joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105ec058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105ec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105ec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ec06a
add dl, dl
jne 0x105ec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ec0dc
xor eax, eax
add dl, dl
jne 0x105ec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ec17d
add dl, dl
jne 0x105ec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105ec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105ec075
mov eax, 1
add dl, dl
jne 0x105ec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ec0e1
sub eax, ebx
mov ebx, 1
jne 0x105ec128
mov ecx, 1
add dl, dl
jne 0x105ec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105ec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105ec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105ec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ec136
cmp eax, 0x7d00
jae 0x105ec16d
cmp eax, 0x500
jb 0x105ec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ec075
cmp eax, 0x7f
ja 0x105ec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105ec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105ec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42c2d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x30], 0x12
mov byte [ebp - 0x2f], 0x10
mov byte [ebp - 0x2e], 0x15
mov byte [ebp - 0x2d], 0xff
mov byte [ebp - 0x2c], 0x40
mov byte [ebp - 0x2b], 0x40
mov byte [ebp - 0x2a], 0x40
mov byte [ebp - 0x29], 0xff
mov byte [ebp - 0x28], 0x40
mov byte [ebp - 0x27], 0x40
mov byte [ebp - 0x26], 0x40
mov byte [ebp - 0x25], 0xff
mov byte [ebp - 0x24], 0x40
mov byte [ebp - 0x23], 0x40
mov byte [ebp - 0x22], 0x40
mov byte [ebp - 0x21], 0xff
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0xff
movsd dword es:[edi], dword [esi]
call fcn.00565dbd
push 2
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x42c35c
call fcn.00565dbd
push 0x14
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul dword [0x58b4d8]
fadd dword [ebp - 0x10]
jmp 0x42c376
call fcn.00565dbd
push 0x14
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul dword [0x58b4d8]
fsubr dword [ebp - 0x10]
fstp dword [ebp - 0x10]
call fcn.00565dbd
push 2
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x42c3a4
call fcn.00565dbd
push 0x14
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul dword [0x58b4d8]
fadd dword [ebp - 8]
jmp 0x42c3be
call fcn.00565dbd
push 0x14
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul dword [0x58b4d8]
fsubr dword [ebp - 8]
fstp dword [ebp - 8]
fldz
fstp dword [ebp - 0xc]
fldz
fstp dword [ebp - 0x1c]
fldz
fstp dword [ebp - 0x14]
call fcn.00565dbd
push 5
cdq
pop ecx
idiv ecx
push 0
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fmul dword [0x58b4d8]
fstp dword [ebp - 0x18]
call fcn.00565dbd
push 5
cdq
pop ecx
idiv ecx
push dword [ebp + edx*4 - 0x30]
call fcn.00565dbd
fld dword [ebp + 8]
push 0x14
pop ecx
cdq
idiv ecx
lea esi, [ebp - 0x1c]
add edx, 0x28
push edx
sub esp, 0x10
fstp dword [esp + 0xc]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0xc
lea esi, [ebp - 0x10]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0046c7cf
add esp, 0x28
pop edi
pop esi
leave
ret
Function at 0x4b00f3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x600758]
push ebx
push esi
push edi
mov esi, str.TMNT_WIN32
push esi
xor edi, edi
push edi
push edi
mov dword [ebp + 0xac], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x28
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00565d50
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push edi
mov dword [ebp - 0x80], 0x200
mov dword [ebp - 0x7c], 0x4afc5d
call ebx
push 0x6b
push edi
mov dword [ebp - 0x70], eax
call ebx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push edi
mov dword [ebp - 0x6c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [ebp - 0x68], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push edi
push esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], esi
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x4b01a7
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b0202
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
lea eax, [ebp - 0x54]
push str.TMNT
push eax
call fcn.00566ec0
pop ecx
pop ecx
push edi
push edi
call ebx
push eax
push edi
push edi
push edi
mov eax, DirectSoundCreate
push eax
push edi
push eax
push 0xcf0000
lea eax, [ebp - 0x54]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push dword [ebp - 0x58]
mov dword [0x69f564], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x69f564]
cmp eax, edi
jne 0x4b0206
xor eax, eax
jmp 0x4b0210
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0xac]
pop edi
pop esi
pop ebx
call fcn.00565ca5
add ebp, 0xb0
leave
ret

Function at 0x4b0613
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x69f564]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004afa64
call fcn.00511450
call fcn.004b83e0
call fcn.00517200
jmp fcn.004b84c0

Function at 0x4b063a
Capabilities:
Hide graphical window

Disassembly:
call fcn.004b8430
test eax, eax
je 0x4b06b7
push 0
push 0x5163e0
push 0x5bd8dc
call fcn.004c00e0
push 0
push 0x51b3a0
push 0x5bd8d8
call fcn.004c00e0
push 0
call fcn.005113a0
add esp, 0x1c
push 5
push dword [0x69f564]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004b8380
push eax
call fcn.004b0226
test eax, eax
pop ecx
je 0x4b06ad
push 1
push 0
push dword [0x69f564]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x69f564]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
ret
call fcn.00511450
call fcn.004b83e0
xor eax, eax
ret
Function at 0x4b34e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x600758]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004b2cdc
lea eax, [ebp - 0x108]
mov dword [esp], str.SaveSetting.dat
push eax
call fcn.00566ed0
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x4b356c
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x3a4
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b3563
push 0xfffffffffffffffe
pop eax
jmp 0x4b356c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
call fcn.00565ca5
leave
ret

Function at 0x4b3577
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x600758]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004b2cdc
lea eax, [ebp - 0x108]
mov dword [esp], str.SaveSetting.dat
push eax
call fcn.00566ed0
pop ecx
pop ecx
push 0
push 0x80
push 3
push 0
push 0
push DirectSoundCreate
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x4b35fc
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x3a4
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b35f3
push 0xfffffffffffffffe
pop eax
jmp 0x4b35fc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
call fcn.00565ca5
leave
ret
Function at 0x4b3761
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x134
mov eax, dword [0x600758]
push ebx
push esi
push edi
mov esi, 0x94
push esi
mov dword [ebp + 0x74], eax
xor ebx, ebx
lea eax, [ebp - 0x20]
push ebx
push eax
xor edi, edi
call fcn.00565d50
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
mov eax, dword [ebp - 0x10]
sub eax, ebx
je 0x4b38f6
dec eax
je 0x4b38a6
dec eax
jne 0x4b390a
push 5
pop eax
cmp dword [ebp - 0x1c], eax
jae 0x4b37c5
mov edi, eax
jmp 0x4b390a
ja 0x4b389c
cmp dword [ebp - 0x1c], eax
jne 0x4b37da
cmp dword [ebp - 0x18], 1
ja 0x4b389c
mov edi, 0x9c
push edi
lea eax, [ebp - 0xbc]
push ebx
push eax
call fcn.00565d50
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0xbc], edi
call esi
cmp dword [ebp - 0xb4], ebx
mov esi, str.Unknown
jne 0x4b3829
push 6
pop edi
push str.Windows_2000
push esi
call fcn.00566ec0
cmp byte [ebp - 0x22], 1
pop ecx
pop ecx
je 0x4b384e
push str._Server
jmp 0x4b3853
cmp byte [ebp - 0x22], 1
push 7
pop edi
jne 0x4b385b
push str.Windows_XP
push esi
call fcn.00566ec0
cmp word [ebp - 0x24], 0x200
pop ecx
pop ecx
jne 0x4b384e
push str._Home_Edition
jmp 0x4b3853
push str._Professional
push esi
call fcn.00566ed0
jmp 0x4b3866
push str.Windows_.NET_Server_
push esi
call fcn.00566ec0
cmp byte [ebp - 0xa8], bl
pop ecx
pop ecx
je 0x4b390a
push 0x5be358
push esi
call fcn.00566ed0
lea eax, [ebp - 0xa8]
push eax
push esi
call fcn.00566ed0
push 0x5be354
push esi
call fcn.00566ed0
add esp, 0x18
jmp 0x4b390a
push 7
pop edi
push str.Windows_XP_or_Above
jmp 0x4b38fe
cmp dword [ebp - 0x1c], 4
jne 0x4b38b8
cmp dword [ebp - 0x18], ebx
jne 0x4b38b8
push str.Windows_95
jmp 0x4b38fb
cmp dword [ebp - 0x18], 0xa
jne 0x4b38e6
push 3
pop edi
push str.Windows_98
mov esi, str.Unknown
push esi
call fcn.00566ec0
cmp byte [ebp - 0xc], 0x41
pop ecx
pop ecx
jne 0x4b390a
push str._Second_Edition
push esi
call fcn.00566ed0
jmp 0x4b3908
cmp dword [ebp - 0x18], 0x5a
jne 0x4b390a
push 4
pop edi
push str.Windows_Me
jmp 0x4b38fe
push str.Windows_3.1__Win32s
xor edi, edi
inc edi
push str.Unknown
call fcn.00566ec0
pop ecx
pop ecx
mov eax, dword [edi*4 + 0x5be2d4]
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
pop ebx
call fcn.00565ca5
add ebp, 0x78
leave
ret
Function at 0x4b3921
Capabilities:
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x600758]
push ebx
push esi
push edi
mov dword [ebp + 0x3e8], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x104
lea eax, [ebp + 0x1e0]
push eax
push dword [ebp + 0x3f4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x1e0]
push eax
call fcn.00567ce3
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1e0]
push eax
call fcn.005672f9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x2e4]
push eax
call fcn.00566ec0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x2e4]
push eax
call fcn.00566ed0
add esp, 0x28
lea eax, [ebp + 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push 0x10
call ebx
push esi
push esi
push esi
push 0x11
call ebx
push 8
pop edi
push esi
lea eax, [ebp - 0x34]
push eax
push edi
push 0x3a
mov dword [ebp - 0x34], edi
call ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
and eax, 0xfffffffb
push esi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0x3b
call ebx
push esi
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x34
mov dword [ebp - 0x2c], edi
call ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
and eax, 0xfffffffa
push esi
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x50]
push eax
push edi
push 0x35
call ebx
push 0x18
pop eax
push esi
lea ecx, [ebp - 0x80]
push ecx
push eax
push 0x32
mov dword [ebp - 0x80], eax
call ebx
push 6
pop ecx
lea esi, [ebp - 0x80]
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
and dword [ebp - 0x64], 0xfffffffb
xor esi, esi
push esi
lea eax, [ebp - 0x68]
push eax
push 0x18
push 0x33
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.004b3761
test eax, eax
jne 0x4b3a82
push str.Unknown
lea eax, [ebp + 0xe0]
push str.Operating_System_check_failed..._n_n__s__n
push eax
call fcn.00565c1c
add esp, 0xc
push 0x10
push esi
lea eax, [ebp + 0xe0]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4b3abb
push dword [ebp + 0x3fc]
call fcn.004af997
pop ecx
push 8
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov edi, eax
cmp edi, esi
jne 0x4b3aa9
push dword [ebp - 0x40]
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
call fcn.004b2525
cmp edi, esi
jne 0x4b3abb
push dword [ebp - 0x40]
call dword [sym.imp.WINMM.dll_timeEndPeriod]
push esi
push esi
push dword [ebp - 0x38]
push 0x11
call ebx
push esi
lea eax, [ebp - 0x34]
push eax
push 8
push 0x3b
call ebx
push esi
lea eax, [ebp - 0x2c]
push eax
push 8
push 0x35
call ebx
push esi
lea eax, [ebp - 0x80]
push eax
push 0x18
push 0x33
call ebx
mov ecx, dword [ebp + 0x3e8]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.00565ca5
add ebp, 0x3ec
leave
ret 0x10
Function at 0x4c9090
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x4c9241
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov eax, 1
mov ecx, ebp
xor edx, edx
mov dl, byte [edi + 4]
xor ebx, ebx
shl eax, cl
xor ecx, ecx
mov bl, byte [edi + 5]
mov cl, byte [esi]
mov dword [esp + 0x10], ecx
sub ecx, edx
xor edx, edx
mov dl, byte [esi + 1]
mov dword [esp + 0x14], edx
sub edx, ebx
mov dword [esp + 0x30], edx
xor edx, edx
mov dl, byte [esi + 2]
xor ebx, ebx
mov bl, byte [edi + 6]
mov dword [esp + 0x18], edx
sub edx, ebx
xor ebx, ebx
mov bl, byte [edi + 7]
mov dword [esp + 0x2c], edx
xor edx, edx
mov dl, byte [esi + 3]
mov dword [esp + 0x1c], edx
sub edx, ebx
test ecx, ecx
mov dword [esp + 0x20], edx
jge 0x4c9241
mov ebx, dword [esp + 0x30]
test ebx, ebx
jge 0x4c9241
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jge 0x4c9241
test edx, edx
jge 0x4c9241
mov ebx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [edi]
sub edx, ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x34], edx
xor edx, edx
mov dl, byte [edi + 1]
sub edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [edi + 2]
sub edx, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
xor edx, edx
mov dl, byte [edi + 3]
sub edx, ebx
mov ebx, dword [esp + 0x34]
cmp ebx, eax
jge 0x4c9241
cmp dword [esp + 0x10], eax
jge 0x4c9241
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jge 0x4c9241
cmp edx, eax
jge 0x4c9241
neg eax
cmp ecx, eax
jg 0x4c91d3
cmp dword [esp + 0x30], eax
jg 0x4c91d3
cmp dword [esp + 0x2c], eax
jg 0x4c91d3
cmp dword [esp + 0x20], eax
jg 0x4c91d3
mov eax, dword [esp + 0x34]
test eax, eax
jg 0x4c91d3
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x4c91d3
test ebx, ebx
jg 0x4c91d3
test edx, edx
jg 0x4c91d3
test ebp, ebp
jne 0x4c91d3
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x38]
pop edi
pop esi
pop ebp
mov byte [ecx + 0x18], al
pop ebx
add esp, 0x14
ret
dec ebp
xor ebx, ebx
mov edx, ebx
mov al, byte [esi]
sar edx, 3
and dl, 1
mov ecx, ebp
shl dl, cl
add dl, al
mov eax, ebx
sar eax, 2
and al, 1
mov byte [esp + 0x30], dl
shl al, cl
mov cl, byte [esi + 1]
mov edx, ebx
sar edx, 1
and dl, 1
add al, cl
mov ecx, ebp
shl dl, cl
mov byte [esp + 0x31], al
mov al, byte [esi + 2]
add dl, al
mov al, bl
and al, 1
mov byte [esp + 0x32], dl
shl al, cl
mov cl, byte [esi + 3]
lea edx, [esp + 0x30]
add al, cl
mov ecx, dword [esp + 0x38]
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x28]
push ecx
push edi
mov ecx, dword [eax + ebx*4]
push ebp
push edx
push ecx
call fcn.004c9090
add esp, 0x14
inc ebx
cmp ebx, 0x10
jl 0x4c91d6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4c9250
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x4c9431
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov eax, 1
mov ecx, ebp
xor edx, edx
mov dl, byte [edi + 4]
xor ebx, ebx
shl eax, cl
xor ecx, ecx
mov bl, byte [edi + 5]
mov cl, byte [esi]
mov dword [esp + 0x10], ecx
sub ecx, edx
xor edx, edx
mov dl, byte [esi + 1]
mov dword [esp + 0x14], edx
sub edx, ebx
mov dword [esp + 0x30], edx
xor edx, edx
mov dl, byte [esi + 2]
xor ebx, ebx
mov bl, byte [edi + 6]
mov dword [esp + 0x18], edx
sub edx, ebx
xor ebx, ebx
mov bl, byte [edi + 7]
mov dword [esp + 0x2c], edx
xor edx, edx
mov dl, byte [esi + 3]
mov dword [esp + 0x1c], edx
sub edx, ebx
test ecx, ecx
mov dword [esp + 0x20], edx
jge 0x4c9431
mov ebx, dword [esp + 0x30]
test ebx, ebx
jge 0x4c9431
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jge 0x4c9431
test edx, edx
jge 0x4c9431
mov ebx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [edi]
sub edx, ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x34], edx
xor edx, edx
mov dl, byte [edi + 1]
sub edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [edi + 2]
sub edx, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
xor edx, edx
mov dl, byte [edi + 3]
sub edx, ebx
mov ebx, dword [esp + 0x34]
cmp ebx, eax
jge 0x4c9431
cmp dword [esp + 0x10], eax
jge 0x4c9431
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jge 0x4c9431
cmp edx, eax
jge 0x4c9431
neg eax
cmp ecx, eax
jg 0x4c93c3
cmp dword [esp + 0x30], eax
jg 0x4c93c3
cmp dword [esp + 0x2c], eax
jg 0x4c93c3
cmp dword [esp + 0x20], eax
jg 0x4c93c3
mov eax, dword [esp + 0x34]
test eax, eax
jg 0x4c93c3
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x4c93c3
test ebx, ebx
jg 0x4c93c3
test edx, edx
jg 0x4c93c3
test ebp, ebp
jne 0x4c93c3
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
pop edi
pop esi
fld dword [ecx]
fadd dword [eax]
pop ebp
pop ebx
fstp dword [eax]
fld dword [ecx + 4]
fadd dword [eax + 4]
fstp dword [eax + 4]
fld dword [ecx + 8]
fadd dword [eax + 8]
fstp dword [eax + 8]
fld dword [ecx + 0xc]
fadd dword [eax + 0xc]
fstp dword [eax + 0xc]
fld dword [ecx + 0x10]
fadd dword [eax + 0x10]
fstp dword [eax + 0x10]
fld dword [ecx + 0x14]
fadd dword [eax + 0x14]
fstp dword [eax + 0x14]
add esp, 0x14
ret
dec ebp
xor ebx, ebx
mov eax, ebx
mov ecx, ebp
sar eax, 3
and al, 1
mov edx, ebx
shl al, cl
mov cl, byte [esi]
sar edx, 2
and dl, 1
add al, cl
mov ecx, ebp
shl dl, cl
mov byte [esp + 0x30], al
mov al, byte [esi + 1]
add dl, al
mov eax, ebx
sar eax, 1
and al, 1
mov byte [esp + 0x31], dl
mov dl, byte [esi + 2]
shl al, cl
add al, dl
mov dl, bl
and dl, 1
mov byte [esp + 0x32], al
mov al, byte [esi + 3]
shl dl, cl
lea ecx, [esp + 0x30]
add dl, al
mov eax, dword [esp + 0x38]
mov byte [esp + 0x33], dl
mov edx, dword [esp + 0x28]
push eax
push edi
mov eax, dword [edx + ebx*4]
push ebp
push ecx
push eax
call fcn.004c9250
add esp, 0x14
inc ebx
cmp ebx, 0x10
jl 0x4c93c6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4de478
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x5c23a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4de4cf
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4de4cf
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x4de4cf
xor eax, eax
inc eax
jmp 0x4de4d1
xor eax, eax
leave
ret 0x10
Function at 0x523cd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x523cdb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x523dde
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5c4d28]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5c4d28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5c4d28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5c4d28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5c4d28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5c4d28]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5c4d28]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5c4d28]
xor eax, edx
inc ecx
dec edi
jne 0x523cf6
pop edi
test esi, esi
je 0x523e00
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5c4d28]
xor eax, edx
inc ecx
dec esi
jne 0x523de2
pop esi
pop ebx
not eax
ret