268], ax
movzx ecx, word [ebp - 0x268]
cmp ecx, 0x5a
jg 0x41b83f
mov edx, 2
imul eax, edx, 0
mov cx, word [ebp - 0x268]
mov word [ebp + eax - 0xc], cx
push 0x258
push 0
lea edx, [ebp - 0x264]
push edx
call fcn.0041f550
add esp, 0xc
push 0x12b
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [ebp - 0x264]
push edx
movzx eax, word [ebp - 0x268]
lea ecx, [eax*4 + 0x44e90c]
call fcn.00404fc0
nop
jmp 0x41b7c4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d509
mov esp, ebp
pop ebp
ret

Function at 0x41b880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x44d040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x258
push 0
lea eax, [ebp - 0x25c]
push eax
call fcn.0041f550
add esp, 0xc
push 0x12b
lea ecx, [ebp - 0x25c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x25c]
push edx
mov ecx, 0x44ea7c
call fcn.00404fc0
push 0x5c
lea eax, [ebp - 0x25c]
push eax
call fcn.0041b980
add esp, 8
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
je 0x41b91f
xor ecx, ecx
mov edx, dword [ebp - 0x260]
mov word [edx], cx
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0x44ea78
call fcn.00404fc0
mov ecx, dword [ebp - 0x260]
add ecx, 2
push ecx
mov ecx, 0x44ea80
call fcn.00404fc0
nop
push 0x12b
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0x44ea84
call fcn.00404fc0
push 0x12b
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [ebp - 0x25c]
push edx
mov ecx, 0x44ea88
call fcn.00404fc0
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d509
mov esp, ebp
pop ebp
ret

Function at 0x41e4b7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41e4f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e4f6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e4f6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41e4f6
cmp dword [ecx + 0x74], 0xe
jbe 0x41e4f6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x430260
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x442a34
push 0x442a2c
push str.FlsAlloc
push 0x1f
call fcn.00430147
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430294
push dword [ebp + 8]
mov ecx, esi
call dword [0x43e208]
call esi
jmp 0x43029a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4