joyce8/EMBER2024-capa huggingface dataset:
Function at 0x245ef20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebx
push ebp
mov ebp, ecx
test ebp, ebp
push esi
push edi
mov ebx, edx
je 0x245f06d
test ebx, ebx
je 0x245f06d
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24db5a4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x20]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dcce8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x20]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x245f06d
mov ecx, dword [esp + 0x18]
xor edi, edi
lea edx, [esp + 0x10]
push edx
push edi
lea eax, [esp + 0x1c]
push eax
push edi
push ebp
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x245f04f
mov esi, dword [esp + 0x10]
cmp esi, 0x186a0
ja 0x245f04f
cmp dword [esp + 0x14], 3
jne 0x245f04f
mov eax, dword [ebx + 4]
cmp eax, edi
mov dword [ebx], edi
je 0x245effe
push eax
call fcn.024ad03a
add esp, 4
mov dword [ebx + 4], edi
cmp esi, edi
je 0x245f04f
push esi
call fcn.024acf00
add esp, 4
cmp eax, edi
mov dword [ebx + 4], eax
je 0x245f04f
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push ebp
push ecx
mov dword [ebx], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x245f04f
mov edx, dword [esp + 0x10]
cmp edx, dword [ebx]
jne 0x245f04f
cmp dword [esp + 0x14], 3
jne 0x245f04f
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, edi
pop edi
pop esi
pop ebp
setne al
pop ebx
add esp, 0x74
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x74
ret
Function at 0x245f080
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x68
push ebx
mov ebx, ecx
test ebx, ebx
push ebp
mov ebp, edx
jne 0x245f097
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 4
or ecx, 0xffffffff
push esi
push edi
xor eax, eax
mov edi, 0x24db5a4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x14]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x24dcce8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x14]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
pop edi
pop esi
je 0x245f112
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 4
test ebp, ebp
je 0x245f149
mov eax, dword [esp + 0x74]
test eax, eax
je 0x245f149
mov edx, dword [esp + 8]
push eax
push ebp
push 3
push 0
push ebx
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
je 0x245f155
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 4
mov ecx, dword [esp + 8]
push ebx
push ecx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebp
mov eax, 1
pop ebx
add esp, 0x68
ret 4
Function at 0x2460700
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
xor eax, eax
mov ecx, 0x277
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c]
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
mov dword [eax], 0xffffffff
mov dword [ecx], 0
mov edx, dword [esi + 0x20]
mov eax, dword [esp + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x24]
lea edi, [eax - 0x19]
mov dword [esp + 0x18], edx
mov eax, 0xcf79773d
mul edi
shr edx, 0x12
mov ecx, edx
mov eax, edi
xor edx, edx
mov edi, 0x4ef80
div edi
xor bl, bl
or ebp, 0xffffffff
shl ecx, 7
mov byte [esp + 0x13], 0
cmp edx, 0x80
jbe 0x2460784
lea edi, [edx - 0x80]
mov eax, 0x9f1cfc27
mul edi
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 0xb
add ecx, edi
mov eax, dword [esp + 0x18]
cmp eax, ecx
jb 0x246079b
mov ecx, dword [esp + 0x2c]
mov dword [ecx], 1
jmp 0x246081f
mov ecx, dword [esi + 0x44]
mov edi, eax
shr edi, 7
cmp ecx, edi
je 0x2460803
mov eax, dword [esi]
mov edx, edi
imul edx, edx, 0x4ef80
push 0
push 0
add edx, 0x19
push edx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x2460839
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x80
lea edx, [esi + 0x48]
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x24608b3
cmp dword [esp + 0x14], 0x80
jne 0x24608b3
mov eax, dword [esp + 0x18]
mov dword [esi + 0x44], edi
and eax, 0x7f
mov bl, byte [eax + esi + 0x48]
mov ecx, eax
imul ecx, ecx, 0x9de
imul edi, edi, 0x4ef80
lea ebp, [ecx + edi + 0x99]
mov edx, dword [esp + 0x2c]
cmp dword [edx], 0
jne 0x24608d2
cmp bl, 1
je 0x246084c
inc dword [esi + 0x20]
jmp 0x246072c
pop edi
mov dword [esi + 0x28], 0xa
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [esi]
push 0
push 0
push ebp
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x2460872
pop edi
mov dword [esi + 0x28], 0xa
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x24]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x9de
push edx
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x24608a9
pop edi
mov dword [esi + 0x28], 5
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
cmp dword [esp + 0x1c], 0x9de
je 0x24608c6
pop edi
mov dword [esi + 0x28], 5
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov ecx, dword [esi + 0x20]
mov edx, dword [esp + 0x28]
mov dword [edx], ecx
inc dword [esi + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0xc
Function at 0x2460930
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ebp, ecx
xor eax, eax
mov ecx, 0x68
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c]
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
mov dword [eax], 0xffffffff
mov dword [ecx], 0
mov edx, dword [ebp + 0x20]
mov eax, dword [esp + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0x24]
lea ecx, [eax - 0x19]
mov dword [esp + 0x18], edx
mov eax, 0x38d22d37
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xf
mov esi, eax
mov eax, ecx
xor edx, edx
mov ecx, 0xd180
div ecx
xor bl, bl
or edi, 0xffffffff
shl esi, 7
mov byte [esp + 0x13], 0
cmp edx, 0x80
jbe 0x24609b6
add edx, 0xffffff80
mov eax, 0x9cc8e161
mul edx
shr edx, 8
add esi, edx
mov eax, dword [esp + 0x18]
cmp eax, esi
jb 0x24609cd
mov edx, dword [esp + 0x2c]
mov dword [edx], 1
jmp 0x2460a6e
mov ecx, dword [ebp + 0x44]
mov esi, eax
shr esi, 7
cmp ecx, esi
je 0x2460a44
lea eax, [esi + esi*2]
lea ecx, [esi + eax*4]
mov eax, dword [ebp]
shl ecx, 4
add ecx, esi
push 0
lea edx, [esi + ecx*2]
shl edx, 7
push 0
add edx, 0x19
push edx
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x2460a88
mov eax, dword [ebp]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x80
lea edx, [ebp + 0x48]
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x2460b04
cmp dword [esp + 0x14], 0x80
jne 0x2460b04
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x44], esi
lea ecx, [esi + esi*2]
lea edx, [esi + ecx*4]
shl edx, 4
add edx, esi
and eax, 0x7f
mov bl, byte [eax + ebp + 0x48]
lea ecx, [esi + edx*2]
lea edx, [eax + eax*2]
lea edx, [eax + edx*4]
shl ecx, 7
shl edx, 4
add edx, eax
lea edi, [ecx + edx*2 + 0x99]
mov eax, dword [esp + 0x2c]
cmp dword [eax], 0
jne 0x2460b23
cmp bl, 1
je 0x2460a9b
inc dword [ebp + 0x20]
jmp 0x246095c
pop edi
pop esi
mov dword [ebp + 0x28], 0xa
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov ecx, dword [ebp]
push 0
push 0
push edi
push ecx
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x2460ac2
pop edi
pop esi
mov dword [ebp + 0x28], 0xa
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp]
push 0
lea edx, [esp + 0x20]
push edx
push 0x1a2
push eax
push ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2460afa
pop edi
pop esi
mov dword [ebp + 0x28], 5
pop ebp
pop ebx
add esp, 0x10
ret 0xc
cmp dword [esp + 0x1c], 0x1a2
je 0x2460b17
pop edi
pop esi
mov dword [ebp + 0x28], 5
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov edx, dword [ebp + 0x20]
mov eax, dword [esp + 0x28]
mov dword [eax], edx
inc dword [ebp + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0xc
Function at 0x2460b40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
push esi
push edi
mov esi, ecx
jne 0x2460b60
pop edi
mov dword [esi + 0x28], 0xb
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x24]
xor ecx, ecx
test eax, eax
setne cl
neg eax
push 0
sbb eax, eax
push 0x20
and eax, 0xc0000000
push 3
add eax, 0xc0000000
mov edi, ecx
mov ebx, eax
push 0
push edi
mov edx, ebx
mov ecx, ebp
call fcn.02481ba0
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x2460c20
lea edx, [esp + 0x18]
mov ecx, ebp
mov dword [esp + 0x18], 0
call fcn.02481c80
test eax, eax
jne 0x2460bc0
pop edi
mov dword [esi + 0x28], 1
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
test byte [esp + 0x18], 0x11
je 0x2460bd8
pop edi
mov dword [esi + 0x28], 8
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov dword [esp + 0x24], 0
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
push 0
push 0x20
push 3
push 0
push edi
mov edx, ebx
mov ecx, ebp
call fcn.02481ba0
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x2460c20
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x32
mov dword [esp + 0x24], eax
jb 0x2460be0
pop edi
mov dword [esi + 0x28], 1
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
lea ebx, [esi + 4]
xor eax, eax
mov ecx, 6
mov edi, ebx
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x14]
push edx
push 0x19
stosb byte es:[edi], al
mov eax, dword [esi]
push ebx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2460c6e
mov ecx, dword [esi]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [esi], 0xffffffff
mov dword [esi + 0x28], 5
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
cmp dword [esp + 0x10], 0x19
jne 0x2460cc3
mov edx, dword [ebx]
cmp edx, dword [esp + 0x1c]
jne 0x2460cc3
cmp byte [esi + 0x1c], 1
jne 0x2460cc3
cmp dword [esi + 0x10], 0x9de
jne 0x2460cc3
cmp dword [esi + 0x14], 0x80
jne 0x2460cc3
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x2460cb6
mov ecx, dword [esi + 8]
mov dword [eax], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
mov eax, dword [esi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [esi], 0xffffffff
mov dword [esi + 0x28], 3
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
Function at 0x2460cf0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
push esi
push edi
mov esi, ecx
jne 0x2460d10
pop edi
mov dword [esi + 0x28], 0xb
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x24]
xor ecx, ecx
test eax, eax
setne cl
neg eax
push 0
sbb eax, eax
push 0x20
and eax, 0xc0000000
push 3
add eax, 0xc0000000
mov edi, ecx
mov ebx, eax
push 0
push edi
mov edx, ebx
mov ecx, ebp
call fcn.02481ba0
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x2460dd0
lea edx, [esp + 0x18]
mov ecx, ebp
mov dword [esp + 0x18], 0
call fcn.02481c80
test eax, eax
jne 0x2460d70
pop edi
mov dword [esi + 0x28], 1
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
test byte [esp + 0x18], 0x11
je 0x2460d88
pop edi
mov dword [esi + 0x28], 8
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov dword [esp + 0x24], 0
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
push 0
push 0x20
push 3
push 0
push edi
mov edx, ebx
mov ecx, ebp
call fcn.02481ba0
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x2460dd0
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x32
mov dword [esp + 0x24], eax
jb 0x2460d90
pop edi
mov dword [esi + 0x28], 1
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
lea ebx, [esi + 4]
xor eax, eax
mov ecx, 6
mov edi, ebx
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x14]
push edx
push 0x19
stosb byte es:[edi], al
mov eax, dword [esi]
push ebx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2460e1e
mov ecx, dword [esi]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [esi], 0xffffffff
mov dword [esi + 0x28], 5
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
cmp dword [esp + 0x10], 0x19
jne 0x2460e73
mov edx, dword [ebx]
cmp edx, dword [esp + 0x1c]
jne 0x2460e73
cmp byte [esi + 0x1c], 1
jne 0x2460e73
cmp dword [esi + 0x10], 0x1a2
jne 0x2460e73
cmp dword [esi + 0x14], 0x80
jne 0x2460e73
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x2460e66
mov ecx, dword [esi + 8]
mov dword [eax], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
mov eax, dword [esi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [esi], 0xffffffff
mov dword [esi + 0x28], 3
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
Function at 0x2469530
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x24c2b18
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov ebx, ecx
xor ecx, ecx
cmp esi, ecx
push edi
je 0x2469640
mov edi, dword [esp + 0x2c]
cmp edi, ecx
je 0x2469640
cmp dword [esp + 0x30], ecx
je 0x2469640
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov ebp, dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [esp + 0x20], ecx
test ecx, ecx
je 0x2469592
test edx, edx
jne 0x2469657
push 0xffffffffffffffff
lea ecx, [ebx + 0xa90]
call fcn.02469ef0
test eax, eax
je 0x2469627
call ebp
mov edx, dword [edi]
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx]
mov esi, eax
sub esi, edx
cmp ecx, esi
jbe 0x24695c8
sub ecx, eax
add ecx, edx
test ecx, ecx
je 0x24695c8
push ecx
call dword [sym.imp.kernel32.dll_Sleep]
call ebp
lea esi, [ebx + 0xa14]
mov ecx, esi
mov dword [edi], eax
call fcn.024871d0
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.02469090
mov edi, eax
mov eax, dword [ebx + 0xa54]
test eax, eax
mov ecx, 0x1770
je 0x24695f8
mov ecx, eax
xor edx, edx
mov eax, 0xea60
div ecx
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov ecx, esi
call fcn.02487290
test edi, edi
je 0x2469627
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
jmp 0x2469586
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x10], 0
je 0x2469640
push eax
call fcn.024ad03a
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
mov eax, dword [esi + 4]
test eax, eax
mov dword [esp + 0x14], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [esp + 0x10], 0
je 0x2469678
push eax
call fcn.024ad03a
add esp, 4
mov eax, 1
jmp 0x2469642
Function at 0x246b890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x24c2d01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
call fcn.0240dc70
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.0240d1a0
mov ecx, dword [esp + 0xc]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x2475dc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x24e399c
mov ecx, 0x24dd44c
call 0x2475dc0
mov edx, 0x24e3a9c
mov ecx, 0x24dd48c
jmp 0x2475dc0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
mov eax, ebx
and eax, 0xf
mov esi, eax
and esi, 1
shl esi, 3
mov ecx, eax
sar ecx, 1
or esi, ecx
mov edi, ebx
sar edi, 4
mov ecx, edi
and ecx, 1
shl ecx, 3
xor esi, ecx
xor ecx, ecx
xor eax, edi
mov cl, byte [eax + ebp]
xor esi, edi
xor eax, eax
mov al, byte [esi + ebp + 0x10]
mov edi, ecx
mov ecx, eax
and ecx, 1
shl ecx, 3
mov esi, eax
sar esi, 1
or ecx, esi
mov esi, edi
and esi, 1
shl esi, 3
xor ecx, esi
xor ecx, edi
mov cl, byte [ecx + ebp + 0x30]
shl cl, 4
xor eax, edi
or cl, byte [eax + ebp + 0x20]
inc ebx
cmp ebx, 0x100
mov byte [ebx + edx - 1], cl
jl 0x2475dc8
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x2475e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov esi, 0x24e359c
xor edx, edx
mov dl, byte [ebx + 0x24e399c]
add esi, 4
mov eax, edx
and eax, 1
mov eax, dword [eax*4 + 0x24dd4cc]
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
mov edi, eax
shr edi, 1
and ecx, 1
mov ecx, dword [ecx*4 + 0x24dd4cc]
xor ecx, edi
xor ecx, edx
xor eax, ecx
mov edi, edx
shl edi, 8
or edi, ecx
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
mov dword [esi - 0x804], edi
mov edi, ecx
shl edi, 8
or edi, eax
shl edi, 8
or edi, edx
xor edx, edx
mov dl, byte [ebx + 0x24e3a9c]
shl edi, 8
or edi, ecx
mov dword [esi - 4], edi
mov edi, edx
shr edx, 1
mov eax, edi
and eax, 1
mov ecx, dword [eax*4 + 0x24dd4cc]
xor ecx, edx
mov eax, ecx
and eax, 1
mov edx, dword [eax*4 + 0x24dd4cc]
mov ebp, ecx
shr ebp, 1
xor edx, ebp
xor edx, edi
xor ecx, edx
mov eax, ecx
shl eax, 8
mov ebp, eax
or ebp, ecx
or eax, edi
shl ebp, 8
shl eax, 8
or ebp, edx
or eax, ecx
shl ebp, 8
shl eax, 8
or ebp, edi
or eax, edx
mov dword [esi - 0xc04], ebp
mov dword [esi - 0x404], eax
inc ebx
cmp esi, 0x24e399c
jl 0x2475e4b
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x2475f20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x24e3b9c]
sub esp, 0x50
test eax, eax
push esi
mov esi, ecx
jne 0x2475f31
jmp 0x2475f2f
test edx, edx
jl 0x24760a4
cmp edx, 0x20
jg 0x24760a4
push ebx
push ebp
push edi
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x44
sub ecx, edx
mov esi, ecx
shr ecx, 2
xor eax, eax
lea edi, [esp + edx + 0x1c]
rep stosd dword es:[edi], eax
lea ebp, [edx + 7]
mov ecx, esi
sar ebp, 3
and ecx, 3
cmp ebp, 2
rep stosb byte es:[edi], al
mov dword [esp + 0x10], ebp
jge 0x2475f8f
mov dword [esp + 0x10], 2
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x64]
xor esi, esi
lea ebx, [ecx + 0x1004]
push ebp
lea edx, [esp + 0x20]
mov ecx, esi
call fcn.024760b0
push ebp
lea edx, [esp + 0x24]
lea ecx, [esi + 1]
mov edi, eax
call fcn.024760b0
mov ecx, eax
shr ecx, 0x18
shl eax, 8
or ecx, eax
add edi, ecx
add ecx, edi
mov edx, ecx
shr edx, 0x17
shl ecx, 9
or edx, ecx
mov dword [ebx - 4], edi
mov dword [ebx], edx
add esi, 2
add ebx, 8
cmp esi, 0x28
jl 0x2475f9b
lea ecx, [esp + ebp*8 + 0x1c]
lea eax, [esp + 0x1c]
cmp ecx, eax
jbe 0x247608a
lea edi, [esp + 0x47]
sub ecx, 8
lea edx, [edi - 0xb]
mov dword [edx], 0
mov eax, dword [ecx]
mov dword [edi - 7], eax
mov edx, dword [ecx + 4]
lea ebp, [edi - 8]
cmp edi, ebp
mov dword [esp + 0x18], ecx
mov dword [edi - 3], edx
mov eax, edi
jbe 0x2476077
mov cl, byte [eax]
mov byte [esp + 0x14], cl
mov esi, dword [esp + 0x14]
and esi, 0xff
mov bl, cl
shl bl, 1
mov edx, esi
shr edx, 7
mov dl, byte [edx*4 + 0x24dd4d4]
xor dl, bl
mov bl, cl
shr bl, 1
and esi, 1
mov cl, byte [esi*4 + 0x24dd4dc]
xor cl, bl
mov bl, byte [eax - 1]
xor cl, dl
xor bl, cl
mov byte [eax - 1], bl
mov bl, byte [eax - 2]
xor bl, dl
mov dl, byte [eax - 4]
mov byte [eax - 2], bl
mov bl, byte [eax - 3]
xor bl, cl
mov cl, byte [esp + 0x14]
xor dl, cl
mov byte [eax - 3], bl
mov byte [eax - 4], dl
dec eax
cmp eax, ebp
ja 0x2476016
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
add edi, 8
cmp ecx, edx
ja 0x2475ff2
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
push eax
mov edx, ebp
lea ecx, [esp + 0x40]
call fcn.02476320
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x50
ret 4
jmp 0x24760a4
Function at 0x2479d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 2
mov esi, ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
jne 0x2479d85
pop esi
ret 4
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x2479d95
pop esi
ret 4
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov ecx, eax
test ecx, ecx
jne 0x2479da6
pop esi
ret 4
cmp dword [ecx], 0x28
jae 0x2479db1
xor eax, eax
pop esi
ret 4
mov eax, dword [ecx + 4]
mov esi, dword [esp + 8]
cdq
xor eax, edx
sub eax, edx
mov dword [esi], eax
mov eax, dword [ecx + 8]
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 4], eax
mov eax, 1
pop esi
ret 4

Function at 0x2479de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
mov esi, ecx
jne 0x2479df3
pop edi
xor eax, eax
pop esi
ret 4
push 2
push edx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
jne 0x2479e06
pop edi
pop esi
ret 4
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x2479e17
pop edi
pop esi
ret 4
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edx, dword [eax]
cmp edx, 0x28
jae 0x2479e2c
pop edi
xor eax, eax
pop esi
ret 4
xor ecx, ecx
mov cx, word [eax + 0xe]
dec ecx
je 0x2479e54
sub ecx, 3
je 0x2479e4d
sub ecx, 4
je 0x2479e46
pop edi
xor eax, eax
pop esi
ret 4
mov esi, 0x100
jmp 0x2479e59
mov esi, 0x10
jmp 0x2479e59
mov esi, 2
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x2479e63
mov si, cx
mov word [edi + 2], si
and esi, 0xffff
mov word [edi], 0x300
jbe 0x2479e98
lea ecx, [edx + eax + 1]
lea eax, [edi + 4]
mov byte [eax + 3], 0
mov dl, byte [ecx + 1]
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 1], dl
mov dl, byte [ecx - 1]
mov byte [eax + 2], dl
add eax, 4
add ecx, 4
dec esi
jne 0x2479e7b
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x2479eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 2
mov esi, ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
jne 0x2479ec5
pop esi
ret 8
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x2479ed5
pop esi
ret 8
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edx, dword [eax]
cmp edx, 0x28
jae 0x2479ee9
xor eax, eax
pop esi
ret 8
xor ecx, ecx
mov cx, word [eax + 0xe]
dec ecx
je 0x2479f10
sub ecx, 3
je 0x2479f09
sub ecx, 4
je 0x2479f02
xor eax, eax
pop esi
ret 8
mov ecx, 0x100
jmp 0x2479f15
mov ecx, 0x10
jmp 0x2479f15
mov ecx, 2
mov esi, dword [eax + 0x20]
test esi, esi
je 0x2479f1f
mov cx, si
push 0
push eax
add edx, eax
mov eax, dword [eax + 8]
and ecx, 0xffff
lea ecx, [edx + ecx*4]
cdq
xor eax, edx
push ecx
sub eax, edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push 0
push edx
push eax
call dword [sym.imp.gdi32.dll_SetDIBits]
neg eax
sbb eax, eax
neg eax
pop esi
ret 8