joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6375a8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x6375bf
add esp, 0xfffffff0
call fcn.00408f3c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004cbbe0
mov eax, dword [0x687248]
cmp byte [eax], 0
jne 0x6375ec
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x687920]
cmp word [eax + 2], 0
jne 0x637606
mov eax, dword [0x687920]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00639a40
mov eax, dword [0x687b88]
cmp word [eax + 2], 0
jne 0x637620
mov eax, dword [0x687b88]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00639c44
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x57d5d8]
call fcn.00583b00
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x63a1bc
mov dl, 1
mov eax, dword [0x48e5f8]
call fcn.00408850
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48e5f8]
call fcn.00408850
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x582374]
call fcn.0058ddbc
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x637810
mov eax, dword [0x687670]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0058e2d8
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x63a4a4
mov dl, 1
mov eax, dword [0x48e5f8]
call fcn.00408850
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x687670]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426480
test eax, eax
je 0x63773a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004262d8
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00426464
test eax, eax
je 0x637752
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b294
push ebx
push 0x639420
call fcn.0062c758
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x687248]
cmp byte [eax], 0
jne 0x6377a3
mov eax, ebx
call fcn.006379d8
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.0063a6dc
mov eax, ebx
call fcn.0063b364
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x637807
call fcn.00408f94
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x637d04
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x637da6
cmp dword [ebx + 0xac], 0
jne 0x637da0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x637c44
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x637da0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x637d66
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x637da0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004b6a60
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x637d75
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x63804c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x68e97c]
cmp dword [eax + 0x188], 0
je 0x6381b5
test bl, bl
jne 0x638108
cmp dword [esi + 0xb4], 0
jne 0x6380fd
mov eax, esi
call fcn.0063b1b4
push eax
push 0x637f4c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x6380ce
mov eax, dword [0x68e97c]
cmp byte [eax + 0xeb], 0
je 0x6380ce
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x6380af
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x6380ce
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x6380b7
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x6380fd
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b6a60
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x6380dd
inc dword [esi + 0xb4]
jmp 0x6381b5
cmp dword [esi + 0xb4], 0
jle 0x6381b5
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x6381b5
cmp dword [esi + 0x58], 0
je 0x63816a
mov eax, dword [0x68e97c]
cmp byte [eax + 0xeb], 0
je 0x63816a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x63814b
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x63816a
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x638153
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x638199
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b6a60
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x638179
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x6293d0]
call fcn.0040cbd0
pop edi
pop esi
pop ebx
ret
Function at 0x638f3c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x638f99
cmp byte [ebx + 0xeb], 0
jne 0x638f99
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a870
mov eax, dword [esi]
test eax, eax
je 0x638f86
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x638fa6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040aac8
jmp 0x638fa6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040aac8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x63a8f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x63a961
mov eax, esi
call fcn.006699f0
test al, al
je 0x63a961
mov eax, dword [ebx + 0x98]
call fcn.0066961c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x63a961
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x63a952
push 0
mov eax, dword [ebx + 0x98]
call fcn.0066961c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.006601f4
jmp 0x63a961
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0063a6fc
pop esi
pop ebx
ret
Function at 0x63f50c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x63f592
mov eax, dword [ebx + 8]
call fcn.0066961c
mov ecx, eax
mov dl, 1
mov eax, dword [0x5b0650]
call fcn.00663734
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.005b541c
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x63eddc
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0066961c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0066961c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x63f614
mov eax, dword [ebx + 8]
call fcn.0066961c
mov ecx, eax
mov dl, 1
mov eax, dword [0x5b0650]
call fcn.00663734
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.005b541c
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x63ee28
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0066961c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0066961c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x63f692
mov eax, dword [ebx + 8]
call fcn.0066961c
mov ecx, eax
mov dl, 1
mov eax, dword [0x5b10f8]
call fcn.00663734
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
mov byte [esi + 0x2a0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0066961c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0066961c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x649690
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040a6e8
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x6496e2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x6496db
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040b294
jmp 0x6496e2
mov eax, esi
call fcn.0040a6e8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x64f2e8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64f447
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x6870a0], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x528244]
call fcn.00529390
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x64f41d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00529478
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040b294
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x64f460
call fcn.0040b444
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00529704
test al, al
je 0x64f407
lea ecx, [ebp - 4]
mov edx, 0x64f4d4
mov eax, dword [ebp - 0xc]
call fcn.00529f94
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042e76c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x64f407
xor edx, edx
push ebp
push 0x64f400
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x64f4ec
mov eax, dword [ebp - 8]
push eax
call fcn.004157fc
test eax, eax
je 0x64f3e9
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x64f3e9
call fcn.0064f274
test eax, eax
je 0x64f3d9
mov eax, dword [ebx + 0x50]
jmp 0x64f3dc
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x6870a0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f407
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f424
mov eax, dword [ebp - 0xc]
call fcn.00408880
ret

Function at 0x64f550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x64f597
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x64f57a
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x64f58b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x64f597
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x65d61c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x68ea20], 0
je 0x65d75d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x687afc]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x65d75d
mov eax, dword [0x68ea24]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x68ea20]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x65d72c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x68ea20]
call fcn.004b6a60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x65d724
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x215], 0
je 0x65d724
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x78]
test al, al
je 0x65d724
mov eax, dword [ebp - 0x14]
call fcn.0066961c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x65d724
push ebp
call fcn.0065d5d8
pop ecx
test al, al
jne 0x65d724
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb8
call fcn.00408c48
test al, al
je 0x65d724
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00408c48
cmp byte [ebp - 1], 0
je 0x65d724
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.004131c0
test al, al
je 0x65d724
mov edx, dword [ebp - 0x14]
mov eax, dword [0x68ea24]
call fcn.0065cd48
inc edi
dec ebx
jne 0x65d681
mov eax, dword [0x68ea24]
cmp dword [eax + 8], 0
jle 0x65d744
mov eax, dword [0x68ea24]
call fcn.0065cdfc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x65d75d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0065d440
pop ecx
test al, al
jne 0x65d75d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x665ecc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004136c0
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0065fc80
test ebx, ebx
jne 0x665f1f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00665d44
mov ebx, eax
test ebx, ebx
je 0x666015
cmp esi, ebx
je 0x665f48
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x665f5d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x665f95
add eax, 0xffffff5f
sub eax, 2
jb 0x665fad
dec eax
sub eax, 2
jb 0x665fc1
dec eax
sub eax, 2
jb 0x665fb7
jmp 0x665fcb
add eax, 0xfffffdff
sub eax, 2
jb 0x665fad
dec eax
sub eax, 2
jb 0x665fc1
dec eax
sub eax, 2
jb 0x665fb7
jmp 0x665fcb
mov byte [esp + 0x120], 0
jmp 0x665fd3
mov byte [esp + 0x120], 2
jmp 0x665fd3
mov byte [esp + 0x120], 1
jmp 0x665fd3
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0062c808
mov esi, eax
call fcn.0065c3c4
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.006617c0
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x666017
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x434bc5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x434bd4
pop dword [ebp - 4]
mov eax, 0x434bd4
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x50880
push 0
mov eax, 0xa6aadcaf
sub eax, 0xa66474d7
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x64c1d451
add ecx, 0x9b3e7f3b
mov ebx, eax
mov edx, 0x48e000
add edx, dword [ebp - 4]
mov edi, 0x1fbce151
mov esi, dword [edx]
xor esi, edi
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x434c22
add eax, 0x14103
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7638d688
sub ecx, 0x75f8d688
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x78357f45
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section._RDATA
mov ebx, 0x42cd70
nop
mov ecx, 0x79ae104f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x419710
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x44e5d8]
not eax
add eax, 0x35e15d92
cmp eax, 0x2e044ce7
jge 0x419731
mov eax, dword [0x449738]
shl eax, 5
or dword [0x43c65c], eax
mov dword [ecx], 0
mov edx, dword [0x44859c]
sar edx, 8
mov dword [0x44c410], edx
mov dword [ecx + 4], 0
mov ax, word [0x47db90]
mov edx, dword [0x44a99c]
inc word [0x47db90]
cwde
add edx, eax
cmp edx, 0xbd66820c
jle 0x4197a0
mov ax, word [0x475e2a]
movsx edx, ax
add edx, 0x163ee750
cmp edx, 0x95275c19
jle 0x4197aa
mov eax, dword [0x443db4]
movzx edx, word [0x47b84a]
lea eax, [eax*8 + 0x302d6962]
and edx, eax
mov word [0x47b84a], dx
jmp 0x4197aa
xor dword [0x43e764], 0x8d57eba0
mov dword [ecx + 8], 0x67452301
fld dword [0x48d104]
fstp dword [0x480ac8]
mov dword [ecx + 0xc], 0xefcdab89
xor dword [0x446ec4], 0x9b9c904f
mov dword [ecx + 0x10], 0x98badcfe
fld dword [0x47f0dc]
fmul dword [0x48395c]
fmul dword [0x485be8]
fstp dword [0x48daf8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x443f7c]
shl eax, 9
sub dword [0x44e9c4], eax
ret

Function at 0x41c7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x449b24]
mov edx, dword [0x449c48]
imul ecx, ecx, 0x511fbb9
mov eax, 0xd49acf5c
sub eax, ecx
imul edx, eax
mov eax, dword [ebp + 8]
mov dword [0x449c48], edx
add dword [0x44d244], 0xed07b76d
cmp byte [eax], 0
mov edx, eax
je 0x41c842
lea esp, [esp]
mov ecx, dword [0x44a758]
lea ecx, [ecx*8 - 0x17de669b]
add dword [0x43e06c], ecx
mov cx, word [0x47b58c]
movsx ecx, cx
sar ecx, 6
xor ecx, 0xc8960001
add dword [0x4486f4], ecx
inc edx
cmp byte [edx], 0
jne 0x41c810
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
mov byte [edx], cl
inc edx
inc esi
test cl, cl
jne 0x41c846
dec dword [0x44c65c]
mov edx, dword [0x44c65c]
cmp edx, 0x5ddbbbe7
pop esi
jl 0x41c88b
mov ecx, dword [0x44b7a0]
add ecx, 0x4e7ee0e2
cmp ecx, 0x8d48a65c
je 0x41c88b
fld dword [0x487794]
fmul dword [0x48f4f4]
fstp dword [0x487794]
pop ebp
ret