joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4073c0]
test esi, esi
jle 0x4025c0
mov edi, dword [0x4073c4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4024e4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402565
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4024d0
mov dword [esp], eax
mov ebx, eax
call fcn.00402da0
test eax, eax
mov edi, eax
je 0x4025e7
mov eax, dword [0x4073c4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402ea0
add eax, dword [edi + 0xc]
mov edx, dword [0x4073c4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4025c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40255e
sub eax, 4
and eax, 0xfffffffb
jne 0x402570
add dword [0x4073c0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4073c4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40255e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004032a0
lea esi, [esi]
xor esi, esi
jmp 0x4024ee
mov eax, dword [0x4073c4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004032a0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004032a0
mov esi, esi
lea edi, [edi]

Function at 0x402a20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4073d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4073d0]
sub esp, 4
test ebx, ebx
je 0x402a75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402a6e
test esi, esi
je 0x402a6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402a50
mov dword [esp], 0x4073d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4032a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004030e0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004030e0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0

Function at 0x4064a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409a50]
jne 0x407826
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x40a2b8], eax
mov dword [0x40a2b4], ecx
mov dword [0x40a2b0], edx
mov dword [0x40a2ac], ebx
mov dword [0x40a2a8], esi
mov dword [0x40a2a4], edi
mov word [0x40a2d0], ss
mov word [0x40a2c4], cs
mov word [0x40a2a0], ds
mov word [0x40a29c], es
mov word [0x40a298], fs
mov word [0x40a294], gs
pushfd
pop dword [0x40a2c8]
mov eax, dword [ebp]
mov dword [0x40a2bc], eax
mov eax, dword [ebp + 4]
mov dword [0x40a2c0], eax
lea eax, [ebp + 8]
mov dword [0x40a2cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x40a208], 0x10001
mov eax, dword [0x40a2c0]
mov dword [0x40a1bc], eax
mov dword [0x40a1b0], 0xc0000409
mov dword [0x40a1b4], 1
mov eax, dword [0x409a50]
mov dword [ebp - 0x328], eax
mov eax, dword [0x409a54]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x40a200], eax
push 1
call fcn.004068ed
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x4021d8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x40a200], 0
jne 0x407916
push 1
call fcn.004068ed
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x406f7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406f89
pop dword [ebp - 0x1c]
mov eax, 0x406f89
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x37b9d
push 0
mov eax, 0x3e07e63f
sub eax, 0x3dc7d57b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xb6e297a9
sub ecx, 0xb6e24c8a
xor ebx, ebx
add ebx, eax
mov edx, 0x58f89996
sub edx, 0x58b7d196
add edx, dword [ebp - 0x1c]
mov edi, 0x3d199a02
sub edi, 0xae899a8a
xor dword [ebp - 0x14], ecx
mov esi, dword [edx]
add dword [ebp - 0x14], ebx
xor esi, edi
add dword [ebp - 0x10], 0x3f46fcc5
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x690dd226
add ebx, 0xb908634a
add ebx, 0x46f79cba
add edx, 0x860ca2d4
sub edx, 0x860ca2d0
loop 0x406fe5
add eax, 0x5d02e90
add eax, 0xfa30f0bf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd11ec34a
sub ecx, 0xd0dec34a
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x100043c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006534f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1009a8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x1000449c
je 0x10004497
cmp eax, 0x80000000
je 0x10004497
test eax, eax
jne 0x100044a3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Heap::constructor_void_]
mov eax, dword [0x1009bddc]
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000444b
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10015c00
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_class_ScCore::Variant____thiscall_ScCore::Variant::operator_unsigned_short_int_const__]
mov eax, dword [0x1009bddc]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x1000447c
mov eax, dword [ebp - 0x10]
lea ecx, [ecx + eax*4]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100044bf
xorps xmm0, xmm0
jmp 0x100044ba
cmp eax, 0x40000000
je 0x100044af
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100044b6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b9c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067f55
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1009a8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Root::constructor_void_]
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScScript::ScopeInfo.0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::SparseArray::constructor_void_]
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 4], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0x10000
mov dword [esi + 0x14], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002dec0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov ecx, dword [edi + 8]
add ecx, 0xec
call dword [0x10071104]
push str.JSINCLUDE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x1002df20
cmp byte [esi], 0
je 0x1002df20
mov ecx, dword [ebp + 8]
call dword [sym.imp.ScCore.dll_public:_int___thiscall_ScCore::String::length_void_const]
test eax, eax
je 0x1002df10
mov ecx, dword [edi + 8]
push 0x3a
add ecx, 0xec
call dword [0x1007118c]
mov ecx, dword [edi + 8]
push esi
add ecx, 0xec
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_char_const__]
pop edi
pop esi
pop ebp
ret 4
Function at 0x408ff1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00404297
mov dword [ebp - 0x14], eax
cmp dword [0x417008], edi
jne 0x4090e2
push 0x800
push edi
push 0x410b98
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40906f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4091c2
push 0x410b98
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4091c2
push 0x410bb0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4091c2
push eax
call ebx
push 0x410bbc
push esi
mov dword [0x417008], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x410bcc
push esi
mov dword [0x41700c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x410be0
push esi
mov dword [0x417010], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417018], eax
test eax, eax
je 0x4090df
push 0x410bfc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417014], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x409107
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4090fa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40911c
push 4
pop eax
jmp 0x4091c4
cmp dword [ebp - 0x14], edi
je 0x40911c
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x409101
mov eax, dword [0x417014]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40917a
cmp dword [0x417018], esi
je 0x40917a
push eax
call ebx
push dword [0x417018]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40917a
test eax, eax
je 0x40917a
call ecx
test eax, eax
je 0x40916f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40916f
test byte [ebp - 8], 1
jne 0x40917a
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4091aa
mov eax, dword [0x41700c]
cmp eax, esi
je 0x4091a7
push eax
call ebx
test eax, eax
je 0x4091a7
call eax
mov edi, eax
test edi, edi
je 0x4091a7
mov eax, dword [0x417010]
cmp eax, esi
je 0x4091a7
push eax
call ebx
test eax, eax
je 0x4091a7
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x417008]
call ebx
test eax, eax
je 0x4091c2
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4091c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b6f
leave
ret
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001ba36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001ba45
pop dword [ebp - 8]
mov eax, 0xc0686054
add eax, 0x4f9959f1
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3a53c
push 0
mov eax, 0xc61d94a2
add eax, 0x49e44cc2
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x8e8d84b5
add ecx, 0x7172c806
mov edi, eax
mov ebx, 0x638f9b28
sub ebx, 0x538b5d28
add ebx, dword [ebp - 8]
mov esi, 0x31cb4baa
sub dword [ebp - 4], 0x9c1b4e81
mov edx, dword [ebx]
sub dword [ebp - 4], 0xfbe0ecea
add edx, esi
xor dword [ebp - 4], 0xe13c99aa
mov dword [edi], edx
sub dword [ebp - 4], edx
add edi, 0x8008a388
sub edi, 0x8008a384
add ebx, 4
loop 0x1001ba9e
add eax, 0x8fe3b20b
add eax, 0x701d73b4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x438cc0
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop eax
add ebx, 1
sub ebx, 0x879a3efc
call fcn.00438d00
sub ebx, 0x44349c85
dec esi
xor dword [edi], eax
add ebx, 0xd01c427f
inc esi
sub esi, esi
inc edi
inc ebx
or ebx, esi
add ebx, ebx
cmp edi, edx
jne fcn.00438cc0
sub esi, ebx
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406243
pop dword [ebp - 0x1c]
mov eax, 0xab669e4c
add eax, 0x54d9c3f7
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xdfaec9da
add dword [ebp - 0x2c], 0x6ea37b71
mov dword [ebp - 0x28], 0x518ae9cf
sub dword [ebp - 0x28], 0x1f579d8a
mov dword [ebp - 0x24], 0x998e9fac
sub dword [ebp - 0x24], 0x4d425b7e
mov dword [ebp - 0x20], 0x567c140c
sub dword [ebp - 0x20], 0x567c140c
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x9adf90e2
add eax, 0x6560f022
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x47691aa1
add dword [ebp - 0x2c], 0x2d094eb5
mov dword [ebp - 0x28], 0x42a97110
sub dword [ebp - 0x28], 0x13d0f9b
mov dword [ebp - 0x24], 0x41567910
sub dword [ebp - 0x24], 0xdde70ca4
mov dword [ebp - 0x20], 0x29a9731f
sub dword [ebp - 0x20], 0x29a9731f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x5b38ba53
add eax, 0xa507c6ad
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35e57
push 0
call eax
mov ecx, 0x437e
xor esi, esi
add esi, eax
mov edx, 0x24d326ea
sub edx, 0x248c42ea
add edx, dword [ebp - 0x1c]
mov edi, 0x8d0034b2
mov ebx, dword [edx]
add dword [ebp - 0x10], esi
add ebx, edi
xor dword [ebp - 4], eax
mov dword [esi], ebx
xor dword [ebp - 0x18], esi
add esi, 0x76e70c89
sub esi, 0x76e70c85
add edx, 0xcf5c4f8d
sub edx, 0xcf5c4f89
loop 0x40635b
add eax, 0xbfec0dbe
add eax, 0x4014f30d
xor ebx, ebx
add ebx, eax
add eax, 0x1bfd99f4
add eax, 0xe4026611
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, str.:hn_
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3f351cb4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_FindResourceW]
push 0xa
push 0x3e7
push dword [0x3f3a32c0]
mov esi, ecx
call edi
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
push eax
push dword [0x3f3a32c0]
call ebx
mov ebp, dword [sym.imp.kernel32.dll_LockResource]
push eax
call ebp
push 0xa
push 0x3e6
mov dword [esi + 0xab4], eax
push dword [0x3f3a32c0]
call edi
push eax
push dword [0x3f3a32c0]
call ebx
push eax
call ebp
push 0xa
push 0x3e5
mov dword [esi + 0xab0], eax
push dword [0x3f3a32c0]
call edi
push eax
push dword [0x3f3a32c0]
call ebx
push eax
call ebp
movzx eax, word [eax]
lea edi, [esi + 0xac0]
mov dword [edi], eax
shl eax, 2
push 4
push eax
call fcn.3f3915d6
mov dword [esi + 0xab8], eax
mov eax, dword [edi]
shl eax, 1
push eax
call fcn.3f3915c4
add esp, 0xc
pop edi
mov dword [esi + 0xabc], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x3f351d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x10]
mov eax, ecx
shl eax, 2
cmp ecx, 6
jge 0x3f351dad
add eax, dword [esp + 0x18]
jmp 0x3f351daf
add eax, ebx
mov ecx, dword [edi + 0xab8]
mov esi, eax
shl esi, 2
cmp dword [esi + ecx], 0
jne 0x3f351e24
add eax, 0x3e8
movzx eax, ax
push 0xa
push eax
push dword [0x3f3a32c0]
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
jne 0x3f351e07
test ebx, ebx
jl 0x3f351e24
cmp ebx, 2
jle 0x3f351df8
cmp ebx, 3
jne 0x3f351e24
mov eax, dword [edi + 0xab8]
mov dword [esi + eax], 0x3f102594
jmp 0x3f351e24
mov eax, dword [edi + 0xab8]
mov dword [esi + eax], 0x3f102590
jmp 0x3f351e24
push eax
push dword [0x3f3a32c0]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov ecx, dword [edi + 0xab8]
mov dword [esi + ecx], eax
mov eax, dword [edi + 0xab8]
mov eax, dword [esi + eax]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x3f3709bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x3f3709ca
pop dword [ebp - 0x18]
mov eax, 0xe1e214e8
add eax, 0x5d54f4e2
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x43673
push 0
mov eax, 0xe8c774e9
sub eax, 0xa9b76389
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3b8dd56c
sub ecx, 0x3b8d9197
mov ebx, eax
mov edi, 0x5abf1bf7
sub edi, 0x1b7f0bf7
add edi, dword [ebp - 0x18]
mov edx, 0xa2933e69
mov dword [ebp - 0x10], 0x96ada1c5
mov esi, dword [edi]
sub dword [ebp - 4], 0xb5810c0
xor esi, edx
xor dword [ebp - 0x14], 0x1495ab9b
mov dword [ebx], esi
xor dword [ebp - 0x14], 0xab13a940
add ebx, 0x46c5055f
add ebx, 0xb93afaa5
add edi, 0xb01e5022
add edi, 0x4fe1afe2
loop 0x3f370a23
add eax, 0x10227
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3f100000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x3f3845bf
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x110
push esi
push edi
push dword [ebp + 0x7c]
xor esi, esi
push dword [ebp + 0x78]
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x68], esi
call fcn.3f3709bb
mov edi, eax
cmp edi, esi
je 0x3f384696
push 0x80
lea eax, [ebp - 0x20]
push eax
push 0xc
push dword [0x3f3a32c0]
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
jle 0x3f38468f
mov ecx, dword [ebp + 0x64]
push ebx
push dword [ebp + 0x78]
call fcn.3f38958d
push esi
push esi
mov ebx, eax
push 0x81
lea eax, [ebp - 0xa4]
push eax
push ebx
call fcn.3f390cad
pop ecx
inc eax
push eax
push ebx
push esi
push esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xa4]
push eax
push 1
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop ebx
jne 0x3f38468f
push 0x80
lea eax, [ebp - 0x20]
push eax
push 0xd
push dword [0x3f3a32c0]
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
jle 0x3f38468f
mov ecx, dword [ebp + 0x64]
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.3f3709bb
mov dword [ebp + 0x68], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x68]
pop edi
pop esi
add ebp, 0x6c
leave
ret 0xc