joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d68fb40
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x78
invalid
xor eax, 0x12c08b7d
fisttp word ss:[ecx + 0x933ba5]
rcl byte [edx], 0x36
fisttp word [ecx + 0x933ba5]
cmp edx, dword [ebx + 0x2df2e200]
jbe 0x5d68fba9
loop 0x5d68fb2e
sub eax, 0x77346a76
xor al, 0x77
ja 0x5d68fb9f
pop ebp
mov dword [edx + 0x74379645], 0x2383a4a7
jle 0x5d68fb31
adc edx, ebp
pop es
jne 0x5d68fb37
inc edi
faddp st(5)
mov dh, 0xc7
push ebp
push ebp
xor dword [eax], ebx
or al, 0x7c
push ecx
jge 0x5d68fbdd
or edx, esi
je 0x5d68fb62
mov ch, 0x78
mov ecx, 0xf2c89071
cmp esp, dword [eax - 0x7e919dc]
jno 0x5d68fafb
enter 0x3bf2, 0xffffffffffffffa0
and al, 0xe6
push ss
clc
in al, dx
mov bl, 0x60
rcr dword [ecx + 0x2f], cl
inc esi
test dword [esi], esi
inc cl
adc eax, 0xfcf6a816
inc ebx
rcl dword fs:[0x18f8a1be], cl
inc eax
jno 0x5d68fb3a
sub dword [edi - 0xf8895c6], edi
mov dh, 0x58
push ebp
and byte [esp + ebp*4 - 0x212591e8], dl
mov ch, 0xf4
test al, 0xd5
jbe 0x5d68fb69
leave
in al, 0x6e
bound ebp, qword [ebx + 0xb]
out 0x3c, eax
int1
imul ecx, dword [ebx], 0xffffffe7
cmp al, 0xf1
insb byte es:[edi], dx
test al, 0xfa
mov dl, 7
inc edx
push ebx
daa
ret 0xb380
mov esp, 0x2f35771
test al, 0x17
in eax, 0xac
add eax, dword fs:[eax + 0x17f8f1c0]
push ecx
aad 2
out dx, eax
js 0x5d68fb97
invalid

Function at 0x5d690130
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
jp 0x5d690158
push es
invalid
call 0x8cdfcab3
jbe 0x5d6900f9
invalid
shr byte [edx + 0x25a01066], 1
jl 0x5d69018d
adc eax, 0xdeb250c4
cmp al, 0xcf
sub eax, 0x5c09d5ec
sar edi, 1
mov dh, 0x93
aaa
cmp dword [edi + 0x4d74e703], esp
les edi, [esi]
fstp st(5)
mov cs, word [eax + 0x55]
push cs
dec ecx
test ebp, ecx
and al, 0x73
loope 0x5d690155
into
pop ebp
push es
mov ecx, 0xb14a8ede
jl 0x5d690116
xchg ebx, eax
pop esp
je 0x5d69010c
or dword [esi + 0x21], ecx
mov esi, ecx
jno 0x5d6901da
aam 0xec
insb byte es:[edi], dx
invalid
cmovb edx, dword [ebp + 0x15fef122]
imul ebx
or dword [edx - 0x5e], ebx
cmp ah, byte [esi]
out dx, al
pop edi
pop es
call 0x4f4055db
aas
in eax, 0x69
xor ebp, dword [esi - 0x1eec283]
pushal
mov eax, 0xbcd87406
cmpsd dword [esi], dword es:[edi]
jmp 0x5d69014e
push edi
cmp dl, byte [eax]
xlatb
pop esp
nop
rcr byte [ebx - 0x6a232fc8], 0xce
sbb dl, byte [esi - 0x66]
push esi
fdiv dword [edi - 0x700ca12]
out 9, al
inc ebx
push edx
cdq
aaa
and esp, eax
mov eax, dword [0xc78be043]
inc esp
salc
lodsb al, byte [esi]
mov esp, 0x38568723
cmp dword [ecx], 0xffffffc1
jle 0x5d690220
push edx
mov esi, 0x2efe6f79
cwde
salc
cdq
jbe 0x5d690253
aam 0x50
cmp byte [esi], al
pop ds
sbb cl, cl
invalid
iretd
in eax, dx
xor al, 0xab
mov eax, dword [0xc0d5eadf]
push ebp
jle 0x5d6902b9
push edx
stc
mul byte [ebx - 0x3e]
adc dword [edx], 0x66ea1e93
in al, dx
or eax, 0x354503d5
in eax, 0x42
mov eax, dword [0x6e211a9]
dec ebp
mov word [ebp - 0x6a5ea356], ss
fdivr dword [edi + 0x99daf15]
cmp al, 0xaa
test al, 0x8e
or al, 0x78
iretd
pop esp
sti
cdq
lea ebx, [0xdbd662be]
mov esp, 0xfafd36e0
ja 0x5d690285
cmpsd dword [si], dword es:[di]
fiadd word [ebx]
pop edi
sbb byte [eax + 0x3f], ah
inc edi
fucomp st(5)
scasd eax, dword es:[edi]
invalid
Function at 0x5d698080
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0xec
pop ebp
mov byte [eax + ebp*2 - 6], 0xc0
push 0x57e3c0fa
push 0x57e3c0fa
cmp al, byte [ebp + 0xf6b421a]
inc edi
popal
adc dword [esi + eax - 0x31c70631], 0x56df4d5d
jge 0x5d69807b
xchg ebx, eax
adc byte [edx - 0x3ee48434], bh
out dx, eax
xor bl, bh
mov eax, 0xa4f3a525
inc ebx
stosb byte es:[edi], al
aam 0x28
lcall 0xd73d, 0x182aa8cd
pop ebp
loope 0x5d6980ea
jo 0x5d69807b
bswap edi
sahf
ficom word [edi - 0x2b]
mov bh, byte [ecx]
adc byte [edx], al
inc esp
push ds
daa
jns 0x5d698103
pop eax
dec ebp
or eax, 0x4b6ce264
cld
ljmp 0xce54
sar byte [0xf26abff9], 0x94
dec ecx
salc
movsd dword es:[edi], dword [esi]
mov ebp, 0x74ce89fb
les edi, gs:[edx - 0xb5b4776]
je 0x5d698151
les edi, [edx - 0xb5b4776]
cli
invalid
and eax, 0x9317b378
lds eax, [esi - 0x3df3ddf6]
scasd eax, dword es:[edi]
xor al, 0x70
push ecx
jo 0x5d698163
out dx, eax
mov al, byte [0xf914650e]
xor eax, 0x380c932f
cmp eax, 0x8999a668
xchg dword [eax + 0x1a98c13b], ecx
xor byte [eax - 0x4451928d], dl
pushal
cli
sbb ch, al
sbb al, 0x91
xchg ebx, eax
mov al, 0x95
out dx, al
outsb dx, byte [esi]
push ebp
xchg esp, eax
out 0x85, al
aad 0x56
leave
and dword [eax], edi
xchg edx, eax
jecxz 0x5d698110
retf 0x7e42
out dx, eax
xor ch, byte [ebp + 0x97a6c1e]
sbb byte [edx + 0x4ef72a32], al
cmp bl, byte [ebp + 0x36]
push 0xffffffffffffffc1
rcl byte [ecx - 0x4f], 0x59
sub bl, byte [esi]
leave
mov ebp, esi
sub dl, byte [0x90163db5]
test al, 0x9c
cmc
ror edi, 1
shl bl, cl
neg byte [ecx]
xchg edi, eax
das
out 0x96, eax
or dword [ebp - 0x20], eax
je 0x5d698190
enter 0xffffffffffffd530, 0x51
adc eax, 0x6423c83c
inc esp
in eax, 0xec
in al, dx
push ds
and ah, byte [eax + 0x29]
invalid

Function at 0x5d69c790
Capabilities:
Encode data using xor

Disassembly:
loop 0x5d69c7d8
popfd
dec esp
ja 0x5d69c7a1
clc
ljmp 0x8739
xor bl, byte [ebx + 0x2e3b2faa]
and ebp, dword [eax - 0x30]
jnp 0x5d69c7a1
jge 0x5d69c803
bts dword [edi - 0x7a], esi
mov dword es:[eax], edx
jp 0x5d69c7dc
aaa
mov ah, byte [edx + 0x2e]
push esp
iretd
shl byte [edx - 1], 0x54
mov ch, ah
and dword [ecx - 1], edi
dec edi
lodsb al, byte [esi]
xor eax, 0xb0caab51
xchg edi, eax
cmp byte [edx + ecx + 0x2602267c], al
inc esi
and edx, dword [edx - 4]
jl 0x5d69c852
sar byte [ebp + 0x23], cl
push esi
pushfd
ret 0x1ff5
stc
or eax, 0xde8f155a
or dword [esi - 0x4b], edi
cwde
jbe 0x5d69c830
in eax, 0x4a
fmul qword [edi - 0x5f]
xchg ebx, eax
push 0x7f
sub dword [edx - 9], ecx
movsb byte es:[edi], byte [esi]
inc ebx
and ecx, dword [eax - 0x21]
cwde
pushfd
shl dword [edx + 0x45], 1
inc esi
test al, 0xba
aam 0xbd
jmp 0x5d69c842
sahf
xchg ebp, eax
mov eax, dword [0x5fbbfe00]
invalid
ficom dword [ecx + 0x56cf1fcc]
mov ecx, 0x2b4d9d07
add eax, 0x1984c9ab
lock dec dword [edx]
insd dword es:[edi], dx
rcl byte [edi + 0x3d3baf3f], cl
xor al, byte [ebx + 8]
jnp 0x5d69c82e
invalid
Function at 0x401060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x406f7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40a034
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004069ec
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x4010f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x406faf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40a03c
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004069ec
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x405ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407bef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40adc4
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004069ec
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x406870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407c3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40af58
push ecx
push 8
push 1
push 5
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004069ec
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x406950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407c6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40af64
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004069ec
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x4158d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x427eb0], 0
je 0x4158e6
xor eax, eax
jmp 0x415b02
cmp dword [0x427eac], 0
je 0x4158f9
mov eax, dword [0x427eac]
jmp 0x415b02
push 0x24
push 0
push 0x427e80
call fcn.00411267
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x427e80], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x427e84], eax
cmp dword [0x427e84], 0
jne 0x41599e
mov dword [0x427eb0], 1
cmp dword [0x427e84], 0
je 0x415951
mov eax, dword [0x427e84]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x427e88], 0
mov dword [0x427e8c], 0
mov dword [0x427e90], 0
mov dword [0x427e94], 0
mov dword [0x427e98], 0
mov dword [0x427e9c], 0
mov dword [0x427ea0], 0
xor eax, eax
jmp 0x415b02
push str.ImagehlpApiVersionEx
mov ecx, dword [0x427e84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427e88], eax
push str.SymInitialize
mov edx, dword [0x427e84]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427e8c], eax
push str.SymSetOptions
mov eax, dword [0x427e84]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427e90], eax
push str.SymGetOptions
mov ecx, dword [0x427e84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427e94], eax
push str.SymLoadModule64
mov edx, dword [0x427e84]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427e98], eax
push str.SymGetModuleInfo64
mov eax, dword [0x427e84]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427e9c], eax
push str.SymFromName
mov ecx, dword [0x427e84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x427ea0], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.00411267
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x427e88], 0
je 0x415a83
cmp dword [0x427e8c], 0
je 0x415a83
cmp dword [0x427e98], 0
je 0x415a83
cmp dword [0x427e9c], 0
je 0x415a83
cmp dword [0x427ea0], 0
jne 0x415a88
jmp 0x415932
lea ecx, [ebp - 0xc]
push ecx
call dword [0x427e88]
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x415aa0
jmp 0x415932
push 0
push 0
mov eax, dword [0x427e80]
push eax
call dword [0x427e8c]
test eax, eax
jne 0x415ab9
jmp 0x415932
cmp dword [0x427e94], 0
je 0x415af3
cmp dword [0x427e90], 0
je 0x415af3
call dword [0x427e94]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x427e90]
mov dword [0x427eac], 0x427e80
mov eax, dword [0x427eac]
mov esp, ebp
pop ebp
ret
Function at 0x417e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00418060
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x417f1d
mov edx, dword [ebp - 4]
cmp edx, dword [0x4240d4]
jb 0x417e9a
mov eax, dword [ebp - 4]
cmp eax, dword [0x4240d8]
ja 0x417e9a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x417e6a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00411267
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x417ec0
jmp 0x417f1d
cmp dword [ebp - 0x14], 0x10000
jne 0x417f03
cmp dword [ebp - 0x18], 0x10000
jb 0x417f03
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x417ef6
mov eax, dword [ebp - 8]
jmp 0x417f1f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x417f18
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.00418060
add esp, 4
mov dword [ebp - 4], eax
jmp 0x417e6a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x417f60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00418090
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x418025
mov edx, dword [ebp - 4]
cmp edx, dword [0x4240d4]
jb 0x417fa5
mov eax, dword [ebp - 4]
cmp eax, dword [0x4240d8]
ja 0x417fa5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x417f75
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00411267
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x417fcb
jmp 0x418025
cmp dword [ebp - 0x14], 0x10000
jne 0x41800e
cmp dword [ebp - 0x18], 0x10000
jb 0x41800e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x418001
mov eax, dword [ebp - 8]
jmp 0x418027
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x418020
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.00418090
add esp, 4
mov dword [ebp - 4], eax
jmp 0x417f75
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x419c40
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x427ec4], eax
je 0x419c5e
mov eax, 0x10dd
jmp 0x419d43
mov eax, dword [0x427ed4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419cde
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x419cba
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x419cba
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00418640
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.004110b9
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x419c66
mov dword [0x427ed4], 0
call fcn.00419140
mov ecx, dword [0x427ed0]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x419d2d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004110b9
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x419cf6
mov dword [0x427ed0], 0
mov dword [0x427ec4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4022a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4022c4
xor eax, eax
jmp 0x402344
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4022db
xor eax, eax
jmp 0x402344
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x402327
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x402327
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4022fe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x402333
xor eax, eax
jmp 0x402344
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x402341
xor eax, eax
jmp 0x402344
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4035d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x48], 0x67452301
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x48], 0xefcdab89
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x48], 0x98badcfe
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x48], 0x10325476
pop ebp
ret

Function at 0x405170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4051a4
mov dword [ebp - 4], 0
jmp 0x4051bd
cmp dword [ebp - 8], 0xea
jne 0x4051b6
mov dword [ebp - 4], 0xffffffe4
jmp 0x4051bd
mov dword [ebp - 4], 0xfffffff2
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x405540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.DuiLib.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetInstance_struct_HINSTANCE____]
add esp, 4
push 0x449df8
push 0x96
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4055cd
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.DuiLib.dll_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4055c3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.DuiLib.dll_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4055c3
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call dword [sym.imp.DuiLib.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceZip_void___unsigned_int_]
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret

Function at 0x4055e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x4053a0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0x449e08
lea eax, [ebp - 0x10]
push eax
call fcn.00405fe0
add esp, 8
mov ecx, eax
call fcn.004017b0
push eax
call fcn.004060a0
add esp, 0xc
test eax, eax
jne 0x405623
mov dword [ebp - 0xc], 1
jmp 0x40562a
mov dword [ebp - 0xc], 0
mov cl, byte [ebp - 0xc]
mov byte [ebp - 1], cl
lea ecx, [ebp - 0x10]
call fcn.004020b0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x405647
xor eax, eax
jmp 0x405701
push str.SeDebugPrivilege
call fcn.00405310
add esp, 4
test eax, eax
jne 0x40565f
xor eax, eax
jmp 0x405701
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x405680
jmp 0x4056ef
push str..ACP
push 0
call fcn.004241f9
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00405710
add esp, 4
push str...XiaoShuPendantUI
mov eax, dword [ebp + 8]
push eax
call fcn.00405540
add esp, 8
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov ecx, 0x455c30
call fcn.0040b0b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x4056eb
mov edx, dword [ebp + 0x10]
push edx
mov ecx, 0x455c30
call fcn.0040b130
mov ecx, 0x455c30
call fcn.0040b110
xor eax, eax
jne 0x405678
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10