joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8cc732
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
movzx eax, byte [esi + 0x14]
movzx ecx, byte [esi + 0x15]
movzx edx, byte [esi + 0x16]
shl eax, 8
add eax, ecx
movzx ecx, byte [esi + 0x17]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0x3ffc]
shl eax, 8
add eax, ecx
movzx ecx, byte [esi + 0x3ffd]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 0x3ffe]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 0x3fff]
shl edx, 8
add edx, ecx
cmp eax, edx
je 0x8cc792
mov eax, 1
pop esi
add esp, 0x10
ret
mov eax, dword [0x7625ac]
test eax, eax
push edi
je 0x8cc82d
lea edx, [esp + 8]
push edx
call fcn.0089dfe2
add esp, 4
test eax, eax
je 0x8cc82d
lea edi, [esi + 0x10]
push edi
call fcn.008b9a42
mov ecx, dword [esp + 0xc]
add esp, 4
cmp ecx, eax
ja 0x8cc82d
jb 0x8cc7cf
mov eax, dword [esp + 0xc]
cmp eax, edx
jae 0x8cc82d
push 0x75a7d0
call fcn.0088e022
push edi
call fcn.008b9a42
mov ecx, dword [esp + 0x10]
add esp, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
push eax
push ecx
push edx
push edi
call fcn.008b9a42
movzx edx, byte [esi + 4]
movzx ecx, byte [esi + 6]
add esp, 4
push eax
movzx eax, byte [esi + 5]
shl edx, 8
add edx, eax
movzx eax, byte [esi + 7]
shl edx, 8
add edx, ecx
shl edx, 8
add edx, eax
push edx
push 0x651ca0
push 0x75a7d0
call fcn.00924278
add esp, 0x1c
movzx edi, byte [esi + 0x3ff8]
movzx ecx, byte [esi + 0x3ff9]
movzx edx, byte [esi + 0x3ffa]
movzx eax, byte [esi + 0x3ffb]
shl edi, 8
add edi, ecx
movzx ecx, byte [esi + 0x10]
shl edi, 8
add edi, edx
movzx edx, byte [esi + 0x11]
shl ecx, 8
add ecx, edx
movzx edx, byte [esi + 0x13]
shl edi, 8
add edi, eax
movzx eax, byte [esi + 0x12]
shl ecx, 8
add ecx, eax
shl ecx, 8
add ecx, edx
cmp edi, ecx
je 0x8cc893
push esi
call fcn.008cc6e2
add esp, 4
cmp edi, eax
je 0x8cc893
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret
movzx edi, byte [esi]
movzx eax, byte [esi + 1]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl edi, 8
add edi, eax
shl edi, 8
add edi, ecx
shl edi, 8
add edi, edx
je 0x8cc8c0
push esi
call fcn.008cc5e2
add esp, 4
cmp edi, eax
jne 0x8cc888
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x8d13d2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push esi
mov esi, eax
xor esi, ecx
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
mov eax, dword [esp + 0xc]
xor esi, 0x573ed587
add esi, ecx
xor ecx, ecx
test eax, eax
jbe 0x8d1470
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0xc]
push ebp
mov ecx, eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
mov edi, edi
mov edi, dword [ebx + 4]
cmp edi, 0xffffffff
je 0x8d145f
mov edx, dword [ebx]
xor eax, eax
test edi, edi
jbe 0x8d1446
movzx ecx, byte [edx]
mov ebp, ecx
xor ebp, eax
xor ebp, 0xff946a4f
shl ebp, 8
add ebp, eax
xor ebp, 0x573ed587
add ebp, ecx
inc edx
dec edi
mov eax, ebp
jne 0x8d1422
mov ecx, dword [esp + 0x20]
mov edx, eax
xor edx, esi
xor edx, 0xff946a4f
shl edx, 8
add edx, esi
xor edx, 0x573ed587
add edx, eax
mov esi, edx
mov eax, dword [esp + 0x18]
add ebx, 0x18
dec eax
mov dword [esp + 0x18], eax
jne 0x8d1412
pop edi
pop ebp
pop ebx
mov edx, dword [esp + 0x10]
test edx, edx
jbe 0x8d14b6
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0xc]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x8d14b6
cmp eax, edx
jbe 0x8d1495
mov eax, edx
push eax
push ecx
call fcn.0089a9f2
mov ecx, eax
xor eax, esi
xor eax, 0xff946a4f
shl eax, 8
add eax, esi
add esp, 8
xor eax, 0x573ed587
add eax, ecx
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x8d14c2
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
movzx eax, byte [edx - 4]
movzx ecx, byte [edx - 3]
shl eax, 8
add eax, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
shr eax, 1
and eax, 0x3ff
cmp ebp, eax
push esi
push edi
jbe 0x8d14f4
mov ebp, eax
xor edi, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edi
jmp 0x8d1502
jne 0x8d14fe
xor edi, edi
mov dword [esp + 0x1c], edi
jmp 0x8d1502
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov esi, eax
xor esi, ecx
xor esi, 0xff946a4f
shl esi, 8
add esi, ecx
xor esi, 0x573ed587
add esi, eax
xor ebx, ebx
test ebp, ebp
jbe 0x8d1591
lea eax, [esp + 0x20]
push eax
push ebx
push edx
call fcn.008f2d92
mov edi, dword [esp + 0x2c]
add esp, 0xc
cmp edi, 0xffffffff
je 0x8d1584
mov edx, eax
xor eax, eax
test edi, edi
jbe 0x8d156b
movzx ecx, byte [edx]
mov ebp, ecx
xor ebp, eax
xor ebp, 0xff946a4f
shl ebp, 8
add ebp, eax
xor ebp, 0x573ed587
add ebp, ecx
inc edx
dec edi
mov eax, ebp
jne 0x8d1547
mov ebp, dword [esp + 0x18]
mov ecx, eax
xor ecx, esi
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, esi
xor ecx, 0x573ed587
add ecx, eax
mov esi, ecx
mov edx, dword [esp + 0x14]
inc ebx
cmp ebx, ebp
jb 0x8d1527
mov edi, dword [esp + 0x1c]
test edi, edi
jbe 0x8d15db
lea eax, [esp + 0x20]
push eax
push ebx
push edx
call fcn.008f2d92
mov ecx, dword [esp + 0x2c]
add esp, 0xc
cmp ecx, 0xffffffff
je 0x8d15db
cmp ecx, edi
jbe 0x8d15b7
mov ecx, edi
mov dword [esp + 0x20], ecx
push ecx
push eax
call fcn.0089a9f2
mov ecx, eax
xor eax, esi
add esp, 8
xor eax, 0xff946a4f
shl eax, 8
pop edi
add eax, esi
pop esi
xor eax, 0x573ed587
pop ebp
add eax, ecx
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x8d81f2
Capabilities:
Decompress data using quicklz

Disassembly:
sub esp, 0x14
push esi
mov esi, eax
push edi
lea eax, [esi + 0x65]
push eax
mov edi, ecx
call fcn.00894872
movzx ecx, byte [eax - 4]
movzx edx, byte [eax - 3]
sub eax, 4
mov eax, dword [edi + 4]
shl ecx, 8
add ecx, edx
shr ecx, 1
and ecx, 0x3ff
add esp, 4
cmp ecx, eax
je 0x8d825e
push 0x653bd0
push 0x75a7d0
call fcn.00924278
push esi
call fcn.008cc8d2
push edi
push 0x75a7d0
call fcn.008a78a2
push 0x75a7d0
push 0x653b08
call fcn.00925512
add esp, 0x1c
pop edi
pop esi
add esp, 0x14
ret
push ebp
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 4
xor ebp, ebp
push edi
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
call fcn.009054c2
mov edx, dword [esp + 0x30]
mov eax, dword [edi + 4]
add esp, 0x20
cmp edx, eax
jne 0x8d82b6
mov eax, dword [esp + 0xc]
push ebx
push eax
call fcn.008aa482
add esp, 8
pop ebp
pop edi
pop esi
add esp, 0x14
ret
push edi
call fcn.008a72a2
push ebx
push ebp
push eax
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.00905f12
add esp, 0x18
test eax, eax
jne 0x8d83e0
push ebx
push esi
call fcn.008f5112
lea edx, [esp + 0x14]
push edx
push 4
push edi
push esi
call fcn.008a8b62
push edi
call fcn.008a72a2
push ebx
push ebp
push eax
lea eax, [esp + 0x34]
push edi
push eax
call fcn.00905f12
add esp, 0x30
test eax, eax
jne 0x8d83e0
push 0x75a7d0
call fcn.0088e022
push edi
call fcn.008a72e2
add esp, 8
push eax
push 1
push esi
call fcn.008a8ad2
add esp, 8
push eax
push 0x653ab8
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
push 0x653a94
call fcn.00925512
push edi
push 0x75a7d0
call fcn.008a78a2
push 0x75a7d0
push 0x653a08
call fcn.00925512
push esi
call fcn.008945b2
push eax
call fcn.008a86e2
push esi
mov edi, eax
call fcn.008945b2
push eax
call fcn.008944d2
mov ecx, ebx
mov edx, edi
call fcn.008d4652
push esi
mov edi, eax
call fcn.008945b2
push eax
call fcn.008944d2
and eax, 0x3fff
shl eax, 2
mov ecx, eax
shr ecx, 3
movzx edx, byte [ecx + edi + 0x5e]
and eax, 7
mov esi, edx
lea ecx, [eax + 1]
shr esi, cl
mov ecx, eax
shr edx, cl
add esp, 0x40
and esi, 1
and edx, 1
lea ecx, [esi + edx*2]
push ecx
push 0x6539f4
push 0x75a7d0
call fcn.00924278
push 0x75a7d0
push 0x6539b4
call fcn.00925512
add esp, 0x14
pop ebp
pop edi
pop esi
add esp, 0x14
ret
Function at 0x8feb52
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor ecx, ecx
lea edx, [ebx + 2]
mov edi, 0x30
lea esp, [esp]
movzx esi, byte [edx - 2]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, esi
movzx esi, byte [edx - 1]
mov ecx, esi
xor ecx, eax
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, eax
xor ecx, 0x573ed587
add ecx, esi
movzx esi, byte [edx]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, esi
movzx esi, byte [edx + 1]
mov ecx, esi
xor ecx, eax
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, eax
xor ecx, 0x573ed587
add ecx, esi
movzx esi, byte [edx + 2]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 3]
xor eax, 0x573ed587
add eax, esi
mov esi, ecx
xor esi, eax
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add ecx, esi
add edx, 6
dec edi
jne 0x8feb62
movzx eax, byte [ebx + 0x120]
movzx edx, byte [ebx + 0x121]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0x122]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0x123]
shl eax, 8
add eax, edx
cmp ecx, eax
je 0x8fec3b
pop edi
xor eax, eax
pop esi
ret
lea edx, [ebx + 8]
xor ecx, ecx
mov edi, 0x47
movzx esi, byte [edx]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
xor eax, 0x573ed587
add eax, esi
movzx esi, byte [edx + 1]
mov ecx, esi
xor ecx, eax
xor ecx, 0xff946a4f
shl ecx, 8
add ecx, eax
xor ecx, 0x573ed587
add ecx, esi
movzx esi, byte [edx + 2]
mov eax, esi
xor eax, ecx
xor eax, 0xff946a4f
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 3]
xor eax, 0x573ed587
add eax, esi
mov esi, ecx
xor esi, eax
xor esi, 0xff946a4f
shl esi, 8
add esi, eax
xor esi, 0x573ed587
add ecx, esi
add edx, 4
dec edi
jne 0x8fec45
movzx eax, byte [ebx + 0x124]
movzx edx, byte [ebx + 0x125]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0x126]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0x127]
shl eax, 8
add eax, edx
xor edx, edx
cmp ecx, eax
sete dl
pop edi
pop esi
mov eax, edx
ret

Function at 0x901ee2
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [0x7607d4]
push edi
mov edi, dword [esp + 0x10]
inc esi
mov dword [0x7607d4], esi
mov eax, dword [edi + 0x30]
mov esi, dword [edi + 0x54]
mov ebx, dword [eax + 0x34]
push edi
call fcn.00901d82
mov esi, eax
add esp, 4
cmp esi, 0xa
mov dword [ebx + 0xbc], esi
je 0x901fba
push esi
push 0x65aa00
push 0x75a7d0
call fcn.00924278
add esp, 0xc
cmp esi, 0xd
jne 0x901f4a
push 0x65a9a8
push 0x75a7d0
call fcn.00924278
add esp, 8
push 1
call fcn.00924238
push 0x75a7d0
call fcn.0088e022
add esp, 4
push 0x14e
push 0x65a990
call fcn.0088de12
push eax
call fcn.0088de02
mov ecx, dword [0x67fa0c]
add esp, 4
push eax
push ecx
push 0x75a7d0
call fcn.00924278
mov edx, dword [0x67fa10]
push edx
push 0x75a7d0
call fcn.00924278
mov eax, dword [0x7608c8]
mov dword [0x7608c4], 1
mov ecx, dword [eax]
add esp, 0x1c
test ecx, ecx
je 0x901fb4
mov dword [0x7608c8], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x916972
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x762610]
sub esp, 0xc38
test eax, eax
jne 0x916b30
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0xc
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc48]
mov edx, dword [eax + 0x20]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x40]
mov dword [0x762610], 1
mov ecx, 1
push ebp
mov ebp, dword [esp + 0x10]
movzx eax, cl
mov al, byte [eax + ebp + 1]
test al, 7
je 0x9169df
mov ebp, dword [esp + 0x18]
mov byte [esp + ebp + 0x48], cl
inc ebp
mov dword [esp + 0x18], ebp
test al, 3
je 0x9169f3
mov ebp, dword [esp + 0x1c]
mov byte [esp + ebp + 0x148], cl
inc ebp
mov dword [esp + 0x1c], ebp
test al, 0x20
je 0x916a07
mov ebp, dword [esp + 0x24]
mov byte [esp + ebp + 0x348], cl
inc ebp
mov dword [esp + 0x24], ebp
test al, 4
je 0x916a1b
mov ebp, dword [esp + 0x28]
mov byte [esp + ebp + 0x448], cl
inc ebp
mov dword [esp + 0x28], ebp
test al, 0x17
je 0x916a2f
mov ebp, dword [esp + 0x2c]
mov byte [esp + ebp + 0x548], cl
inc ebp
mov dword [esp + 0x2c], ebp
test al, 2
je 0x916a43
mov ebp, dword [esp + 0x30]
mov byte [esp + ebp + 0x648], cl
inc ebp
mov dword [esp + 0x30], ebp
test al, 0x57
je 0x916a57
mov ebp, dword [esp + 0x34]
mov byte [esp + ebp + 0x748], cl
inc ebp
mov dword [esp + 0x34], ebp
test al, 0x10
je 0x916a63
mov byte [esp + ebx + 0x848], cl
inc ebx
test al, 8
je 0x916a6f
mov byte [esp + edi + 0x948], cl
inc edi
test al, 1
je 0x916a7b
mov byte [esp + esi + 0xa48], cl
inc esi
test al, al
jns 0x916a87
mov byte [esp + edx + 0xb48], cl
inc edx
inc ecx
cmp ecx, 0xff
jbe 0x9169c3
mov dword [esp + 0x44], edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x48]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], edi
mov byte [esp + 0x248], 0x20
mov byte [esp + 0x249], 9
mov dword [esp + 0x20], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
xor ebx, ebx
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov ebp, dword [eax]
lea ecx, [ebp + 1]
push ecx
call fcn.00925b97
add esp, 4
test eax, eax
je 0x916b37
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov byte [eax + ebp], 0
mov dword [ebx + 0x68303c], eax
add ebx, 0x10
add edx, 0x100
add ecx, 4
cmp ebx, 0xc0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jb 0x916ad2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc38
ret
push 0x65da3c
push 0x75a7d0
call fcn.00924278
add esp, 8
push 1
call fcn.00924238
int3
Function at 0x934598
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x9345c6
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x9345cd
cmp ebx, dword [eax + 4]
jae 0x9345cd
xor eax, eax
jmp 0x9347bd
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x9345de
xor eax, eax
inc eax
jmp 0x9347bc
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x9345f4
cmp ecx, edx
jae 0x934739
cmp dword [eax + 4], 0
je 0x9345fd
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x9345e5
cmp dword [ebp + 8], 0
je 0x93461f
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x934739
cmp eax, esi
jae 0x934739
mov eax, dword [0x762b88]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x934644
cmp dword [esi*4 + 0x762b90], edi
je 0x93473d
inc esi
cmp esi, eax
jl 0x934632
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x5df164]
test eax, eax
je 0x9347b9
cmp dword [ebp - 8], 0x1000000
jne 0x9347b9
test byte [ebp - 0xc], 0xcc
je 0x9346c2
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x9347b9
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x9347b9
cmp word [eax + 0x18], 0x10b
jne 0x9347b9
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x9347b9
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x9346c2
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x9346c2
test byte [ecx + 0x27], 0x80
jne 0x934739
push 1
push 0x762bd0
call dword [0x5df168]
test eax, eax
jne 0x9345d6
mov ecx, dword [0x762b88]
test ecx, ecx
mov edx, ecx
jle 0x9346f6
lea eax, [ecx*4 + 0x762b8c]
cmp dword [eax], edi
je 0x9346f6
dec edx
sub eax, 4
test edx, edx
jg 0x9346ea
test edx, edx
jne 0x934727
push 0xf
pop ebx
cmp ecx, ebx
jg 0x934703
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x93471b
lea eax, [edx*4 + 0x762b90]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x934709
cmp ecx, 0x10
jge 0x934727
inc ecx
mov dword [0x762b88], ecx
push 0
push 0x762bd0
call dword [0x5df168]
jmp 0x9345d6
xor eax, eax
jmp 0x9347bc
test esi, esi
jle 0x9345d6
mov ebx, dword [0x5df168]
push 1
push 0x762bd0
call ebx
test eax, eax
jne 0x9345d6
cmp dword [esi*4 + 0x762b90], edi
je 0x934793
mov eax, dword [0x762b88]
lea esi, [eax - 1]
test esi, esi
jl 0x934781
cmp dword [esi*4 + 0x762b90], edi
je 0x93477d
dec esi
jns 0x934771
test esi, esi
jge 0x934791
cmp eax, 0x10
jge 0x93478c
inc eax
mov dword [0x762b88], eax
lea esi, [eax - 1]
jmp 0x934793
je 0x9347ab
xor ecx, ecx
test esi, esi
jl 0x9347ab
lea eax, [ecx*4 + 0x762b90]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x934799
push 0
push 0x762bd0
call ebx
jmp 0x9345d6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ba3
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x401bc1
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov dword [0x40a624], eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401bf7
push esi
call edi
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
je 0x401beb
cmp al, bl
jne 0x401bdc
cmp byte [esi], 0x22
jne 0x401c05
push esi
call edi
mov esi, eax
jmp 0x401c05
cmp al, 0x20
jle 0x401c05
push esi
call edi
mov esi, eax
cmp byte [esi], 0x20
jg 0x401bfb
mov al, byte [esi]
cmp al, bl
je 0x401c0f
cmp al, 0x20
jle 0x401bf0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x18], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
pop edi
je 0x401c29
movzx eax, word [ebp - 0x14]
jmp 0x401c2c
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push dword [0x40a624]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x401d2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x22a], bl
jne 0x401e4f
cmp byte [esi + 0x539], bl
jne 0x401e4f
mov ax, word [esi + 0x5a8]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push 0x6b
push 5
push dword [esi + 0x224]
call edi
cmp eax, ebx
jne 0x401da9
mov ax, word [esi + 0x5a8]
and ax, 0x3ff
or ah, 4
push eax
push 0x6b
push 5
push dword [esi + 0x224]
call edi
cmp eax, ebx
jne 0x401da9
push 5
push 0x6b
push dword [esi + 0x224]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x401e4f
push eax
push dword [esi + 0x224]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x401c94
push ebx
push eax
push dword [esi + 0x224]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [esi + 0x540], eax
lea eax, [ebp - 0xc]
push eax
push 0x9003
mov ecx, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00405a71
test al, al
je 0x401e2f
lea eax, [esi + 0x270]
lea ecx, [ebp - 0xc]
push eax
call fcn.00406c28
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
push 0x9102
push dword [esi + 0x540]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x14]
call fcn.004016cb
push dword [ebp - 0x18]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
lea ecx, [ebp - 8]
call fcn.004016cb
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407184
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x4071d6
push eax
call fcn.00401c7e
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4071d6
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40a604
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4071da
xor al, al
jmp 0x40723b
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x407239
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.00401c7e
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x407239
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x407227
mov al, 1
pop ebx
leave
ret 4

Function at 0x407665
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4280a4], 0
jne 0x4076a3
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407679
mov dword [ecx*4 + 0x4280a0], eax
inc ecx
cmp ecx, 0x100
jl 0x407674
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4076d0
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4280a0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4076b1
not eax
pop ebp
ret 0xc
Function at 0x41bca0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49f76b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004934bc
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41bd22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00490407
mov eax, dword [eax]
push 0x6c8234
push eax
call fcn.004823b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00493747
test bl, bl
je 0x41bd22
push 0x6c8234
lea ecx, [esp + 0xc]
call fcn.00493ad7
push 0x6cbdc4
lea ecx, [esp + 0xc]
call fcn.00493ad7
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41bd5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00493747
jmp 0x41be29
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41bde2
lea edx, [esp + 0x7c]
push 0x6cbdc0
push edx
call fcn.004823b4
add esp, 8
test eax, eax
je 0x41bde2
lea eax, [esp + 0x7c]
push 0x6cbdbc
push eax
call fcn.004823b4
add esp, 8
test eax, eax
je 0x41bde2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41bd72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00493747
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41c620
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41c682
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc