joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a6c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x497943
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0048af5f
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004905f5
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00491b11
test eax, eax
je 0x45a7dc
mov ecx, dword [esp + 0x3c]
call fcn.00490622
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45a7a0
push edi
mov ecx, esi
call fcn.0048dc8a
mov ecx, esi
call fcn.0045a980
cmp dword [esp + 0x38], 1
jne 0x45a7d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0048ddc5
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x45c9c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45c9f3
push esi
call fcn.0046ad60
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45c9ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45ca79
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45ca62
mov eax, dword [esi + 8]
test eax, eax
je 0x45ca17
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45ca5e
cmp eax, 2
je 0x45ca62
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45ca0a
cmp eax, 3
je 0x45ca3d
cmp eax, 1
jne 0x45ca0a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45ca0a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45ca0a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045caa0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45ca88
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045caa0
add esp, 4
pop esi
ret

Function at 0x45d310
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x45d331
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x45d331
mov eax, dword [eax + 0x44]
test eax, eax
je 0x45d331
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x48bd55
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48bd8d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00489e09
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00489de1
jmp 0x48bd99
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48d447
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48d489
call fcn.00492efc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48d489
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48d480
xor eax, eax
jmp 0x48d491
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048d497
pop edi
pop esi
pop ebx
ret 4
Function at 0x49342c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49345a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x493478
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00493392
jmp 0x493478
mov eax, dword [esi + 0x14]
test eax, eax
je 0x493478
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00493392
test edi, edi
mov eax, edi
jne 0x493462
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x474900
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x522638]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esi + 0x28], ebx
cmp eax, ebx
je 0x474930
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x474941
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], ebx
cmp dword [esi + 0x1c], ebx
je 0x47496e
cmp dword [esi + 0x20], 8
push edi
lea edi, [esi + 0xc]
jb 0x474954
mov eax, dword [edi]
jmp 0x474956
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], ebx
jb 0x474968
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
pop edi
lea ecx, [ebp - 0x414]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x474a1f
lea edx, [ebp - 0x20c]
push edx
push ebx
push 0x4fdc94
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x474a1f
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea edx, [ebp - 0x424]
push edx
push ebx
push ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x41c], 0x5456
mov dword [ebp - 0x418], 0x6d24
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20c]
mov dword [esi + 8], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4749f2
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
lea ecx, [esi + 0xc]
push eax
call fcn.00405fe0
mov ecx, dword [esi + 0x48]
mov edx, dword [esi + 4]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x2c], ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00401306
mov esp, ebp
pop ebp
ret
Function at 0x41606b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4227b8]
jne 0x416075
repz ret
jmp fcn.0041917a

Function at 0x416468
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041466b
and dword [ebp - 4], 0
cmp dword [0x423e2c], 0
mov ebx, eax
jne 0x416519
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4165ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4165ca
push eax
call fcn.004145f9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e2c], eax
call esi
push eax
call fcn.004145f9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e30], eax
call esi
push eax
call fcn.004145f9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e34], eax
call esi
push eax
call fcn.004145f9
pop ecx
mov dword [0x423e3c], eax
test eax, eax
je 0x416519
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004145f9
pop ecx
mov dword [0x423e38], eax
mov eax, dword [0x423e38]
cmp eax, ebx
je 0x416571
cmp dword [0x423e3c], ebx
je 0x416571
push eax
call fcn.00414674
push dword [0x423e3c]
mov esi, eax
call fcn.00414674
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416571
test edi, edi
je 0x416571
call esi
test eax, eax
je 0x416568
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416568
test byte [ebp - 0xc], 1
jne 0x416571
or dword [ebp + 0x10], 0x200000
jmp 0x4165aa
mov eax, dword [0x423e30]
cmp eax, ebx
je 0x4165aa
push eax
call fcn.00414674
pop ecx
test eax, eax
je 0x4165aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4165aa
mov eax, dword [0x423e34]
cmp eax, ebx
je 0x4165aa
push eax
call fcn.00414674
pop ecx
test eax, eax
je 0x4165aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e2c]
call fcn.00414674
pop ecx
test eax, eax
je 0x4165ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4165cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6fe63b2f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x5dd17178
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x43b65d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
mov ebx, 0xb734a1ef
push edx
pop ebx
call fcn.0043b691
dec ebx
xor dword [esi], edi
add ebx, ebx
sub edx, ebx
sub ebx, 1
inc esi
inc edx
mov edx, ebx
inc ebx
cmp esi, eax
jne fcn.0043b65d
add ebx, 0xad0f3e20
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402fd8
pop dword [ebp - 0x1c]
mov eax, 0x42fe7e23
add eax, 0xbd41b1b5
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfe05f523
add dword [ebp - 0x2c], 0x504c5028
mov dword [ebp - 0x28], 0x4205fe6c
sub dword [ebp - 0x28], 0xfd2b227
mov dword [ebp - 0x24], 0xc504972f
add dword [ebp - 0x24], 0x8747acff
mov dword [ebp - 0x20], 0xdb2f918a
add dword [ebp - 0x20], 0x24d06e76
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x40477b6
sub eax, 0x3c3a762
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x674391cd
add dword [ebp - 0x2c], 0xd2ed789
mov dword [ebp - 0x28], 0x1d1a436e
add dword [ebp - 0x28], 0x24521e07
mov dword [ebp - 0x24], 0x38ae0297
sub dword [ebp - 0x24], 0xd53e962b
mov dword [ebp - 0x20], 0x4c16ce05
add dword [ebp - 0x20], 0xb3e931fb
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xe6dff130
sub eax, 0xe69f20e4
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b877
push 0
call eax
mov ecx, 0x5009
mov ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x1c]
mov edx, 0xf4099e6d
sub edx, 0xeeba9ec
sub dword [ebp - 4], edx
mov edi, dword [esi]
add dword [ebp - 8], 0xa0d2ace9
xor edi, edx
add dword [ebp - 0xc], 0x2432c6e7
mov dword [ebx], edi
mov dword [ebp - 0x18], 0xe251070b
add ebx, 0x460e8d44
sub ebx, 0x460e8d40
add esi, 0xc5d449c6
sub esi, 0xc5d449c2
loop 0x4030ee
add eax, 0x69ec858b
sub eax, 0x69eb5294
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x742b8f3b
sub ecx, 0x73eb8f3b
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x43b646
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop esi
push 0x5f6385b8
pop eax
call fcn.0043b681
mov ebx, eax
or ebx, eax
inc ebx
xor dword [edi], esi
sub ebx, 0x7e4cdec0
add eax, ebx
inc eax
inc edi
or eax, ebx
add eax, 0x7db6e3ee
cmp edi, ecx
jne fcn.0043b646
push eax
pop ebx
dec ebx
inc eax
ret
Function at 0x107e5b00
Capabilities:
Encode data using xor

Disassembly:
jmp 0x107e5b0a
pushal
call 0x107e5b10
pop ebp
sub ebp, 0x10
sub ebp, 0x7e5b00
mov al, byte [esp + 0x28]
cmp al, 1
je 0x107e5b34
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x107e5b3d
mov eax, 0x7e5b00
add eax, ebp
add eax, 0x63
mov ecx, 0x603
mov edx, 0xe7208850
xor byte [eax], dl
inc eax
dec ecx
jne 0x107e5b54
jmp 0x107e5b67
fistp dword [ebp + 0x506cd9db]
push eax
push eax
rcl dword [ecx + 0x505050a8]
push ebx
popfd
call 0x60ceabd2
ljmp 0xb2a7
Function at 0x401400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x438478]
xor eax, ebp
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4014a4
xor edx, edx
mov word [ebp - 0x220], dx
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x224], 0x208
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4014a4
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCR90.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x4014a4
mov al, 1
jmp 0x4014b0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042673a
mov esp, ebp
pop ebp
ret

Function at 0x4014c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4014ee
mov byte [ebp - 9], 1
movzx edx, byte [ebp - 9]
test edx, edx
je 0x401516
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401516
xor al, al
jmp 0x401556
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 1]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401549
mov byte [ebp - 0xa], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x4084e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428038
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x438478]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x20]
call fcn.004082a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00408480
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x408571
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004082d0
mov eax, dword [ebp - 0x230]
jmp 0x408610
mov dword [ebp - 0x10], 0x100
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4085de
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004084e0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4085d5
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x234], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004082d0
mov eax, dword [ebp - 0x234]
jmp 0x408610
mov dword [ebp - 0x10], 0x100
jmp 0x408578
lea ecx, [ebp - 0x20]
call fcn.004083c0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x23c]
call fcn.00408360
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004082d0
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0042673a
mov esp, ebp
pop ebp
ret 4
Function at 0x408c10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x408c19
xor ecx, ecx
jne 0x408c19
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x408c3a
mov eax, 0xd
jmp 0x408c95
xor eax, eax
jne 0x408c21
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x408c4b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x40b020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov ecx, 0x4384b4
call fcn.0040e050
mov dword [ebp - 0x1c], eax
push 0x42c638
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40b077
push 0x42c640
movzx edx, word [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40b077
xor eax, eax
jmp 0x40b146
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40b095
xor eax, eax
jmp 0x40b146
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40b0b3
xor eax, eax
jmp 0x40b146
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40b0d4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x40b146
mov ecx, dword [ebp - 0x14]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b0f7
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x40b146
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x413970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x413980
xor eax, eax
jmp 0x413b1d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x413ade
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x42dcd0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x42dcd0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x42dcd0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x42dcd0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x42dcd0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x42dcd0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x42dcd0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x42dcd0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x413989
cmp dword [ebp + 0x10], 0
je 0x413b17
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x42dcd0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x413ae4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret