joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011a0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x14c
mov eax, dword [0x425e98]
xor eax, esp
mov dword [esp + 0x148], eax
fldz
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x1c], ebx
fstp qword [esp + 0x20]
push edi
mov dword [esp + 0xc], ebx
push 0x104
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.0040b33b
add esp, 4
push ebx
mov esi, eax
push 2
mov dword [esp + 0x24], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, ebx
je 0x4013b4
push ebp
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], 0x128
call sub.KERNEL32.dll_Process32First
or ebp, 0xffffffff
test eax, eax
je 0x401361
mov edi, esi
lea ecx, [esp + 0x54]
sub edi, ecx
nop
lea eax, [esp + 0x54]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
cmp cl, bl
jne 0x401224
push esi
call fcn.0041e513
mov ecx, dword [esp + 0x164]
add esp, 4
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401260
cmp dl, bl
je 0x40125c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401260
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x401240
xor eax, eax
jmp 0x401264
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x401318
cmp dword [esp + 0x164], ebx
je 0x401339
mov edx, dword [esp + 0x38]
push edx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [0x424c78]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
sub ecx, 0x5ebddcf
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fsub dword [0x4232ac]
fsubp st(1)
call fcn.0040b420
mov dword [0x424c78], eax
add dword [esp + 0x14], ebp
cmp esi, ebx
je 0x401314
fld qword [esp + 0x28]
mov edx, dword [esp + 0x14]
fsubr qword [0x41f358]
add dword [esp + 0x14], ebp
inc dword [esp + 0x18]
sub edx, 0x1e21f67f
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fcompp
fnstsw ax
fld qword [esp + 0x28]
fadd qword [0x41f340]
fstp qword [esp + 0x28]
test ah, 0x41
jne 0x401305
add dword [esp + 0x14], 0xe1ad90d1
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x38], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401220
jmp 0x40135d
mov edx, dword [0x425d88]
inc dword [esp + 0x18]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul qword [0x425d10]
fstp qword [0x425d10]
add dword [0x425d88], ebp
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
fld qword [0x423118]
fadd qword [0x41f340]
fstp qword [0x423118]
fld qword [0x423118]
mov eax, dword [esp + 0x24]
fadd qword [0x41f350]
mov ecx, dword [0x42321c]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
faddp st(2)
fsubrp st(1)
call fcn.0040b420
mov dword [esp + 0x24], eax
add dword [0x42321c], ebp
pop ebp
push esi
call fcn.0040b25e
mov ecx, dword [esp + 0x158]
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b405
add esp, 0x14c
ret
Function at 0x401c30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
fldz
push ebx
push ebp
xor eax, eax
push esi
mov word [esp + 0xc], ax
fstp qword [esp + 0x10]
fldz
push edi
mov edi, dword [esp + 0x24]
fstp dword [esp + 0x14]
push edi
call fcn.0040b33b
mov ebx, dword [esp + 0x24]
push edi
mov esi, eax
push ebx
push esi
call fcn.0040b4d0
mov eax, dword [0x4276a4]
mov dx, word [0x424bd4]
sub eax, 0x423004
add eax, ebx
movzx ebx, word [esp + 0x20]
movzx ebp, word [esp + 0x20]
movsx edx, dx
add ebx, edx
add ebx, ebp
add ebx, dword [0x424b70]
add edi, esi
mov word [esp + 0x20], bx
inc word [0x424bd4]
add esp, 0x10
mov ecx, esi
cmp esi, edi
je 0x401cad
mov dl, byte [eax]
xor byte [ecx], dl
inc ecx
inc eax
cmp ecx, edi
jne 0x401ca3
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x402bf0
Capabilities:
Write file on windows

Disassembly:
push ecx
fldz
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
fstp dword [esp + 0xc]
xor eax, eax
push 3
push 0x4233a0
mov word [esp + 0x14], ax
call fcn.00401c30
mov ebx, dword [esp + 0x1c]
mov esi, eax
push esi
push ebx
call fcn.0040bec8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x402c46
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call fcn.0040bec8
mov edi, eax
add esp, 8
test edi, edi
je 0x402c6a
fld qword [0x41f4b0]
push edi
push 1
fstp qword [0x424c90]
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.0040bd82
push edi
call fcn.0040bba4
add esp, 0x14
xor eax, eax
mov word [esi], ax
mov dword [esp + 0xc], 0
push esi
mov dword [esp + 0x10], 0
mov byte [esi + 2], al
call fcn.0040b25e
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x402da0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
fldz
push ebx
push ebp
fstp dword [esp + 8]
xor eax, eax
xor ecx, ecx
push 0x2e
mov word [esp + 0xc], ax
push 0x423230
mov word [esp + 0x10], cx
call fcn.00401c30
add esp, 8
lea edx, [esp + 0xc]
push edx
mov ebp, eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor ebx, ebx
test eax, eax
jne 0x402eb6
push esi
push edi
push 0x34
push 0x423408
call fcn.00401c30
fld qword [0x4233e8]
fld1
mov esi, eax
fadd st(1), st(0)
add esp, 8
fxch st(1)
fstp qword [0x4233e8]
mov ax, word [esp + 0x10]
movsx ecx, ax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fsub dword [0x423160]
fld qword [0x4233e8]
fadd qword [0x41f4b8]
fsub dword [0x423160]
fcompp
fnstsw ax
fld dword [0x423160]
fsub st(1)
fstp dword [0x423160]
fsubr dword [0x423160]
fstp dword [0x423160]
test ah, 5
jp 0x402e74
mov dx, word [0x423094]
movsx eax, dx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [0x423158]
dec word [0x423094]
mov edx, dword [esp + 0x1c]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402e80
mov ecx, dword [esp + 0x14]
sub eax, edi
push eax
push edx
push 1
push ebx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x34
push ebx
mov dword [esp + 0x18], ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.0040b840
push esi
call fcn.0040b25e
add esp, 0x10
pop edi
pop esi
push 0x2e
push ebx
mov dword [esp + 0x10], ebx
push ebp
mov dword [esp + 0x14], ebx
call fcn.0040b840
push ebp
call fcn.0040b25e
mov edx, dword [esp + 0x1c]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40b405
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425e98]
jne 0x40b40f
repz ret
jmp fcn.0040f7c7

Function at 0x4168f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040fc56
and dword [ebp - 4], 0
cmp dword [0x428114], 0
mov ebx, eax
jne 0x4169a5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416a56
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420ae0
push edi
call esi
test eax, eax
je 0x416a56
push eax
call fcn.0040fbe4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428114], eax
call esi
push eax
call fcn.0040fbe4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428118], eax
call esi
push eax
call fcn.0040fbe4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42811c], eax
call esi
push eax
call fcn.0040fbe4
pop ecx
mov dword [0x428124], eax
test eax, eax
je 0x4169a5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040fbe4
pop ecx
mov dword [0x428120], eax
mov eax, dword [0x428120]
cmp eax, ebx
je 0x4169fd
cmp dword [0x428124], ebx
je 0x4169fd
push eax
call fcn.0040fc5f
push dword [0x428124]
mov esi, eax
call fcn.0040fc5f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4169fd
test edi, edi
je 0x4169fd
call esi
test eax, eax
je 0x4169f4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4169f4
test byte [ebp - 0xc], 1
jne 0x4169fd
or dword [ebp + 0x10], 0x200000
jmp 0x416a36
mov eax, dword [0x428118]
cmp eax, ebx
je 0x416a36
push eax
call fcn.0040fc5f
pop ecx
test eax, eax
je 0x416a36
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416a36
mov eax, dword [0x42811c]
cmp eax, ebx
je 0x416a36
push eax
call fcn.0040fc5f
pop ecx
test eax, eax
je 0x416a36
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428114]
call fcn.0040fc5f
pop ecx
test eax, eax
je 0x416a56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416a58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4014c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
fldz
push esi
fstp qword [esp + 0xc]
xor esi, esi
fldz
mov dword [esp + 0x24], 0x44
fstp dword [esp + 4]
push edi
mov edi, 1
mov dword [esp + 0xc], esi
mov dword [0x423a00], 0xf307f1
fld qword [0x423220]
fadd qword [0x41f398]
mov dword [esp + 0x2c], esi
xor ecx, ecx
fstp qword [0x423220]
fld qword [esp + 0x10]
mov dword [esp + 0x30], esi
fsub qword [0x41f390]
mov dword [esp + 0x34], esi
mov dword [esp + 0x54], edi
fstp qword [esp + 0x10]
add dword [esp + 0xc], edi
mov eax, dword [esp + 0xc]
add eax, 0x2a981e53
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
mov word [esp + 0x5a], cx
fstp qword [esp + 0x10]
fld dword [esp + 8]
fadd dword [esp + 8]
fsub qword [0x41f388]
call fcn.0040aee0
mov dword [esp + 0xc], eax
fld dword [esp + 8]
fld1
mov ecx, dword [esp + 0x74]
fadd st(1), st(0)
lea edx, [esp + 0x18]
push edx
fxch st(1)
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x2c]
fstp dword [esp + 0xc]
push eax
fld dword [esp + 0x10]
push esi
fsub st(1)
push esi
push 8
push esi
fstp dword [esp + 0x20]
push esi
fld dword [esp + 0x24]
mov dword [esp + 0x78], esi
fadd qword [0x423220]
push esi
push ecx
push edx
fstp dword [esp + 0x30]
fsubr dword [esp + 0x30]
mov word [esp + 0x80], di
fstp dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
add esp, 0x64
ret
Function at 0x402a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
fldz
push ebx
push esi
fst qword [esp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov word [esp + 0x10], ax
fstp qword [esp + 0x20]
push edi
call fcn.0040b068
mov cx, word [esp + 0x14]
movsx edx, cx
mov dword [esp + 0x18], edx
mov esi, eax
add esp, 4
fild dword [esp + 0x14]
fld qword [esp + 0x20]
fcompp
fnstsw ax
fld qword [esp + 0x20]
fsub qword [0x41f360]
fstp qword [esp + 0x20]
dec dword [esp + 0x10]
test ah, 1
jne 0x402a64
fld qword [0x41f4e8]
fstp qword [esp + 0x18]
mov ebx, dword [ebp + 8]
push edi
push ebx
push esi
call fcn.0040b140
inc dword [esp + 0x1c]
movzx eax, word [esp + 0x1c]
mov edx, 0xfd857409
sub edx, eax
movzx eax, word [0x424c28]
imul edx, eax
mov word [0x424c28], dx
mov edx, dword [0x427924]
fld qword [esp + 0x24]
add edx, ebx
fld1
or ebx, 0xffffffff
fadd st(1), st(0)
add esp, 0xc
fxch st(1)
add edi, esi
mov ecx, esi
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
mov eax, dword [0x423838]
add dword [0x423838], ebx
add eax, 0x7d443489
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fcompp
fnstsw ax
test ah, 5
jp 0x402ae9
mov ax, word [0x423870]
cwde
add dword [0x423214], eax
add word [0x423870], bx
sub edx, 0x423004
cmp esi, edi
je 0x402b21
fld qword [0x41f4e0]
fld qword [esp + 0x18]
mov al, byte [edx]
xor byte [ecx], al
fsubr st(1)
inc ecx
inc edx
fmul dword [0x424c44]
fstp dword [0x424c44]
fld qword [esp + 0x18]
fadd st(2)
fstp qword [esp + 0x18]
cmp ecx, edi
jne 0x402af9
fstp st(1)
pop edi
fstp st(0)
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403490
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
fldz
push ebx
mov dword [esp + 8], 0
fst dword [esp + 8]
push 0x2e
fstp dword [esp + 0xc]
push 0x423ea4
call fcn.00402a00
add esp, 8
mov ebx, eax
lea eax, [esp + 4]
push eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403537
push esi
push edi
push 0x34
push 0x42396c
call fcn.00402a00
mov edx, dword [esp + 0x28]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4034e8
mov ecx, dword [esp + 0xc]
sub eax, edi
push eax
push edx
push 1
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
push 0x34
fstp dword [esp + 0x18]
fldz
push 0
fstp qword [esp + 0x1c]
push esi
call fcn.0040b4b0
push esi
call fcn.0040af8b
fld dword [esp + 0x20]
fsubr qword [0x41f530]
add esp, 0x10
call fcn.0040aee0
pop edi
mov dword [esp + 0xc], eax
pop esi
fldz
push 0x2e
fstp dword [esp + 0x10]
push 0
fldz
push ebx
fstp qword [esp + 0x18]
call fcn.0040b4b0
push ebx
call fcn.0040af8b
mov edx, dword [esp + 0x14]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
add esp, 0x10
ret
Function at 0x4035c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
fldz
push ebx
push esi
fst qword [esp + 0xc]
push edi
push 3
mov dword [esp + 0x10], 0
fstp qword [esp + 0x1c]
push 0x423960
call fcn.00402a00
mov ebx, dword [esp + 0x2c]
mov edi, eax
push edi
push ebx
call fcn.0040ba45
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x403630
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ax, word [0x42403c]
movsx ecx, ax
mov eax, 0xd29f57e4
sub eax, ecx
add dword [esp + 0xc], eax
dec word [0x42403c]
push edi
push ebx
call fcn.0040ba45
mov esi, eax
add esp, 8
test esi, esi
je 0x403699
push esi
push 1
lea edx, [esp + 0x30]
push 4
push edx
call fcn.0040bea6
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld qword [esp + 0x28]
fadd qword [0x41f550]
fsubp st(1)
call fcn.0040aee0
mov dword [esp + 0x1c], eax
push esi
call fcn.0040b5eb
dec word [0x423854]
fld qword [0x4237c0]
mov cx, word [0x423854]
movsx edx, cx
mov dword [esp + 0x20], edx
add esp, 0x14
fild dword [esp + 0xc]
fsubp st(1)
fsub qword [0x41f548]
call fcn.0040aee0
mov dword [esp + 0xc], eax
fld qword [esp + 0x10]
fsub qword [0x41f360]
fstp qword [esp + 0x10]
fld qword [esp + 0x10]
fsub qword [0x41f540]
fld qword [0x423880]
fsubr qword [0x41f538]
fcompp
fnstsw ax
test ah, 0x41
jp 0x4036d4
mov eax, dword [esp + 0xc]
imul eax, eax, 0x3c7ad306
mov dword [esp + 0xc], eax
fldz
xor eax, eax
fstp dword [esp + 0xc]
mov word [edi], ax
fldz
push edi
fstp qword [esp + 0x1c]
mov byte [edi + 2], al
call fcn.0040af8b
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x40b52a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426120]
jne 0x40b534
repz ret
jmp fcn.0040f757

Function at 0x416574
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004106e5
and dword [ebp - 4], 0
cmp dword [0x428394], 0
mov ebx, eax
jne 0x416625
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4166d6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420aa8
push edi
call esi
test eax, eax
je 0x4166d6
push eax
call fcn.00410673
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428394], eax
call esi
push eax
call fcn.00410673
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428398], eax
call esi
push eax
call fcn.00410673
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42839c], eax
call esi
push eax
call fcn.00410673
pop ecx
mov dword [0x4283a4], eax
test eax, eax
je 0x416625
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410673
pop ecx
mov dword [0x4283a0], eax
mov eax, dword [0x4283a0]
cmp eax, ebx
je 0x41667d
cmp dword [0x4283a4], ebx
je 0x41667d
push eax
call fcn.004106ee
push dword [0x4283a4]
mov esi, eax
call fcn.004106ee
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41667d
test edi, edi
je 0x41667d
call esi
test eax, eax
je 0x416674
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416674
test byte [ebp - 0xc], 1
jne 0x41667d
or dword [ebp + 0x10], 0x200000
jmp 0x4166b6
mov eax, dword [0x428398]
cmp eax, ebx
je 0x4166b6
push eax
call fcn.004106ee
pop ecx
test eax, eax
je 0x4166b6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4166b6
mov eax, dword [0x42839c]
cmp eax, ebx
je 0x4166b6
push eax
call fcn.004106ee
pop ecx
test eax, eax
je 0x4166b6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428394]
call fcn.004106ee
pop ecx
test eax, eax
je 0x4166d6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4166d8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40313a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
xor edi, edi
mov ebx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
cmp dword [esp + 0x10], eax
jle 0x403180
sub ebx, 0x42b6c0
mov ax, word [ebx + edi*2 + 0x42b6c0]
mov ecx, esi
xor ax, word [edi*2 + 0x42b6c0]
movzx eax, ax
push eax
call fcn.00401a7c
inc edi
cmp edi, dword [esp + 0x10]
jl 0x40315e
pop edi
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x403188
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp dword [esp + 0x10], ebx
jle 0x4031c8
sub edi, 0x42b690
mov al, byte [edi + ebx + 0x42b690]
mov ecx, esi
xor al, byte [ebx + 0x42b690]
movzx eax, al
push eax
call fcn.0040424a
inc ebx
cmp ebx, dword [esp + 0x10]
jl 0x4031a9
pop edi
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x404943
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, edx
cmp dword [0x4a3778], ebx
jne 0x404989
mov ecx, ebx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x40496a
shr eax, 1
xor eax, 0xedb88320
jmp 0x40496c
shr eax, 1
dec edx
jne 0x40495d
mov dword [ecx*4 + 0x4a8910], eax
inc ecx
cmp ecx, 0x100
jl 0x404958
mov dword [0x4a3778], 1
mov eax, dword [ebp + 8]
or edx, 0xffffffff
xor ecx, ecx
lea eax, [edi + eax*2]
mov esi, eax
sub esi, edi
inc esi
shr esi, 1
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4049be
movzx eax, byte [edi]
lea edi, [edi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4a8910]
inc ebx
cmp ebx, esi
jb 0x4049a4
pop edi
not edx
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405564
Capabilities:
Get common file path

Disassembly:
sub esp, 0x444
push ebx
push ebp
push esi
mov esi, dword [esp + 0x454]
mov ebx, ecx
push edi
push dword [esp + 0x45c]
mov ecx, esi
call fcn.004030b4
push eax
mov ecx, ebx
call fcn.004054d1
mov edi, eax
test edi, edi
jne 0x405707
push 0x104
lea eax, [esp + 0x44]
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebp
mov word [esp + 0x10], ax
cmp word [esp + 0x40], ax
je 0x4055cf
lea eax, [esp + 0x40]
push eax
call fcn.0041012b
pop ecx
push eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x18]
call fcn.004026be
mov edi, 0x42d094
push edi
call fcn.0041012b
pop ecx
push eax
push ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0040648c
inc eax
lea ecx, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x30]
push eax
call fcn.00401ad1
push eax
lea ecx, [esp + 0x14]
call fcn.00401a35
push ebp
push 1
lea ecx, [esp + 0x30]
call fcn.004023dd
cmp word [esi], bp
jne 0x405626
mov eax, ebp
jmp 0x40562d
push esi
call fcn.0041012b
pop ecx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401e6d
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x10]
push dword [esp + 0x45c]
cmovae ecx, dword [esp + 0x14]
call fcn.004030b4
push eax
mov ecx, ebx
call fcn.004054d1
mov edi, eax
test edi, edi
jne 0x4056fb
lea eax, [esp + 0x248]
push eax
push ebp
push ebp
push 0x25
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [esp + 0x248], bp
jne 0x405685
mov eax, ebp
jmp 0x405693
lea eax, [esp + 0x248]
push eax
call fcn.0041012b
pop ecx
push eax
lea eax, [esp + 0x24c]
push eax
lea ecx, [esp + 0x18]
call fcn.004026be
mov edi, 0x42b5f8
push edi
call fcn.0041012b
pop ecx
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.00401e6d
cmp word [esi], bp
jne 0x4056c5
mov eax, ebp
jmp 0x4056cc
push esi
call fcn.0041012b
pop ecx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00401e6d
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x10]
push dword [esp + 0x45c]
cmovae ecx, dword [esp + 0x14]
call fcn.004030b4
push eax
mov ecx, ebx
call fcn.004054d1
mov edi, eax
push ebp
push 1
lea ecx, [esp + 0x18]
call fcn.004023dd
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x444
ret 8
Function at 0x4057c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x5a4d
push edi
mov dword [esp + 0x14], ecx
cmp word [esi], ax
je 0x4057ec
xor eax, eax
jmp 0x405974
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi + 0x74], 0x10
jne 0x4057e5
mov ecx, dword [eax + esi + 0x7c]
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x4057e5
mov edi, dword [eax + esi + 0x78]
xor ebx, ebx
add edi, esi
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
add eax, esi
mov dword [esp + 0x1c], eax
add edx, esi
mov eax, dword [edi + 0x1c]
add eax, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
cmp dword [ebp + 0xc], ebx
je 0x405874
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [edi + 0x14], eax
jbe 0x405972
mov ecx, dword [edx + eax*4]
add ecx, esi
call fcn.0040307d
cmp eax, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
je 0x40585f
mov edx, dword [esp + 0x18]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [edi + 0x14]
jb 0x405839
jmp 0x405972
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
movzx eax, word [ecx + eax*2]
mov ecx, dword [esp + 0x24]
mov ebx, dword [ebx + eax*4]
jmp 0x405886
mov ebx, dword [ebp + 0x10]
sub ebx, dword [edi + 0x10]
cmp ebx, dword [edi + 0x14]
jae 0x4057e5
mov ebx, dword [eax + ebx*4]
add ebx, esi
cmp ebx, edi
jbe 0x405972
lea eax, [ecx + edi]
cmp ebx, eax
jae 0x405972
push 0x104
call fcn.0040f04a
mov dword [esp + 0x14], eax
mov dword [esp], 0x100
call fcn.0040f04a
pop ecx
mov esi, eax
push 0x2e
push ebx
mov dword [esp + 0x2c], esi
call fcn.00410dd0
pop ecx
pop ecx
push 0x100
lea edi, [eax + 1]
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
call esi
sub edi, ebx
push edi
push ebx
mov ebx, dword [esp + 0x18]
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x42b5fc
push ebx
call esi
push 0x42d09c
push ebx
call esi
push 0x42d0a0
push ebx
call esi
mov ecx, dword [esp + 0x14]
push ebx
call fcn.0040576f
mov edi, eax
test edi, edi
jne 0x40592a
push eax
push ecx
push ebx
mov ebx, dword [esp + 0x20]
mov ecx, ebx
call fcn.0040613a
mov edi, eax
test edi, edi
jne 0x40592e
jmp 0x4057e5
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jle 0x40594c
cmp byte [esi], 0x23
jne 0x40594c
movsx eax, byte [esi + 1]
push eax
push 0
jmp 0x405956
push 0
mov ecx, esi
call fcn.0040307d
push eax
push edi
mov ecx, ebx
call fcn.004057c8
push esi
mov ebx, eax
call fcn.00410a63
mov eax, dword [esp + 0x14]
pop ecx
push eax
call fcn.00410a63
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc