joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ab28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.1000acb4
xor ecx, ecx
mov edx, eax
mov dword [0x10047694], 0x2395
mov esi, dword [eax + 0x3c]
mov dword [0x10047698], 0xffffeb9a
mov dword [0x10047694], 0x1e6a
mov esi, dword [eax + esi + 0x78]
mov dword [0x10047694], 0x359
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x10047698], 0xffffd6b4
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x1000aca9
jmp 0x1000ac2f
mov eax, dword [ebp - 0x2c]
add eax, 2
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], eax
jb 0x1000ac13
jmp 0x1000aca9
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], ch
mov eax, dword [ebp - 0x4c]
cmp eax, 0x20
setb cl
mov dl, byte [ebp - 0x4d]
and dl, cl
test dl, 1
mov dword [ebp - 0x54], eax
jne 0x1000ac41
jmp 0x1000ac6e
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edx
jmp 0x1000ac41
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
jmp 0x1000ac13
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x58]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
jne 0x1000abdd
mov al, byte [ebp - 0x46]
test al, 1
jne 0x1000ac7a
jmp 0x1000aba9
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10047698], 0x1745
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [0x10047694], 0x11fb
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b343
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x10047694], 0xdf9
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000a86f
lea ecx, [0x1000b2ec]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x60], edx
mov dword [esp + 0x70], 0x145c00
mov edx, dword [0x10047680]
mov dword [esp + 0x6c], edx
mov edx, dword [0x10047684]
mov dword [esp + 0x4c], edx
mov edx, dword [0x10047688]
mov dword [esp + 0x74], edx
mov edx, dword [0x1004768c]
mov dword [esp + 0x68], edx
mov edx, dword [0x10047690]
mov dword [esp + 0x84], edx
mov dword [0x10047694], 0xfffffbee
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1000b3ee
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1000b402
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1000b3cb
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [0x10047698], 0xffffeb9a
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x44], esi
mov dword [0x10047694], 0x11c2
mov esi, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1000a2cb
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x10047694]
add ecx, 0xffffe901
mov dword [0x10047698], ecx
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x40105b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
push edx
mov dword [ebp - 0x228], eax
call esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov dword [esp], 0
call ebx
lea ebx, [ebp - 0x210]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathW]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4012c8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.0040105b
test eax, eax
jne 0x401362
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402b7c
sub eax, 0x40211a
mov dword [esp], 0x40211a
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401362
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.0040165d
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00401ba8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c000
mov dword [esp], 0x40300c
call fcn.0040287f
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x1000149c
Capabilities:
Read .ini file

Disassembly:
push dword [0x100082f8]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [0x100082d0]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 8
Function at 0x401812
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401829
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40185e
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40185a
cmp edi, eax
jae 0x40185e
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40184c
cmp edi, eax
jb 0x401862
xor eax, eax
jmp 0x40186b
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x402acf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x402add
push 0xd
pop eax
jmp 0x402b10
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x402ae4
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x402fa6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x441050]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push ecx
push dword [esi]
mov dword [ebp - 0x21c], ecx
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.00402f68
mov ebx, eax
cmp ebx, edi
je 0x40300c
cmp dword [ebp - 0x214], edi
je 0x403005
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4030a4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403034
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402fa6
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x4030b5
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x403014
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], edi
je 0x40307f
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], edi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call fcn.00403122
mov esi, eax
cmp dword [ebp - 0x214], edi
je 0x4030a2
push dword [ebp - 0x214]
call ebx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f3bc
leave
ret 4
cmp dword [ebp - 0x214], edi
je 0x4030c9
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x4030a4

Function at 0x403122
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x44fc20], 0
jne 0x403152
push 0x43627c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40314b
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44fc24], eax
mov byte [0x44fc20], 1
mov eax, dword [0x44fc24]
test eax, eax
je 0x40316a
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x403176
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x403ffd
Capabilities:
Identify system language via api

Disassembly:
push 0
mov eax, 0x432dff
call fcn.0042e085
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 0x4a0]
push esi
lea eax, [edi + 0x28]
mov dword [edi + 0x20], vtable.IArkEvent.0
push eax
mov dword [edi], vtable.CMainDlg.0
mov dword [edi + 0x20], vtable.CMainDlg.1.0
call fcn.0040f927
lea eax, [edi + 0x3e8]
mov edx, esi
call fcn.00416ce6
lea esi, [edi + 0x470]
call fcn.00401ce7
mov byte [ebp - 4], 3
lea esi, [edi + 0x478]
call fcn.0041e94d
or dword [esi + 0x14], 0xffffffff
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0x1f4
mov dword [esi + 0x10], ebx
lea eax, [edi + 0x490]
or dword [eax + 4], 0xffffffff
mov dword [eax], ebx
mov dword [eax + 8], ebx
lea eax, [edi + 0x4a0]
mov byte [ebp - 4], 5
call fcn.00403e43
mov dword [edi + 0x450], ebx
mov dword [edi + 0x454], ebx
mov dword [edi + 0x458], ebx
mov dword [edi + 0x46c], ebx
mov dword [edi + 0x49c], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
xor edx, edx
mov ecx, 0x412
cmp ax, cx
sete dl
push 0x6b
push dword [0x442f8c]
mov dword [0x443bc0], edx
call esi
push 0x82
mov dword [edi + 0x464], eax
push dword [0x442f8c]
call esi
mov dword [edi + 0x468], eax
cmp dword [0x443bc0], ebx
jne 0x404109
call fcn.0041bc36
mov eax, edi
call fcn.0042e124
ret 4
Function at 0x404dce
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x432bf0
call fcn.0042e085
mov eax, dword [0x442f6c]
mov ecx, 0x442f6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x3e8
add eax, 4
lea ecx, [ebp - 0x10]
call fcn.004052ea
mov esi, dword [ebp - 0x10]
push 5
push 0
push 0
push esi
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
call fcn.00401cc5
xor eax, eax
call fcn.0042e124
ret 4

Function at 0x405024
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebx + 0xc], 0x202
jne 0x40507a
push esi
push edi
mov esi, eax
lea edi, [ebx + 0x18]
add esi, 0x478
push edi
call fcn.0041ec2c
lea eax, [ebp - 4]
push eax
call fcn.0041ec4e
mov eax, dword [edi]
push edi
mov dword [ebx + 0x1c], eax
call fcn.0041ec2c
push 5
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401cc5
pop edi
pop esi
mov eax, dword [ebp + 8]
and dword [eax], 0
xor eax, eax
leave
ret 4

Function at 0x405086
Capabilities:
Check os version

Disassembly:
push ebx
push esi
lea esi, [eax + 0x490]
mov eax, dword [eax + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [esi + 8], eax
call edi
movzx ebx, al
call edi
shr eax, 8
movzx eax, al
cmp ebx, 6
ja 0x4050b3
jne 0x4050db
test eax, eax
jbe 0x4050db
mov eax, dword [esi]
test eax, eax
je 0x4050c2
and dword [esi], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
push 0x43b2e4
push 0x17
push 0
push 0x43446c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4050df
or dword [esi + 4], 0xffffffff
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4052ea
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov esi, ecx
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x40533f
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
push edi
call fcn.00401ac3
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405333
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x405333
push ecx
push eax
call fcn.0041fbad
pop ecx
pop ecx
mov edx, esi
call fcn.00401ae9
mov eax, edi
pop edi
jmp 0x405346
call fcn.004019a8
xor eax, eax
pop esi
pop ebx
ret 4
Function at 0x406799
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
add ecx, 0x10
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
test eax, eax
jbe 0x4067d0
mov ebx, dword [edx]
mov dword [ecx + esi*4], ebx
inc esi
add edx, 4
cmp esi, eax
jb 0x4067c3
cmp esi, edi
jae 0x4068b3
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 - 4]
mov dword [ebp - 8], eax
test edx, edx
jne 0x406849
mov eax, edi
mov edx, 0xff
and eax, edx
movzx eax, byte [eax + str.cw]
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
mov ebx, edi
shr edi, 8
and edi, edx
shr ebx, 0x10
and ebx, edx
movzx edx, byte [edi + str.cw]
movzx ebx, byte [ebx + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x4373cc]
shl eax, 8
or eax, ebx
xor edx, edi
shl eax, 8
or eax, edx
mov edi, eax
jmp 0x40689b
cmp dword [ebp + 8], 6
jbe 0x40689b
cmp edx, 4
jne 0x40689b
mov edx, edi
shr edx, 0x10
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
mov eax, 0xff
and edx, eax
movzx edx, byte [edx + str.cw]
shl ebx, 8
or edx, ebx
mov ebx, edi
shr ebx, 8
and ebx, eax
movzx ebx, byte [ebx + str.cw]
shl edx, 8
and edi, eax
movzx eax, byte [edi + str.cw]
or edx, ebx
shl edx, 8
or edx, eax
mov edi, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4067e2
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4082bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
push edi
xor edi, edi
and edx, 7
cmp ecx, 5
jae 0x4082db
xor eax, eax
jmp 0x4083ef
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], 5
sub ecx, 4
add ecx, eax
push ebx
mov dword [ebp - 4], ecx
push esi
lea esi, [edi + eax]
jmp 0x4082fc
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x408301
inc esi
cmp esi, dword [ebp - 4]
jb 0x4082f1
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, eax
sub edi, eax
cmp esi, dword [ebp - 4]
jae 0x4083d9
cmp ecx, 2
jbe 0x408356
xor edx, edx
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x408375
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
add eax, edi
add edi, 5
cmp dword [ebp + 0x14], 0
mov ebx, ecx
je 0x408380
add ebx, eax
jmp 0x408382
shr edx, cl
test edx, edx
je 0x40831b
cmp edx, 4
ja 0x408375
cmp edx, 3
je 0x408375
mov ecx, edx
shr ecx, 1
movzx ecx, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
jne 0x40831b
or edx, 8
shr edx, 1
inc edi
jmp 0x4082ec
sub ebx, eax
test edx, edx
je 0x4083b3
and edx, 6
shl edx, 2
mov ecx, edx
mov edx, ebx
shr edx, cl
mov dword [ebp - 8], ecx
inc edx
test dl, 0xfe
jne 0x4083b1
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x14], 0
je 0x4083af
add ebx, eax
jmp 0x4083b1
sub ebx, eax
xor edx, edx
mov eax, ebx
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
mov byte [esi + 1], bl
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
mov eax, dword [ebp + 8]
mov byte [esi + 4], bl
jmp 0x4082ec
push 2
pop eax
shr edx, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x10]
sbb eax, eax
not eax
and eax, edx
pop esi
mov dword [ecx], eax
mov eax, edi
pop ebx
pop edi
leave
ret

Function at 0x40be7f
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret

Function at 0x40c9cb
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [ecx + 0x20]
and esi, 0x3f
push edi
mov edi, eax
mov byte [esi + ecx + 0x28], 0x80
jmp 0x40c9eb
and esi, 0x3f
jne 0x40c9e6
call fcn.0040bebf
mov byte [ecx + esi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x40c9dc
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
shld edx, eax, 3
shl eax, 3
bswap edx
bswap eax
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x64], eax
call fcn.0040bebf
xor edx, edx
mov eax, dword [ecx + edx*4 + 4]
mov esi, dword [ecx + edx*4]
bswap esi
bswap eax
mov dword [edi], esi
mov dword [edi + 4], eax
add edi, 8
inc edx
inc edx
cmp edx, 8
jb 0x40ca0f
pop edi
mov eax, ecx
pop esi
jmp fcn.0040be7f
Function at 0x40cac1
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], ecx
dec ecx
je 0x40cae1
sub ecx, 3
je 0x40cad8
sub ecx, 6
jne 0x40cae5
add eax, 0x10
jmp fcn.0040be7f
or dword [eax + 8], 0xffffffff
or dword [eax + 0xc], 0xffffffff
ret
or dword [eax + 4], 0xffffffff
ret

Function at 0x40ddca
Capabilities:
Hash data with crc32

Disassembly:
mov dword [esi], vtable.CArkExtractorImpl.0
mov dword [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], 0x437b10
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x4c], vtable.IArkStreamFilter.0
mov dword [esi + 0x230], eax
mov dword [esi + 0x234], eax
mov dword [esi + 0x238], eax
mov dword [esi + 0x23c], eax
mov dword [esi + 0x240], eax
mov dword [esi + 0x3c], vtable.CArkCrypto.0
mov dword [esi + 0x4c], vtable.CArkCrypto.1.0
lea ecx, [esi + 0x250]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, dword [esp + 4]
mov dword [esi + 0x260], ecx
lea ecx, [esi + 0x340]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push 0x70
push eax
mov dword [esi + 0x25c], eax
mov dword [esi + 4], eax
lea eax, [esi + 0x2d0]
push eax
mov dword [esi + 0x244], 0xff
mov dword [esi + 0x258], 0x4158a9
call fcn.00422360
add esp, 0xc
mov eax, esi
ret 4
Function at 0x413c51
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
mov edx, dword [ecx + 8]
push ebx
mov ebx, eax
mov eax, dword [ecx]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
je 0x413cdb
push edi
mov edi, 0xff
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebx]
mov ebx, dword [ebp - 4]
shr ebx, 8
movzx edx, al
xor edx, dword [ebp - 4]
and edx, edi
xor ebx, dword [esi + edx*4]
movzx edx, bl
add edx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
imul edx, edx, 0x8088405
inc edx
mov dword [ebp - 8], edx
shr edx, 0x18
xor edx, dword [ebp - 0xc]
shr ebx, 8
and edx, edi
xor ebx, dword [esi + edx*4]
dec dword [ebp + 8]
mov edx, ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], al
inc ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
jne 0x413c7e
pop edi
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
pop ebx
leave
ret 4

Function at 0x413cef
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [eax]
movzx edx, dl
xor edx, ecx
push esi
mov esi, dword [eax + 0xc]
push edi
mov edi, 0xff
and edx, edi
mov edx, dword [esi + edx*4]
shr ecx, 8
xor edx, ecx
mov ecx, dword [eax + 8]
mov dword [eax], edx
movzx edx, dl
add edx, dword [eax + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [eax + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, edi
shr ecx, 8
xor ecx, dword [esi + edx*4]
pop edi
mov dword [eax + 8], ecx
pop esi
ret

Function at 0x413d32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x441050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov cx, word [eax + 8]
or cx, 2
movzx ecx, cx
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
lea edi, [ebp + esi - 0x10]
sar ebx, 8
xor bl, byte [edi]
mov dl, bl
call fcn.00413cef
inc esi
cmp esi, 0xb
mov byte [edi], bl
jl 0x413d52
mov cx, word [eax + 8]
or cx, 2
movzx ecx, cx
mov byte [ebp - 0x11], bl
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
sar ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov dl, bl
call fcn.00413cef
cmp bl, byte [ebp + 0x10]
pop edi
pop esi
pop ebx
jne 0x413dbc
mov dl, byte [ebp - 0x11]
xor ecx, ecx
cmp dl, byte [ebp + 0xc]
setne cl
mov dword [eax + 0x10], ecx
xor eax, eax
inc eax
jmp 0x413dbe
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f3bc
leave
ret 0xc

Function at 0x414703
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x414715
xor eax, eax
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
ret