joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a14c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, ebx
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 6
je 0x40a165
push 6
push esi
call sub.kernel32.dll_SetFileAttributesA
pop esi
pop ebx
ret
Function at 0x40a788
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
dec esi
test esi, esi
jl 0x40a7a5
inc esi
xor edx, edx
xor ebx, ebx
mov bl, byte [eax + edx]
xor bx, 0x56dd
mov byte [ecx + edx], bl
inc edx
dec esi
jne 0x40a794
pop esi
pop ebx
ret

Function at 0x40a7a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x40a7b1
mov eax, dword [ebp - 4]
add esp, 0xfffff5f8
mov byte [ebp - 1], 0
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40a84b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
jne 0x40a7fb
call fcn.00403488
jmp 0x40a852
lea ecx, [ebp - 0x3a0c]
mov eax, 0x4111bc
mov edx, 0x3a00
call fcn.0040a788
push 0
lea eax, [ebp - 0xc]
push eax
push 0x3a00
lea eax, [ebp - 0x3a0c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a852
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x40aad0
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe4
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x40ab56
mov dword [esp + 0xc], 1
lea eax, [esp + 0x10]
push eax
push 0x40ab60
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp byte [esp], 0
je 0x40ab18
mov dword [esp + 0x18], 2
jmp 0x40ab1e
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [0x414bec]
mov eax, dword [eax]
call eax
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x1c
pop ebx
ret

Function at 0x40ac68
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
pop ebp
ret 4
Function at 0x40ac90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.0040536c
mov edi, eax
mov dword [ebp - 0x128], 0x128
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.0040538c
jmp 0x40ad04
push esi
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x40acf7
push 0
mov eax, dword [ebp - 0x120]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.004053ac
test eax, eax
jne 0x40acc8
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad4c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
call fcn.00403cc0
mov eax, dword [ebp + 0xc]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40aec7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40aed8
mov eax, dword [ebp + 8]
call fcn.00403cd0
mov esi, eax
push esi
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x40ae5f
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ae9c
push 0xff
lea eax, [ebp - 0x103]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x40ae45
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x103]
call fcn.0040a8c0
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0040a8d4
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 0xc]
call fcn.0040a8d4
mov eax, dword [ebp - 0x110]
pop edx
call fcn.00403db8
test eax, eax
je 0x40ae45
push 0
push 0xf060
push 0x112
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
cmp byte [ebp + 0x10], 0
je 0x40ae45
push ebp
mov eax, dword [ebp - 4]
call fcn.0040ad1c
pop ecx
push 2
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40adc0
jmp 0x40ae9c
mov eax, dword [ebp + 0xc]
call fcn.00403cd0
push eax
push esi
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ae9c
push 0
push 0xf060
push 0x112
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
cmp byte [ebp + 0x10], 0
je 0x40ae9c
push ebp
mov eax, dword [ebp - 4]
call fcn.0040ad1c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aece
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403954
lea eax, [ebp + 8]
mov edx, 2
call fcn.00403954
ret
Function at 0x40b708
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40b7f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00403cd0
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.00403a7c
mov eax, dword [ebp - 0x10]
call fcn.00405744
test al, al
je 0x40b7d9
push ebx
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
mov eax, esi
and eax, 0x80000001
jns 0x40b76c
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x40b777
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
mov eax, dword [0x414bd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40b7d2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0xffffffff
sete byte [ebp - 5]
test esi, esi
je 0x40b7b7
push esi
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7d9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x414bf8]
mov eax, dword [eax]
call eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7fe
lea eax, [ebp - 0x10]
call fcn.00403930
lea eax, [ebp - 4]
call fcn.00403930
ret

Function at 0x40b808
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
mov eax, dword [ebp - 8]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40b8fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40b8d9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
je 0x40b8c2
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403cd0
push eax
push 0
push 3
push 1
push 0x30
mov eax, dword [ebp - 4]
call fcn.00403cd0
mov esi, eax
push esi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
mov eax, dword [0x414bec]
mov eax, dword [eax]
call eax
cmp eax, 0x431
jne 0x40b8ad
push 0x10
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b8e0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x40baa8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40bbf5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00405744
test al, al
je 0x40bbdf
mov eax, dword [ebp - 4]
call fcn.0040ba04
mov edi, eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403cd0
push eax
mov eax, dword [0x414bd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x40bbd8
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40bb2e
call fcn.00403488
jmp 0x40bbdf
push 0
lea eax, [ebp - 0x10]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x10]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
movzx ebx, word [ebp - 0x142]
dec ebx
test ebx, ebx
jl 0x40bbbd
inc ebx
xor esi, esi
push 0
lea eax, [ebp - 0x10]
push eax
push 0x28
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
movzx eax, word [ebp - 0x142]
dec eax
cmp esi, eax
jne 0x40bbb9
mov eax, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x160]
add edx, eax
mov eax, edx
mov edx, edi
sub edx, eax
mov dword [ebp - 8], edx
inc esi
dec ebx
jne 0x40bb7e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bbdf
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x414bf8]
mov eax, dword [eax]
call eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bbfc
lea eax, [ebp - 4]
call fcn.00403930
ret

Function at 0x40be18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40bf72
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00403930
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
xor eax, eax
push ebp
push 0x40bec5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40beae
lea eax, [ebp - 8]
lea edx, [ebp - 0x118]
mov ecx, pe_nt_image_headers32
call fcn.00403ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40becc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
Function at 0x4dde14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00484424
xor edx, edx
push ebp
push 0x4dde86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dde90
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x411ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ac8
mov eax, 1
add ebx, ebx
jne 0x411aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ae0
jne 0x411afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ae0
xor ecx, ecx
sub eax, 3
jb 0x411b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411b82
mov ebp, eax
add ebx, ebx
jne 0x411b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411b4c
inc ecx
add ebx, ebx
jne 0x411b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411b2d
jne 0x411b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411b5d
jmp 0x411ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411b6c
add edi, ecx
jmp 0x411ace
pop esi
mov edi, esi
mov ecx, 0x203
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411b8a
cmp byte [edi], 0xa
jne 0x411b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411b8f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1140c]
or eax, eax
je 0x411bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x411bd9
call dword [esi + 0x11410]
popal
jmp 0x403ae7
Function at 0x40d85e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x433003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001020
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x101294a4], esi
jne 0x1000105f
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x10001055
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x101294a0], eax
mov dword [0x101294a4], 1
mov eax, dword [0x101294a0]
mov edi, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000107b
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x100010b5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x100010aa
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [ebp + 8]
jns 0x10001099
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
jmp 0x1000109e
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
call edx
test eax, eax
je 0x100010b5
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push edi
push eax
call ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10001170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000118b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100011c2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100011be
jmp 0x100011b0
cmp esi, eax
jae 0x100011c2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100011b0
cmp esi, eax
jb 0x100011c9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x24
cmp ecx, 1
jbe 0x10004d76
mov edx, dword [ebp + 0x10]
mov eax, 0x3e003e0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov eax, 0x1f001f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ecx - 2]
imul eax, edx
push edi
mov edi, dword [ebp + 8]
add eax, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
cmp edi, eax
jae 0x10004d5c
mov eax, edx
shr eax, 1
and eax, 3
push ebx
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 4], edi
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
shr ecx, 3
movq mm6, qword [ebp - 0x24]
movq mm7, qword [ebp - 0x1c]
movq mm0, qword [esi]
movq mm1, mm0
movq mm2, mm0
psrlw mm0, 0xa
pand mm1, mm6
pand mm2, mm7
movq mm3, qword [esi + ebx*2]
movq mm4, mm3
movq mm5, mm3
psrlw mm3, 0xa
pand mm4, mm6
pand mm5, mm7
paddw mm0, mm3
psrlw mm0, 1
psllw mm0, 0xa
paddw mm1, mm4
psrlw mm1, 1
pand mm1, mm6
paddw mm2, mm5
psrlw mm2, 1
por mm0, mm1
por mm0, mm2
movq qword [esi + ebx], mm0
lea esi, [esi + 8]
dec ecx
jne 0x10004c87
mov dword [ebp - 4], esi
test eax, eax
je 0x10004d45
mov edi, dword [ebp - 4]
movzx esi, byte [edi]
add edx, edx
dec eax
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + edi]
mov edx, eax
and edx, 0x3e0
mov ecx, esi
and ecx, 0x3e0
add ecx, edx
mov ebx, eax
mov edx, esi
and edx, 0x1f
and ebx, 0x1f
add edx, ebx
sar edx, 1
sar ecx, 1
xor cl, dl
mov edx, esi
and edx, 0x3e0
and eax, 0x3e0
add edx, eax
mov eax, dword [ebp - 0x10]
sar edx, 1
and cl, 0x1f
xor cl, dl
mov edx, dword [ebp + 0x10]
mov byte [edi + edx], cl
mov edi, dword [ebp - 4]
inc edi
mov dword [ebp - 4], edi
test eax, eax
jne 0x10004ce4
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
lea edi, [edi + edx*2]
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0xc]
jb 0x10004c71
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
pop edi
test cl, 1
jne 0x10004d74
cmp ecx, 2
jb 0x10004d74
push edx
push eax
add eax, edx
push eax
call fcn.100a7bf0
add esp, 0xc
emms
mov esp, ebp
pop ebp
ret
Function at 0x1000e360
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x428]
test eax, eax
je 0x1000e399
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000e38f
mov eax, dword [esi + 0x428]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x428], 0
cmp dword [esi + 0x444], 0
je 0x1000e415
mov ecx, dword [esi + 0x438]
test ecx, ecx
je 0x1000e3b9
mov eax, dword [esi + 0x4c8]
test eax, eax
je 0x1000e3b9
push ecx
call eax
mov ecx, dword [esi + 0x430]
test ecx, ecx
je 0x1000e3d0
mov eax, dword [esi + 0x4b0]
test eax, eax
je 0x1000e3d0
push ecx
call eax
mov ecx, dword [esi + 0x434]
test ecx, ecx
je 0x1000e3e7
mov eax, dword [esi + 0x4b0]
test eax, eax
je 0x1000e3e7
push ecx
call eax
mov ecx, dword [esi + 0x42c]
test ecx, ecx
je 0x1000e3fe
mov eax, dword [esi + 0x4a8]
test eax, eax
je 0x1000e3fe
push ecx
call eax
mov ecx, dword [esi + 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x444], 0
pop esi
ret
Function at 0x1000ffb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100db818
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101279d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10010083
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push str.DivX_MPEG_4_DVD_Video_Decompressor
push eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 4], ebx
call eax
test eax, eax
js 0x10010019
push str.divx_c32.ax
call fcn.10028f50
add esp, 4
shr edx, 0x10
xor eax, eax
ja 0x10010019
cmp edx, 4
jbe 0x10010064
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push str.Microcrap_MPEG_4_Video_Decompressor
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
jns 0x10010064
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push str.Microsoft_MPEG_4_Video_Decompressor
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x1001006b
push str.mpg4ds32.ax
call fcn.10028f50
add esp, 4
shr edx, 0x10
xor eax, eax
ja 0x1001006b
jb 0x10010064
cmp edx, 3
ja 0x1001006b
mov byte [esi + 0x308], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100100d9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x100100d9
cmp ebx, 1
jne 0x100100d9
cmp dword [esi + 0x370], 0
jne 0x100100c8
mov eax, dword [esi + 0x40]
lea ecx, [ebp - 0x10]
push ecx
push 0
lea edx, [esi + 0x374]
push edx
push 0x10024e30
mov dword [esi + 0x378], eax
push 0
lea eax, [esi + 0xe8]
push 0
mov dword [esi + 0x37c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x370], eax
mov ecx, dword [esi + 0x8c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
lea edx, [ecx + 0x34]
push edx
call eax
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
mov ecx, esi
call fcn.10085de0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8