joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5de620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613582
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6963c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004d6d20
mov dword [edi], vtable.CSkyObject.0
xorps xmm0, xmm0
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00569c41
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
xorps xmm0, xmm0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
movups xmmword [edi + 0x1d8], xmm0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.004e4c00
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x6e79d0]
call fcn.004c35a0
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e47c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5e47ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5e47ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5e5ee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x5e5ef0
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x5e5ef9
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x5e5f0c
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x5e5f15
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x5e5f82
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x5e5f30
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5e5fa0
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x5e5faa
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x5e5fbb
xor edi, dword [edx]
test esi, esi
je 0x5e5fc1
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x5e5fd7
xor edx, dword [ecx]
test esi, esi
je 0x5e5fdd
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x5e5ff0
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x5e5ff6
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x1001c139
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x1001c1cb
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c1ad
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1001c1c9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001c1c9
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1001c220
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x38]
push 0x378d
push dword [ebp - 0x3c]
push 0x66a7
push 0x6622
push dword [ebp - 0x40]
push 0
push dword [ebp - 0x44]
push 0x1f6f
push dword [ebp - 0x48]
push 0x742d
push 0x1e07
call fcn.1000d1e1
add esp, 0x30
mov esp, ebp
pop ebp
ret

Function at 0x1001d538
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001d5b7
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d56a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1001d5b5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d598
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001d5b5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000b0d9
mov dword [eax], 0xffff
jmp 0x1001d58d
jmp 0x1001d5d3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x24]
call fcn.1000d9e9
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10025361
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100253ee
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100253a1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002539f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x100253ec
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100253cf
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x100253ec
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000b0d9
mov dword [eax], 1
jmp 0x100253c4
jmp 0x1002541a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 0x1b4f
push 0x7268
push 0x6ae9
push 0x9b4
push 1
push dword [ebp - 0x24]
push 0x34c1
call fcn.10024daa
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x10069785
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10073750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005b1c8
mov dword [ebp - 0x14], eax
cmp dword [0x10660558], esi
jne 0x10069878
push 0x800
push esi
push 0x10007718
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10069805
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10069958
push esi
push esi
push 0x10007718
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10069958
push 0x10007730
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10069958
push eax
call ebx
push 0x1000773c
push edi
mov dword [0x10660558], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000774c
push edi
mov dword [0x1066055c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007760
push edi
mov dword [0x10660560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10660568], eax
test eax, eax
je 0x10069875
push 0x1000777c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10660564], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006989d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10069890
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100698b2
push 4
pop eax
jmp 0x1006995a
cmp dword [ebp - 0x14], esi
je 0x100698b2
push dword [0x10660558]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10069897
mov eax, dword [0x10660564]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10069910
cmp dword [0x10660568], edi
je 0x10069910
push eax
call ebx
push dword [0x10660568]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10069910
test eax, eax
je 0x10069910
call ecx
test eax, eax
je 0x10069905
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10069905
test byte [ebp - 8], 1
jne 0x10069910
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10069940
mov eax, dword [0x1066055c]
cmp eax, edi
je 0x1006993d
push eax
call ebx
test eax, eax
je 0x1006993d
call eax
mov esi, eax
test esi, esi
je 0x1006993d
mov eax, dword [0x10660560]
cmp eax, edi
je 0x1006993d
push eax
call ebx
test eax, eax
je 0x1006993d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10660558]
call ebx
test eax, eax
je 0x10069958
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006995a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100582e0
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x557a4ddd
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x131b2655
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1005387
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10020fc
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10053df
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1002138
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10053d2
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10053e1
xor eax, eax
pop esi
leave
ret 4

Function at 0x100886d
Capabilities:
Get number of processors

Disassembly:
push 0xc1f70e72
call fcn.0100f0e5
push esi
mov edx, dword fs:[0x30]
test edx, edx
js 0x10088b4
cld
sub eax, esi
nop
push ebx
mov edx, dword [edx + 0xc]
mov ebx, dword [edx + 0x1c]
push 1
mov ebx, dword [ebx + 8]
push 0x116ccc7e
call fcn.0100f0e5
mov edx, esp
push 4
push edx
push 0x15
push 0xffffffffffffffff
call fcn.0100f0e1
jmp 0x10088b0
add esp, 4
pop ebx
pop edi
call edi
call fcn.01008846
cmp dword [ebp + 0x6730], 0x1ff
jle 0x10088fe
wait
not edi
nop
sub esi, dword [esp + 0x28]
jbe 0x10088fe
mov edi, esi
nop
nop
sub eax, dword [esp + 0x30]
lea ecx, [esp + 1]
sbb edx, dword [ecx + 0x2b]
idiv esi
sub eax, 0x1e3da
sub eax, 0x986b88
sbb eax, eax
push 0xfffffffffffffff4
imul edx, eax, 0xcfa924b3
sbb byte [ebp - 0x67], dh
pop edi
lea edi, [edi + 0x64]
push dword [ebp + 0x676f]
add edi, ebp
pop edx
ret

Function at 0x1013262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0101326e

Function at 0x10138e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.010138fa

Function at 0x1013961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.01013974

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4069cb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069ef
xor eax, eax
test eax, eax
je 0x406a02
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a02
xor ecx, ecx
jmp 0x406a05
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a662c], 0
push esi
jne 0x406b5f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b39
mov dword [ecx*4 + 0x7a6628], eax
inc ecx
cmp ecx, 0x100
jl 0x406b34
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b90
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a6628]
xor eax, esi
inc ecx
dec edx
jne 0x406b72
pop edi
not eax
pop esi
ret 0xc

Function at 0x4283e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42849c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428497
mov ecx, dword [ebp - 8]
push ecx
call fcn.00428990
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428456
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428456
xor eax, eax
jmp 0x42849c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283ef
mov esp, ebp
pop ebp
ret
Function at 0x40249e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
mov eax, dword [0x48b068]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
mov ebx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
push esi
or eax, 0x2001f
mov dword [esp + 0x1c], ecx
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x18]
call fcn.00402442
jmp 0x4024f6
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0040249e
mov esi, eax
test esi, esi
jne 0x40254a
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4024e8
cmp dword [esp + 0xc], esi
je 0x402539
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.0040234f
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x40255b
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00439dc4
mov esp, ebp
pop ebp
ret 4
Function at 0x405935
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x824
mov eax, dword [0x48b068]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
mov ebx, dword [esp + 0x82c]
xor eax, eax
push ebp
push esi
mov esi, dword [esp + 0x838]
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0x28], al
mov dword [edi], eax
call fcn.00410fb7
mov ebp, eax
mov dword [edi], ebp
test ebp, ebp
jne 0x405988
mov ecx, str.ERROR:_ShutdownEvent_handle_is_NULL
call fcn.0041774e
mov ecx, esi
call fcn.004107df
test eax, eax
jne 0x4059a1
mov ecx, str.jusched_ERROR:_Could_not_open_Policy_key_for_reading
call fcn.0041774e
push 0xfffffffffffffffd
jmp 0x4059c5
mov ecx, dword [esi]
call fcn.004058b8
xor ecx, ecx
mov dword [edi + 4], eax
push 0xfffffffffffffffe
test ebp, ebp
pop esi
cmovne esi, ecx
test eax, eax
jne 0x4059c6
mov ecx, str.jusched_main:_ERROR_creating_registry_watch_event_notifier
call fcn.0041774e
push 0xfffffffffffffffe
pop esi
push str.SunJavaUpdateSchedulerMutex
xor ebp, ebp
push 1
push ebp
mov dword [ebx], ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebx], eax
test eax, eax
jne 0x405a31
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x800
mov esi, eax
lea eax, [esp + 0x34]
push ebp
push eax
call fcn.0043c350
add esp, 0xc
lea eax, [esp + 0x30]
cmp esi, 0xb7
jne 0x405a15
push str.Error:_Scheduler_Mutex_already_exists_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0x405a25
push esi
push str.Error:_Error_creating_scheduler_mutex:__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.0041774e
or esi, 0xffffffff
test esi, esi
je 0x405a52
push dword [ebx]
mov ecx, edi
call fcn.00405906
pop ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x14]
call fcn.00417295
mov ecx, dword [esp + 0x830]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439dc4
add esp, 0x824
ret