joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d28
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41f008], 0x8088405
inc edx
mov dword [ebx + 0x41f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42ec60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42ec8d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x42ec7e
and ecx, 3
je 0x42eca5
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42ec92
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42ecb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x42ece9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x42ecd1
pop esi
and esi, 3
je 0x42ed0e
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x42ecef
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42ed18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42ed44
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42ed35
and ecx, 3
je 0x42ed5c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x42ed49
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42ed64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x42ed70
pop edi
pop ebx
ret
Function at 0x42f68c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0042f2e4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x33b7cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x42f73a
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00402910
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042ed64
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.00402910
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042ed64
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x42f6e7
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x42f788
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00402910
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042ed64
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.00402910
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x42f7b2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x42f7b2
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x42f7a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x33b7d2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042f480
ret

Function at 0x43df94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x43dfe8
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x41f814]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x41fc14]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x420014]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x420414]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x43dfa3
pop edi
pop esi
pop ebx
ret
Function at 0x49eef4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x440f28]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x3ab0cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004970c4
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004982ec
mov eax, dword [esi]
call fcn.00485bc4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x49ef66
mov eax, dword [esi]
call fcn.00485bc4
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00485bd0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x49ef8a
mov eax, dword [esi]
call fcn.00485bd0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00485bb8
cmp eax, dword [ebp - 0x18]
jle 0x49efa0
mov eax, dword [esi]
call fcn.00485bb8
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00485bac
cmp eax, dword [ebp - 0xc]
jle 0x49efb6
mov eax, dword [esi]
call fcn.00485bac
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0049d87c
push eax
call fcn.004078d4
call fcn.00406e14
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x49f07d
mov eax, ebx
call fcn.00404534
cmp eax, 0x64
jge 0x49f07d
cmp dword [0x42e26c], 0
je 0x49f07d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00407924
cmp dword [ebp - 8], 0
je 0x49f07d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00407924
cmp dword [ebp - 8], 0
je 0x49f040
mov bl, 2
jmp 0x49f05b
lea edx, [ebp - 0x20]
mov eax, dword [0x448830]
call fcn.004a218c
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x49f059
xor ebx, ebx
jmp 0x49f05b
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x42e374]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.0049d87c
push eax
call dword [0x42e26c]
mov eax, dword [0x440d34]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.0049afb0
push 4
mov eax, dword [ebp - 4]
call fcn.0049d87c
push eax
call fcn.0040791c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ab0d4
call fcn.00406e14
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4d30e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x4d30f7
add esp, 0xfffffff0
call fcn.004036f0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040335c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x4d311d
cmp dword [esi + 0x58], 0x40
jb 0x4d3303
jmp 0x4d3123
jl 0x4d3303
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.004079c8
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.004d29e8
cmp word [ebx + 0xc], 0x5a4d
jne 0x4d3303
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x4d3303
cmp ecx, 0x10000
jge 0x4d3303
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d317e
cmp eax, dword [esi + 0x58]
ja 0x4d3303
jmp 0x4d3184
jg 0x4d3303
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.004079c8
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.004d29e8
cmp dword [ebx + 0x4c], 0x4550
jne 0x4d3303
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.004d29e8
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x4d323b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d31ff
cmp eax, dword [esi + 0x58]
ja 0x4d328c
jmp 0x4d3205
jg 0x4d328c
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.004d29e8
mov byte [ebx + 4], 1
jmp 0x4d328c
cmp ax, 0x14c
jne 0x4d328c
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d325c
cmp eax, dword [esi + 0x58]
ja 0x4d328c
jmp 0x4d325e
jg 0x4d328c
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.004d29e8
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x4d3303
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d32bd
cmp eax, dword [esi + 0x58]
ja 0x4d3303
jmp 0x4d32bf
jg 0x4d3303
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x3de470]
call fcn.0040599c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004d29e8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d331a
call fcn.00403748
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d4000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3e00bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4d40b1
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4d409a
test esi, esi
jbe 0x4d40b1
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a644
test eax, eax
jne 0x4d408c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4d40b1
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4d4069
jmp 0x4d40b1
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4d40b1
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e00c6
ret
Function at 0x4d4ae0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x3e0c8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404980
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4d4b1b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4d4b34
lea eax, [ebp - 0x10]
mov edx, dword [0x440f00]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004049e0
jmp 0x4d4b47
lea eax, [ebp - 0x10]
mov edx, dword [0x440f00]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.004049e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4d4b53
adc edx, 0
mov edx, dword [edx*4 + 0x42e8ac]
call fcn.00404bec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404bd0
push eax
call fcn.00406b4c
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4c61
mov eax, 0x40
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4c54
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4d4c54
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406fcc
mov eax, edi
call fcn.00402734
mov eax, 0x18
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4c54
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4d4c54
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4d4c54
cmp dx, 0x150
ja 0x4d4c54
mov eax, edi
call fcn.00402734
mov eax, 0xe0
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4c54
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4d4c54
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004049bc
mov eax, edi
call fcn.00402734
push esi
call fcn.00406b04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404cf8
jne 0x4d4c79
inc ebx
cmp ebx, 0x19
jne 0x4d4b0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e0c96
lea eax, [ebp - 0x10]
call fcn.00404980
ret
Function at 0x5093a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x44d594
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5093c2
shr eax, 1
xor eax, 0xedb88320
jmp 0x5093c4
shr eax, 1
dec edx
jne 0x5093b0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5093a9
mov byte [0x44d994], 1
pop esi
pop ebx
ret

Function at 0x5093e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x44d994], 0
jne 0x5093f7
call fcn.005093a0
mov eax, edi
dec eax
test eax, eax
jl 0x509420
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x44d594]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x509401
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x2fc211d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
je 0x2fc2174
dec eax
jne 0x2fc217b
call fcn.02fc2045
test eax, eax
jge 0x2fc2140
xor eax, eax
jmp 0x2fc2195
mov esi, 0x104
push esi
mov edi, 0x2fd3160
push edi
mov dword [0x2fd3370], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x2fc213c
add eax, 2
cmp eax, esi
ja 0x2fc213c
push 0x2fc1438
push esi
push edi
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
jmp 0x2fc217b
and dword [0x2fd3370], 0
cmp dword [0x2fd336c], 0
je 0x2fc2192
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.02fcc020
jmp 0x2fc2195
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x2fc2d97
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x2fd3078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x5c
lea eax, [ebp - 0x80]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
add esp, 0xc
push 8
pop edi
push 0x20
lea eax, [ebp - 0x64]
push eax
push 0x64
push dword [0x2fd3370]
mov dword [ebp - 0x70], 0x190
mov byte [ebp - 0x69], 1
call esi
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x65
push dword [0x2fd3370]
call esi
test eax, eax
je 0x2fc2e03
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov edi, eax
push 0x2fc1464
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x84], esi
test esi, esi
je 0x2fc2ef4
push 5
push 0x3ee
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x2fc2ee8
mov ecx, dword [eax]
mov edx, 0xffff0000
and ecx, edx
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
je 0x2fc2e5a
add eax, 0x1a
jmp 0x2fc2e5d
add eax, 0x12
mov edx, 0xffff
mov esi, edx
cmp word [eax], si
jne 0x2fc2e6e
add eax, 4
jmp 0x2fc2e78
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x2fc2e6e
cmp word [eax], dx
jne 0x2fc2e82
add eax, 4
jmp 0x2fc2e8c
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x2fc2e82
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x2fc2e8c
movzx edi, word [eax]
xor edx, edx
test ecx, ecx
setne dl
lea edx, [edx + edx + 1]
lea esi, [eax + edx*2]
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x2fc2eac
sub eax, ecx
sar eax, 1
lea ecx, [eax + 1]
push 0x20
pop eax
cmp ecx, eax
ja 0x2fc2ed8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x2fc2ec9
sub eax, edx
sar eax, 1
inc eax
add eax, eax
push eax
lea eax, [ebp - 0x64]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
push esi
neg eax
push 0
mov dword [ebp - 0x80], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.02fc29c2
leave
ret
Function at 0x2fc5d67
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
mov word [ebp - 0x18], ax
mov word [ebp - 0x14], ax
mov word [ebp - 0x16], ax
mov ax, word [esi + 0x2c]
mov word [ebp - 0x10], ax
mov ax, word [esi + 0x28]
mov word [ebp - 0x12], ax
mov eax, 0x5a0
mov word [ebp - 0xe], ax
mov dword [ebp + 0xc], 0x5711
mov ax, word [ebp + 0xc]
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 0x9ac6cdd7
lea ecx, [ebp - 0x18]
xor ax, word [ecx]
inc ecx
inc ecx
lea edx, [ebp - 8]
cmp ecx, edx
jb 0x2fc5db6
mov word [ebp - 8], ax
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x24]
call fcn.02fc5c9c
mov edi, eax
test edi, edi
je 0x2fc5e37
push 4
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.02fc4549
mov ebx, eax
test ebx, ebx
jl 0x2fc5e2b
push 0x12
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.02fc4549
mov ebx, eax
test ebx, ebx
jl 0x2fc5e2b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.02fc4549
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x2fc5e2b
mov ecx, dword [ebp + 0xc]
add ecx, 0x16
mov dword [eax], ecx
push dword [ebp + 0xc]
push edi
call fcn.02fc50ad
mov dword [esi + 0x24], eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x2fcbfda
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x2fcbfe5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
jle 0x2fcc017
and eax, 0xffff
or eax, 0x80070000
pop ebp
ret 0xc
Function at 0x2fcfebe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x2fd3078]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x2fcff7a
cmp dword [0x2fd38a8], 0
jne 0x2fcff7a
push 0x2fd3160
mov esi, 0x10f
lea eax, [ebp - 0x224]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
push 0x2fc1da4
lea eax, [ebp - 0x224]
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0x18
lea eax, [ebp - 0x224]
push eax
call ebx
mov dword [0x2fd38a8], eax
test eax, eax
je 0x2fcff7a
push 0x2fc1d90
push eax
call edi
push 0x2fc1d7c
push dword [0x2fd38a8]
mov dword [0x2fd3880], eax
call edi
push 0x2fc1d60
push dword [0x2fd38a8]
mov dword [0x2fd387c], eax
call edi
push 0x2fc1d44
push dword [0x2fd38a8]
mov dword [0x2fd3878], eax
call edi
mov dword [0x2fd3874], eax
test byte [ebp + 8], 1
je 0x2fd0021
cmp dword [0x2fd38a4], 0
jne 0x2fd0021
push 0x2fd3160
mov esi, 0x111
lea eax, [ebp - 0x228]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
push 0x2fc1d28
lea eax, [ebp - 0x228]
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0x18
lea eax, [ebp - 0x228]
push eax
call ebx
mov dword [0x2fd38a4], eax
test eax, eax
jne 0x2fcffd6
mov eax, 0x80004005
jmp 0x2fd0023
push 0x2fc1d10
push eax
call edi
mov dword [0x2fd38a0], eax
test eax, eax
je 0x2fcffcf
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push 0x2fc1ce4
call esi
push 0x2fc1cb8
mov word [0x2fd38ac], ax
call esi
push 0x2fc1c88
mov word [0x2fd38b0], ax
call esi
push 0x2fc1c58
mov word [0x2fd38b4], ax
call esi
mov word [0x2fd38b8], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.02fc29c2
leave
ret 4

Function at 0x2fd93bd
Capabilities:
Encode data using xor

Disassembly:
call 0x2fd9336
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x2fd9366
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x2fd9382
xor edx, 0
jmp 0x2fd938d
xor edx, edx
jmp 0x2fd93a4
jmp 0x2fd93b0
xor eax, eax
push 0x8427d7c0
call 0x2fd93bd
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x2fd93f9
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x2fd93d2
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x2fd9410
add eax, 0
jno 0x2fd9415
add esi, 0
ret 0x10