joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477460
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x53577c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x220], 0xff
mov esi, esp
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [section..rdata]
cmp esi, esp
call fcn.00504bf9
mov esi, esp
call dword [0x50f0f8]
cmp esi, esp
call fcn.00504bf9
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x7a
je 0x4774f3
mov eax, dword [ebp - 0x22c]
jmp 0x477559
mov eax, dword [ebp - 0xc]
push eax
call fcn.00456d6a
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ebp - 0x220], 0xff
mov esi, esp
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [section..rdata]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x477557
mov esi, esp
call dword [0x50f0f8]
cmp esi, esp
call fcn.00504bf9
jmp 0x477559
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x477588]
call fcn.00504c1c
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453735
add esp, 0x2fc
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret

Function at 0x4777e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x8f0]
mov ecx, 0x23c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x53577c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0x400
xor eax, eax
mov word [ebp - 0x820], ax
push 0x7fe
push 0
lea eax, [ebp - 0x81e]
push eax
call fcn.00453ec0
add esp, 0xc
mov dword [ebp - 0x82c], 0x400
mov esi, esp
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x820]
push ecx
call dword [0x50f004]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x477874
push 0x800
push 0
lea eax, [ebp - 0x820]
push eax
call fcn.00453ec0
add esp, 0xc
lea eax, [ebp - 0x820]
push eax
call fcn.00504cb0
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x4778b4]
call fcn.00504c1c
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453735
add esp, 0x8f0
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret
Function at 0x47c100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov esi, esp
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
call eax
cmp esi, esp
call fcn.00504bf9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x47c146
xor eax, eax
jmp 0x47c17e
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [0x50f3d4]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x47c16d
mov eax, dword [ebp - 0x14]
push eax
call fcn.00456987
add esp, 4
xor eax, eax
jmp 0x47c17e
mov eax, dword [ebp - 0x14]
push eax
call fcn.00456987
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret
Function at 0x47c400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50af46
mov eax, dword fs:[0]
push eax
sub esp, 0x398
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x3a4]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x53577c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
xor eax, eax
mov word [ebp - 0x228], ax
push 0x206
push 0
lea eax, [ebp - 0x226]
push eax
call fcn.00453ec0
add esp, 0xc
mov dword [ebp - 0x234], 0x208
mov dword [ebp - 0x240], 0
mov esi, esp
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push 2
push str.Version
push 0x5142f0
push 0x80000002
call dword [0x50f3b0]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x47c650
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x398], esp
lea eax, [ebp - 0x228]
push eax
call fcn.004042e0
mov dword [ebp - 0x3a0], eax
lea ecx, [ebp - 0x264]
push ecx
call fcn.0040c410
add esp, 0x20
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 4], 0
push 0x2e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x38c], esp
lea eax, [ebp - 0x264]
push eax
call fcn.00403cf0
mov dword [ebp - 0x3a0], eax
lea ecx, [ebp - 0x284]
push ecx
call fcn.0040c580
add esp, 0x24
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x284]
call fcn.00404170
cmp eax, 4
jae 0x47c567
mov dword [ebp - 0x380], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x284]
call fcn.0040cc80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.00403d20
mov eax, dword [ebp - 0x380]
jmp 0x47c652
push 0
lea ecx, [ebp - 0x284]
call fcn.004157c0
mov ecx, eax
call fcn.00405080
push eax
call fcn.00455e00
add esp, 4
mov byte [ebp - 0x28d], al
push 1
lea ecx, [ebp - 0x284]
call fcn.004157c0
mov ecx, eax
call fcn.00405080
push eax
call fcn.00455e00
add esp, 4
mov byte [ebp - 0x299], al
push 3
lea ecx, [ebp - 0x284]
call fcn.004157c0
mov ecx, eax
call fcn.00405080
push eax
call fcn.00455e00
add esp, 4
mov word [ebp - 0x2a8], ax
movzx eax, byte [ebp - 0x28d]
and eax, 0xff
movzx ecx, al
movzx edx, byte [ebp - 0x299]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
movzx ecx, cx
and ecx, 0xffff
movzx edx, cx
movzx eax, word [ebp - 0x2a8]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x240], edx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x284]
call fcn.0040cc80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.00403d20
mov eax, dword [ebp - 0x374]
jmp 0x47c652
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x47c68c]
call fcn.00504c1c
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453735
add esp, 0x3a4
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret
Function at 0x47c6f0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2ec]
mov ecx, 0xbb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x53577c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00453ec0
add esp, 0xc
mov dword [ebp - 0x228], 0x208
mov esi, esp
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 2
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall23F3F476_BE34_4f48_9C77_2806A8393EC4
push 0x80000002
call dword [0x50f3b0]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x47c7a9
mov esi, esp
lea eax, [ebp - 0x21c]
push eax
call dword [0x50f3d4]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x47c798
xor eax, eax
jmp 0x47c7ab
lea eax, [ebp - 0x21c]
push eax
call fcn.00504cb0
add esp, 4
jmp 0x47c7ab
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x47c7dc]
call fcn.00504c1c
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453735
add esp, 0x2ec
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret
Function at 0x47d600
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x398]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x53577c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x2c8], 0
push 0x2b0
push 0
lea eax, [ebp - 0x2c4]
push eax
call fcn.00453ec0
add esp, 0xc
mov esi, esp
push 0x100
push 0x2b4
lea eax, [ebp - 0x2c8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov edi, esp
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
call eax
cmp edi, esp
call fcn.00504bf9
push eax
call dword [0x50f39c]
cmp esi, esp
call fcn.00504bf9
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
jl 0x47d69d
mov eax, dword [ebp - 0x2c8]
jmp 0x47d69f
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x47d6d0]
call fcn.00504c1c
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453735
add esp, 0x398
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret

Function at 0x47d6f0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2ec]
mov ecx, 0xbb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x53577c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00453ec0
add esp, 0xc
mov dword [ebp - 0x228], 0x208
mov esi, esp
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 2
push str.DisplayIcon
push 0x5145a8
push 0x80000001
call dword [0x50f3b0]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x47d7a9
mov esi, esp
lea eax, [ebp - 0x21c]
push eax
call dword [0x50f3d4]
cmp esi, esp
call fcn.00504bf9
test eax, eax
jne 0x47d798
xor eax, eax
jmp 0x47d7ab
lea eax, [ebp - 0x21c]
push eax
call fcn.00504cb0
add esp, 4
jmp 0x47d7ab
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x47d7dc]
call fcn.00504c1c
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453735
add esp, 0x2ec
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret
Function at 0x492980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea edi, [ebp - 0x104]
mov ecx, 0x41
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
cmp dword [ecx], 0
jne 0x4929cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00492bd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x492a23
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x18]
cmp edx, dword [ecx + 0x24]
jbe 0x492a23
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x80]
cdq
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x18]
xor esi, esi
push esi
push ecx
push edx
push eax
call fcn.00454210
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
push eax
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
push edx
call fcn.00492b70
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x24], edx
cmp dword [ebp - 8], 0
jne 0x492b20
cmp dword [ebp + 0xc], 0
je 0x492b20
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax + 0x18]
ja 0x492b12
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x18]
and ecx, 0x20
jne 0x492b12
mov ecx, dword [ebp - 0x24]
sub ecx, 1
xor esi, esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
cdq
push edx
push eax
push esi
push ecx
call fcn.00454210
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 1
jne 0x492a95
mov eax, dword [ebp + 0xc]
push eax
call fcn.00492320
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x80]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
push eax
call fcn.0048fb90
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 0x24], 1
jne 0x492ae4
push 0x10
mov eax, dword [ebp - 0x40]
add eax, 0x18
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x64
push ecx
call fcn.004571c0
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax + 0x20]
jbe 0x492af8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x20], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
push ecx
call fcn.0049e610
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp + 0xc], ecx
jmp 0x492a23
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x492b48]
call fcn.00504c1c
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x104
cmp ebp, esp
call fcn.00504bf9
mov esp, ebp
pop ebp
ret
Function at 0x40672d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x40676b
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406741
mov dword [ecx*4 + 0x469c78], eax
inc ecx
cmp ecx, 0x100
jl 0x40673c
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406798
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406779
not eax
pop ebp
ret 0xc
Function at 0x4033a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406610
test esi, esi
jne 0x4033dc
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040674c
jmp 0x4033fa
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004032e8
mov edi, eax
test esi, esi
je 0x4033fa
cmp dword [ebx], 0
je 0x4033fa
dec esi
jmp 0x4033e3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403430
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x54d008], 0x8088405
inc edx
mov dword [ebx + 0x54d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403f9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x54d024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x404034
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x404014
xor eax, eax
push ebp
push 0x40400d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40406c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404014
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x54d024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x54d024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4051bc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x551054], 0
je 0x40521d
cmp word [0x551330], 0xd7b2
jne 0x4051e5
cmp dword [0x551338], 0
jbe 0x4051e5
mov eax, 0x55132c
call dword [0x551348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push 0x54d7b4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405248
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x54d030], 0
jne 0x405239
push 0
push 0x54d7ac
push 0x54d7b4
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4053c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x54d034], 0
je 0x4053ee
mov edx, esi
mov eax, ebx
call dword [0x54d034]
jmp 0x4053fd
mov eax, 8
call fcn.00403030
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x551055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405390
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4a85ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a8682
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406664
lea eax, [ebp - 4]
call fcn.00407068
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4a866c
mov eax, ebx
call fcn.00403030
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a8665
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4a864f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a8694
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4a864f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a866c
mov eax, dword [ebp - 0x10]
call fcn.0040304c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8689
lea eax, [ebp - 4]
call fcn.00406600
ret

Function at 0x4b3ea0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x556354
mov eax, esi
mov edx, 8
test al, 1
je 0x4b3ebc
shr eax, 1
xor eax, 0xedb88320
jmp 0x4b3ebe
shr eax, 1
dec edx
jne 0x4b3eaf
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4b3ea8
pop esi
ret

Function at 0x4b3ed4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x556350], 0
jne 0x4b3ef7
call fcn.004b3ea0
push 1
push 0x556350
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4b3f22
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x556354]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4b3efd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4b4cc8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x401220
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x430ee0], 0x24e1
mov eax, dword [0x430ee0]
sub eax, 0x24e1
mov dword [0x430ee0], eax
mov ecx, 1
test ecx, ecx
je 0x4012cb
mov edx, dword [0x430ee0]
cmp edx, dword [ebp + 0xc]
jb 0x401257
jmp 0x4012cb
cmp dword [0x430ee0], 0
jne 0x401275
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401275
xor eax, eax
jmp 0x4012cb
mov eax, dword [ebp + 8]
add eax, dword [0x430ee0]
mov ecx, dword [eax]
add ecx, dword [0x430ee0]
mov edx, dword [ebp + 8]
add edx, dword [0x430ee0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x141ec
mov eax, dword [0x430ee0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x430ee0]
push eax
call fcn.004012d0
add esp, 8
mov ecx, dword [0x430ee0]
add ecx, 4
mov dword [0x430ee0], ecx
jmp 0x40123d
mov esp, ebp
pop ebp
ret
Function at 0x1003b19a
Capabilities:
Encode data using xor

Disassembly:
call 0x1003b113
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1003b143
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1003b15f
xor edx, 0
jmp 0x1003b16a
xor edx, edx
jmp 0x1003b181
jmp 0x1003b18d
xor eax, eax
push 0x8427d7c0
call 0x1003b19a
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1003b1d6
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1003b1af
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1003b1ed
add eax, 0
jno 0x1003b1f2
add esi, 0
ret 0x10

Function at 0x1003bf5b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1003bf7d
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1003c11f
cmp edi, dword [ebp + 0x10]
jb 0x1003c11f
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.1003ba47
inc edi
jmp 0x1003c006
jmp 0x1003c013
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1003ba47
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1003ba47
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1003c067
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1003c04b
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1003c095
add dword [eax], 0x39
jle 0x1003c071
sub al, 0xf5
mov ch, al
call fcn.1003c0aa
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10