joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4527f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452977
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45296d
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45284c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45284c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45285f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x452942
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x452934
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x45292b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x4528b6
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x4528ff
mov eax, 1
cmp eax, ecx
ja 0x4528ed
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00462e50
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x452926
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x4528f2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x4528bb
call fcn.00462df0
xor eax, eax
mov ecx, eax
call fcn.00462de0
call fcn.00462e50
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x452968
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x452939
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x452864
call fcn.00462df0
xor eax, eax
mov ecx, eax
call fcn.00462de0
nop
call fcn.00461950
jmp fcn.004527f0
Function at 0x45a2b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a34f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00463007
lea ecx, [0x45a360]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00461840
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00461950
jmp fcn.0045a2b0
Function at 0x462c10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xbe8780]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4613db
je 0x46142e
cmp ebx, 0x20
jbe 0x461434
cmp ebx, 0x40
jbe 0x46147a
jmp 0x46151b
test ebx, ebx
je 0x461424
add eax, 0x10
test ax, 0xff0
je 0x461410
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xa581c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xa583c0]
jmp 0x4613f8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x4613f8
pxor xmm1, xmmword [0xbe8790]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xbe8790]
pxor xmm2, xmmword [0xbe87a0]
pxor xmm3, xmmword [0xbe87b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xbe8790]
pxor xmm2, xmmword [0xbe87a0]
pxor xmm3, xmmword [0xbe87b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46157a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xbe82bb], 0
je 0x462c2a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4613a0
jmp fcn.004081b0
Function at 0x1403700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0140378f
jae 0x140370e
xor ecx, ecx
call fcn.0140378f
jae 0x140373d
xor eax, eax
call fcn.0140378f
jae 0x140374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0140378f
adc al, al
jae 0x140372f
jne 0x1403779
stosb byte es:[edi], al
jmp 0x1403711
call fcn.0140379b
sub ecx, ebx
jne 0x1403756
call fcn.01403799
jmp 0x1403775
lodsb al, byte [esi]
shr eax, 1
je 0x1403783
adc ecx, ecx
jmp 0x1403772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01403799
cmp eax, 0x7d00
jae 0x1403772
cmp ah, 5
jae 0x1403773
cmp eax, 0x7f
ja 0x1403774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1403711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40145e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push esi
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 4], 0
jne reloc.gdi32.dll_SetWorldTransform
sub eax, eax
pop esi
leave
ret 0xc
mov eax, dword [ebp - 4]
add esi, eax
sub dword [ebp + 0x10], eax
jne reloc.gdi32.dll_SetWorldTransform
mov eax, 1
pop esi
leave
ret 0xc

Function at 0x401963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
push esi
push edi
push dword [ebp + 8]
pop ebx
mov al, byte [ebx]
mov byte [ebp - 3], al
mov al, byte [ebx + 1]
mov byte [ebp - 4], al
mov edi, ebx
inc edi
inc edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
jecxz reloc.gdi32.dll_SetWorldTransform
inc byte [ebp - 3]
movzx eax, byte [ebp - 3]
movzx edx, byte [eax + edi]
mov byte [ebp - 1], dl
add byte [ebp - 4], dl
movzx eax, byte [ebp - 4]
mov dl, byte [eax + edi]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 3]
mov byte [eax + edi], dl
movzx eax, byte [ebp - 4]
mov dl, byte [ebp - 1]
mov byte [eax + edi], dl
mov dl, byte [ebp - 1]
add dl, byte [ebp - 2]
mov dl, byte [edx + edi]
mov eax, dword [ebp - 8]
xor byte [eax + esi], dl
inc dword [ebp - 8]
loop reloc.gdi32.dll_SetWorldTransform
mov al, byte [ebp - 3]
mov byte [ebx], al
mov al, byte [ebp - 4]
mov byte [ebx + 1], al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401c46
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push edi
mov eax, dword [ebp + 0x14]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [eax], 0
sub edi, edi
cmp dword [ebp + 0x18], 1
jne reloc.gdi32.dll_SetWorldTransform
mov edx, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 0x18], 2
jne reloc.gdi32.dll_SetWorldTransform
mov edx, reloc.gdi32.dll_CancelDC
jmp reloc.gdi32.dll_SetWorldTransform
sub edx, edx
or edx, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push edx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 8], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0xc], 1
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 8], 1
je reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.00401888
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push edi
call fcn.00401871
sub edi, edi
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x14]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
pop dword [eax]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 0x18], 2
jae reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x18]

Function at 0x401d7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
inc ebp
or bh, dh
ror byte [ebx + reloc.gdi32.dll_SetWorldTransform], 1
adc byte [ebx], cl
leave
je reloc.gdi32.dll_SetWorldTransform
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
invalid
invalid

Function at 0x401f38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
mov eax, 0
leave
ret 4
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
test eax, 0x10
setne al
movzx eax, al
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, 0
leave
ret 4
Function at 0x401f73
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push eax
push eax
call fcn.00401888
mov dword [ebp - 4], eax
pop eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call fcn.00401871
sub eax, eax
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x401fb7
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push reloc.wsock32.dll_WSAIsBlocking
push ebx
call fcn.0040189f
push 0
push 0
push 3
push 0
push 3
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebx], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
dec eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebx]
call sub.kernel32.dll_CreateFileMappingA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebx + 4], eax
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx + 8], eax
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebx + 4]
call sub.kernel32.dll_CloseHandle
push dword [ebx]
call sub.kernel32.dll_CloseHandle
mov dword [ebx], 0xffffffff
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebx]
call sub.kernel32.dll_CloseHandle
mov dword [ebx], 0xffffffff
sub eax, eax
cmp dword [ebx + 8], eax
setne al
pop ebx
leave
ret 8
Function at 0x4026a7
Capabilities:
Create directory
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
sub ebx, ebx
lea eax, [ebp - 4]
push eax
push reloc.shlwapi.dll_ChrCmpIA
push dword [reloc.wsock32.dll_WSACleanup]
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
inc ebx
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
and ebx, ebx
jne reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x10d]
push eax
push reloc.gdi32.dll_AbortPath
call sub.kernel32.dll_GetTempPathA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp eax, reloc.gdi32.dll_AbortPath
ja reloc.gdi32.dll_SetWorldTransform
push 0
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_CreateDirectoryA
lea eax, [ebp - 0x10d]
push eax
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
lea eax, [ebp - 0x10d]
push eax
call fcn.00401db1
push dword [ebp + 8]
push eax
call fcn.00401e05
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
lea eax, [ebp - 0x10d]
push eax
call fcn.00401db1
mov dword [ebp - 0x114], eax
push 0
push 0
push 2
push 0
push 3
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0040145e
mov ebx, eax
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
and ebx, ebx
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_DeleteFileA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x4027c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push reloc.shlwapi.dll_ChrCmpIA
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
sub ebx, ebx
lea eax, [ebp - 0x111]
push eax
push reloc.gdi32.dll_AbortPath
call sub.kernel32.dll_GetTempPathA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp eax, reloc.gdi32.dll_AbortPath
ja reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
call fcn.00401000
lea eax, [ebp - 0x111]
push eax
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
lea eax, [ebp - 0x111]
push eax
call fcn.00401db1
push dword [ebp + 8]
push eax
call fcn.00401e05
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
lea eax, [ebp - 0x111]
push eax
call fcn.00401db1
push eax
push dword [ebp - 4]
push eax
call fcn.00401230
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call fcn.00401091
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0xc]
call sub.kernel32.dll_GlobalLock
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp - 8]
call fcn.00401888
mov ebx, eax
pop eax
push dword [ebp - 8]
push ebx
push eax
call fcn.004018bf
push dword [ebp - 0xc]
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp + 0xc]
push dword [ebp - 8]
pop dword [eax]
call fcn.00401871
push dword [ebp - 4]
call fcn.00401026
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x402cd8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
xor edx, eax
xor eax, edx
xor edx, eax
push reloc.shlwapi.dll_StrFormatKBSizeW
nop
clc
nop
jb reloc.gdi32.dll_SetWorldTransform
nop
ret
inc byte [ebx + reloc.gdi32.dll_SetWorldTransform]
add byte [eax], al
je reloc.gdi32.dll_SetWorldTransform
cmp dword [0x4153bf], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [0x4153f7], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [0x4153fb], 0
jne reloc.gdi32.dll_SetWorldTransform
sub eax, eax
pop ebx
leave
ret 4
sub ebx, ebx
call dword [0x4153bb]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_Process32First
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsPrefixW
lea eax, [ebp - 0x110]
push eax
call sub.shlwapi.dll_StrStrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call dword [0x4153bf]
mov edx, dword [ebp - 0x13c]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp edx, dword [ebp - 0xc]
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push 0
push reloc.gdi32.dll_SetWorldTransform
call sub.kernel32.dll_OpenProcess
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
call dword [0x4153f7]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call dword [0x4153fb]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
inc ebx
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x140]
push eax
push reloc.gdi32.dll_SetWorldTransform
call sub.advapi32.dll_RegOpenCurrentUser
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x140], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
pop dword [reloc.gdi32.dll_SetWorldTransform]
mov eax, dword [ebp + 8]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
pop dword [eax]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x134]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_Process32Next
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x402e7e
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push eax
push ebx
push ecx
push edx
push edi
push esi
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x80]
lea edx, [eax*8]
mov ebx, eax
mov ecx, eax
shr eax, 6
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
add edi, ecx
mov byte [edi], reloc.shlwapi.dll_StrCSpnW
and ebx, 0x3f
sub edi, ebx
cmp ebx, 0x38
jb reloc.gdi32.dll_SetWorldTransform
add edi, ebx
mov eax, reloc.shlwapi.dll_PathStripPathA
sub eax, ebx
add edi, eax
inc dword [ebp - 0x14]
mov dword [edi + 0x38], edx
lea esi, [ebp - 0x10]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
push dword [ebp - 0x14]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402f09
cld
mov ecx, 4
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0xc

Function at 0x40351c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push edi
push esi
push ebx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
pop dword [ebp - 8]
mov dword [0x41a000], 0x67452301
mov dword [0x41a004], 0xefcdab89
mov dword [0x41a008], 0x98badcfe
mov dword [0x41a00c], 0x10325476
mov dword [0x41a010], 0xc3d2e1f0
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push reloc.shlwapi.dll_PathStripPathA
push 0x41a014
push eax
call fcn.004018bf
add dword [ebp - 4], 0x40
call fcn.0040364e
sub dword [ebp - 8], 0x40
jae reloc.gdi32.dll_SetWorldTransform
mov ebx, dword [ebp - 8]
add ebx, 0x40
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push ebx
push 0x41a014
push eax
call fcn.004018bf
add dword [ebp - 4], ebx
mov byte [ebx + 0x41a014], 0x80
sub ebx, 0x37
jbe reloc.gdi32.dll_SetWorldTransform
sub ebx, 8
je reloc.gdi32.dll_SetWorldTransform
and byte [ebx + 0x41a054], 0
inc ebx
js reloc.gdi32.dll_SetWorldTransform
call fcn.0040364e
mov ebx, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
and byte [ebx + 0x41a04c], 0
inc ebx
js reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0xc]
mov ecx, 8
xor edx, edx
mul ecx
bswap eax
bswap edx
mov dword [0x41a050], eax
mov dword [0x41a04c], edx
call fcn.0040364e
mov eax, dword [0x41a000]
mov edx, dword [0x41a004]
mov ecx, dword [0x41a008]
bswap eax
bswap edx
bswap ecx
mov dword [0x41a000], eax
mov dword [0x41a004], edx
mov dword [0x41a008], ecx
mov eax, dword [0x41a00c]
mov edx, dword [0x41a010]
bswap eax
bswap edx
mov dword [0x41a00c], eax
mov dword [0x41a010], edx
push reloc.opengl32.dll_glDrawBuffer
push dword [ebp + 0x10]
push 0x41a000
call fcn.004018bf
pop ebx
pop esi
pop edi
leave
ret 0xc