joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018440
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e88b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1d8
mov eax, dword [0x10052024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x14], 0x10
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
jb 0x1001848d
mov ecx, dword [ecx]
cmp dword [eax + 0x14], 0x10
jb 0x10018495
mov eax, dword [eax]
cmp dword [edx + 0x14], 0x10
jb 0x1001849d
mov edx, dword [edx]
push ecx
push pe_nt_image_headers32
lea ecx, [ebp - 0x118]
push ecx
push 0x1004b527
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
test eax, eax
je 0x1001861f
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x1d4], 0
movups xmmword [ebp - 0x1e4], xmm0
mov dword [ebp - 0x1d0], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100184e6
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x1e4]
call fcn.10003190
push 0xa8
lea eax, [ebp - 0x1c8]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1001d1c0
add esp, 4
lea eax, [ebp - 0x1e4]
lea ecx, [ebp - 0x1c8]
push eax
call fcn.1000a4e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + 4]
or dword [ebp + eax - 0x1b4], 0x4000
lea eax, [ebp - 0x11c]
push eax
call fcn.10018690
mov eax, dword [ebp - 0x1c8]
movss xmm0, dword [ebp - 0x11c]
movss dword [ebp - 0x1cc], xmm0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1cc], eax
lea ecx, [ebp - 0x1b8]
call fcn.10006510
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x1cc], eax
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1001a6fa
mov ecx, dword [ebp - 0x1d0]
add esp, 4
cmp ecx, 0x10
jb 0x10018617
mov edx, dword [ebp - 0x1e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001860d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001863d
push ecx
push edx
call fcn.1001b25a
add esp, 8
movss xmm0, dword [ebp - 0x1cc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001b217
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.10020319
int3
Function at 0x10019bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052024]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [0x7f94cc]
cmp byte [edi + 0x50], 0
je 0x10019c41
mov eax, dword [edi + 0x20]
mov dword [ecx + 0x74], eax
mov eax, dword [0x10052ac0]
mov dword [edi + 0x24], 0
cmp dword [eax], 3
jne 0x10019c0c
mov dword [eax], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4db8ce
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x50]
mov ecx, 0x4db8ce
mov dword [ecx], eax
mov ax, word [edi + 0x54]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x60
push edi
call fcn.1001b25a
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, edi
xor ecx, ebp
pop edi
call fcn.1001b217
mov esp, ebp
pop ebp
ret 4

Function at 0x10027d9e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10027ddd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10027ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10027ddd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10027ddd
cmp dword [ecx + 0x74], 0xe
jbe 0x10027ddd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1002df0d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100434ac
push 0x100434a4
push str.FlsAlloc
push 0x1f
call fcn.1002dd38
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002df41
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003f16c]
call esi
jmp 0x1002df47
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002df8b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100434bc
push 0x100434b4
push str.FlsGetValue
push 0x21
call fcn.1002dd38
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002dfc2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003f16c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002dfca
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100434c4
push 0x100434bc
push str.FlsSetValue
push 0x22
call fcn.1002dd38
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002e004
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003f16c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10031d53
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10031df0
push ebx
push esi
call fcn.10031d1c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10030b8c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10031d9d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10031def
push edi
push eax
call fcn.1002be7e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10031dbd
call fcn.1002be44
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10031dee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10030b8c
add esp, 0x20
test eax, eax
jne 0x10031ddc
push edi
call fcn.1002be44
jmp 0x10031de4
push ebx
call fcn.1002be44
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10031df3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10031e04
pop esi
ret
push ebx
push edi
push esi
call fcn.10031d1c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1002be7e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10031e2c
push ebx
push esi
push edi
call fcn.1001cc40
add esp, 0xc
push 0
call fcn.1002be44
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100321fc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10031e41

Function at 0x10034481
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1002956c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100344f0
cmp esi, dword [ebp - 4]
je 0x100344eb
cmp dword [ebp + 0xc], 0
je 0x100344eb
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100344c8
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10033fd3
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100344f2
xor eax, eax
inc eax
jmp 0x100344f2
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10034557
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10052024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1002956c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1002956c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100345ce
cmp word [ecx], dx
je 0x100345ce
mov eax, dword [0x10043ae4]
push edi
dec eax
push eax
push 0x100439d0
call fcn.100344f6
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10034641
cmp word [eax], dx
je 0x10034641
mov eax, dword [edi]
test eax, eax
je 0x100345f2
cmp word [eax], dx
je 0x100345f2
lea eax, [ebp - 0x10]
push eax
call fcn.10033ed9
jmp 0x100345fb
lea eax, [ebp - 0x10]
push eax
call fcn.10033f74
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1003466b
mov eax, dword [0x100439cc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100436c0
call fcn.100344f6
add esp, 0xc
test al, al
je 0x1003466b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10034636
cmp word [eax], di
je 0x10034636
lea eax, [ebp - 0x10]
push eax
call fcn.10033ed9
pop ecx
jmp 0x1003466d
lea eax, [ebp - 0x10]
push eax
call fcn.10033f74
jmp 0x10034633
mov eax, dword [edi]
test eax, eax
je 0x10034658
cmp word [eax], dx
je 0x10034658
lea eax, [ebp - 0x10]
push eax
call fcn.10033e8e
pop ecx
jmp 0x1003466b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10034736
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1003437b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10034736
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10034736
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10034736
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100346c3
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1002e10a
test ebx, ebx
je 0x10034731
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1002e10a
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10034736
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10034736
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10038a81
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10034738
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001b217
leave
ret
Function at 0x1003a040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003a06d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003a06d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41fd56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41fd65
pop dword [ebp - 0x14]
mov eax, 0x89955784
sub eax, 0x89535a1f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x703d1a08
add dword [ebp - 0x24], 0xde152b43
mov dword [ebp - 0x20], 0x4c11bc52
add dword [ebp - 0x20], 0xe6218ff3
mov dword [ebp - 0x1c], 0x7452f313
add dword [ebp - 0x1c], 0xd7f9511b
mov dword [ebp - 0x18], 0x861ba14b
add dword [ebp - 0x18], 0x79e45eb5
lea eax, [ebp - 0x24]
push eax
mov eax, 0x7f6cf2cb
add eax, 0x80d66f15
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe2287e2e
add dword [ebp - 0x24], 0x9249eb28
mov dword [ebp - 0x20], 0xfb5734fb
sub dword [ebp - 0x20], 0xb9ead386
mov dword [ebp - 0x1c], 0xa7c8ff27
sub dword [ebp - 0x1c], 0x445992bb
mov dword [ebp - 0x18], 0xee6135a7
add dword [ebp - 0x18], 0x119eca59
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x455df
push 0
call eax
mov ecx, 0xa9eff15
sub ecx, 0xa9eadba
xor edi, edi
add edi, eax
mov ebx, 0x58b0fa89
sub ebx, 0x586b3289
add ebx, dword [ebp - 0x14]
mov edx, 0x5692715f
add edx, 0xd363ea60
xor dword [ebp - 8], 0xfc2296d7
mov esi, dword [ebx]
xor dword [ebp - 8], 0x4e9ef90a
sub esi, edx
add dword [ebp - 4], 0x4e53153b
mov dword [edi], esi
add dword [ebp - 0xc], 0xd86bfafb
add edi, 4
add ebx, 4
loop 0x41fe84
add eax, 0x1383f
mov ebx, eax
add eax, 0x5579224c
add eax, 0xaa86ddb9
mov ecx, 0xe776893c
add ecx, 0x18c976c4
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0xf00328
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf00332
pushal
call 0xf00338
pop ebp
sub ebp, 0x10
sub ebp, 0xb00328
jmp 0xf0034e
mov eax, 0xb00328
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x45ea1fad
xor byte [eax], dl
inc eax
dec ecx
jne 0xf00365
jmp 0xf00378
pushal
and al, 0x91
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
sub al, 0x6c
push ebp
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
scasb al, byte es:[edi]
pushal
adc eax, 0xadadadab
pop ss
test dword [ebp + 0x4f5aadad], ebp
scasb al, byte es:[edi]
sub al, 0xa1
lodsd eax, dword [esi]
lodsd eax, dword [esi]
lodsd eax, dword [esi]
scasb al, byte es:[edi]
push 0x5189c920
and al, 0xa9
mov ebp, edi
invalid
Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4034db
pop dword [ebp - 8]
mov eax, 0x4034db
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1f1e88e1
sub dword [ebp - 0x18], 0xd0cc4396
mov dword [ebp - 0x14], 0xc6b73c71
add dword [ebp - 0x14], 0x6b7c0fd4
mov dword [ebp - 0x10], 0xd4b9bb83
sub dword [ebp - 0x10], 0x886d7755
mov dword [ebp - 0xc], 0xde8e8db8
add dword [ebp - 0xc], 0x21717248
lea eax, [ebp - 0x18]
push eax
mov eax, 0x396ecc97
add eax, 0xc6d173bd
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd6de0637
add dword [ebp - 0x18], 0x9d94631f
mov dword [ebp - 0x14], 0x7a87407b
add dword [ebp - 0x14], 0xc6e520fa
mov dword [ebp - 0x10], 0x1975bbd6
sub dword [ebp - 0x10], 0xb6064f6a
mov dword [ebp - 0xc], 0x5da2ca0a
add dword [ebp - 0xc], 0xa25d35f6
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x5fff600d
add eax, 0xa040e043
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3be10
push 0
call eax
mov ecx, 0xba81c6fe
add ecx, 0x457e94fb
xor esi, esi
add esi, eax
mov edi, 0xce052122
add edi, 0x323b62de
add edi, dword [ebp - 8]
mov ebx, 0x41292ec2
sub ebx, 0x2fe35ab1
mov dword [ebp - 4], 0x9ca90c1c
mov edx, dword [edi]
sub dword [ebp - 4], eax
add edx, ebx
xor dword [ebp - 4], 0x59ffa48d
mov dword [esi], edx
mov dword [ebp - 4], 0xff18b1cc
add esi, 4
add edi, 0x165fc04e
add edi, 0xe9a03fb6
loop 0x4035fa
add eax, 0xd10220e7
add eax, 0x2eff41d0
xor ebx, ebx
add ebx, eax
add eax, 0x82ff9bd0
sub eax, 0x82ff9bcb
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40645d
pop dword [ebp - 0x38]
mov eax, 0x8794427
sub eax, 0x838dfca
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x8a205f40
sub dword [ebp - 0x48], 0x3bce19f5
mov dword [ebp - 0x44], 0x5d421165
sub dword [ebp - 0x44], 0x2b0ec520
mov dword [ebp - 0x40], 0x8353b581
add dword [ebp - 0x40], 0xc8f88ead
mov dword [ebp - 0x3c], 0xb44e0edc
sub dword [ebp - 0x3c], 0xb44e0edc
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xa3dc04d9
sub dword [ebp - 0x48], 0x2f699b83
mov dword [ebp - 0x44], 0xc123822c
add dword [ebp - 0x44], 0x8048df49
mov dword [ebp - 0x40], 0x503f5226
add dword [ebp - 0x40], 0x13301a46
mov dword [ebp - 0x3c], 0xaf3df0b9
sub dword [ebp - 0x3c], 0xaf3df0b9
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xcba4ba4d
add eax, 0x349bc62f
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3a363
push 0
call eax
mov ecx, 0x54a3
mov esi, eax
mov edi, 0xebb47b8b
sub edi, 0xeb6f678b
add edi, dword [ebp - 0x38]
mov edx, 0x3ec8949d
add edx, 0xd925b7f6
mov dword [ebp - 8], 0x2797d79
mov ebx, dword [edi]
xor dword [ebp - 0x24], edi
xor ebx, edx
sub dword [ebp - 0x34], eax
mov dword [esi], ebx
mov dword [ebp - 0x2c], 0x457813f3
add esi, 0x6b4da9eb
add esi, 0x94b25619
add edi, 0xddc788a7
add edi, 0x2238775d
loop 0x406574
add eax, 0x7b46eb32
sub eax, 0x7b45a5d3
mov ebx, eax
add eax, 0xd799d72c
sub eax, 0xd799d727
mov ecx, 0xda6cdb4d
sub ecx, 0xda2cdb4d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x407d60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x2c
jl 0x407db8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x407daa
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x407dcf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407df4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00408010
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x407e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447545
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5b9718], 0x2c
jl 0x407e5d
push 0x5b971c
call fcn.00429990
mov edi, dword [0x5b9714]
add esp, 4
test edi, edi
je 0x407e4f
mov eax, dword [edi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edi, edi
jne 0x407e74
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x407ed1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00408010
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00408630
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x4083c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x1c
jl 0x408418
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40840a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40842f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40848b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x408540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4476cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x1c
jl 0x40859b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40858d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x4085b2
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4085d9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.004084a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x408c10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0xc
jl 0x408c68
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x408c5a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x408c7f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408cb5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3