joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd7dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd7dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd7dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd7dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd7dd94
push eax
push esi
call fcn.00d8020b
add esp, 8
pop esi
ret 0x10

Function at 0xd7dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd7de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd7de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd96320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d7fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd7ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd7de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd7dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd7deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd96320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d7fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd7deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd7de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd7e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd7e131
push esi
call fcn.00d81145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d70080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd7e131
push 0
push ebp
call fcn.00d703a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d70260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd7e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d702f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd7e121
push 0xd96918
push edi
call fcn.00d7f3f0
push eax
push ebx
push esi
call fcn.00d7df60
push 0xd968f8
push edi
call fcn.00d7f3f0
push eax
push ebx
push esi
call fcn.00d7df60
push 0xd968d8
push edi
call fcn.00d7f3f0
push eax
push ebx
push esi
call fcn.00d7df60
push 0xd968c0
push edi
call fcn.00d7f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d7df60
push 0xd968a0
push edi
call fcn.00d7f3f0
push eax
push ebx
push esi
call fcn.00d7df60
push 0xd96888
push edi
call fcn.00d7f3f0
push eax
push ebx
push esi
call fcn.00d7df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd7f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d7f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d7f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d7f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d7f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd7fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd7fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd9187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd7fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd7fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x408844
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x408868
mov dword [esp], ebx
call fcn.0040874c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4088bc
test edx, edx
jne 0x408898
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.00408458
cmp eax, 7
je 0x4088cc
call sub.msvcrt.dll_abort
nop
mov edi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x40887b
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x408874
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0040857c
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x408958
test edx, edx
jne 0x408934
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
lea esi, [ebp - 0x1c]
jmp 0x40890d
cmp ebx, 5
je 0x40892a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp eax, 1
sbb ebx, ebx
and ebx, 5
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
test eax, eax
je 0x408900
mov ebx, 3
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov esi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push esi
mov dword [esp], ebx
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ebx
mov eax, dword [ebp - 0x2c]
jmp 0x4088f7
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x4088f0

Function at 0x408968
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4089ec
test edx, edx
jne 0x4089c8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x4089ac
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.004083b4
cmp eax, 7
je 0x4089bd
call sub.msvcrt.dll_abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.00408458
cmp eax, 7
jne 0x4089a5
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0040857c
nop
mov edi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x408987
jmp 0x484a5c
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x409e9b
pop dword [ebp - 0x40]
mov eax, 0xfd1c155c
add eax, 0x324893f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xc3922e71
sub dword [ebp - 0x50], 0x753fe926
mov dword [ebp - 0x4c], 0x1d5f00c3
add dword [ebp - 0x4c], 0x14d44b82
mov dword [ebp - 0x48], 0x97771a50
add dword [ebp - 0x48], 0xb4d529de
mov dword [ebp - 0x44], 0x96874fa8
add dword [ebp - 0x44], 0x6978b058
lea eax, [ebp - 0x50]
push eax
mov eax, 0x6aba4ee0
sub eax, 0x6a797e8c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x2c3dfef5
sub dword [ebp - 0x50], 0xb7cb959f
mov dword [ebp - 0x4c], 0x6e43b20
add dword [ebp - 0x4c], 0x3a882655
mov dword [ebp - 0x48], 0x3dd5b229
sub dword [ebp - 0x48], 0xda6645bd
mov dword [ebp - 0x44], 0x2f8c5865
add dword [ebp - 0x44], 0xd073a79b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x5d240b04
sub eax, 0x5ce33ab8
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4287e
push 0
call eax
mov ecx, 0xc5eaa428
add ecx, 0x3a15c76c
xor edx, edx
add edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x40]
mov esi, 0x9198d7e7
add esi, 0x7b8ca28e
mov dword [ebp - 0x14], 0xe5c1bce
mov ebx, dword [edi]
xor dword [ebp - 0x20], ecx
add ebx, esi
add dword [ebp - 0x3c], esi
mov dword [edx], ebx
xor dword [ebp - 0x20], 0x9af3074b
add edx, 0x7f6b3080
sub edx, 0x7f6b307c
add edi, 0x2ff5a4e4
sub edi, 0x2ff5a4e0
loop 0x409fb9
add eax, 0xde5125dc
add eax, 0x21b07b47
xor ebx, ebx
add ebx, eax
add eax, 0x3b96fa5f
add eax, 0xc46905a6
mov ecx, 0x7b710d67
add ecx, 0x84cef299
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x404870
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, 0x5b3144
mov edx, edi
mov eax, dword [ebx + 0x28]
test eax, eax
cmovne edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x18]
test eax, eax
cmovne edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x54]
lea ecx, [ebx + 0x5c]
add eax, eax
push eax
push dword [ebx + 0x58]
call fcn.00420bb0
mov dword [ebx + 0x58], 0
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x50], 0
mov eax, dword [ebx + 0x44]
add eax, eax
push eax
push dword [ebx + 0x48]
call fcn.00420bb0
mov dword [ebx + 0x48], 0
lea ecx, [ebx + 0x3c]
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x40], 0
mov eax, dword [ebx + 0x34]
add eax, eax
push eax
push dword [ebx + 0x38]
call fcn.00420bb0
mov dword [ebx + 0x38], 0
lea ecx, [ebx + 0x2c]
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov eax, dword [ebx + 0x24]
add eax, eax
push eax
push dword [ebx + 0x28]
call fcn.00420bb0
mov dword [ebx + 0x28], 0
lea ecx, [ebx + 0x1c]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x20], 0
mov eax, dword [ebx + 0x14]
add eax, eax
push eax
push dword [ebx + 0x18]
call fcn.00420bb0
mov dword [ebx + 0x18], 0
lea ecx, [ebx + 0xc]
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
mov eax, dword [ebx + 4]
add eax, eax
push eax
push dword [ebx + 8]
call fcn.00420bb0
pop edi
mov dword [ebx + 8], 0
mov dword [ebx + 4], 0
mov dword [ebx], 0
pop ebx
ret
Function at 0x405320
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xab4
push ebx
mov ebx, ecx
cmp dword [ebx + 0x68], 0
je 0x40533b
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00420e00
add esp, 4
mov ecx, ebx
push eax
push esi
call fcn.00403040
mov esi, dword [ebp + 0xc]
push esi
call fcn.00420e00
add esp, 4
lea ecx, [ebx + 0x30]
push eax
push esi
call fcn.00403040
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push 0x5c
push esi
mov dword [ebx + 0x64], eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x405384
lea esi, [eax + 2]
push esi
call fcn.00420e00
add esp, 4
lea ecx, [ebx + 0x50]
push eax
push esi
call fcn.00403040
lea eax, [ebp - 0x680]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x1ea
lea eax, [ebp - 0x454]
mov ecx, 8
mov esi, 0x54a3a8
lea edi, [ebp - 0x474]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x474]
add esp, 0xc
push eax
push 0
push 0x54a3c8
lea eax, [ebp - 0x680]
push eax
call esi
lea eax, [ebp - 0x474]
push eax
call fcn.00420e00
add esp, 4
lea ecx, [ebx + 0x20]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.00403040
mov eax, dword [str.dxdiag.xml]
mov dword [ebp - 0x268], eax
mov eax, dword [0x54a3d4]
mov dword [ebp - 0x264], eax
mov eax, dword [0x54a3d8]
mov dword [ebp - 0x260], eax
mov eax, dword [0x54a3dc]
mov dword [ebp - 0x25c], eax
mov eax, dword [0x54a3e0]
mov dword [ebp - 0x258], eax
mov ax, word [0x54a3e4]
push 0x1f4
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x252]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x268]
push eax
push 0
push 0x54a3e8
lea eax, [ebp - 0x680]
push eax
call esi
lea eax, [ebp - 0x268]
push eax
call fcn.00420e00
add esp, 4
lea ecx, [ebx + 0x10]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00403040
cmp byte [ebp + 0x18], 0
pop edi
pop esi
je 0x405558
push 0x105
lea eax, [ebp - 0x88c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x268]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push str.0dxdiag.exe__x_1
lea eax, [ebp - 0xab4]
push 0x113
push eax
call fcn.00403fe0
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
mov dword [ebp - 0x5c], 0x44
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0xab4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40554f
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xc]
mov dword [ebx + 0x68], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x68]
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x6c], eax
mov eax, dword [ebx + 0x68]
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4063e0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x406400
mov eax, 0x200
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x48]
mov eax, ebx
push esi
push edi
mov edi, ebx
mov esi, ebx
and edi, 1
mov ecx, edi
or ecx, 2
and al, 2
mov eax, ebx
cmove ecx, edi
mov edx, ecx
or edx, 4
and al, 4
push 0
cmove edx, ecx
mov eax, edx
or eax, 0x10
and esi, 0x10
cmove eax, edx
mov ecx, eax
or ecx, 0x20
and bl, 0x20
mov ebx, dword [ebp + 8]
cmove ecx, eax
mov eax, ecx
or ecx, 0x80000000
or eax, 0x40000000
test esi, esi
push ebx
cmovne ecx, eax
or ecx, 0x1000000
mov esi, ecx
or esi, 0x800000
test edi, edi
cmovne esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
mov ecx, esi
mov dword [ebp - 8], edx
cmp edx, 0x28
jbe 0x406519
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push ebx
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push ebx
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
mov ecx, esi
cmp word [ebp - 4], ax
jne 0x406516
mov edx, dword [ebp - 0x10]
lea eax, [edx + 0x34]
cmp dword [ebp - 8], eax
jbe 0x406516
push 0
push 0
push edx
push ebx
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x14]
cmp eax, 0x5a4d
je 0x40650e
cmp eax, 0x454e
je 0x40650e
cmp eax, 0x454c
je 0x40650e
mov ecx, esi
cmp eax, 0x4550
jne 0x406516
mov ecx, esi
or ecx, 0x400000
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x406522
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40652b
mov dword [eax], edx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x34]
test esi, esi
je 0x4065a4
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
sub ecx, 0xd53e8000
push 0
push 0x989680
sbb eax, 0x19db1de
push eax
push ecx
call fcn.00546a10
mov dword [esi], eax
mov ecx, ebx
sub ecx, 0xd53e8000
mov dword [esi + 4], edx
push 0
mov eax, edi
push 0x989680
sbb eax, 0x19db1de
push eax
push ecx
call fcn.00546a10
mov ecx, dword [ebp - 0x44]
mov dword [esi + 8], eax
sub ecx, 0xd53e8000
mov eax, dword [ebp - 0x40]
push 0
push 0x989680
sbb eax, 0x19db1de
mov dword [esi + 0xc], edx
push eax
push ecx
call fcn.00546a10
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4065cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.0040a120
movzx ecx, word [ebp - 4]
add esp, 0x10
movzx eax, word [ebp - 8]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4094c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4094ce
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x40958d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
sub edi, 1
jne 0x4094e6
pop edi
test esi, esi
je 0x4095ab
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x549dd0]
sub esi, 1
jne 0x409591
not eax
pop esi
pop ebp
ret
Function at 0x409d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x409f9c
cmp dword [esi + 0x6af90], 3
jb 0x409e08
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x409e46
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x409e46
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x409e2f
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.0040abb0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
add esp, 8
cmp edi, ecx
cmova edi, ecx
cmp edi, 3
jb 0x409f19
lea eax, [edi - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.004098a0
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
cmp edi, dword [esi + 0x6af98]
ja 0x409ee0
cmp dword [esi + 0x6af90], 3
jb 0x409ee0
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x409e84
mov eax, dword [ebp + 8]
jmp 0x409f39
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp + 8]
jmp 0x409f3f
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.004098a0
add esp, 0xc
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x409f7a
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x409f57
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x409f59
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 0
sub eax, ecx
push eax
push edx
push esi
call fcn.0040a2e0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x409f8f
push esi
call fcn.0040a180
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x409db3
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x409fb0
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x409fb2
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edx
push esi
call fcn.0040a2e0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret