joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ae30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4685c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.004612e6
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0043a7d0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00461214
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0045dad5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0045dad5
push 1
push 0
push 0
mov ecx, esi
call fcn.0045da7d
push 1
push 0
push 1
mov ecx, esi
call fcn.0045da7d
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00461358
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x43afb0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4685e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004612e6
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0043a7d0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00461214
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x43b074
cmp dword [esp + 0x40], 1
jne 0x43b072
cmp ecx, eax
jge 0x43b074
mov eax, ecx
cmp eax, 0xc8
jge 0x43b080
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0043ae30
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00461358
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x43b800
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x468653
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045bef5
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046158e
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00462aaa
test eax, eax
je 0x43b91c
mov ecx, dword [esp + 0x3c]
call fcn.004615bb
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43b8e0
push edi
mov ecx, esi
call fcn.0045ec25
mov ecx, esi
call fcn.0043ba80
cmp dword [esp + 0x38], 1
jne 0x43b915
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045ed60
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43e330
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43e363
push esi
call fcn.00441420
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43e35c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43e3e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43e3d2
mov eax, dword [esi + 8]
test eax, eax
je 0x43e387
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43e3ce
cmp eax, 2
je 0x43e3d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43e37a
cmp eax, 3
je 0x43e3ad
cmp eax, 1
jne 0x43e37a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43e37a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43e37a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043e410
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43e3f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043e410
add esp, 4
pop esi
ret

Function at 0x45cceb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45cd23
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045ada2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045ad7a
jmp 0x45cd2f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45e3dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45e41f
call fcn.00463e9a
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45e41f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45e416
xor eax, eax
jmp 0x45e427
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045e42d
pop edi
pop esi
pop ebx
ret 4

Function at 0x4643ca
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4643f8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x464416
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00464330
jmp 0x464416
mov eax, dword [esi + 0x14]
test eax, eax
je 0x464416
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00464330
test edi, edi
mov eax, edi
jne 0x464400
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5c88b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x125000]
push edi
or ebp, 0xffffffff
jmp 0x5c88d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c88d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c88c8
mov eax, 1
add ebx, ebx
jne 0x5c88eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c88fc
jne 0x5c891b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c891b
dec eax
add ebx, ebx
jne 0x5c8908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c88e0
add ebx, ebx
jne 0x5c8917
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c896d
xor ecx, ecx
sub eax, 3
jb 0x5c8933
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c89a2
sar eax, 1
mov ebp, eax
jmp 0x5c893e
add ebx, ebx
jne 0x5c893e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c890c
inc ecx
add ebx, ebx
jne 0x5c894c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c890c
add ebx, ebx
jne 0x5c8959
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c894e
jne 0x5c896a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c894e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c898c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c897e
jmp 0x5c88ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c898c
add edi, ecx
jmp 0x5c88ce
pop esi
mov edi, esi
mov ecx, 0x9f1b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c89aa
cmp byte [edi], 0x24
jne 0x5c89aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c89af
lea edi, [esi + 0x1b7000]
mov eax, dword [edi]
or eax, eax
je 0x5c8a27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1cb5cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1cb76c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c89dc
mov ecx, edi
jns 0x5c8a0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1cb774]
or eax, eax
je 0x5c8a21
mov dword [ebx], eax
add ebx, 4
jmp 0x5c89f9
call dword [esi + 0x1cb770]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5c8a58
cmp al, 0xef
ja 0x5c8a4b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5c8a2d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5c8a3a
mov ebp, dword [esi + 0x1cb778]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c8a8c
sub esp, 0xffffff80
jmp 0x50681c
Function at 0x403560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x484020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035d8
xor eax, eax
push ebp
push 0x4035d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403614
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x484020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x484020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404368
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x489048], 0
je 0x4043c9
cmp word [0x48921c], 0xd7b2
jne 0x404391
cmp dword [0x489224], 0
jbe 0x404391
mov eax, 0x489218
call dword [0x489234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x484070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4043f0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x484030], 0
jne 0x4043e5
push 0
push 0x484068
push 0x484070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406360
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063c6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004047d0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402fb8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4063b0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063cd
lea eax, [ebp - 0x10]
call fcn.00404560
ret

Function at 0x408364
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x408400
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.00404bac
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00404a78
lea edx, [ebp + 0x30]
mov byte [eax + esi - 1], dl
dec esi
test ebx, ebx
jne 0x40838c
cmp byte [esp], 0
je 0x4083d1
mov eax, edi
call fcn.00404a78
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x40840c
mov eax, edi
call fcn.00404a78
push eax
mov eax, edi
call fcn.00404a78
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.0040290c
mov edx, ebx
mov eax, edi
call fcn.00404bac
jmp 0x40840c
mov eax, edi
mov edx, 0x40841c
call fcn.004045b4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408d7c
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp byte [0x4842c0], 0
jne 0x408daf
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408da8
mov al, byte [esp]
mov byte [0x4842c0], al
jmp 0x408daf
mov byte [0x4842c0], 0x2c
mov al, byte [0x4842c0]
pop edx
ret

Function at 0x409298
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a10
xor eax, eax
push ebp
push 0x4092fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004045b4
mov eax, ebx
call fcn.00404a70
mov eax, dword [ebx]
call fcn.00404820
test eax, eax
jle 0x4092e4
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x4092d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409301
lea eax, [ebp - 4]
call fcn.00404560
ret
Function at 0x409a14
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a10
xor eax, eax
push ebp
push 0x409ae8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a20
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x409aca
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00404bac
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a20
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x409aca
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x409afc
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x409aca
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409aef
lea eax, [ebp - 0x1c]
call fcn.00404560
lea eax, [ebp - 4]
call fcn.00404560
ret

Function at 0x409bf4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0x40
push 0x1000
push 0x11
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [ebp - 4], ebx
mov eax, ebx
mov byte [eax], 0x58
mov byte [eax + 1], 0x68
mov dword [eax + 2], esi
mov byte [eax + 6], 0x50
mov byte [eax + 7], 0xff
mov byte [eax + 8], 0x25
lea edx, [eax + 0xd]
mov dword [eax + 9], edx
mov dword [eax + 0xd], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40a588
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x40a5d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov edi, esi
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x40a5c6
cmp word [edi], 0x5a4d
jne 0x40a5c6
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x40a5c6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40a5dc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a76c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x40a7b2
push 0x20a
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x40a7e3
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x40a840
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x40a80e
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x40a820
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x40a83a
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x411804
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x41193a
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x41182c
cmp dword [ebx + 4], 0
jne 0x41193a
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x411852
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x411852
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
sub edx, dword [ebx + 8]
mov eax, 0x100000
call fcn.004117fc
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x41193a
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
jne 0x4118f7
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x41189d
push 4
push 0x1000
push 0x100000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push 0
push 0
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, dword [ebx + 8]
jne 0x4118ed
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4118ed
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 4]
jne 0x4118ed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], eax
jmp 0x411912
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x18], edx
jmp 0x411912
push esi
mov eax, dword [ebx + 8]
push eax
push 0
push 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov dword [ebx], eax
cmp dword [ebx + 8], 0
jne 0x41193a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
add dword [ebx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
sub dword [ebx + 4], eax
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x413c20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x413c47
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
and edx, 0xff
mov edx, dword [edx*4 + 0x484d60]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x413c2b
mov eax, esi
pop esi
ret
Function at 0x414070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x41408f
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00413cb0
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x4140f1
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00413cb0
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x414140
add ebx, 0x400
dec edi
jne 0x41413e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret