joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40326c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x403286
xor eax, eax
jmp 0x403406
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x40329a
xor eax, eax
jmp 0x403406
cmp word [ebx + 0x14], 0xe0
jne 0x4032aa
cmp word [ebx + 0x18], 0x10b
je 0x4032b1
xor eax, eax
jmp 0x403406
mov dword [0x452e8c], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004031f0
add esp, 8
test eax, eax
jne 0x4032dc
xor eax, eax
jmp 0x403406
mov edx, dword [0x452e8c]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00403238
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x40330e
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x403406
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x4033d8
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x4033ca
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x4033c5
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x4033bc
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4033b1
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4033b1
test cl, cl
je 0x4033a6
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4033b1
add eax, 2
add edx, 2
test cl, cl
jne 0x40338a
jne 0x4033b1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x403406
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x403370
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403348
jmp 0x403404
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x4033fc
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x4033f8
cmp dword [eax], 0
je 0x4033f8
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x403406
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x4033df
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403518
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x403535
xor eax, eax
jmp 0x403572
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x40355c
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x403572
cmp dword [esp + 4], 4
jne 0x403570
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x403572
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x4035d4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4035ed
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4035f4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x403614
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f960
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.004035ac
pop ecx
test eax, eax
je 0x403650
push ebx
call fcn.004035f4
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x40368e
push ebx
call fcn.00403488
pop ecx
test eax, eax
jne 0x403685
push ebx
call fcn.004034c0
pop ecx
test eax, eax
je 0x4036ab
push ebx
call fcn.004035f4
pop ecx
jmp 0x4036ab
push ebx
call fcn.004035d4
pop ecx
test eax, eax
jne 0x4036a4
push ebx
call fcn.00403578
pop ecx
test eax, eax
je 0x4036ab
push ebx
call fcn.004035f4
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403717
jmp 0x403706
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4036f8
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x403706
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4036da
cmp esi, dword [ebp - 4]
je 0x40373c
cmp dword [ebp - 4], 0
je 0x40373c
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x40381a
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44fb05
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x40381a
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4037f6
xor esi, esi
lea ebx, [ebp - 0x12cc]
jmp 0x4037ec
push 0x104
lea eax, [ebp - 0x13d0]
push eax
mov edx, dword [ebx]
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4037e8
lea ecx, [ebp - 0x13d0]
push ecx
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4037e8
mov dword [ebp - 0xc], 1
jmp 0x4037f6
inc esi
add ebx, 4
mov edx, dword [ebp - 8]
shr edx, 2
cmp esi, edx
jb 0x4037af
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x40381a
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0fff
dec dword [edi]
pop ds
add al, ch
or al, 0xae
add byte [eax], al
Function at 0x403874
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x403885
jne 0x403885
jmp fcn.00403809
cmp esi, 8
jb 0x4038c3
xor ebx, ebx
jmp 0x4038ba
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.004038c8
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x40388e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4038c8
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004018e0
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x40397b
mov eax, fcn.00401580
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x40397b
mov eax, fcn.00403b24
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x40397b
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x40397b
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403943
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403998
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004018e0
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a4e
mov eax, fcn.00401580
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a4e
mov eax, fcn.00403998
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a4e
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403a4e
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403a16
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403b74
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004018e0
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c2a
mov eax, fcn.00401580
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c2a
mov eax, fcn.00403b24
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c2a
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403c2a
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403bf2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4052cc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x409690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4096f2
call fcn.00409640
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004059b8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004059b8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x409750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x451948], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40982a
cmp dword [0x451944], 0
jne 0x40982a
cmp dword [0x451b38], 0
je 0x4097e4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00409540
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4097ca
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00409540
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4097ca
lea ebx, [ebp - 0x84]
jmp 0x4097cb
inc ebx
call fcn.0040970c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x409865
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x45194c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004059b8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x45194f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x409865
cmp dword [0x451944], 0
je 0x409844
cmp dword [0x451944], 0xffffffff
je 0x409865
push esi
call dword [0x451944]
pop ecx
mov eax, dword [0x451948]
test eax, eax
je 0x409865
cmp dword [0x451948], 0xffffffff
je 0x409865
cmp byte [eax], 0
je 0x409865
push esi
push eax
call fcn.00409690
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a0a8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x453908], 0
jne 0x40a129
cmp dword [0x453928], 0
jne 0x40a0d8
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x453928], eax
test eax, eax
jne 0x40a0d8
push str.GetEnvironmentStrings_failed
call fcn.0040987c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x453928]
jmp 0x40a0ec
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004059b8
pop ecx
mov edi, eax
test eax, eax
jne 0x40a0e4
lea edi, [ebp + 1]
push edi
call fcn.00404884
pop ecx
mov ebx, eax
mov dword [0x45390c], ebx
test ebx, ebx
jne 0x40a116
xor eax, eax
jmp 0x40a1ec
push edi
mov edx, dword [0x453928]
push edx
push ebx
call fcn.00405868
add esp, 0xc
jmp 0x40a149
xor esi, esi
mov ebx, dword [0x453908]
jmp 0x40a143
push eax
call fcn.004059b8
pop ecx
test eax, eax
jne 0x40a13f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a133
lea ebx, [esi + 4]
push 4
mov dword [0x453910], ebx
inc ebx
push ebx
call fcn.004043e8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40a16c
xor eax, eax
jmp 0x40a1ec
cmp dword [0x453908], 0
jne 0x40a19d
xor esi, esi
mov ebx, dword [0x45390c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40a18e
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004059b8
pop ecx
mov edi, eax
test eax, eax
jne 0x40a184
jmp 0x40a1ce
xor esi, esi
mov ebx, dword [0x453908]
mov eax, dword [esp]
mov edi, eax
jmp 0x40a1c8
push eax
call fcn.004059b8
pop ecx
test eax, eax
je 0x40a1bd
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40a1c1
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a1ac
mov eax, dword [0x453908]
test eax, eax
je 0x40a1de
push eax
call fcn.00404894
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x453908], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c96c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4525a8
sub eax, eax
test esi, esi
je 0x40ca4c
sub eax, 1
test ecx, ecx
je 0x40ca4a
test esi, 3
je 0x40c9aa
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40c98f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x40ca31
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40c9b8
mov ecx, edx
test ecx, ecx
je 0x40ca4a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40ca37
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40cd30
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040cdb3
jae 0x40cd3e
xor ecx, ecx
call fcn.0040cdb3
jae 0x40cd6d
xor eax, eax
call fcn.0040cdb3
jae 0x40cd7d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040cdb3
adc al, al
jae 0x40cd5f
jne 0x40cda9
stosb byte es:[edi], al
jmp 0x40cd41
call fcn.0040cdbf
sub ecx, ebx
jne 0x40cd86
call fcn.0040cdbd
jmp 0x40cda5
lodsb al, byte [esi]
shr eax, 1
je 0x40cdcf
adc ecx, ecx
jmp 0x40cda2
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040cdbd
cmp eax, 0x7d00
jae 0x40cda2
cmp ah, 5
jae 0x40cda3
cmp eax, 0x7f
ja 0x40cda4
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40cd41
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40d338
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40d3a7
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40d36f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40dc34
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40dcd3
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_3689
call fcn.004059b8
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x452a7c
call fcn.00405b24
add esp, 0xc
test eax, eax
jne 0x40dcd3
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x40dcd0
mov ecx, dword [ebp + 0x10]
mov esi, 0x452aa8
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040597c
add esp, 8
mov eax, 1
jmp 0x40dcde
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x40dc53
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403dcb
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 4], edi
push 0xc
mov esi, edx
mov ecx, edx
mov ebx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
movzx eax, word [ebx + 4]
mov dword [ebp - 0xc], eax
pop ebx
test eax, eax
je 0x403e42
mov eax, dword [edi + 0x18]
mov edi, dword [ebp + 8]
cmp dword [eax], edi
mov edi, dword [ebp - 4]
jne 0x403e3a
cmp dword [ebp + 0xc], edx
je 0x403e29
cmp dword [edi + 0x20], edx
je 0x403e29
test byte [eax + 4], 1
jne 0x403e3a
imul esi, ecx, 0xc
lea edi, [ebp - 0x20]
add esi, dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x403e4c
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
test byte [eax + 4], 1
jne 0x403e42
inc ecx
add eax, ebx
cmp ecx, dword [ebp - 0xc]
jb 0x403e01
mov eax, edx
test esi, esi
je 0x403f0d
cmp dword [ebp + 0xc], edx
je 0x403e59
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], edx
jne 0x403e5c
push 8
pop ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx + eax]
test al, 4
je 0x403e6f
and ecx, 0xffffcfff
test al, 2
je 0x403e79
and ecx, 0xfffff3ff
test al, 1
je 0x403e83
and ecx, 0xfffffcff
test al, 8
je 0x403e92
and ecx, 0xc0ffffff
mov dword [ebp - 0xc], edx
jmp 0x403e98
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x20], edx
je 0x403f0b
mov ebx, ecx
mov edi, ecx
shr ebx, 0xc
mov esi, ecx
shr edi, 0xa
mov eax, ebx
shr esi, 8
or eax, edi
or eax, esi
test al, 3
jne 0x403ec3
test ecx, 0x3f000000
jne 0x403ec3
test cl, 2
je 0x403f0b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, ecx
mov edx, dword [ebp - 8]
shr eax, 0x1e
mov dword [edx + 8], eax
mov eax, ecx
shr eax, 0x18
and al, 0x3f
shr ecx, 1
mov byte [edx + 4], al
and ecx, 1
mov eax, edx
mov dword [eax + 0x14], ecx
and ebx, 3
je 0x403ef4
mov dword [eax], ebx
jmp 0x403f04
and edi, 3
je 0x403efd
mov dword [eax], edi
jmp 0x403f04
and esi, 3
je 0x403f04
mov dword [eax], esi
xor eax, eax
inc eax
xor edx, edx
jmp 0x403f0d
mov eax, edx
mov edi, dword [ebp - 0x10]
mov esi, edx
mov ecx, dword [ebp - 4]
movzx edi, word [edi + 6]
mov ecx, dword [ecx + 0x1c]
test edi, edi
je 0x403f34
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x403f31
inc esi
add ecx, 0x10
cmp esi, edi
jb 0x403f23
jmp 0x403f34
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x10], edx
leave
ret 8
Function at 0x408c6c
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x408ca9
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x408ca2
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x408cae
add edx, 0x28
cmp edx, esi
jne 0x408c93
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x408cab