joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c8a8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c9ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x76bb8c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x76bba4]
jne 0x40c8f4
mov eax, esi
mov edx, 0x76bba6
mov ecx, 0x55
call fcn.0040aa00
push 0x76bb8c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40c996
push 0x76bb8c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409914
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c963
cmp byte [0x76bb88], 0
je 0x40c928
mov edx, esi
mov eax, ebx
call fcn.0040c78c
jmp 0x40c963
mov edx, esi
mov eax, ebx
call fcn.0040c590
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40c963
cmp dword [esi], 0
je 0x40c94c
mov eax, esi
mov edx, 0x40c9c4
call fcn.0040ab58
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c590
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040ab58
push 0x76bb8c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x76bba4], bx
mov eax, dword [esi]
call fcn.0040a944
mov ecx, eax
mov eax, 0x76bba6
mov edx, 0xaa
call fcn.0040c410
push 0x76bb8c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9b3
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x40cbdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099f8
xor eax, eax
push ebp
push 0x40ce01
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40cc1c
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40cc36
mov eax, dword [ebp - 4]
call fcn.0040a944
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c410
cmp word [ebp - 0x21a], 0
je 0x40cdeb
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ce10
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cd05
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ce10
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cd05
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ce4c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cd05
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ce4c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cd05
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ce80
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cd05
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ceb4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40cdeb
xor eax, eax
push ebp
push 0x40cde4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c9ec
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40cd74
mov eax, dword [ebp - 0x10]
call fcn.00406718
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a9ac
jmp 0x40cdbf
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40cef4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40cdbf
mov eax, dword [ebp - 0x10]
call fcn.00406718
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40cef4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a9ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cdeb
cmp dword [ebp - 8], 0
je 0x40cdda
mov eax, dword [ebp - 8]
call fcn.00406734
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ce08
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x40d0f0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099f8
xor eax, eax
push ebp
push 0x40d1b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040aa00
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040abb0
mov eax, dword [ebx]
call fcn.0040cfb8
test al, al
jne 0x40d18d
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040aa00
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040abb0
mov eax, dword [ebx]
call fcn.0040cfb8
test al, al
jne 0x40d18d
mov eax, ebx
call fcn.00409914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d1b7
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409974
lea eax, [ebp - 4]
call fcn.00409914
ret

Function at 0x4143a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x414440
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.0040a4dc
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.00409ee8
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x4143ca
cmp byte [esp], 0
je 0x41440f
mov eax, edi
call fcn.00409ee8
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x41444c
mov eax, edi
call fcn.00409ee8
push eax
mov eax, edi
call fcn.00409ee8
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.0040690c
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.0040a4dc
jmp 0x41444c
mov eax, edi
mov edx, 0x414460
call fcn.00409d98
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x414464
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x414507
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.0040aad8
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00409ee0
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x41448c
cmp byte [esp], 0
je 0x4144d5
mov eax, edi
call fcn.00409ee0
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x414513
mov eax, edi
call fcn.00409ee0
push eax
mov eax, edi
call fcn.00409ee0
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call fcn.0040690c
mov edx, ebx
mov eax, edi
call fcn.0040aad8
jmp 0x414513
mov eax, edi
mov edx, 0x414528
call fcn.00409cf4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4154fc
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x75ff74], 0
jne 0x415534
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41552b
movzx eax, word [esp]
mov word [0x75ff74], ax
jmp 0x415534
mov word [0x75ff74], 0x2c
movzx eax, word [0x75ff74]
pop edx
ret
Function at 0x415b08
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x415b10
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415d22
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x415b53
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x75fd04]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040aa1c
jmp 0x415cef
test ebx, 0xc0000000
je 0x415b9b
lea edx, [ebp - 0x10]
mov eax, dword [0x75ff8c]
call fcn.00415d40
mov eax, dword [ebp - 0x10]
call fcn.0040a3a8
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x75fd70]
call fcn.00415d40
mov eax, dword [ebp - 0x14]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_2
test eax, eax
je 0x415b9b
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x415be0
cmp ebx, 0xbb7
ja 0x415be0
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x75ff88]
call fcn.00415d40
mov eax, dword [ebp - 0x18]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x415be5
or edi, 0x800
jmp 0x415be5
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x415ce8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x415c88
xor eax, eax
push ebp
push 0x415c81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040a9ac
mov eax, dword [esi]
call fcn.00409e0c
mov ebx, eax
test ebx, ebx
jbe 0x415c6a
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x415c51
mov eax, esi
call fcn.00409ee0
mov word [eax + ebx*2 - 2], 0x20
jmp 0x415c65
cmp di, 0xa
jne 0x415c65
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.0040ad68
dec ebx
test ebx, ebx
ja 0x415c34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415ccb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree_1
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x75ff90]
call fcn.00415d40
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040aa1c
push dword [ebp - 0x1c]
push 0x415d3c
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.00414e7c
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.0040ac38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415cef
cmp dword [ebp - 8], 0
je 0x415ce7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415d29
lea eax, [ebp - 0x24]
call fcn.00409914
lea eax, [ebp - 0x20]
call fcn.00409938
lea eax, [ebp - 0x1c]
call fcn.00409914
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004099a4
ret
Function at 0x415d40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00409d98
mov eax, ebx
call fcn.00409ef8
mov eax, dword [ebx]
call fcn.00409e24
test eax, eax
jle 0x415d71
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x415d66
pop esi
pop ebx
ret

Function at 0x4170e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4171e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
call fcn.0040bc88
mov esi, eax
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x30]
mov ecx, 1
mov edx, dword [0x4168f4]
call fcn.0040bea4
add esp, 4
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x38]
mov dword [edx + eax*8], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [edx + eax*8 + 4], ecx
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + eax*8 + 0xc], ecx
test edi, edi
jne 0x41716a
test esi, esi
jle 0x41716a
lea edi, [esi + esi*2]
mov eax, dword [ebx + 0x30]
lea eax, [eax + edi*8 + 0x10]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + edi*8 - 8]
call fcn.00409cf4
jmp 0x41717b
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x30]
lea eax, [edx + eax*8 + 0x10]
mov edx, edi
call fcn.00409cf4
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add dword [ebx + 0x38], eax
adc dword [ebx + 0x3c], edx
test esi, esi
jne 0x4171d3
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4171ae
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x10]
call fcn.0040a944
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.user32.dll_SetWindowTextW
jmp 0x4171d3
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x10]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 4]
call fcn.0040a3a8
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.user32.dll_SetWindowTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4171f0
lea eax, [ebp - 4]
call fcn.00409938
ret
Function at 0x419c70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x419c78
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x419e6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409914
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x419cd2
lea eax, [ebp - 0x20]
mov edx, ebx
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call dword [0x760004]
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040aa1c
jmp 0x419e33
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040a944
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x419e33
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040aad8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x419e33
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x419e7c
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x419d71
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x419d43
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x419d71
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, esi
call fcn.00419954
jmp 0x419e33
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x419e80
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x419e33
cmp dword [ebp - 0x14], 0
je 0x419e33
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x419ec0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004120b8
mov edx, dword [ebp - 0x14]
movzx edx, word [edx]
call fcn.004120ac
mov cx, 0x30
mov edx, 8
call fcn.00414d38
mov eax, dword [ebp - 0x30]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.0040ad20
push dword [ebp - 0x2c]
push 0x419ef0
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040ac38
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.0040aa50
mov eax, dword [ebp - 0x24]
call fcn.0040a630
push eax
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x419e33
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x18]
call fcn.0040a9ac
mov eax, dword [ebp - 0x34]
mov ebx, dword [0x768b58]
mov ebx, dword [ebx]
mov edx, esi
call ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419e72
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409974
lea eax, [ebp - 0x24]
call fcn.0040995c
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004099a4
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x419f0c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0x40
push 0x1000
push 0x11
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [ebp - 4], ebx
mov eax, ebx
mov byte [eax], 0x58
mov byte [eax + 1], 0x68
mov dword [eax + 2], esi
mov byte [eax + 6], 0x50
mov byte [eax + 7], 0xff
mov byte [eax + 8], 0x25
lea edx, [eax + 0xd]
mov dword [eax + 9], edx
mov dword [eax + 0xd], edi
lea eax, [ebp - 8]
push eax
push 0x20
push 0x11
push 0
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x41aab4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x41ab00
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.0041bae0
test al, al
jne 0x41aaf6
cmp word [edi], 0x5a4d
jne 0x41aaf6
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x41aaf6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41ab0c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41acb8
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x760020], 0
jne 0x41ad99
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41ad0b
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW_1
mov esi, eax
jmp 0x41ad3c
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x41ad99
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41ad67
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x41ad79
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x41ad93
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x41b328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41b442
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409938
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x41b371
push ebx
mov eax, edi
call fcn.0040a944
push eax
push esi
call sub.kernel32.dll_FindResourceW
mov ebx, eax
jmp 0x41b3de
movzx eax, bl
cmp ebx, eax
jne 0x41b39b
push ebx
lea eax, [ebp - 4]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 4]
call fcn.0040a3a8
push eax
push esi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
jmp 0x41b3de
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040a9ac
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 8]
call fcn.0040a3a8
push eax
lea eax, [ebp - 0x10]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x10]
call fcn.0040a3a8
push eax
push esi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x41b417
push ebx
push esi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x41b417
push 0
push ebx
push esi
call sub.kernel32.dll_SizeofResource
push eax
push edi
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp + 8]
pop ecx
call fcn.00409af0
mov eax, edi
call fcn.004120c4
push edi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b449
lea eax, [ebp - 0x10]
call fcn.00409938
lea eax, [ebp - 0xc]
call fcn.00409914
lea eax, [ebp - 8]
mov edx, 2
call fcn.004099a4
ret

Function at 0x42312c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x423150
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
movzx edx, dl
mov edx, dword [edx*4 + 0x7614b8]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x423137
mov eax, esi
pop esi
ret
Function at 0x423d50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ebx, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x423d6c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00423990
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x48], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x44], ecx
inc edi
cmp edi, 9
jne 0x423dcd
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1048]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00423990
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x423e13
add ebx, 0x400
dec edi
jne 0x423e11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret