joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c3631e0
Capabilities:
Create pipe

Disassembly:
push 0x24
push 0x7c381ef0
call fcn.7c34230b
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov dword [ebp - 0x34], 0xc
and dword [ebp - 0x30], 0
mov al, byte [ebp + 0x10]
and al, 0x80
neg al
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x7c36323c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.7c349ee2
pop ecx
mov eax, esi
jmp 0x7c3633d4
call fcn.7c3531c6
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
je 0x7c363398
and dword [ebp - 4], 0
mov ecx, edi
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov byte [ecx + eax*4 + 4], 0x89
mov dword [ebp - 4], esi
call fcn.7c36335a
call fcn.7c3531c6
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x7c363378
mov dword [ebp - 4], 1
mov ecx, esi
sar ecx, 5
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov byte [ecx + eax*4 + 4], 0x89
or dword [ebp - 4], 0xffffffff
call fcn.7c36336b
mov eax, 0x8000
test dword [ebp + 0x10], eax
jne 0x7c3632c3
test byte [ebp + 0x11], 0x40
jne 0x7c3632f9
cmp dword [sym.MSVCR71.dll__fmode], eax
jne 0x7c3632f9
mov ecx, edi
sar ecx, 5
mov eax, edi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
and byte [eax], 0x7f
mov ecx, esi
sar ecx, 5
mov eax, esi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
and byte [eax], 0x7f
test byte [ebp + 0x10], 0x80
je 0x7c363335
mov ecx, edi
sar ecx, 5
mov eax, edi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
or byte [eax], 0x10
mov ecx, esi
sar ecx, 5
mov eax, esi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
lea eax, [ecx + eax*4 + 4]
or byte [eax], 0x10
push dword [ebp - 0x24]
push edi
call fcn.7c352fc8
push dword [ebp - 0x28]
push esi
call fcn.7c352fc8
add esp, 0x10
call sym.MSVCR71.dll__errno
and dword [eax], 0
jmp 0x7c3633a6
mov ecx, edi
sar ecx, 5
mov eax, edi
and eax, 0x1f
lea eax, [eax + eax*8]
mov ecx, dword [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov byte [ecx + eax*4 + 4], 0
call sym.MSVCR71.dll__errno
jmp 0x7c3633a0
call sym.MSVCR71.dll__errno
mov esi, dword [ebp - 0x20]
mov dword [eax], 0x18
call sym.MSVCR71.dll__errno
cmp dword [eax], 0
je 0x7c3633cd
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
call sym.MSVCR71.dll___doserrno
and dword [eax], 0
or eax, 0xffffffff
jmp 0x7c3633d4
mov dword [ebx], edi
mov dword [ebx + 4], esi
xor eax, eax
call fcn.7c342346
ret
Function at 0x7c36345d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x7c363631
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + sym.MSVCR71.dll___pioinfo]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x7c363631
test cl, 0x48
je 0x7c3634c8
cmp byte [eax + 5], 0xa
je 0x7c3634c8
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x7c36351a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x7c363502
call sym.MSVCR71.dll__errno
mov dword [eax], 9
call sym.MSVCR71.dll___doserrno
mov dword [eax], esi
jmp 0x7c363512
cmp eax, 0x6d
je 0x7c363631
push eax
call fcn.7c349ee2
pop ecx
or eax, 0xffffffff
jmp 0x7c363633
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x7c36362c
test eax, eax
je 0x7c363541
cmp byte [ebx], 0xa
jne 0x7c363541
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x7c36354a
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x7c363626
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x7c363616
cmp al, 0xd
je 0x7c36357c
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x7c363608
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x7c363596
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x7c363591
add dword [ebp + 0x10], 2
jmp 0x7c3635ea
mov dword [ebp + 0x10], eax
jmp 0x7c363604
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x7c3635be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7c363604
cmp dword [ebp - 0xc], 0
je 0x7c363604
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x7c3635df
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x7c3635ea
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x7c363607
cmp ebx, dword [ebp + 0xc]
jne 0x7c3635ef
cmp byte [ebp - 1], 0xa
jne 0x7c3635ef
mov byte [ebx], 0xa
jmp 0x7c363607
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.7c352d68
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x7c363608
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x7c363560
jmp 0x7c363626
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x7c363626
lea esi, [esi + eax + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x7c363633
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7c366d53
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x7c3916c0]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x7c366d9c
call ebp
mov esi, eax
cmp esi, ebx
je 0x7c366d82
mov dword [0x7c3916c0], 1
jmp 0x7c366da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c366d97
push 2
pop eax
mov dword [0x7c3916c0], eax
jmp 0x7c366d9c
mov eax, dword [0x7c3916c0]
cmp eax, 1
jne 0x7c366df9
cmp esi, ebx
jne 0x7c366db4
call ebp
mov esi, eax
cmp esi, ebx
jne 0x7c366db4
xor eax, eax
jmp 0x7c366ea0
cmp word [esi], bx
mov eax, esi
je 0x7c366dc9
inc eax
inc eax
cmp word [eax], bx
jne 0x7c366dbb
inc eax
inc eax
cmp word [eax], bx
jne 0x7c366dbb
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call sym.MSVCR71.dll_malloc
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x7c366dec
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x7c366ea0
push ebp
push esi
push edi
call sym.MSVCR71.dll_memcpy
add esp, 0xc
jmp 0x7c366dde
cmp eax, 2
je 0x7c366e02
cmp eax, ebx
jne 0x7c366dad
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x7c366dad
cmp byte [ebp], bl
mov esi, ebp
je 0x7c366e38
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x7c366dad
push esi
add edi, eax
call sym.MSVCR71.dll_strlen
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x7c366e15
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call sym.MSVCR71.dll_malloc
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7c366eb1
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x7c366e92
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7c366ea7
push edi
call sym.MSVCR71.dll_strlen
push esi
lea edi, [edi + eax + 1]
call sym.MSVCR71.dll_wcslen
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x7c366e58
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call sym.MSVCR71.dll_free
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x7c366dad
Function at 0x7c370627
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x7c370648
lea eax, [ebp - 4]
push eax
call sym.MSVCR71.dll_time
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call sym.MSVCR71.dll_localtime
test eax, eax
pop ecx
jne 0x7c370669
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x7c37076a
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x7c37075b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c37075b
push edi
call sym.MSVCR71.dll_localtime
test eax, eax
pop ecx
je 0x7c37075b
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x7c37075b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c37075b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sym.MSVCR71.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x7c37075b
xor eax, eax
jmp 0x7c370769
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x7c3707a4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x7c3707cb
lea eax, [ebp - 0x30]
push eax
call sym.MSVCR71.dll__time64
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x38]
lea eax, [edi + 8]
push eax
call sym.MSVCR71.dll__localtime64
test eax, eax
pop ecx
jne 0x7c3707ec
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x7c3708ed
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x7c3708de
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c3708de
push edi
call sym.MSVCR71.dll__localtime64
test eax, eax
pop ecx
je 0x7c3708de
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x28], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x26], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x22], cx
mov cx, word [eax + 8]
mov word [ebp - 0x20], cx
mov cx, word [eax + 4]
mov word [ebp - 0x1e], cx
mov ax, word [eax]
and word [ebp - 0x1a], 0
mov word [ebp - 0x1c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x7c3708de
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x7c3708de
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call sym.MSVCR71.dll__get_osfhandle
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x7c3708de
xor eax, eax
jmp 0x7c3708ec
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret
Function at 0x7c373d2f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x7c38b118]
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jle 0x7c373dce
push edi
lea edi, [esi + 8]
mov dword [ebp + 8], ebx
mov eax, dword [esi + 4]
shr eax, 0xb
push 3
and eax, 7
push eax
push edi
call fcn.7c373b82
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 0xfffff800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
add esp, 0xc
dec dword [ebp + 8]
mov dword [esi + 4], ecx
jne 0x7c373d54
lea edi, [ebx + ebx*4]
shl edi, 1
lea eax, [esi + 0x1c]
push edi
push eax
lea eax, [ebp - 0x54]
push eax
call sym.MSVCR71.dll_memcpy
push 8
pop eax
sub eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea eax, [edi + esi + 0x1c]
push eax
lea eax, [esi + 0x1c]
push eax
call sym.MSVCR71.dll_memmove
push edi
lea eax, [ebp - 0x54]
sub esi, edi
push eax
add esi, 0x6c
push esi
call sym.MSVCR71.dll_memcpy
add esp, 0x24
pop edi
jmp 0x7c373e0c
jge 0x7c373e0c
mov ecx, dword [esi + 4]
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi + 4], eax
shr eax, 0xb
and eax, 7
push 0
push eax
lea eax, [esi + 8]
push eax
call fcn.7c373b82
lea eax, [esi + 0x1c]
push 0x46
push eax
add esi, 0x26
push esi
call sym.MSVCR71.dll_memmove
add esp, 0x18
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.7c341aed
leave
ret
Function at 0x4030e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x412008], 0x8088405
inc edx
mov dword [ebx + 0x412008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41201c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4037ac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40378c
xor eax, eax
push ebp
push 0x403785
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4037e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40378c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x41201c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41201c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404580
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x415ae4
mov edi, 0x413048
cmp dword [0x412004], 0
je 0x4045a8
call fcn.00404458
call fcn.004044f0
xor eax, eax
mov dword [0x412004], eax
cmp dword [0x415b18], 0
je 0x4045d2
call sub.kernel32.dll_GetCurrentThreadId
cmp eax, dword [0x415b40]
jne 0x4045d2
mov eax, 0x415b14
call fcn.004041dc
mov eax, 0x415b14
call fcn.004044c4
cmp byte [esi + 0x28], 0
jne 0x4045ec
cmp dword [edi], 0
je 0x4045ec
mov eax, dword [edi]
mov ebx, eax
xor eax, eax
mov dword [edi], eax
call ebx
cmp dword [edi], 0
jne 0x4045dd
cmp byte [esi + 0x28], 2
jne 0x404600
cmp dword [section..data], 0
jne 0x404600
xor eax, eax
mov dword [esi + 0xc], eax
call fcn.00402ec8
mov ebx, eax
test ebx, ebx
je 0x40461d
mov eax, ebx
call fcn.00403894
call fcn.00402ec8
mov ebx, eax
test ebx, ebx
jne 0x40460b
call fcn.00404204
cmp byte [esi + 0x28], 1
jbe 0x404631
cmp dword [section..data], 0
je 0x404657
mov ebp, dword [esi + 0x10]
test ebp, ebp
je 0x404657
mov eax, ebp
call fcn.00406204
mov eax, dword [esi + 0x10]
mov edi, dword [eax + 0x10]
mov eax, dword [esi + 0x10]
cmp edi, dword [eax + 4]
je 0x404657
test edi, edi
je 0x404657
push edi
call sub.kernel32.dll_FreeLibrary
mov eax, esi
call fcn.004041dc
cmp byte [esi + 0x28], 1
jne 0x404667
call dword [esi + 0x24]
cmp byte [esi + 0x28], 0
je 0x404674
mov eax, esi
call fcn.004044c4
cmp dword [esi], 0
jne 0x404693
cmp dword [0x41302c], 0
je 0x404688
call dword [0x41302c]
mov eax, dword [section..data]
push eax
call sub.kernel32.dll_Exit
mov eax, dword [esi]
push esi
mov edi, esi
mov esi, eax
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4045ec
Function at 0x40a91f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004067e4
mov edi, eax
cmp edi, 0x104
jbe 0x40a942
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40a944
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004067e4
push edi
push esi
call fcn.0040687c
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40a97d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40a967
mov eax, esp
cmp esi, eax
je 0x40a98a
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40a9c4
cmp bl, 0
je 0x40a9c0
cmp bl, 0x41
jl 0x40a9bb
cmp bl, 0x5a
jg 0x40a9bb
or bl, 0x20
xor al, bl
inc esi
jmp 0x40a99f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a904

Function at 0x40c5a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d98
mov eax, esi
mov edx, 8
test al, 1
je 0x40c5bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c5be
shr eax, 1
dec edx
jne 0x40c5af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c5a8
pop esi
ret

Function at 0x40c5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d94], 0
jne 0x40c5f7
call fcn.0040c5a0
push 1
push 0x417d94
call fcn.004066b0
mov eax, edi
test esi, esi
je 0x40c622
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c5fd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x40129f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5c0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], eax
call fcn.00401298
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x41b5c8]
add ebx, 0x23f
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5cc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov ecx, dword [0xaf7fc4]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132c
push 0x418300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 4]
mov ecx, dword [0xaf7fc4]
add eax, dword [ebp - 0x28]
mov edx, 0xedeb2e40
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
mov eax, dword [0xaf7fc0]
cmove eax, edx
xor edx, edx
mov dword [0xaf7fc0], eax
cmp ecx, 0x3eb
mov eax, dword [0xaf7f18]
cmove eax, edx
mov dword [0xaf7f18], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], edx
mov dword [0xaf7fbc], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov dword [ebp - 0x18], esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 4]
add ebx, 0x61c88647
shr edx, cl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
xor edx, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x10], ebx
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
jne 0x4012fa
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret