joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3cebe34
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov eax, dword [edx]
mov ebx, dword [edx + 4]
bswap eax
bswap ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0xc]
bswap eax
bswap ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
bswap eax
bswap ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [edx + 0x18]
mov ebx, dword [edx + 0x1c]
bswap eax
bswap ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 0x24]
bswap eax
bswap ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
bswap eax
bswap ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov eax, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
bswap eax
bswap ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov eax, dword [edx + 0x38]
mov ebx, dword [edx + 0x3c]
bswap eax
bswap ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
lea esi, [esi + 0x40]
mov ecx, 0x30
mov eax, dword [esi - 8]
mov edi, dword [esi - 0x1c]
mov edx, eax
mov ebx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x3cebebf
pop ebx
pop edi
pop esi
ret
Function at 0x3cebf00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x20]
lea eax, [ebp - 0x120]
call fcn.03cebe34
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov edx, eax
mov ebx, eax
ror eax, 6
ror edx, 0xb
ror ecx, 0x19
xor eax, edx
mov edx, dword [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, edx
mov dword [ebp - 0xc], ebx
and eax, ebx
xor eax, edx
add eax, dword [edi*4 + 0x3e215cc]
add eax, ecx
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp + edi*4 - 0x120]
mov ebx, dword [ebp - 0x20]
add ecx, eax
mov esi, eax
mov dword [ebp - 0x10], ecx
mov eax, ebx
mov edx, ebx
ror eax, 2
mov ecx, ebx
ror edx, 0xd
ror ecx, 0x16
xor eax, edx
xor eax, ecx
mov ecx, dword [ebp - 0x1c]
add esi, eax
mov eax, ebx
mov edx, ebx
or eax, ecx
and eax, dword [ebp - 0x18]
and edx, ecx
or eax, edx
inc edi
add esi, eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp edi, 0x40
jne 0x3cebf4e
pop edi
pop esi
pop ebx
mov eax, dword [esi]
add dword [ebx], eax
mov eax, dword [esi + 4]
add dword [ebx + 4], eax
mov eax, dword [esi + 8]
add dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
add dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
add dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
add dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
add dword [ebx + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3cec0e0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov ebx, dword [0x3e4d43c]
mov ebx, dword [ebx]
add eax, 0x20
xor ecx, ecx
mov edx, 0x4c
call ebx
pop ebx
ret
Function at 0x3cec760
Capabilities:
Hash data using sha224

Disassembly:
push ebx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
xor edx, edx
mov dword [eax + 0xc8], edx
mov ebx, dword [0x3e4d43c]
mov ebx, dword [ebx]
add eax, 0x48
xor ecx, ecx
mov edx, 0x80
call ebx
pop ebx
ret

Function at 0x3cec984
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
xor edx, edx
mov dword [eax + 0xc8], edx
mov ebx, dword [0x3e4d43c]
mov ebx, dword [ebx]
add eax, 0x48
xor ecx, ecx
mov edx, 0x80
call ebx
pop ebx
ret

Function at 0x3cecf68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff10
mov esi, eax
mov edi, 0x18
mov ebx, 0x3e21950
lea ecx, [esp + 0xc8]
mov eax, esp
mov edx, esi
call fcn.03cecab4
mov eax, dword [esi]
mov edx, dword [esi + 4]
xor eax, dword [ebx]
xor edx, dword [ebx + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
add ebx, 8
dec edi
jne 0x3cecf7d
emms
add esp, 0xf0
pop edi
pop esi
pop ebx
ret

Function at 0x3ced160
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ecx, eax
lea ebx, [eax + 0xc8]
mov edx, dword [eax + 0x18c]
shr edx, 5
mov esi, edx
dec esi
test esi, esi
jl 0x3ced188
inc esi
xor edx, edx
mov edi, dword [ebx + edx*4]
xor dword [ecx + edx*4], edi
inc edx
dec esi
jne 0x3ced17e
call fcn.03cecf68
pop edi
pop esi
pop ebx
ret
Function at 0x3ced194
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
test byte [esi + 0x194], 7
je 0x3ced1c2
mov ecx, 0x3cec7b4
mov dl, 1
mov eax, dword [0x3ce9664]
call fcn.03a8cc0c
call fcn.03a6a818
cmp byte [esi + 0x189], 0
je 0x3ced1e1
mov ecx, 0x3cec828
mov dl, 1
mov eax, dword [0x3ce9664]
call fcn.03a8cc0c
call fcn.03a6a818
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
jge 0x3ced39f
cmp dword [esi + 0x194], 0
jne 0x3ced2af
mov eax, dword [esi + 0x18c]
cmp eax, dword [esp + 4]
jg 0x3ced2af
mov eax, dword [esp + 4]
sub eax, dword [esi + 0x18c]
cmp eax, dword [esp + 8]
jl 0x3ced2af
mov eax, dword [esp + 4]
sub eax, dword [esp + 8]
cdq
idiv dword [esi + 0x18c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
shr eax, 3
mov edx, dword [esp]
lea edi, [edx + eax]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x3ced29c
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
mov eax, dword [esi + 0x18c]
shr eax, 5
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
dec eax
test eax, eax
jl 0x3ced284
inc eax
mov dword [esp + 0x28], eax
xor ebx, ebx
mov eax, dword [edi + ebx*4]
mov edx, dword [esp + 0x20]
xor dword [edx + ebx*4], eax
inc ebx
dec dword [esp + 0x28]
jne 0x3ced273
mov eax, esi
call fcn.03cecf68
mov eax, dword [esi + 0x18c]
shr eax, 3
add edi, eax
dec dword [esp + 0x1c]
jne 0x3ced252
mov eax, dword [esi + 0x18c]
imul dword [esp + 0x10]
add dword [esp + 8], eax
jmp 0x3ced391
mov eax, dword [esp + 4]
sub eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18c]
mov edx, dword [esi + 0x194]
add edx, dword [esp + 0x14]
cmp eax, edx
jge 0x3ced2df
mov eax, dword [esi + 0x18c]
sub eax, dword [esi + 0x194]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
and eax, 7
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov eax, dword [esi + 0x194]
shr eax, 3
lea edx, [esi + eax + 0xc8]
mov eax, dword [esp + 8]
shr eax, 3
mov ecx, dword [esp]
lea eax, [ecx + eax]
mov ebx, dword [0x3e4d1dc]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x14]
shr ecx, 3
call ebx
mov eax, dword [esp + 0x14]
add dword [esi + 0x194], eax
mov eax, dword [esp + 0x14]
add dword [esp + 8], eax
mov eax, dword [esi + 0x194]
cmp eax, dword [esi + 0x18c]
jne 0x3ced34f
mov eax, esi
call fcn.03ced160
xor eax, eax
mov dword [esi + 0x194], eax
cmp dword [esp + 0x18], 0
jle 0x3ced391
mov ecx, dword [esp + 0x18]
mov eax, 1
shl eax, cl
dec eax
mov edx, dword [esp + 8]
shr edx, 3
mov ecx, dword [esp]
and al, byte [ecx + edx]
mov edx, dword [esi + 0x194]
shr edx, 3
mov byte [esi + edx + 0xc8], al
mov eax, dword [esp + 0x18]
add dword [esi + 0x194], eax
mov eax, dword [esp + 0x18]
add dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
jl 0x3ced1f5
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x3ced9d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe10
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.03ced8f0
mov eax, dword [ebp - 4]
push esi
mov esi, eax
lea edi, [ebp - 0x1b0]
mov ecx, 0x69
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, ebx
test eax, eax
je 0x3ceda16
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0x1b0]
mov ecx, eax
mov eax, ebx
xchg edx, eax
call fcn.03ced904
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1a0], 4
jae 0x3ceda53
mov eax, 0x3cecf58
test eax, eax
je 0x3ceda40
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 0x1b0]
mov ecx, eax
mov eax, 0x3cecf6c
xchg edx, eax
call fcn.03ced904
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x1b0]
mov cl, 1
call fcn.03ced964
cmp esi, 2
jl 0x3cedb40
mov eax, dword [ebp + 8]
push esi
mov esi, eax
lea edi, [ebp - 0x1f0]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop esi
sub esi, 2
jl 0x3cedb0a
inc esi
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 4]
mov esi, eax
lea edi, [ebp - 0x1b0]
mov ecx, 0x69
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x19c]
lea edx, [ebp - 0x1f0]
lea eax, [ebp - 0x1b0]
call fcn.03ced904
lea edx, [ebp - 0x1f0]
lea eax, [ebp - 0x1b0]
mov cl, 1
call fcn.03ced964
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1f0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19c]
cmp eax, 4
jl 0x3cedaf5
sub eax, 4
mov ebx, dword [ecx]
xor dword [edx], ebx
add edx, 4
add ecx, 4
cmp eax, 4
jge 0x3cedae3
test eax, eax
jle 0x3cedb05
dec eax
movzx ebx, byte [ecx + eax]
xor byte [edx + eax], bl
test eax, eax
jg 0x3cedaf9
dec dword [ebp - 0xc]
jne 0x3ceda8d
lea eax, [ebp - 0x1f0]
call fcn.03cd3bac
mov ebx, dword [0x3e4d43c]
mov ebx, dword [ebx]
lea eax, [ebp - 0x1b0]
xor ecx, ecx
mov edx, 0x19c
call ebx
mov ebx, dword [0x3e4d43c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x19c
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3cef000
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov ebx, dword [0x3e4d43c]
mov ebx, dword [ebx]
add eax, 0x20
xor ecx, ecx
mov edx, 0x4c
call ebx
pop ebx
ret
Function at 0x3d8bc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp eax, 0x80
jge 0x3d8bc43
cmp eax, 0x41
jl 0x3d8bd02
cmp eax, 0x5a
jg 0x3d8bd02
add eax, 0x20
mov dword [ebp - 4], eax
jmp 0x3d8bd02
cmp eax, 0x10000
jge 0x3d8bcee
mov ecx, 0xa2
xor ebx, ebx
mov dword [ebp - 8], 0xffffffff
cmp ebx, ecx
jg 0x3d8bc8b
lea edx, [ebx + ecx]
sar edx, 1
jns 0x3d8bc6a
adc edx, 0
movzx esi, word [edx*4 + 0x3e28d26]
push esi
mov esi, eax
pop edi
sub esi, edi
test esi, esi
jl 0x3d8bc84
mov dword [ebp - 8], edx
lea ebx, [edx + 1]
jmp 0x3d8bc87
lea ecx, [edx - 1]
cmp ebx, ecx
jle 0x3d8bc60
mov edx, dword [ebp - 8]
shl edx, 2
add edx, 0x3e28d26
movzx ecx, word [edx]
mov ebx, ecx
movzx esi, byte [edx + 3]
add ebx, esi
cmp eax, ebx
jge 0x3d8bccc
xor ebx, ebx
mov bl, byte [edx + 2]
and ebx, 1
xor ecx, eax
and ebx, ecx
jne 0x3d8bccc
movzx edx, byte [edx + 2]
sar edx, 1
movzx ecx, word [edx*2 + 0x3e28fb2]
add eax, ecx
and eax, 0xffff
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x3d8bd02
cmp dword [ebp + 0xc], 2
sete al
and eax, 1
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.03d8bb08
add esp, 8
mov dword [ebp - 4], eax
jmp 0x3d8bd02
cmp eax, 0x10400
jl 0x3d8bd02
cmp eax, 0x10428
jge 0x3d8bd02
add eax, 0x28
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x3d953bc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [0x3e29584]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [0x3e29588]
mov dword [ebp - 4], eax
cmp dword [ebx + edi*4 + 0x18], 0
jne 0x3d953fe
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
push ecx
mov ecx, dword [ebp + edi*4 - 8]
push ecx
push ebx
call fcn.03d9520c
add esp, 0x10
mov dword [ebx + edi*4 + 0x18], eax
cmp dword [ebx + 0x28], 0
jne 0x3d954bd
mov esi, dword [ebx + edi*4 + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push esi
call fcn.03d1f41c
add esp, 0x10
push esi
call fcn.03d1e87c
pop ecx
cmp eax, 0x65
jne 0x3d95456
test edi, edi
je 0x3d95434
mov edx, 0x3e34c2f
jmp 0x3d95439
mov edx, str.SELECT_idx_FROM__Q._q_segdir_WHERE_level__ORDER_BY_1_ASC
push edx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x3e34c02
push ebx
call fcn.03d95268
add esp, 0x1c
jmp 0x3d954b3
cmp eax, 0x64
jne 0x3d954b3
push 0
push esi
call fcn.03d1ee68
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x1c]
jne 0x3d9547a
cmp eax, dword [ebp + 0x18]
je 0x3d954b3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
test edi, edi
je 0x3d95493
mov edx, 0x3e34c2f
jmp 0x3d95498
mov edx, str.SELECT_idx_FROM__Q._q_segdir_WHERE_level__ORDER_BY_1_ASC
push edx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x3e34c40
push ebx
call fcn.03d95268
add esp, 0x2c
push esi
push ebx
call fcn.03d951ec
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3d9e008
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp + 0x10]
cmp ebx, ecx
jle 0x3d9e02e
mov esi, eax
inc ecx
shl esi, 3
xor eax, esi
movzx esi, byte [edx]
inc edx
xor eax, esi
cmp ebx, ecx
jg 0x3d9e01c
pop esi
pop ebx
pop ebp
ret
Function at 0x3da7000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
cmp dword [ebp + 8], 0
je 0x3da70dc
lea eax, [edi - 1]
mov edx, dword [ebp + 0x10]
add edx, eax
test eax, eax
mov esi, 0xd
jl 0x3da7043
mov ecx, esi
shl ecx, 3
xor esi, ecx
movsx ecx, byte [edx]
xor esi, ecx
dec eax
dec edx
test eax, eax
jge 0x3da7031
mov eax, esi
shl eax, 3
xor esi, eax
xor esi, dword [ebp + 0xc]
and esi, 0x1ff
mov edx, dword [ebp + 8]
mov ebx, dword [edx + esi*4]
test ebx, ebx
je 0x3da7090
mov eax, dword [ebx + 8]
cmp eax, dword [ebp + 0xc]
jne 0x3da7089
cmp edi, dword [ebx + 4]
jne 0x3da7089
push edi
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebx]
push ecx
call fcn.03cf57f0
add esp, 0xc
test eax, eax
jne 0x3da7089
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
jmp 0x3da7090
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x3da705d
test ebx, ebx
jne 0x3da70dc
mov eax, edi
add eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 4]
push eax
call fcn.03da6ef8
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x3da70dc
lea eax, [ebx + 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], edi
mov edx, dword [ebp + 0xc]
mov dword [ebx + 8], edx
push edi
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebx]
push ecx
call fcn.03cf5764
add esp, 0xc
mov eax, dword [ebp + 8]
mov edx, dword [eax + esi*4]
mov dword [ebx + 0xc], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + esi*4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x3dab8d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, 0xd
mov eax, dword [ebp + 0x10]
dec eax
mov edx, dword [ebp + 0xc]
add edx, eax
test eax, eax
jl 0x3dab901
mov ebx, ecx
shl ebx, 3
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx]
xor ecx, ebx
dec eax
dec edx
test eax, eax
jge 0x3dab8ee
mov eax, ecx
xor edx, edx
div dword [ebp + 8]
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x3dab910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, 0xd
mov eax, dword [ebp + 0x14]
dec eax
mov edx, dword [ebp + 0x10]
add edx, eax
test eax, eax
jl 0x3dab939
mov ebx, ecx
shl ebx, 3
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx]
xor ecx, ebx
dec eax
dec edx
test eax, eax
jge 0x3dab926
mov eax, ecx
xor edx, edx
shl eax, 3
mov dl, byte [ebp + 0xc]
xor ecx, eax
xor ecx, edx
xor edx, edx
mov eax, ecx
div dword [ebp + 8]
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x3dbc5ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp eax, 0x80
jge 0x3dbc5df
cmp eax, 0x41
jl 0x3dbc69e
cmp eax, 0x5a
jg 0x3dbc69e
add eax, 0x20
mov dword [ebp - 4], eax
jmp 0x3dbc69e
cmp eax, 0x10000
jge 0x3dbc68a
mov ecx, 0xa2
xor ebx, ebx
mov dword [ebp - 8], 0xffffffff
cmp ebx, ecx
jg 0x3dbc627
lea edx, [ebx + ecx]
sar edx, 1
jns 0x3dbc606
adc edx, 0
movzx esi, word [edx*4 + 0x3e29d66]
push esi
mov esi, eax
pop edi
sub esi, edi
test esi, esi
jl 0x3dbc620
mov dword [ebp - 8], edx
lea ebx, [edx + 1]
jmp 0x3dbc623
lea ecx, [edx - 1]
cmp ebx, ecx
jle 0x3dbc5fc
mov edx, dword [ebp - 8]
shl edx, 2
add edx, 0x3e29d66
movzx ecx, word [edx]
mov ebx, ecx
movzx esi, byte [edx + 3]
add ebx, esi
cmp eax, ebx
jge 0x3dbc668
xor ebx, ebx
mov bl, byte [edx + 2]
and ebx, 1
xor ecx, eax
and ebx, ecx
jne 0x3dbc668
movzx edx, byte [edx + 2]
sar edx, 1
movzx ecx, word [edx*2 + 0x3e29ff2]
add eax, ecx
and eax, 0xffff
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x3dbc69e
cmp dword [ebp + 0xc], 2
sete al
and eax, 1
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.03dbc4a4
add esp, 8
mov dword [ebp - 4], eax
jmp 0x3dbc69e
cmp eax, 0x10400
jl 0x3dbc69e
cmp eax, 0x10428
jge 0x3dbc69e
add eax, 0x28
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x407490
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453140
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
or ebx, 0x2001f
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push edx
push ebx
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x21c]
test esi, esi
jne 0x407642
xor esi, esi
test eax, eax
je 0x407534
push eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x224]
and ebx, 0x300
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ebx
test esi, esi
jne 0x407642
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x234]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x100
push ecx
lea ecx, [ebp - 0x210]
push ecx
push esi
push eax
call ebx
test eax, eax
jne 0x4075db
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00407490
mov esi, eax
test esi, esi
jne 0x40763c
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x21c]
call ebx
test eax, eax
je 0x407590
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4075f2
push eax
call edi
mov dword [ebp - 0x21c], 0
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x218], 0
call fcn.00406610
mov ecx, dword [ebp - 0x21c]
mov esi, eax
test ecx, ecx
je 0x40761c
push ecx
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40761c
push eax
jmp 0x40761a
Function at 0x4077f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45318b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x46a180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40789c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40789c
call fcn.00406270
mov esi, eax
jmp 0x40798c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4078bf
call fcn.00406270
jmp 0x40797f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4078dd
call fcn.00406270
jmp 0x40797f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4078fe
mov esi, 0x8007000e
jmp 0x407981
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004060a0
jmp 0x407928
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x40793f
mov esi, 0x8007000e
jmp 0x407981
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40795f
call fcn.00406270
jmp 0x40797f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00407650
mov esi, eax
test edi, edi
je 0x40798c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4079a5
lea ecx, [ebp - 0x418]
call fcn.00406790
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004312d2
mov esp, ebp
pop ebp
ret 0x10