joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov ax, word [0x44f38c]
lea edx, [ebp - 0x210]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov word [ebp - 6], ax
push 0x208
push edx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x2e
lea ecx, [ebp - 0x210]
push ecx
call fcn.00405d85
add esp, 8
mov byte [eax], 0
push str._useid_
lea eax, [ebp - 0x210]
push eax
call fcn.00405c78
add esp, 8
push esi
lea edx, [ebp - 0x210]
push edx
call fcn.00405c78
add esp, 8
push str..txt
lea ecx, [ebp - 0x210]
push ecx
call fcn.00405c78
add esp, 8
lea eax, [ebp - 0x210]
push 0
push 0
push 2
push 0
push 3
push 0x40000000
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40168d
push 0
lea eax, [ebp - 4]
push eax
push 0x44f483
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0x44f47a
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call sub.KERNEL32.DLL_lstrlenA
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebp - 4]
push 0
push ecx
lea eax, [ebp - 6]
push 2
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_lstrlenA
push eax
mov eax, dword [ebp + 8]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
lea edx, [ebp - 4]
push 0
push edx
lea ecx, [ebp - 6]
Function at 0x4034ec
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x403520
mov edx, dword [eax + 8]
test edx, edx
jne 0x40350f
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x40351c
add edx, esi
cmp ebx, edx
jb 0x40352d
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x403505
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403568
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x403582
xor eax, eax
jmp 0x403702
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x403596
xor eax, eax
jmp 0x403702
cmp word [ebx + 0x14], 0xe0
jne 0x4035a6
cmp word [ebx + 0x18], 0x10b
je 0x4035ad
xor eax, eax
jmp 0x403702
mov dword [0x45347c], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004034ec
add esp, 8
test eax, eax
jne 0x4035d8
xor eax, eax
jmp 0x403702
mov edx, dword [0x45347c]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00403534
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x40360a
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x403702
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x4036d4
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x4036c6
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x4036c1
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x4036b8
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4036ad
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4036ad
test cl, cl
je 0x4036a2
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4036ad
add eax, 2
add edx, 2
test cl, cl
jne 0x403686
jne 0x4036ad
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x403702
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x40366c
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403644
jmp 0x403700
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x4036f8
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x4036f4
cmp dword [eax], 0
je 0x4036f4
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x403702
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x4036db
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403814
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x403831
xor eax, eax
jmp 0x40386e
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x403858
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x40386e
cmp dword [esp + 4], 4
jne 0x40386c
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x40386e
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x4038d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4038e9
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4038f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x403910
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f9c4
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.004038a8
pop ecx
test eax, eax
je 0x40394c
push ebx
call fcn.004038f0
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x40398a
push ebx
call fcn.00403784
pop ecx
test eax, eax
jne 0x403981
push ebx
call fcn.004037bc
pop ecx
test eax, eax
je 0x4039a7
push ebx
call fcn.004038f0
pop ecx
jmp 0x4039a7
push ebx
call fcn.004038d0
pop ecx
test eax, eax
jne 0x4039a0
push ebx
call fcn.00403874
pop ecx
test eax, eax
je 0x4039a7
push ebx
call fcn.004038f0
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403a13
jmp 0x403a02
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4039f4
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x403a02
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4039d6
cmp esi, dword [ebp - 4]
je 0x403a38
cmp dword [ebp - 4], 0
je 0x403a38
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x403b16
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44fb69
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x403b16
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x403af2
xor esi, esi
lea ebx, [ebp - 0x12cc]
jmp 0x403ae8
push 0x104
lea eax, [ebp - 0x13d0]
push eax
mov edx, dword [ebx]
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x403ae4
lea ecx, [ebp - 0x13d0]
push ecx
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403ae4
mov dword [ebp - 0xc], 1
jmp 0x403af2
inc esi
add ebx, 4
mov edx, dword [ebp - 8]
shr edx, 2
cmp esi, edx
jb 0x403aab
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x403b16
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0fff
dec dword [edi]
pop ds
add al, ch
sal byte [edx + 0x6a0000], 1
Function at 0x403b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x403b81
jne 0x403b81
jmp fcn.00403b05
cmp esi, 8
jb 0x403bbf
xor ebx, ebx
jmp 0x403bb6
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.00403bc4
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x403b8a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403bc4
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c77
mov eax, fcn.00401694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c77
mov eax, fcn.00403e20
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c77
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403c77
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403c3f
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403c94
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403d4a
mov eax, fcn.00401694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403d4a
mov eax, fcn.00403c94
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403d4a
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403d4a
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403d12
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403e70
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403f26
mov eax, fcn.00401694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403f26
mov eax, fcn.00403e20
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403f26
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403f26
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403eee
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4055c8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4099c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x409a26
call fcn.00409974
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00405cb4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00405cb4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x409a84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4519ac], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x409b5e
cmp dword [0x4519a8], 0
jne 0x409b5e
cmp dword [0x451b9c], 0
je 0x409b18
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00409874
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409afe
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00409874
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409afe
lea ebx, [ebp - 0x84]
jmp 0x409aff
inc ebx
call fcn.00409a40
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x409b99
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4519b0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00405cb4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4519b3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x409b99
cmp dword [0x4519a8], 0
je 0x409b78
cmp dword [0x4519a8], 0xffffffff
je 0x409b99
push esi
call dword [0x4519a8]
pop ecx
mov eax, dword [0x4519ac]
test eax, eax
je 0x409b99
cmp dword [0x4519ac], 0xffffffff
je 0x409b99
cmp byte [eax], 0
je 0x409b99
push esi
push eax
call fcn.004099c4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a3dc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x453efc], 0
jne 0x40a45d
cmp dword [0x453f1c], 0
jne 0x40a40c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x453f1c], eax
test eax, eax
jne 0x40a40c
push str.GetEnvironmentStrings_failed
call fcn.00409bb0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x453f1c]
jmp 0x40a420
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00405cb4
pop ecx
mov edi, eax
test eax, eax
jne 0x40a418
lea edi, [ebp + 1]
push edi
call fcn.00404b80
pop ecx
mov ebx, eax
mov dword [0x453f00], ebx
test ebx, ebx
jne 0x40a44a
xor eax, eax
jmp 0x40a520
push edi
mov edx, dword [0x453f1c]
push edx
push ebx
call fcn.00405b64
add esp, 0xc
jmp 0x40a47d
xor esi, esi
mov ebx, dword [0x453efc]
jmp 0x40a477
push eax
call fcn.00405cb4
pop ecx
test eax, eax
jne 0x40a473
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a467
lea ebx, [esi + 4]
push 4
mov dword [0x453f04], ebx
inc ebx
push ebx
call fcn.004046e4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40a4a0
xor eax, eax
jmp 0x40a520
cmp dword [0x453efc], 0
jne 0x40a4d1
xor esi, esi
mov ebx, dword [0x453f00]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40a4c2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00405cb4
pop ecx
mov edi, eax
test eax, eax
jne 0x40a4b8
jmp 0x40a502
xor esi, esi
mov ebx, dword [0x453efc]
mov eax, dword [esp]
mov edi, eax
jmp 0x40a4fc
push eax
call fcn.00405cb4
pop ecx
test eax, eax
je 0x40a4f1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40a4f5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a4e0
mov eax, dword [0x453efc]
test eax, eax
je 0x40a512
push eax
call fcn.00404b90
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x453efc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40cca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x45260c
sub eax, eax
test esi, esi
je 0x40cd80
sub eax, 1
test ecx, ecx
je 0x40cd7e
test esi, 3
je 0x40ccde
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40ccc3
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x40cd65
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40ccec
mov ecx, edx
test ecx, ecx
je 0x40cd7e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40cd6b
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40d064
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040d0e7
jae 0x40d072
xor ecx, ecx
call fcn.0040d0e7
jae 0x40d0a1
xor eax, eax
call fcn.0040d0e7
jae 0x40d0b1
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040d0e7
adc al, al
jae 0x40d093
jne 0x40d0dd
stosb byte es:[edi], al
jmp 0x40d075
call fcn.0040d0f3
sub ecx, ebx
jne 0x40d0ba
call fcn.0040d0f1
jmp 0x40d0d9
lodsb al, byte [esi]
shr eax, 1
je 0x40d103
adc ecx, ecx
jmp 0x40d0d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040d0f1
cmp eax, 0x7d00
jae 0x40d0d6
cmp ah, 5
jae 0x40d0d7
cmp eax, 0x7f
ja 0x40d0d8
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40d075
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40d430
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40d49f
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40d467
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40dda0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40de3f
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00405cb4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x452ece
call fcn.00405e2c
add esp, 0xc
test eax, eax
jne 0x40de3f
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x40de3c
mov ecx, dword [ebp + 0x10]
mov esi, str.__
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405c78
add esp, 8
mov eax, 1
jmp 0x40de4a
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x40ddbf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret