joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f36c198
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
push ebx
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x3f3c4e06
push ebx
push ebx
push ebx
push 2
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x3f3c4e2d
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x3f3c4e51
push 0x38
call fcn.3f246692
cmp eax, ebx
pop ecx
je 0x3f3c4e7e
mov ecx, eax
call fcn.3f36bb84
mov edi, eax
cmp edi, ebx
je 0x3f3c4e85
push esi
mov ecx, edi
push dword [ebp - 8]
call fcn.3f36bbbb
mov esi, eax
cmp esi, ebx
jl 0x3f3c4e8a
mov eax, dword [ebp - 4]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
jg 0x3f3c4e1b
call esi
mov esi, eax
jmp 0x3f3c4ea6
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x3f3c4ea6
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
jg 0x3f3c4e3f
call esi
mov esi, eax
jmp 0x3f3c4e98
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x3f3c4e98
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
jg 0x3f3c4e6c
call esi
mov esi, eax
jmp 0x3f3c4e8a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x3f3c4e8a
xor edi, edi
jmp 0x3f36c203
mov esi, 0x8007000e
cmp dword [ebp - 8], ebx
je 0x3f3c4e98
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
cmp dword [ebp - 4], ebx
je 0x3f3c4ea6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp + 8], 0xffffffff
je 0x3f3c4eb5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp edi, ebx
je 0x3f36c231
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x3f36c607
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, 0xc
ja case.0x3f36c61d.1
jmp dword [esi*4 + 0x3f36c624]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
jmp 0x3f36c7fb
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
jmp 0x3f36c7fb
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x20]
jmp 0x3f36c7fb
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
jmp 0x3f36c73f
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
jmp 0x3f36c73f
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
jmp 0x3f36c73f
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
jle 0x3f3c4257
mov eax, dword [eax + 0x14]
imul eax, eax, 0x64
cdq
idiv ecx
push eax
push 0x3f36c984
jmp 0x3f36c801
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 0x1c]
cmp edx, ebx
mov dword [ebp + 0x10], edx
je 0x3f3c425e
fild dword [eax + 0x28]
fidiv dword [ebp + 0x10]
mov edx, dword [eax + 0x20]
cmp edx, ebx
je 0x3f3c4265
mov eax, dword [eax + 0x2c]
fild dword [ebp + 0x10]
add eax, edx
mov dword [ebp + 0x10], eax
fild dword [ebp + 0x10]
fdivp st(1)
fld st(1)
fcomp qword [0x3f1035e8]
fnstsw ax
sahf
je 0x3f3c426c
fcom qword [0x3f1035e8]
fnstsw ax
sahf
je 0x3f3c426c
push ecx
push ecx
cmp esi, 0xb
fstp qword [esp]
push ecx
push ecx
fstp qword [esp]
jne 0x3f36c7e6
call fcn.3f36c858
fmul qword [0x3f105640]
call fcn.3f101507
push 0xa
mov esi, eax
pop ecx
cmp ecx, ebx
je 0x3f3c4277
mov eax, esi
xor edx, edx
div ecx
lea eax, [edx + edx*4]
xor edx, edx
shl eax, 1
div ecx
xor edx, edx
push eax
mov eax, esi
div ecx
push eax
lea eax, [ebp - 0x68]
push 0x3f36c97c
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x34]
mov esi, 0x400
push 0x31
push eax
lea eax, [ebp - 0x68]
push ebx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetNumberFormatA]
lea eax, [ebp - 0x68]
push 2
push eax
push 0xe
push esi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
test eax, eax
je 0x3f36c7c3
lea eax, [ebp - 0x68]
mov byte [ebp - 0x67], bl
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.3f36c82c
pop ecx
cmp eax, ebx
pop ecx
je 0x3f36c7c3
mov esi, dword [sym.imp.USER32.DLL_CharNextA]
push eax
call esi
push eax
call esi
cmp eax, ebx
je 0x3f36c7c3
mov byte [eax], bl
push 0x32
lea eax, [ebp - 0x34]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
pop esi
pop ebx
leave
ret 0xc
call fcn.3f36c898
jmp 0x3f36c72f
mov byte [ebp - 0x34], bl
jmp 0x3f36c7c3
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
push eax
push 0x3f36c978
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
jmp 0x3f36c7c3
xor eax, eax
jmp 0x3f36c6ba
fldz
jmp 0x3f36c6dc
fldz
jmp 0x3f36c6f7
fstp st(0)
fstp st(0)
fldz
jmp 0x3f36c72f
push 1
xor esi, esi
pop ecx
jmp 0x3f36c747
Function at 0x3f373668
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x3f373700
call dword [sym.imp.KERNEL32.DLL_GetVersion]
push 1
mov dword [0x3f3d5764], eax
call fcn.3f373ba9
test eax, eax
pop ecx
je 0x3f3c7305
mov eax, dword [0x3f3d5764]
xor ecx, ecx
mov cl, byte [0x3f3d5765]
and eax, 0xff
shr dword [0x3f3d5764], 0x10
mov dword [0x3f3d576c], eax
mov dword [0x3f3d5770], ecx
shl eax, 8
add eax, ecx
mov dword [0x3f3d5768], eax
call fcn.3f373c44
test eax, eax
je 0x3f3c7300
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x3f3d5890], eax
call fcn.3f373cc9
mov dword [0x3f3d575c], eax
call fcn.3f373d72
call fcn.3f373e57
call fcn.3f3744eb
call fcn.3f3745a5
inc dword [0x3f3d5758]
push 1
pop eax
ret 0xc
xor ecx, ecx
cmp eax, ecx
jne 0x3f3c730c
cmp dword [0x3f3d5758], ecx
jle 0x3f3c7305
dec dword [0x3f3d5758]
cmp dword [0x3f3d5774], ecx
jne 0x3f373729
call fcn.3f3737d1
call fcn.3f373a55
call fcn.3f373aa8
call fcn.3f373b34
jmp 0x3f3736fa
call fcn.3f373b34
xor eax, eax
jmp 0x3f3736fd
cmp eax, 3
jne 0x3f3736fa
push ecx
call fcn.3f3c76c4
pop ecx
jmp 0x3f3736fa

Function at 0x3f3737e0
Capabilities:
Terminate process

Disassembly:
push edi
call fcn.3f373754
push 1
pop edi
cmp dword [0x3f3d58b8], edi
je 0x3f3c9c53
cmp dword [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x3f3d5774], edi
mov byte [0x3f3d58b4], bl
jne 0x3f373849
mov eax, dword [0x3f3d5884]
test eax, eax
je 0x3f373838
mov ecx, dword [0x3f3d5880]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x3f373837
mov eax, dword [esi]
test eax, eax
je 0x3f37382c
call eax
sub esi, 4
cmp esi, dword [0x3f3d5884]
jae 0x3f373824
pop esi
push 0x3f3d58a4
push 0x3f3d589c
call fcn.3f37373a
pop ecx
pop ecx
push 0x3f3d58b0
push 0x3f3d58a8
call fcn.3f37373a
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x3f3c9c69
call fcn.3f37375d
pop edi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x3f3737f5
push dword [esp + 8]
mov dword [0x3f3d58b8], edi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x3f373cc9
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x3f3d5d90]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x3f3ca970
call ebp
mov esi, eax
cmp esi, ebx
je 0x3f3ca954
mov dword [0x3f3d5d90], 1
cmp esi, ebx
je 0x3f3ca97a
cmp word [esi], bx
mov eax, esi
je 0x3f373d1b
inc eax
inc eax
cmp word [eax], bx
jne 0x3f373d0d
inc eax
inc eax
cmp word [eax], bx
jne 0x3f373d0d
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x3f373d62
push ebp
call fcn.3f11db93
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x3f373d62
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x3f3ca987
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x3f3ca9ee
mov dword [0x3f3d5d90], 2
jmp 0x3f3ca99f
cmp eax, 1
jne 0x3f3ca99a
jmp 0x3f373cfe
call ebp
mov esi, eax
cmp esi, ebx
je 0x3f3ca9ee
jmp 0x3f373d06
push dword [esp + 0x10]
call fcn.3f11d1f1
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x3f373d5e
cmp eax, 2
jne 0x3f3ca9ee
cmp edi, ebx
jne 0x3f3ca9af
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x3f3ca9ee
cmp byte [edi], bl
mov eax, edi
je 0x3f3ca9bf
inc eax
cmp byte [eax], bl
jne 0x3f3ca9b5
inc eax
cmp byte [eax], bl
jne 0x3f3ca9b5
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.3f11db93
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x3f3ca9d5
xor esi, esi
jmp 0x3f3ca9e0
push ebp
push edi
push esi
call fcn.3f3ca25d
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x3f373d6b
xor eax, eax
jmp 0x3f373d6b
Function at 0x3f374f23
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea eax, [ebp - 0x100]
push 0x80
push eax
push dword [ebp + 8]
call dword [sym.imp.OLE32.DLL_StringFromGUID2]
xor eax, eax
lea ecx, [ebp - 0x80]
push eax
push eax
push 0x40
push ecx
or ebx, 0xffffffff
lea ecx, [ebp - 0x100]
push ebx
push ecx
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov edi, 0x3f375108
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x80]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov ebx, 0x3f375100
and ecx, 3
cmp dword [ebp + 0x10], eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
mov edi, SysReAllocString
jne 0x3f3c4cb3
cmp dword [ebp + 0xc], 0
jne 0x3f3c4cd4
lea eax, [ebp - 0x40]
push 0x3f3750f8
push eax
call fcn.3f375019
lea eax, [ebp - 0x40]
push 0x3f3750dc
push eax
call fcn.3f375019
lea eax, [ebp - 0x40]
push 0x3f3750cc
push eax
call fcn.3f375019
lea eax, [ebp - 0x40]
push 0x3f3750bc
push eax
call fcn.3f375019
lea eax, [ebp - 0x40]
push eax
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
push 0x3f394d68
push dword [ebp + 0x10]
call fcn.3f375019
push ebx
push dword [ebp + 0x10]
call fcn.3f375019
push dword [ebp + 0x10]
push edi
call esi
jmp 0x3f374fc7
push ebx
push dword [ebp + 0xc]
call fcn.3f375019
push dword [ebp + 0xc]
push edi
call esi
jmp 0x3f374fd1

Function at 0x3f375019
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
or edx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov ecx, edx
xor eax, eax
lea ebx, [ebp - 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0xc], 0
rep movsb byte es:[edi], byte [esi]
je 0x3f3750a2
mov edi, 0x3f375110
mov ecx, edx
xor eax, eax
lea ebx, [ebp - 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x80]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
mov ecx, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x80]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegDeleteKeyA]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 8
Function at 0x3f37529e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
or ebx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x3f37532a
mov edi, 0x3f375110
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x80]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp + 0xc]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
lea eax, [ebp - 0x80]
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x3f3c4ca5
cmp dword [ebp + 0x10], esi
jne 0x3f375366
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0x10]
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push dword [ebp + 0x10]
push 1
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
jmp 0x3f375354
xor al, al
jmp 0x3f37535f

Function at 0x3f37563a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x3f3c4cac
cmp dword [ebp + 0x10], esi
je 0x3f37568a
push edi
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
pop edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov al, 1
pop esi
pop ebp
ret 0xc
xor al, al
jmp 0x3f375695

Function at 0x3f3a779d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movsx eax, word [ebp + 8]
sub eax, 0
je 0x3f3a77b8
dec eax
jne 0x3f3a77c6
mov dword [ebp - 4], 0x23
jmp 0x3f3a77bf
mov dword [ebp - 4], 0x21
mov dword [ebp + 8], 2
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x3f3a77e5
or ax, 0xffff
jmp 0x3f3a77f2
push 0xa
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.3f11de15
leave
ret 4
Function at 0x3f3bedaf
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x615e0], 0
jne 0x3f3bee03
push 0x400
call fcn.3f246692
test eax, eax
pop ecx
mov dword [esi + 0x615e0], eax
jne 0x3f3bedd7
mov ecx, esi
call fcn.3f265261
xor eax, eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x3f3beded
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x3f3bedef
shr ecx, 1
dec edx
jne 0x3f3bedde
mov edx, dword [esi + 0x615e0]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, 0x100
jl 0x3f3bedd9
movsx eax, word [esp + 8]
mov ecx, dword [esi + 0x242e4]
shl eax, 7
mov ax, word [eax + ecx + 0x62]
mov ecx, esi
push eax
push 0xffffffffffffffff
call fcn.3f3bee4e
movsx ecx, word [esp + 0xc]
mov edx, dword [esi + 0x242e4]
shl ecx, 7
mov cx, word [ecx + edx + 0x62]
push ecx
push eax
mov ecx, esi
call fcn.3f3bee4e
push dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.3f3bee4e
not eax
pop esi
ret 0xc

Function at 0x3f3bee4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebp + 0xc]
call fcn.3f101357
mov esi, dword [ebp + 8]
mov edi, eax
push edi
call fcn.3f11cc9b
pop ecx
lea ecx, [eax + eax + 2]
xor eax, eax
test ecx, ecx
jle 0x3f3bee9b
mov edx, dword [ebx + 0x615e0]
mov dword [ebp + 0xc], edx
movzx edx, byte [eax + edi]
mov ebx, esi
and ebx, 0xff
xor edx, ebx
mov ebx, dword [ebp + 0xc]
shr esi, 8
mov edx, dword [ebx + edx*4]
xor esi, edx
inc eax
cmp eax, ecx
jl 0x3f3bee7d
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x3f3c2237
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 1
je 0x3f3c2281
lea eax, [ebp - 0x48]
push 0x40
push eax
push 0xa
push dword [0x3f3d5140]
call dword [sym.imp.USER32.DLL_LoadStringA]
test eax, eax
jle 0x3f3c22aa
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp - 0x48]
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
jne 0x3f3c22aa
mov ecx, edi
call fcn.3f36d517
mov esi, eax
cmp esi, 0xffffffff
je 0x3f3c22ae
push dword [ebp + 8]
mov ecx, edi
push esi
push 1
call fcn.3f3c22b7
test eax, eax
je 0x3f3c22aa
push esi
mov ecx, edi
call fcn.3f36d539
jmp 0x3f3c2288
xor eax, eax
jmp 0x3f3c22b1
push 1
pop eax
pop edi
pop esi
leave
ret 8

Function at 0x3f3c22b7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
push dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
call fcn.3f36d8ae
mov edi, eax
cmp edi, esi
je 0x3f3c2398
lea eax, [ebp - 0x8c]
push 0x80
push eax
push 0xc
push dword [0x3f3d5140]
call dword [sym.imp.USER32.DLL_LoadStringA]
test eax, eax
jle 0x3f3c2391
mov ecx, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
call fcn.3f36d5c3
mov ebx, eax
push esi
push esi
lea eax, [ebp - 0x110]
push 0x81
push eax
push ebx
call fcn.3f11cc9b
pop ecx
inc eax
push eax
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
lea eax, [ebp - 0x8c]
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
test eax, eax
pop ebx
jne 0x3f3c2391
lea eax, [ebp - 0x8c]
push 0x80
push eax
push 0xd
push dword [0x3f3d5140]
call dword [sym.imp.USER32.DLL_LoadStringA]
test eax, eax
jle 0x3f3c2391
lea eax, [ebp - 0x8c]
mov ecx, dword [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.3f3c4516
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc
Function at 0x3f3caa2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x3f3d7308
cmp edx, dword [eax]
je 0x3f3caa50
add eax, 8
inc ecx
cmp eax, 0x3f3d7398
jl 0x3f3caa41
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x3f3d7308]
jne 0x3f3cab7e
mov eax, dword [0x3f3d76c8]
cmp eax, 1
je 0x3f3cab58
test eax, eax
jne 0x3f3caa81
cmp dword [0x3f3d76cc], 1
je 0x3f3cab58
cmp edx, 0xfc
je 0x3f3cab7e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x3f3caab8
lea eax, [ebp - 0x1a4]
push 0x3f395124
push eax
call fcn.3f37459b
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.3f36bca5
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x3f3caafb
lea eax, [ebp - 0x1a4]
push eax
call fcn.3f36bca5
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x3f395120
push edi
call fcn.3f3cc64d
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x3f395104
push eax
call fcn.3f37459b
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.3f3cc4f3
lea eax, [ebp - 0xa0]
push 0x3f3950fe
push eax
call fcn.3f3cc4f3
push dword [esi + 0x3f3d730c]
lea eax, [ebp - 0xa0]
push eax
call fcn.3f3cc4f3
push 0x12010
lea eax, [ebp - 0xa0]
push 0x3f3950d8
push eax
call fcn.3f3ccb90
add esp, 0x2c
pop edi
jmp 0x3f3cab7e
lea eax, [ebp + 8]
lea esi, [esi + 0x3f3d730c]
push 0
push eax
push dword [esi]
call fcn.3f36bca5
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret
Function at 0x10003cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10003d05
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003d46
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10003d42
nop word [eax + eax]
cmp esi, edx
jae 0x10003d46
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10003d30
cmp esi, edx
jb 0x10003d4b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret