joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4094
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4f409c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f428e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4f42a4
mov eax, esi
call fcn.004f1f20
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004043e4
lea ecx, [ebp - 0x10]
mov edx, 0x4f42b8
mov eax, esi
call fcn.004f1f20
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004043e4
lea ecx, [ebp - 0x14]
mov edx, 0x4f42d0
mov eax, esi
call fcn.004f1f20
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004043e4
lea ecx, [ebp - 0x18]
mov edx, 0x4f42ec
mov eax, esi
call fcn.004f1f20
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004043e4
lea ecx, [ebp - 0x1c]
mov edx, 0x4f4308
mov eax, esi
call fcn.004f1f20
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004043e4
lea ecx, [ebp - 0x24]
mov edx, 0x4f4320
mov eax, esi
call fcn.004f1f20
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004089dc
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408f24
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4f4338
mov eax, esi
call fcn.004f1f20
mov eax, dword [ebp - 0x28]
call fcn.004eb9f8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4f4348
mov eax, esi
call fcn.004f1f20
mov eax, dword [ebp - 0x2c]
call fcn.004eb9f8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4f4360
mov eax, esi
call fcn.004f1f20
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408f24
inc eax
je 0x4f4231
lea ecx, [ebp - 0x34]
mov edx, 0x4f4360
mov eax, esi
call fcn.004f1f20
mov eax, dword [ebp - 0x34]
call fcn.00408ee8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a8dc
fstp qword [ebp - 0x3c]
wait
call fcn.0040ac40
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4f424c
lea ecx, [ebp - 0x40]
mov edx, 0x4f4360
mov eax, esi
call fcn.004f1f20
mov eax, dword [ebp - 0x40]
call fcn.004eb9f8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4f4370
mov eax, esi
call fcn.004f1f20
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004043e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4295
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004043b4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004043b4
ret
Function at 0x4fb684
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4fb6de
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004fb674
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ea664
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004ea264
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb6e5
lea eax, [ebp - 4]
call fcn.00404390
ret
Function at 0x511c7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x522cf0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x522cf0]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x522cf0]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x522cf0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x522c74]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x511ca7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x511d74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x522cf0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x522cf0]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x522cf0]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x522cf0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x522c74]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x511daf
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x511e90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x522cf0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x522cf0]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x522cf0]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x522cf0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x522c74]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x522cf0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x522cf0]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x522cf0]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x522cf0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x511edb
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x51840c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov ecx, dword [ebx + 0x20]
mov dl, 1
mov eax, dword [0x4392f8]
call fcn.004393a8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51856a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [ebx + 0x40]
push eax
mov ecx, 0x518580
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x14]
push eax
mov ecx, 0x5185a4
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 8]
push eax
mov ecx, 0x5185b4
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x2c]
push eax
mov ecx, 0x5185c4
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x30]
push eax
mov ecx, 0x5185d8
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov al, byte [ebx + 4]
push eax
mov ecx, 0x5185ec
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx + 0x24]
push eax
mov ecx, 0x518600
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x10]
push eax
mov ecx, 0x518610
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx + 0x1c]
push eax
mov ecx, 0x518624
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x28]
push eax
mov ecx, 0x518638
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x34]
push eax
mov ecx, 0x51864c
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x38]
push eax
mov ecx, 0x51865c
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebx + 0x3c]
push eax
mov ecx, 0x518668
mov edx, 0x518594
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518571
mov eax, dword [ebp - 4]
call fcn.0040355c
ret
Function at 0x51d534
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00404840
mov eax, dword [ebp - 0x18]
call fcn.00404840
mov eax, dword [ebp - 0x1c]
call fcn.00404840
xor eax, eax
push ebp
push 0x51d61a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00404850
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404850
mov edx, eax
mov eax, dword [0x525668]
pop ecx
call fcn.0051d4bc
pop ecx
test al, al
je 0x51d5ff
xor eax, eax
push ebp
push 0x51d5e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.00404850
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51d5ee
mov eax, dword [ebp - 0x10]
call fcn.00407408
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d621
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004043b4
ret
Function at 0x403520
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40903c]
sub esp, 4
test ebx, ebx
je 0x40356b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x403564
test esi, esi
je 0x403564
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403540
mov dword [esp], 0x409044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403750
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4037a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403878
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4037de
cmp eax, 4
jne 0x403800
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4037ee
cmp edx, 4
je 0x4037ee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403750

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x402a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a89
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402ac4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402ac0
lea ebx, [ebx]
cmp esi, eax
jae 0x402ac4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402ab0
cmp esi, eax
jb 0x402aca
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x404f33
test esi, esi
je 0x404f33
mov ebp, dword [esp + 0x18]
test ebp, ebp
jbe 0x404f33
xor eax, eax
test ebp, ebp
jbe 0x404f28
mov cl, byte [eax + edi]
mov edx, esi
sar edx, 8
xor dl, cl
movzx ecx, cl
add ecx, esi
imul ecx, ecx, 0xce6d
mov byte [eax + edi], dl
add ecx, 0x58bf
add eax, 1
cmp eax, ebp
mov esi, ecx
jb 0x404f01
pop edi
pop esi
mov eax, 1
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebp
ret 0xc

Function at 0x404f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
ret

Function at 0x4050c0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44e9d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46b9d8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMyRxjh
push reloc.WS2_32.dll_accept
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405121
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMyRxjh
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx - 0xc]
lea esi, [ecx - 0x10]
mov eax, esi
cmp dword [eax + 0xc], 1
jle 0x405149
mov edx, dword [eax + 4]
push edx
lea ecx, [esp + 0x28]
call fcn.00402cc0
mov ecx, dword [esp + 0x24]
lea esi, [ecx - 0x10]
mov eax, esi
or ebx, 0xffffffff
add dword [eax + 0xc], ebx
jne 0x405154
mov dword [eax + 0xc], ebx
mov eax, dword [esp + 0x10]
push edi
push ecx
push 1
push 0
push str.Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x1c], ebx
lea ecx, [esi + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x405184
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x406e40
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
xor ebx, ebx
xor ecx, ecx
test bl, 1
je 0x406e50
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x406e5b
or ecx, 0x40
shr eax, 1
test al, 1
je 0x406e64
or ecx, 0x20
shr eax, 1
test al, 1
je 0x406e6d
or ecx, 0x10
shr eax, 1
test al, 1
je 0x406e76
or ecx, 8
shr eax, 1
test al, 1
je 0x406e7f
or ecx, 4
shr eax, 1
test al, 1
je 0x406e88
or ecx, 2
test al, 2
je 0x406e8f
or ecx, 1
shl ecx, 0x18
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov dword [ebx*4 + 0x4700f8], ecx
mov eax, ecx
xor edx, edx
mov ecx, 0x1f
mov edi, edi
test al, 1
je 0x406f5d
mov esi, 1
shl esi, cl
or edx, esi
sub ecx, 1
shr eax, 1
cmp ecx, 0xffffffff
jg 0x406f50
mov dword [ebx*4 + 0x4700f8], edx
add ebx, 1
cmp ebx, 0xff
jle 0x406e44
pop esi
pop ebx
ret

Function at 0x407030
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov al, byte [esi + 1]
mov bl, byte [esi]
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
test edi, edi
mov byte [esp + 0x10], al
jbe 0x4070a9
lea ebx, [ebx]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
je 0x4070a2
mov eax, 0x24924925
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
lea edx, [eax*8]
sub edx, eax
mov eax, ecx
sub eax, edx
je 0x4070a2
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [edx + edx*2]
mov eax, ecx
sub eax, edx
je 0x4070a2
mov dl, byte [ecx + esi]
sub dl, byte [esp + 0x10]
xor dl, bl
mov byte [ecx + esi], dl
add ecx, 1
cmp ecx, edi
jb 0x407050
movzx eax, byte [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
mov byte [eax + esi], 0x50
movzx ecx, byte [esi + 0x3c]
pop edi
mov byte [ecx + esi + 1], 0x45
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4070d0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 0x10]
movzx ecx, word [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
mov dword [esp + 0x20], 0
call fcn.004134d6
push esi
mov edi, eax
push 0
push edi
call fcn.004381e0
push esi
push ebx
push edi
call fcn.004387d0
add esp, 0x1c
test esi, esi
je 0x40718a
mov edx, dword [esp + 0x14]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x40718a
push esi
push edi
call fcn.00407030
add esp, 8
push 0
lea eax, [esp + 0x20]
push eax
push esi
push edi
push ebx
mov byte [edi], 0x4d
mov byte [edi + 1], 0x5a
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004134db
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x407580
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov edx, dword [edx]
or eax, 0xffffffff
test ecx, ecx
je 0x4075b6
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4700f8]
sub ecx, 1
add edx, 1
test ecx, ecx
jne 0x407593
pop edi
pop esi
not eax
ret