joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4248c6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4248d4
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x4249a8
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x475d78]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x475d78]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x475d78]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x475d78]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x475d78]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x475d78]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x475d78]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x475d78]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x4248f1
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4249c8
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x475d78]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x4249ae
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x4304f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x490540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
push 0x46f580
push eax
mov dword [edi + 0x390], 0
mov dword [edi + 0x394], 0
call fcn.00456bee
mov ebx, eax
add esp, 8
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x430546
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 8
push esi
push ebx
push 1
lea eax, [ebp - 0x20]
push 4
push eax
call fcn.00456dc8
mov esi, dword [ebp + 0xc]
push 0
lea eax, [esi*8 + 4]
push eax
push ebx
call fcn.00456f03
push ebx
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00456dc8
mov eax, dword [ebp - 0x10]
add esp, 0x2c
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
and eax, 0x7fffffff
mov dword [edi + 0x394], eax
lea eax, [esi + 1]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x20], eax
jne 0x4305b2
push 2
push 0
push ebx
call fcn.00456f03
push ebx
call fcn.00457316
mov ebx, eax
add esp, 0x10
sub ebx, dword [ebp - 0x1c]
jmp 0x4305b7
mov ebx, dword [ebp - 0xc]
sub ebx, ecx
push ebx
call fcn.00457753
mov esi, eax
add esp, 4
test esi, esi
je 0x430682
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00456f03
push dword [ebp - 0x18]
push 1
push ebx
push esi
call fcn.00456dc8
push dword [ebp - 0x18]
call fcn.00456ab3
push dword [edi + 0x394]
call fcn.00457753
add esp, 0x24
mov dword [edi + 0x390], eax
test eax, eax
jne 0x430621
push esi
call fcn.004565ce
add esp, 4
xor al, al
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 8
test dword [ebp - 0x24], 0x80000000
je 0x430658
push dword [edi + 0x394]
push esi
push eax
call fcn.004580b0
add esp, 0xc
push esi
call fcn.004565ce
add esp, 4
mov al, 1
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 8
push esi
mov ecx, edi
call fcn.00430920
test al, al
jne 0x43063a
push esi
call fcn.004565ce
push dword [edi + 0x390]
call fcn.004565ce
add esp, 8
mov dword [edi + 0x390], 0
mov ecx, dword [ebp - 4]
xor al, al
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00456922
mov esp, ebp
pop ebp
ret 8
Function at 0x4307d0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push eax
call esi
test eax, eax
jne 0x43081f
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
jne 0x43081f
push str.CSP_ERROR_
call fcn.0045755d
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x430852
push 0x46f6e0
call fcn.0045755d
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
mov ecx, edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x430860
push 0
sub ecx, esi
push ecx
push edx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x430893
push 0x46f700
call fcn.0045755d
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0xc]
push eax
push 0x800000
push dword [ebp - 8]
push 0x6801
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x4308ca
push 0x46f718
call fcn.0045755d
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 1
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4308fc
push 0x46f728
call fcn.0045755d
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4313a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x490540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
mov eax, dword [0x491b20]
add eax, 0x15be7fc
push eax
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.004576b2
lea eax, [ebp - 0x108]
push 0x46f580
push eax
call fcn.00456bee
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x431404
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
push esi
call fcn.00456f03
push esi
push 1
push dword [ebp + 0x10]
push edi
call fcn.00456dc8
push esi
call fcn.00456ab3
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc

Function at 0x431440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x490540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
mov eax, dword [0x491b20]
add eax, 0x15be7fc
push eax
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.004576b2
lea eax, [ebp - 0x108]
push 0x46f6a0
push eax
call fcn.00456bee
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4314a4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
push esi
push 1
push dword [ebp + 0x10]
push edi
call fcn.004574db
push esi
call fcn.00456ab3
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc

Function at 0x431730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x46f580
push dword [ebp + 8]
call fcn.00456bee
mov edi, eax
add esp, 8
test edi, edi
jne 0x431754
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
push edi
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.00456dc8
mov esi, dword [ebp + 0xc]
push 0
lea eax, [esi*4 + 4]
push eax
push edi
call fcn.00456f03
push edi
push 1
lea eax, [ebp - 8]
push 8
push eax
call fcn.00456dc8
lea eax, [esi + 1]
add esp, 0x2c
cmp dword [ebp + 8], eax
jne 0x4317a7
push 2
push 0
push edi
call fcn.00456f03
push edi
call fcn.00457316
add esp, 0x10
mov ebx, eax
jmp 0x4317aa
mov ebx, dword [ebp - 4]
sub ebx, dword [ebp - 8]
push ebx
call fcn.00457753
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push 0
mov dword [esi], eax
mov eax, dword [ebp - 8]
lea eax, [eax + ecx*4]
add eax, 4
push eax
push edi
call fcn.00456f03
push edi
push 1
push ebx
push dword [esi]
call fcn.00456dc8
push edi
call fcn.00456ab3
add esp, 0x24
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4317f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x46f580
push dword [ebp + 8]
call fcn.00456bee
mov edi, eax
add esp, 8
test edi, edi
jne 0x431814
pop edi
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.00456dc8
mov esi, dword [ebp + 0xc]
push 0
lea eax, [esi*4 + 4]
push eax
push edi
call fcn.00456f03
push edi
push 1
lea eax, [ebp - 8]
push 8
push eax
call fcn.00456dc8
lea eax, [esi + 1]
add esp, 0x2c
cmp dword [ebp + 8], eax
jne 0x431866
push 2
push 0
push edi
call fcn.00456f03
push edi
call fcn.00457316
add esp, 0x10
mov esi, eax
jmp 0x431869
mov esi, dword [ebp - 4]
sub esi, dword [ebp - 8]
push edi
call fcn.00456ab3
add esp, 4
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x431880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x46f580
push dword [ebp + 8]
call fcn.00456bee
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x43189f
pop ebx
pop ebp
ret 8
push esi
push edi
push 2
push 0
push ebx
call fcn.00456f03
push ebx
call fcn.00457316
mov edi, eax
push edi
call fcn.00457753
mov esi, dword [ebp + 0xc]
push 0
push 0
push ebx
mov dword [esi], eax
call fcn.00456f03
push ebx
push 1
push edi
push dword [esi]
call fcn.00456dc8
push ebx
call fcn.00456ab3
add esp, 0x34
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4397e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x490540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
mov eax, dword [0x491b20]
add eax, 0x15be7fc
push eax
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.004576b2
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.00456940
lea ecx, [ebp - 0x108]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439837
push 0x104
lea eax, [ebp - 0x310]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x108]
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4398ce
lea eax, [ebp - 0x310]
push eax
mov eax, dword [0x491b20]
add eax, 0x15bdffc
push str.File_open_failed_name_s
push eax
call fcn.0042fe70
mov eax, dword [0x491b20]
push 0
push str.Error
add eax, 0x15bdffc
push eax
push 0
call fcn.00439f60
add esp, 0x1c
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x344]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov esi, dword [ebp - 0x320]
cmp esi, 0x400000
jae 0x439916
cmp dword [ebx], 0
jne 0x4398ff
push esi
call fcn.00438b90
add esp, 4
mov dword [ebx], eax
test eax, eax
je 0x439916
push 0
lea eax, [ebp - 0x348]
push eax
push esi
push dword [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x439951
push esi
lea eax, [ebp - 0x108]
push eax
mov eax, dword [0x491b20]
add eax, 0x15bdffc
push str.File_read_failed_name_s_size_d
push eax
call fcn.0042fe70
mov eax, dword [0x491b20]
push 0
push str.Error
add eax, 0x15bdffc
push eax
push 0
call fcn.00439f60
add esp, 0x20
xor esi, esi
test edi, edi
je 0x43995c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00456922
mov esp, ebp
pop ebp
ret
Function at 0x443fd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x490540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], 0
cmp eax, 1
jne 0x444172
test edi, edi
jne 0x444020
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
test eax, eax
je 0x444035
push eax
call fcn.0045a1d0
add esp, 4
mov dword [esi], 0
push 0x10000
push 0
push edi
call dword [sym.imp.WINMM.dll_mmioOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x444130
push str.WAVE
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x44408c
push 0x470528
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x44408c
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x444074
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x444074
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x444074
push edi
call fcn.00457753
add esp, 4
mov dword [esi + 0x90], eax
test eax, eax
jne 0x4440f1
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
push edi
push ebx
push eax
call fcn.004580b0
push 0x48
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.00456940
mov eax, dword [esi + 0x90]
add esp, 0x18
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x48], 0x204d454d
mov dword [ebp - 0x38], edi
push 0x10000
push eax
push 0
call dword [sym.imp.WINMM.dll_mmioOpenW]
mov dword [esi + 4], eax
mov ecx, esi
call fcn.00444340
mov edi, eax
test edi, edi
jns 0x44415d
push 0
push dword [esi + 4]
call dword [sym.imp.WINMM.dll_mmioClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.004444a0
mov ecx, eax
test ecx, ecx
js 0x4441a6
mov eax, dword [esi + 0xc]
mov dword [esi + 0x30], eax
jmp 0x4441a6
push 0x11002
push 0
push edi
call dword [sym.imp.WINMM.dll_mmioOpenW]
mov dword [esi + 4], eax
test eax, eax
je 0x444074
push ebx
mov ecx, esi
call fcn.00444540
mov edi, eax
test edi, edi
js 0x44413d
mov ecx, esi
call fcn.004444a0
mov ecx, eax
test ecx, ecx
js 0x4441a8
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456922
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46a260
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x490540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00462ccc
mov dword [ebp - 0x14], eax
cmp dword [0x496064], esi
jne 0x46a353
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46a2e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46a433
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46a433
push 0x483cd4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46a433
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x496064], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x496068], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49606c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x496074], eax
test eax, eax
je 0x46a350
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x496070], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46a378
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46a36b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46a38d
push 4
pop eax
jmp 0x46a435
cmp dword [ebp - 0x14], esi
je 0x46a38d
push dword [0x496064]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46a372
mov eax, dword [0x496070]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46a3eb
cmp dword [0x496074], edi
je 0x46a3eb
push eax
call ebx
push dword [0x496074]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46a3eb
test eax, eax
je 0x46a3eb
call ecx
test eax, eax
je 0x46a3e0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46a3e0
test byte [ebp - 8], 1
jne 0x46a3eb
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46a41b
mov eax, dword [0x496068]
cmp eax, edi
je 0x46a418
push eax
call ebx
test eax, eax
je 0x46a418
call eax
mov esi, eax
test esi, esi
je 0x46a418
mov eax, dword [0x49606c]
cmp eax, edi
je 0x46a418
push eax
call ebx
test eax, eax
je 0x46a418
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x496064]
call ebx
test eax, eax
je 0x46a433
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46a435
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456922
mov esp, ebp
pop ebp
ret
Function at 0x100100e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10040d67
call fcn.1004053e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10010145
call fcn.1000d37a
mov esi, eax
jmp 0x10010228
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10010163
call fcn.1000d37a
jmp 0x1001021f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10010159
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x10010196
mov esi, 0x8007000e
jmp 0x10010221
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1003d6a0
mov dword [ebp - 4], 1
jmp 0x100101d5
cmp dword [ebp - 0x418], 0
je 0x1001018c
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10010159
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1003d6a0
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10010241
lea ecx, [ebp - 0x418]
call fcn.10010357
lea ecx, [ebp - 0x420]
call fcn.1000d2ec
mov eax, esi
call fcn.10040597
ret 0x10
Function at 0x1003d6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1003d6af
pop dword [ebp - 0x14]
mov eax, 0x1003d6af
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xab34618b
sub dword [ebp - 0x24], 0x5ce21c40
mov dword [ebp - 0x20], 0x4fbc0947
sub dword [ebp - 0x20], 0x1d88bd02
mov dword [ebp - 0x1c], 0xa3892410
sub dword [ebp - 0x1c], 0x573cdfe2
mov dword [ebp - 0x18], 0x3c98661e
add dword [ebp - 0x18], 0xc36799e2
lea eax, [ebp - 0x24]
push eax
mov eax, 0x5873806e
add eax, 0xb78c907a
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x2ed9a91a
add dword [ebp - 0x24], 0x4598c03c
mov dword [ebp - 0x20], 0xb8e25980
add dword [ebp - 0x20], 0x888a07f5
mov dword [ebp - 0x1c], 0xee9bc693
sub dword [ebp - 0x1c], 0x8b2c5a27
mov dword [ebp - 0x18], 0x1117d419
sub dword [ebp - 0x18], 0x1117d419
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xfb2cee4
sub eax, 0xffb2bdc0
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4229f
push 0
call eax
mov ecx, 0xfb18ce20
add ecx, 0x4e77f0e
xor esi, esi
add esi, eax
mov edx, 0x10051e00
add edx, dword [ebp - 0x14]
mov edi, 0x3f0de330
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x65cb4a4d
sub ebx, edi
xor dword [ebp - 8], 0x2cb4946d
mov dword [esi], ebx
add dword [ebp - 0xc], 0x669b94a3
add esi, 0xfd01f2dd
add esi, 0x2fe0d27
add edx, 0xdea3cd1f
sub edx, 0xdea3cd1b
loop 0x1003d7c2
add eax, 0x1278b
xor ebx, ebx
add ebx, eax
add eax, 0xef71714
sub eax, 0xef7170f
mov ecx, 0x910ba5ea
sub ecx, 0x810ba5ea
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x1003eed2
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x10043494
call fcn.1004049f
xor esi, esi
push 0x1004a9c4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.1003d6a0
mov dword [ebp - 4], esi
cmp dword [0x1004a9bc], esi
je 0x1003ef1a
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x1003ef8a
push 1
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.1003d6a0
test eax, eax
jns 0x1003ef32
push 8
pop edi
jmp 0x1003ef7c
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1003ef62
cmp edi, 2
jbe 0x1003ef43
cmp edi, 7
jne 0x1003ef62
push 1
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
call fcn.1003d6a0
mov esi, dword [ebp - 0x10]
test eax, eax
js 0x1003ef2d
mov eax, dword [ebp + 0x1c]
mov ecx, esi
shr eax, 1
jmp 0x1003ef68
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push eax
push ecx
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push dword [ebp - 0x14]
call fcn.1003d6a0
push esi
call fcn.1003d6a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100311d4
mov eax, edi
call fcn.10040577
ret 0x18