joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f5f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
mov edi, ecx
jne 0x42f61f
mov eax, dword [esp + 0x10]
push eax
push 2
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
pop edi
pop esi
pop ebx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x42f63f
pop edi
pop esi
pop ebx
ret 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call fcn.0042f520
pop edi
pop esi
pop ebx
ret 8
Function at 0x4328b0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4487c0]
sub esp, 0x104
test eax, eax
jne 0x432a91
mov eax, dword [0x4487c4]
test eax, eax
jne 0x432ac8
mov eax, dword [0x4463cc]
test eax, eax
je 0x4328ee
push 0x4487a8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4463cc], 0
push 0x4487a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4487c0]
test eax, eax
jne 0x432a86
mov al, byte [0x449294]
test al, al
je 0x432929
push 0x449294
lea eax, [esp + 4]
push str._sGLJPG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x43293c
lea ecx, [esp]
push str.GLJPG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4487c0], eax
jne 0x43296e
push 0x4487a8
mov dword [0x4487c4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadJpgFileImageData
push eax
call esi
mov dword [0x4487c8], eax
mov eax, dword [0x4487c0]
push str.LoadJpgImageDataFromMem
push eax
call esi
mov ecx, dword [0x4487c0]
push str.LoadJpgFile
push ecx
mov dword [0x4487cc], eax
call esi
mov edx, dword [0x4487c0]
push str.LoadJpgFromMem
push edx
mov dword [0x4487d0], eax
call esi
mov dword [0x4487d4], eax
mov eax, dword [0x4487c0]
push str.WriteBitmapToJpeg
push eax
call esi
mov ecx, dword [0x4487c0]
push str.WriteDibToJpeg
push ecx
mov dword [0x4487d8], eax
call esi
mov edx, dword [0x4487c0]
push str.WriteDibToJpegMEM
push edx
mov dword [0x4487dc], eax
call esi
mov dword [0x4487e0], eax
mov eax, dword [0x4487c0]
push str.GetPointerFromHandleLock
push eax
call esi
mov ecx, dword [0x4487c0]
push str.UnLockDataHandle
push ecx
mov dword [0x4487e4], eax
call esi
mov edx, dword [0x4487c0]
push str.FreeDataHandle
push edx
mov dword [0x4487e8], eax
call esi
mov ecx, dword [0x4487c8]
mov dword [0x4487ec], eax
test ecx, ecx
pop esi
je 0x432a9d
mov ecx, dword [0x4487cc]
test ecx, ecx
je 0x432a9d
mov ecx, dword [0x4487d0]
test ecx, ecx
je 0x432a9d
mov ecx, dword [0x4487d4]
test ecx, ecx
je 0x432a9d
mov ecx, dword [0x4487d8]
test ecx, ecx
je 0x432a9d
mov ecx, dword [0x4487dc]
test ecx, ecx
je 0x432a9d
test eax, eax
je 0x432a9d
mov eax, dword [0x4487e0]
test eax, eax
je 0x432a9d
mov eax, dword [0x4487e4]
test eax, eax
je 0x432a9d
mov eax, dword [0x4487e8]
test eax, eax
je 0x432a9d
push 0x4487a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov eax, dword [0x4487c0]
mov dword [0x4487c4], 1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4487a8
mov dword [0x4487c0], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x432b20
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x44881c]
sub esp, 0x104
test eax, eax
jne 0x432c74
mov eax, dword [0x448820]
test eax, eax
jne 0x432cac
mov eax, dword [0x4464b0]
test eax, eax
je 0x432b5e
push 0x4487f0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4464b0], 0
push 0x4487f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44881c]
test eax, eax
jne 0x432c69
mov al, byte [0x449294]
test al, al
je 0x432b99
push 0x449294
lea eax, [esp + 4]
push str._sGLPNG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x432bac
lea ecx, [esp]
push str.GLPNG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x44881c], eax
jne 0x432bde
push 0x4487f0
mov dword [0x448820], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadPNGFile
push eax
call esi
mov dword [0x448808], eax
mov eax, dword [0x44881c]
push str.LoadPNGFromMem
push eax
call esi
mov ecx, dword [0x44881c]
push str.WriteBmpToPNGMem
push ecx
mov dword [0x44880c], eax
call esi
mov edx, dword [0x44881c]
push str.WriteBmpToPNGFile
push edx
mov dword [0x448810], eax
call esi
mov dword [0x448814], eax
mov eax, dword [0x44881c]
push str.WriteImageDataToPNGMem
push eax
call esi
mov ecx, dword [0x448808]
mov dword [0x448818], eax
test ecx, ecx
pop esi
je 0x432c80
mov ecx, dword [0x44880c]
test ecx, ecx
je 0x432c80
mov ecx, dword [0x448810]
test ecx, ecx
je 0x432c80
mov ecx, dword [0x448814]
test ecx, ecx
je 0x432c80
test eax, eax
je 0x432c80
push 0x4487f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov ecx, dword [0x44881c]
mov dword [0x448820], 1
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4487f0
mov dword [0x44881c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x432d20
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x439d78
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
mov edx, dword [esp + 0x14]
sub esp, 0x40
lea ecx, [esp]
push ebp
push esi
push eax
mov eax, dword [esp + 0x5c]
push 0x40
push ecx
push 0x448710
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x432d78
mov eax, dword [esp + 0x60]
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
xor ebp, ebp
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], ebp
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x64]
cmp dword [eax - 8], 2
jge 0x432dcf
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x64]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x432e29
mov edx, dword [esp + 0x64]
push edx
call fcn.00432450
mov esi, eax
mov ecx, eax
and esi, 0xff
and eax, 0xff00
shl esi, 0x10
sar ecx, 0x10
add esi, ecx
add esp, 4
lea ecx, [esp + 0x64]
add esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov esi, dword [esp + 0x64]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
push edi
push esi
call ebx
mov dword [esp + 0x68], eax
mov al, byte [esi]
add esp, 4
xor edi, edi
test al, al
je 0x432e53
cmp al, 0x2c
je 0x432e53
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x432e47
cmp byte [esi], 0x2c
jne 0x432e81
inc esi
push esi
call ebx
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x432e73
cmp al, 0x2c
je 0x432e73
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x432e67
cmp byte [esi], 0x2c
jne 0x432e81
inc esi
push esi
call ebx
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x6c]
shl edi, 8
add edi, ebp
mov dword [esp + 0x58], 0xffffffff
shl edi, 8
add edi, eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x432ec0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x439d98
push eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x40
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x54]
push 0x40
push ecx
push 0x448710
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp]
test al, al
je 0x432f6e
push ebx
push esi
push edi
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0
push ecx
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0x68]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push esi
call edi
mov ebx, dword [esp + 0x68]
add esp, 4
mov dword [ebx], eax
mov al, byte [esi]
test al, al
je 0x432f4b
cmp al, 0x2c
je 0x432f4b
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x432f3f
cmp byte [esi], 0x2c
jne 0x432f5a
inc esi
push esi
call edi
add esp, 4
mov dword [ebx + 4], eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x4010f1
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401101
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x40114f
push 0x403160
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401155
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x40112b
jmp 0x401158
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x401101
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401168
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401207
push ebx
mov dword [ebp - 0xc], 0x403160
mov dword [ebp - 8], str.SteamService.exe
mov dword [ebp - 4], str.steamwebhelper.exe
push esi
xor esi, esi
push dword [ebp + esi*4 - 0xc]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4011ed
push dword [ebp - 0x230]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4011ed
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 3
jb 0x4011b3
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4011b1
pop esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x422be0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x422d3e
nop
jl 0x422c37
int1
ror dword [edi], 1
push cs
cmpsb byte [esi], byte es:[edi]
jb 0x422c2b
push cs
sbb ah, cl
popal
loope 0x422c54
popal
popal
popal
popal
popal
jnp 0x422bf1
mov bh, 0x79
div byte [esi - 0x97bd510]
jp 0x422bf3
jb 0x422c25
or eax, 0x1c832ae0
dec ecx
invalid
jb 0x422c46
or eax, 0x15822ae0
sar byte [eax], 0x72
adc eax, 0x197238c0
cmp esp, 0x30
sbb edx, esi
cmp esp, 0x30
adc ecx, edi
stc
jnp 0x422c2f
div dword [edi - 0x7af1fe8e]
test dword [eax + 0x34], edi
lock sub al, byte [esi + esi*8 + 0x1f72ef7a]
mov bh, 0x72
add dword [esi], ecx
test dword [ebp + 0x2af03478], eax
test dh, dh
jp 0x422c35
jb 0x422c67
or eax, 0x38e02ae0
lock sub al, byte [esi + esi*8 + 0x1f72ef7a]
pop ds
or eax, 0x38e02ae0
test cl, dl
mov al, 0xf0
sub al, byte [esi + esi*8 + 0x1f72ef7a]
or eax, 0x38e02ae0
lock sub al, byte [edx + 0x7af8841e]
sub ah, al
cmp al, dh
sub al, byte [edx + 0x7af8841e]
out dx, eax
jb 0x422c93
or eax, 0x15822ae0
jb 0x422cab
xor bl, dh
jo 0x422c8a
jo 0x422c8a
int1
add cl, byte [esi]
push cs
jb 0x422ca4
invalid
or eax, 0xf37bfe87
mov bl, 0x79
div byte [esi + 0x180684b8]
xchg edx, eax
mov eax, 0x92180684
push cs
push cs
push cs
popal
jp 0x422c91
jb 0x422cd3
cmc
js 0x422c99
jb 0x422cdb
cmc
cmc
jb 0x422cc0
cmc
xchg byte [eax], al
lock sbb byte ds:[ebp - 0x50f1f1f2], bh
scasd eax, dword es:[edi]
js 0x422cbb
dec eax
int1
int1
int1
jnp 0x422cb2
div byte [esi - 0xf32e623]
xchg byte [esi], al
mov dh, 0xdd
sbb ebp, ecx
lock xchg byte [esi], al
jno 0x422c93
test byte [ebx], al
jp 0x422cc0
jnp 0x422c7a
cmc
xchg edi, eax
xor byte [ecx], bl
stc
xor byte [ecx], dh
loope 0x422d4c
xor eax, 0x1a7109d8
sbb eax, esi
add dword [eax - 0xa], edi
lock add dword [eax - 0xa], edi
jb 0x422d17
hlt
mov dh, 0xa1
mov dh, 0x48
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xea45f03
sbb dword [bp - 0xe0e], esp
clc
xor dword [ebp + 0x72f278f6], eax
xor dh, ch
sbb ch, byte [ecx]
push cs
sbb eax, 0x90f1f2a6
sbb byte [ebx], dl
in eax, dx
std
inc dword [eax]
mov eax, section._4321280
xor byte [eax], 0x56
inc eax
cmp eax, 0x422bcc
jle 0x422d43
mov eax, 0x422be6
xor byte [eax], 0xf1
inc eax
cmp eax, 0x422d38
jle 0x422d53
pushal
mov esi, section._4321280
jmp 0x422be5
Function at 0x6319273b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0x724b84
mov dword [ebp - 0x10], 0x724ba8
mov dword [esp + 8], 0x11
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.631e0550
mov dword [esp + 8], 5
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.631e0550
mov dword [esp + 8], 0x15
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x31]
mov dword [esp], eax
call fcn.631e0550
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x15
lea eax, [ebp - 0x31]
mov dword [esp], eax
call fcn.631e0866
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x633be7fc
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x63192824
mov dword [ebp - 0x18], str.Couldnt_update_the_registry_with_your_new_keycode._Do_you_have_sufficient_permissions_to_write_to_the_registry__Are_you_administrator_
mov eax, dword [0x6345597c]
test eax, eax
je 0x63192805
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.631a9970
jmp 0x6319286b
mov dword [0x6345597c], 1
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.63181eb4
jmp 0x6319286b
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], 0x15
lea edx, [ebp - 0x31]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633be8a8
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
leave
ret

Function at 0x631a97f0
Capabilities:
Delete file
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], str.quitting..._n
mov dword [esp], 0
call fcn.631a9790
mov eax, dword [0xcc9d148]
test eax, eax
je 0x631a981e
call fcn.63182022
mov eax, dword [0xcc9d148]
test eax, eax
jne 0x631a9810
call fcn.6318209a
mov byte [0x15ca618], 0
mov dword [esp], 2
call fcn.631f9faf
cmp word [0x13ee4c0], 0
jne 0x631a9851
mov eax, dword [0x1476f1c]
test eax, eax
je 0x631a9868
add esp, 0x1c
jmp fcn.631fb683
call fcn.631825f0
mov eax, dword [0x1476f1c]
xor edx, edx
mov word [0x13ee4c0], dx
test eax, eax
jne 0x631a9849
call fcn.631820a0
call fcn.631fb707
mov dword [esp], 0
call fcn.631825fa
call fcn.6318e58c
call fcn.6318cfdd
mov dword [esp], str.EXE_SERVERQUIT
call fcn.631820ac
call fcn.63182082
call fcn.63182088
mov eax, dword [0x675f5614]
test eax, eax
jne 0x631a98d0
call fcn.6318208e
call fcn.631b6840
call fcn.631b66c3
call fcn.631b66e0
call fcn.631b66fd
add esp, 0x1c
jmp fcn.631fb683
call fcn.631b4aa2
mov dword [0x675f5614], 0
jmp 0x631a98a7
Function at 0x631aa5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], str.May__1_2022
mov dword [esp + 0x10], str.win_mingw_x86
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0x633c246f
mov dword [esp + 8], 0x633c247c
mov dword [esp], eax
call fcn.631e0da0
add esp, 0x2c
ret
Function at 0x631ab510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not eax
test ebx, ebx
jle 0x631ab5cc
mov ecx, dword [esp + 0xc]
add ebx, ecx
lea esi, [esi]
movzx edx, byte [ecx]
xor eax, edx
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov eax, edx
shr eax, 1
mov esi, eax
xor esi, 0xedb88320
and edx, 1
cmovne eax, esi
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov eax, edx
shr eax, 1
mov esi, eax
xor esi, 0xedb88320
and edx, 1
cmovne eax, esi
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov eax, edx
shr eax, 1
mov esi, eax
xor esi, 0xedb88320
and edx, 1
cmovne eax, esi
mov edx, eax
shr edx, 1
mov esi, edx
xor esi, 0xedb88320
test al, 1
cmovne edx, esi
mov eax, edx
shr eax, 1
mov esi, eax
xor esi, 0xedb88320
and edx, 1
cmovne eax, esi
add ecx, 1
cmp ebx, ecx
jne 0x631ab530
not eax
pop ebx
pop esi
ret

Function at 0x631abd80
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push ebx
sub esp, 0x54
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea esi, [esp + 0x2c]
mov dword [esp + 4], str.SOFTWAREActivisionCall_of_Duty_4
mov dword [esp + 8], esi
mov dword [esp], 0x80000001
call ebx
sub esp, 0xc
test eax, eax
jne 0x631abe14
lea eax, [esp + 0x30]
lea ebx, [esp + 0x3b]
mov dword [esp + 0x34], 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], 0x15
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.codkey
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x631abe02
cmp dword [esp + 0x30], 0x15
je 0x631abe80
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x631abe34
mov dword [esp + 8], esi
mov dword [esp + 4], str.SOFTWAREActivisionCall_of_Duty_4
mov dword [esp], 0x80000002
call ebx
sub esp, 0xc
test eax, eax
je 0x631abdab
mov dword [0x724b84], 0x20202020
mov dword [0x724b88], 0x20202020
mov dword [0x724b8c], 0x20202020
mov dword [0x724b90], 0x20202020
mov byte [0x724b94], 0
mov dword [0x724ba8], 0x20202020
mov byte [0x724bac], 0
add esp, 0x54
pop ebx
pop esi
ret
mov dword [esp + 8], 0x11
mov dword [esp + 4], ebx
mov dword [esp], 0x724b84
call fcn.631e0550
lea eax, [esp + 0x4b]
mov dword [esp + 8], 5
mov dword [esp + 4], eax
mov dword [esp], 0x724ba8
call fcn.631e0550
mov dword [esp + 4], 0x724ba8
mov dword [esp], 0x724b84
call fcn.631924e2
test eax, eax
je 0x631abe02
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x631abe74
Function at 0x631b488b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_fread
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x631b52a1
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0x633c8f34
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_fopen
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x745f5a4d
mov dword [ebp - 0x10], 0x747365
cmp dword [ebp - 0xc], 0
jne 0x631b52d8
mov eax, 0
jmp 0x631b5343
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 8
mov dword [esp + 4], 1
lea eax, [ebp - 0x14]
mov dword [esp], eax
call sub.msvcr100.dll_fwrite
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov dword [esp + 4], 0x633c8f37
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x631b5328
mov eax, 0
jmp 0x631b5343
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_remove
mov eax, 1
leave
ret

Function at 0x631b53b9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, 0xcb1dcc0
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x108]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x633c905a
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.631b4ef6
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.msvcr100.dll_remove
mov eax, 0xcb1aab8
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x108]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x633c905a
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.631b4ef6
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.msvcr100.dll_remove
nop
leave
ret

Function at 0x631b56d4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
call fcn.631b74e5
mov edx, eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x208]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x633c905a
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.631b5059
call fcn.631b74e5
mov edx, eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x633c905a
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.631b5059
lea eax, [ebp - 0x408]
mov dword [esp + 4], eax
lea eax, [ebp - 0x208]
mov dword [esp], eax
call sub.msvcr100.dll__wrename
test eax, eax
je 0x631b577f
lea eax, [ebp - 0x408]
mov dword [esp + 4], eax
lea eax, [ebp - 0x208]
mov dword [esp], eax
call fcn.631b5966
lea eax, [ebp - 0x208]
mov dword [esp], eax
call fcn.631b5359
nop
leave
ret