joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x73391148
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x48a575c9
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10017baf
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10017bcc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10017d1b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x10017c2f
xor eax, eax
inc eax
jne 0x10017c2f
and dword [ebp - 0x10], 0
jmp 0x10017c36
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x2fe8
je 0x10017c48
mov dword [ebp - 0x14], 1
jmp 0x10017c4c
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x10017c67
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0
jne 0x10017c67
and dword [ebp - 0x18], 0
jmp 0x10017c6e
mov dword [ebp - 0x18], 1
push 1
mov ecx, dword [ebp - 0x2c]
call fcn.10019b92
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
jg 0x10017c88
mov dword [ebp - 0x1c], 1
jmp 0x10017c8c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
je 0x10017c9f
mov dword [ebp - 0x20], 1
jmp 0x10017ca3
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jg 0x10017cb6
mov dword [ebp - 0x50], 1
jmp 0x10017cba
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x10017cd7
mov dword [ebp - 0x24], 1
jmp 0x10017cdb
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x24], eax
je 0x10017cee
mov dword [ebp - 0x28], 1
jmp 0x10017cf2
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28]
jle 0x10017d05
mov dword [ebp - 0x30], 1
jmp 0x10017d09
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.10019b92
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10020629
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002064f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002064d
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x10020697
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002067d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10020697
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10019b92
or dword [eax], 0xffffffff
jmp 0x10020672
mov esp, ebp
pop ebp
ret

Function at 0x10020d81
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10020dbd
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10020dbb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x10020ddd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10020ddd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x1002efb4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002f00c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002eff0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1002f00a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10019b92
and dword [eax], 0
jmp 0x1002efe5
jmp 0x1002f022
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002f022
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esp, ebp
pop ebp
ret
Function at 0x1003565f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100354ed
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003568f
xor eax, eax
jmp 0x100357d2
lea eax, [ebp + 8]
push eax
push 0x3505
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1003552b
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100356bc
xor eax, eax
jmp 0x100357d2
push 1
push dword [ebp - 8]
push 0x790
push 0x1837
lea eax, [ebp - 0xc]
push eax
call fcn.1003510b
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x100356e4
xor eax, eax
jmp 0x100357d2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
push dword [ebp - 0x10]
push 0x5c0a
push 0x3fc2
push 0x1a99
lea eax, [ebp - 0x24]
push eax
call fcn.10035359
add esp, 0x24
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push dword [ebp + 8]
call fcn.10031a9f
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10035599
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x10035750
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.100355fc
add esp, 0xc
push dword [ebp - 4]
call fcn.10034fee
pop ecx
test eax, eax
jne 0x10035761
xor eax, eax
jmp 0x100357d2
push dword [ebp - 4]
push 0
push 0x3f34
push 0x304c
call fcn.1002f026
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100357ba
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10035797
xor eax, eax
jmp 0x100357d2
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100357b0
xor eax, eax
jmp 0x100357d2
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100357cb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100357cf
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004cd59
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004cd76
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1004ced1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1004ce79
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1004cddf
mov dword [ebp - 8], 1
jmp 0x1004cde3
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
cmp dword [ebp - 8], 0xfff8
jb 0x1004cdfd
mov dword [ebp - 0xc], 1
jmp 0x1004ce01
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jg 0x1004ce14
mov dword [ebp - 0x10], 1
jmp 0x1004ce18
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
inc ecx
cmp dword [eax], ecx
jl 0x1004ce2c
mov dword [ebp - 0x14], 1
jmp 0x1004ce30
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jne 0x1004ce43
mov dword [ebp - 0x18], 1
jmp 0x1004ce47
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jle 0x1004ce5a
mov dword [ebp - 0x20], 1
jmp 0x1004ce5e
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
je 0x1004ce79
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1004ce79
mov dword [ebp - 0x24], 1
jmp 0x1004ce7d
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
je 0x1004cec1
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jl 0x1004cea8
mov dword [ebp - 0x2c], 1
jmp 0x1004ceac
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
jmp 0x1004ced1
mov dword [ebp - 0x58], 8
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x1004cf06
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004cf1e
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1004cf94
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.10019b92
mov dword [ebp - 4], eax
push 2
mov ecx, dword [ebp - 0x20]
call fcn.10019b92
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10019b92
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ecx]
jge 0x1004cf88
mov dword [ebp - 8], 1
jmp 0x1004cf8c
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100844d5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008e330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100756c4
mov dword [ebp - 0x14], eax
cmp dword [0x1067bed0], esi
jne 0x100845c8
push 0x800
push esi
push 0x10007bfc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10084555
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100846a8
push esi
push esi
push 0x10007bfc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100846a8
push 0x10007c14
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100846a8
push eax
call ebx
push 0x10007c20
push edi
mov dword [0x1067bed0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c30
push edi
mov dword [0x1067bed4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c44
push edi
mov dword [0x1067bed8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067bee0], eax
test eax, eax
je 0x100845c5
push 0x10007c60
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067bedc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100845ed
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100845e0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10084602
push 4
pop eax
jmp 0x100846aa
cmp dword [ebp - 0x14], esi
je 0x10084602
push dword [0x1067bed0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100845e7
mov eax, dword [0x1067bedc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10084660
cmp dword [0x1067bee0], edi
je 0x10084660
push eax
call ebx
push dword [0x1067bee0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10084660
test eax, eax
je 0x10084660
call ecx
test eax, eax
je 0x10084655
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10084655
test byte [ebp - 8], 1
jne 0x10084660
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10084690
mov eax, dword [0x1067bed4]
cmp eax, edi
je 0x1008468d
push eax
call ebx
test eax, eax
je 0x1008468d
call eax
mov esi, eax
test esi, esi
je 0x1008468d
mov eax, dword [0x1067bed8]
cmp eax, edi
je 0x1008468d
push eax
call ebx
test eax, eax
je 0x1008468d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067bed0]
call ebx
test eax, eax
je 0x100846a8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100846aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x401bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edx, edx
jmp 0x401c00
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4b2a60], ecx
inc edx
cmp edx, 0x100
jb 0x401c00
cmp edx, 0x800
jae 0x401cd9
lea ebx, [ebx]
mov eax, dword [edx*4 + 0x4b2660]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b2a60]
inc edx
mov dword [edx*4 + 0x4b2a5c], eax
cmp edx, 0x800
jb 0x401cb0
lea esi, [ebp - 0x24]
mov dword [0x49f018], 0x401da0
call fcn.00405650
test eax, eax
je 0x401d96
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov esi, eax
shr eax, 4
shr esi, 8
and eax, 0xf00f
and esi, 0xff00f
xor edi, edi
mov dword [ebp - 4], eax
mov ecx, 0x469298
xor edx, edx
mov eax, dword [ecx - 8]
cmp eax, dword [ebp - 0x20]
jne 0x401d2c
mov eax, dword [ebp - 0x1c]
cmp dword [ecx - 4], eax
jne 0x401d2c
cmp dword [ecx], ebx
je 0x401d64
add edx, 0xc
inc edi
add ecx, 0xc
cmp edx, 0x24
jb 0x401d18
or ecx, 0xffffffff
sub ecx, 0
je 0x401d7c
dec ecx
je 0x401d68
dec ecx
jne 0x401d96
cmp esi, 6
jb 0x401d96
jne 0x401d8c
cmp dword [ebp - 4], 0xf
jb 0x401d96
mov dword [0x49f018], 0x401e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
jmp 0x401d3b
cmp esi, 5
jb 0x401d96
jne 0x401d8c
mov eax, dword [ebp - 4]
cmp eax, 6
jb 0x401d96
cmp eax, 0xa
jmp 0x401d8a
cmp esi, 6
jb 0x401d96
jne 0x401d8c
cmp dword [ebp - 4], 0x100c
je 0x401d96
mov dword [0x49f018], 0x401e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4054c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x4054e2
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
add edi, eax
cmp edi, edx
jae 0x405510
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x405510
inc edi
cmp edi, edx
jb 0x405501
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x405617
cmp eax, 3
jbe 0x405547
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x405584
cmp al, 0xff
je 0x405584
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4054f5
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x40552b
movzx eax, byte [esi + 0x45a768]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x45a760], 0
mov al, byte [ecx + 4]
je 0x405570
test al, al
je 0x405570
cmp al, 0xff
jne 0x40552b
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4054f5
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
lea eax, [edx - 5]
test esi, esi
je 0x4055e7
movzx edx, byte [esi + 0x45a768]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
mov cl, bl
test cl, cl
je 0x4055ce
cmp cl, 0xff
jne 0x4055e4
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x4055a2
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x4054f5
cmp eax, 3
jbe 0x40562c
mov edx, dword [ebp + 0xc]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4071a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4071b8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4071ea
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4071e6
cmp esi, eax
jae 0x4071ea
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4071d8
cmp esi, eax
jb 0x4071f0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x4073d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40743e
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40740d
cmp eax, 2
jne 0x407428
mov eax, dword [ebp - 4]
test esi, esi
je 0x407438
test eax, eax
je 0x407433
test al, 1
jne 0x407428
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x407438
mov eax, 0xd
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8