joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, ecx
and esi, 3
je 0x40891b
cmp esi, 2
jne 0x40892b
shr ecx, 1
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp 0x4089bd
shr ecx, 2
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
jmp 0x4089bd
test ecx, ecx
je 0x4089bd
mov edi, ecx
and edi, 7
je 0x40895b
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
mov byte [eax + esi], bl
inc esi
cmp edi, esi
jne 0x408940
add edx, esi
mov edi, ecx
sub edi, esi
add esi, eax
cmp ecx, 8
jae 0x408964
jmp 0x4089bd
mov edi, ecx
mov esi, eax
cmp ecx, 8
jb 0x4089bd
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp edi, ecx
jne 0x408970
pop esi
pop edi
pop ebx
ret

Function at 0x409100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.00409210
push eax
mov edi, esp
jmp 0x40910f
call fcn.00409210
sub esp, 0x100
mov esi, esp
jmp 0x40911e
call fcn.00432090
test al, 1
jne 0x409129
jmp 0x4091a5
call fcn.0042d5a0
jmp 0x409130
test al, 1
jne 0x409136
jmp 0x40919c
sub esp, 4
mov dword [esp], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
xor eax, eax
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x100
call fcn.00408aa0
add esp, 0xc
jmp 0x40916a
lea eax, str.eleet_or_leetspeak__is_a_system_of_modified_spellings_used_primarily_on_the_internet._it_often_uses_character_replacements_in_ways_that_play_on_the_similarity_of_their_glyphs_via_reflection_or_other_resemblance
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004091c0
add esp, 8
jmp 0x409184
call fcn.0040a580
jmp 0x40918b
test al, 1
jne 0x409191
jmp 0x409198
call fcn.00410970
jmp 0x409198
jmp 0x40919a
jmp 0x40919c
call fcn.004342c0
jmp 0x4091a3
jmp 0x4091a5
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x409396
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x4092b6
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ebx, [ebx + ecx*2]
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x4092d5
cmp cx, 0x7f
jbe 0x4092a0
movzx ecx, cx
cmp ecx, 0x7ff
ja 0x4092d0
add ebx, 2
jmp 0x4092ab
add ebx, 3
jmp 0x4092ab
lea esi, [ebx + 1]
push esi
call fcn.004088c0
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x4093a4
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x409318
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x4093a6
movzx edx, word [edi]
test dx, dx
je 0x4093a6
cmp dx, 0x7f
jbe 0x409300
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
mov dword [esp + 4], esi
cmp esi, 0x7ff
ja 0x409360
cmp ecx, 2
jb 0x409360
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x409307
xor esi, esi
cmp ecx, 3
jb 0x409307
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x409307
push 1
call fcn.004088c0
add esp, 4
mov ebp, eax
jmp 0x4093a6
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x4093c7
mov ebx, eax
mov byte [esp + ecx + 0xc], bl
inc ecx
movzx eax, byte [ebp + ecx]
mov bl, 0x2f
cmp eax, 0x5c
je 0x4093c2
test eax, eax
jne 0x4093c0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.004053f0
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40a360
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov esi, 0xffffffff
mov ecx, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, esi
add ecx, 3
cmp byte [edx + esi + 1], 0
lea esi, [esi + 1]
jne 0x40a380
shr ecx, 2
movzx eax, byte [edx + esi - 1]
cmp eax, 0x3d
je 0x40a3a1
cmp eax, 0x2e
jne 0x40a3a2
dec ecx
movzx eax, byte [edx + esi - 2]
cmp eax, 0x3d
je 0x40a3b1
cmp eax, 0x2e
jne 0x40a3b2
dec ecx
mov dword [esp + 4], ecx
mov edx, 0
test esi, esi
je 0x40a4a4
xor ecx, ecx
mov edi, 2
jmp 0x40a3e2
lea eax, [edi + 4]
add edi, 2
mov ecx, edx
cmp edi, esi
mov edi, eax
jae 0x40a4a4
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x40]
mov ebp, esi
mov esi, eax
movzx eax, byte [eax + edi - 2]
push eax
call fcn.004106e0
add esp, 4
mov ebx, eax
movzx eax, byte [esi + edi - 1]
mov esi, ebp
mov ebp, dword [esp + 8]
push eax
call fcn.004106e0
add esp, 4
mov bh, al
shl bl, 2
shr al, 4
and al, 3
or al, bl
lea edx, [ebp + 1]
mov ecx, dword [esp + 0x44]
mov byte [ecx + ebp], al
cmp edi, esi
jae 0x40a3d0
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + edi]
push eax
mov dword [esp + 4], edx
call fcn.004106e0
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x40a3d0
mov bl, al
shl bh, 4
shr al, 2
and al, 0xf
or al, bh
lea edx, [ebp + 2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + ebp + 1], al
lea eax, [edi + 1]
cmp eax, esi
jae 0x40a3d0
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + edi + 1]
push eax
mov dword [esp + 4], edx
call fcn.004106e0
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x40a3d0
shl bl, 6
add al, bl
mov ecx, dword [esp + 0x44]
mov byte [ecx + ebp + 2], al
add ebp, 3
mov edx, ebp
jmp 0x40a3d0
mov eax, edx
mov edx, dword [esp + 4]
cmp eax, edx
mov eax, 0
jne 0x40a537
mov eax, edx
or eax, 0xffffffdf
mov esi, edx
and esi, 0xffffffdf
add esi, eax
lea edi, [esp + 0xc]
mov ebp, dword [esp + 0x44]
mov eax, ebp
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, esi
inc eax
je 0x40a532
mov ecx, edx
and ecx, 1
xor edi, edi
cmp edx, 0x21
je 0x40a51c
mov edx, eax
sub edx, ecx
xor edi, edi
nop
nop
nop
mov esi, edi
and esi, 0x1e
movzx ebx, byte [esp + esi + 0xc]
xor bl, byte [ebp + edi + 0x20]
mov byte [ebp + edi], bl
lea esi, [edi + 1]
and esi, 0x1f
movzx ebx, byte [esp + esi + 0xc]
xor bl, byte [ebp + edi + 0x21]
mov byte [ebp + edi + 1], bl
add edi, 2
cmp edx, edi
jne 0x40a4f0
test ecx, ecx
je 0x40a532
mov ecx, edi
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [ebp + edi + 0x20]
mov byte [ebp + edi], cl
mov byte [ebp + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov ebp, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp + 2], 0
lea ebp, [ebp + 2]
jne 0x414760
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x414780
sar ebp, 1
sar eax, 1
add eax, ebp
add eax, 2
test eax, eax
jns 0x41479f
mov eax, 0xffffffff
jmp 0x4147a1
add eax, eax
push eax
call fcn.004088c0
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x4147d1
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4147c0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [edi]
test cx, cx
je 0x414801
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4147f0
mov word [eax], 0
lea eax, [esp + 8]
push 0x20
push 1
push 3
push 0x120089
push eax
push ebx
call fcn.004356f0
add esp, 0x18
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x43c1a4]
mov ecx, 0x29fbabd5
xor ecx, dword [0x43c1ac]
add eax, ecx
inc eax
jmp eax
Function at 0x41c500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 0x10], 0x6b2b6d31
mov dword [esp + 0x14], 0x67f669f8
mov dword [esp + 0x18], 0x63c365d8
mov dword [esp + 0x1c], 0x5fff61ec
mov dword [esp + 0x20], 0x5bfe5d01
mov dword [esp + 0x24], 0x57ce59f4
mov dword [esp + 0x28], 0x53c055d9
mov dword [esp + 0x2c], 0x4fd351cc
mov dword [esp + 0x30], 0x4bd44dc2
mov dword [esp + 0x34], 0x47c849d1
mov dword [esp + 0x38], 0x43e645d8
mov dword [esp + 0x3c], 0xbf3041f0
mov dword [esp + 0x40], 0xbb20bd2f
mov dword [esp + 0x44], 0xb722b921
mov dword [esp + 0x48], 0xb33db529
mov dword [esp + 0x4c], 0xb1b0
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x5c]
cmp eax, 0x3f
ja 0x41c5e2
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x5c]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + ecx]
add edx, 0x4aac52
add eax, 0x4aac52
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0xc2
mov ecx, dword [esp + 0x5c]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
cmp eax, 0x40
jb 0x41c5a0
movzx ecx, word [esp + 0x10]
lea esi, [esp + 0x5c]
mov eax, esi
test cx, cx
je 0x41c611
lea eax, [esp + 0x5c]
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41c600
mov word [eax], 0
lea ebx, [esp + 0x58]
push ebx
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x443fd0]
mov edi, dword [esp + 0x58]
test edi, edi
jns 0x41c639
mov eax, 0xffffffff
jmp 0x41c63c
lea eax, [edi + edi]
push eax
call fcn.004088c0
add esp, 4
push ebx
push edi
mov edi, eax
push eax
push 0x1e
push esi
push 0
call dword [0x443fd0]
mov dword [esp + 0x10], 0x33ac359a
mov dword [esp + 0x14], 0x2fa231b9
mov dword [esp + 0x18], 0x2bb72db2
mov dword [esp + 0x1c], 0x27b629a4
mov dword [esp + 0x20], 0x23aa25b1
mov dword [esp + 0x24], 0x1f2021be
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x28
ja 0x41c6f3
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 9
add ecx, 9
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xc1
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x29
jb 0x41c6c0
lea eax, [esp + 0x10]
push eax
push edi
push dword [ebp + 8]
call fcn.00417b40
add esp, 0xc
mov ebx, eax
jmp dword [0x43de50]
Function at 0x42eef0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x42efad
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x42ef50
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0042f570
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x42ef40
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x42f0a4
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x42f08d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x42f050
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42f0a4
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x42f0ea
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.0042f570
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.0042f570
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42f570
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov edx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
mov esi, dword [eax]
mov dword [esp + 0x6c], esi
mov ebx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov ebp, dword [eax + 0xc]
mov edi, ecx
mov dword [esp + 0x70], ecx
xor edi, ebx
mov dword [esp + 0x64], ebx
xor edi, ebp
mov eax, dword [edx]
mov dword [esp + 0x34], eax
add eax, esi
add edi, eax
rol edi, 0xb
mov eax, dword [esp + 0x88]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x68], eax
add edi, eax
mov esi, ecx
rol esi, 0xa
mov dword [esp + 0x14], esi
xor esi, ebx
xor esi, edi
mov ecx, dword [edx + 4]
mov dword [esp + 0x38], ecx
add eax, ecx
add esi, eax
rol esi, 0xe
mov dword [esp + 0x60], ebp
add esi, ebp
Function at 0x4356f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x5c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x435710
mov edi, eax
sar edi, 1
cmp eax, 0xfffffff5
jge 0x43572b
mov eax, 0xffffffff
jmp 0x43572e
add eax, 0xa
push eax
call fcn.004088c0
add esp, 4
mov esi, eax
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea eax, [edi + 4]
mov word [esi + 8], 0
mov ecx, esi
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x435772
add ebp, 2
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x435760
mov word [ecx], 0
mov ecx, 3
sub ecx, edi
and ecx, 2
mov edx, eax
and edx, 0xfffd
imul edx, ecx
and edi, 2
or eax, 2
imul eax, edi
lea ecx, [eax + edx]
mov word [esp + 0x18], cx
add eax, edx
add eax, 2
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov ecx, dword [0x4441e4]
mov edi, 0xffffffff
test ecx, ecx
je 0x4358d4
mov eax, dword [0x4441e8]
add eax, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [eax - 8], 0xb1cf12ba
je 0x435814
add eax, 0xc
dec ecx
jne 0x435800
jmp 0x4358d4
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], 0x900000c2
mov dword [esp + 0xc], 0xd2ff0000
mov dword [esp + 8], 0xba00
mov dword [esp + 4], 0xb8
mov eax, dword [eax]
mov dword [esp + 5], eax
mov eax, dword [0x4441ec]
mov dword [esp + 0xa], eax
mov word [esp + 0x11], 0x2c
mov dword [esp], 0
mov dword [esp + 0x24], 0x10
lea eax, [esp + 0x24]
mov ebp, esp
push 0x40
push 0x3000
push eax
push 0
push ebp
push 0xffffffffffffffff
call dword [0x4441f0]
mov edi, dword [esp]
lea eax, [esp + 4]
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea ecx, [esp + 0x40]
lea eax, [esp + 0x28]
push 0
push 0
push ebx
push dword [esp + 0x78]
push dword [esp + 0x78]
push 0x80
push 0
push ecx
push eax
push dword [esp + 0x88]
push dword [esp + 0x88]
call dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push 0x8000
push eax
push ebp
push 0xffffffffffffffff
call dword [0x4441f4]
push esi
call fcn.004088d0
add esp, 4
mov eax, edi
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
push esi
push edi
push 0x10
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x404017
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push str.StringFileInfo040904b0ProductName
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x404017
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push str.StringFileInfo040904b0ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x404017
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x10]
push ecx
call fcn.00404830
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push edx
call fcn.00404830
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x10
ret
pop edi
xor al, al
pop esi
add esp, 0x10
ret

Function at 0x404ba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4243e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42e43c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
xor edx, edx
push eax
mov dword [ecx + 0x18], 7
lea eax, [esp + 0x40]
mov word [ecx + 4], dx
call fcn.00402400
call fcn.00404020
cmp dword [esp + 0x34], 8
mov dword [esi], vtable.MSIProvider.0
jb 0x404c0e
mov eax, dword [esp + 0x20]
push eax
call fcn.0040cf19
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x404dc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4243e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42e43c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
xor edx, edx
push eax
mov dword [ecx + 0x18], 7
lea eax, [esp + 0x40]
mov word [ecx + 4], dx
call fcn.00402400
call fcn.00404020
cmp dword [esp + 0x34], 8
mov dword [esi], vtable.OSInfoProvider.0
jb 0x404e2e
mov eax, dword [esp + 0x20]
push eax
call fcn.0040cf19
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x405cf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4243e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42e43c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
mov ecx, esp
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
xor edx, edx
push eax
mov dword [ecx + 0x18], 7
lea eax, [esp + 0x40]
mov word [ecx + 4], dx
call fcn.00402400
call fcn.00404020
cmp dword [esp + 0x34], 8
mov dword [esi], vtable.PNPProvider.0
jb 0x405d5e
mov eax, dword [esp + 0x20]
push eax
call fcn.0040cf19
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x406220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ec
mov eax, dword [0x42e43c]
xor eax, esp
mov dword [esp + 0x2e8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 9
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
mov dword [esp + 0x28], edx
call fcn.00405c20
mov ebx, eax
test ebx, ebx
je 0x4063b8
push 0x1b8
lea eax, [esp + 0x13c]
push 0
mov ecx, 0x14
mov esi, str.SYSTEMCurrentControlSetControlClass_
lea edi, [esp + 0xf0]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040f840
mov edi, dword [esp + 0x20]
add esp, 0xc
cmp dword [edi + 0x430], 8
jb 0x40629d
mov eax, dword [edi + 0x41c]
jmp 0x4062a3
lea eax, [edi + 0x41c]
push eax
lea ecx, [esp + 0x24]
push 0x64
push ecx
call fcn.0040d6ac
push str._Module:_
lea edx, [esp + 0x30]
push 0x64
push edx
call fcn.0040d5de
push str.Opening_Registry_Key_SYSTEMCurrentControlSetControlClass__n
lea eax, [esp + 0x3c]
push 0x64
push eax
call fcn.0040d5de
mov eax, dword [edi + 0x434]
add esp, 0x24
lea ecx, [esp + 0x20]
push ecx
mov esi, 0x64
call fcn.00402c20
push ebx
lea edx, [esp + 0xec]
push 0x104
push edx
call fcn.0040d5de
push ebx
call fcn.0040d1fe
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 1
push 0
lea ecx, [esp + 0xf4]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4063b8
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xec]
push eax
push 0
push 0
push str.DriverVersion
push ecx
mov dword [esp + 0x30], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4063b8
mov ebx, dword [esp + 0x14]
push str.Opening_Driver_Version__n
mov eax, esi
lea edi, [esp + 0x24]
call fcn.00401040
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xe8]
push eax
add ecx, 0x828
push 0x400
push ecx
call fcn.0040d6ac
add esp, 0xc
lea eax, [esi - 0x63]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0040cf24
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040cf24
mov esp, ebp
pop ebp
ret 8