joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1020ef50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10232704]
add eax, 0xe9a
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [0x10232704], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x1020efc3
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
jl 0x1020ef8f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
jne 0x1020f070
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1020f070
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff5
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x61
jne 0x1020f070
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1020f070
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff7
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x64
jne 0x1020f070
mov eax, dword [0x10232708]
add eax, 0x26b1
mov dword [0x10232708], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1020f070
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff9
mov dword [ebp - 0x30], eax
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
cmp word [ecx + edx*2], 0x6c
mov dword [ebp - 0x34], eax
je 0x1020f077
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x1020f077
mov eax, dword [ebp - 0x34]
add esp, 0x34
pop ebp
ret
Function at 0x1020f110
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10232710], 0
mov byte [0x10232714], 0
mov dword [0x10232704], 0xcd2
mov dword [0x1023270c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1020f168
mov dword [0x1023270c], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1020f19a
mov eax, dword [ebp - 0x1c]
mov dword [0x10232704], 0x11d2
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1023270c]
add eax, 1
mov dword [0x1023270c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1020f168
jmp 0x1020f157
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10232718], 0
mov edi, dword [0x10232704]
mov ebx, edi
add ebx, 0xfffff4ea
mov dword [0x10232704], ebx
mov ebx, dword [0x10232710]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [esi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x10232718], ecx
add edi, 0xfffff1c3
mov dword [0x10232704], edi
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x10232710], edx
mov edi, dword [ebp - 0x24]
mov cl, byte [esi + edi]
mov byte [0x10232714], cl
mov dword [0x10232708], 0x17dd
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov dword [0x10232704], 0x742
mov cl, byte [0x10232714]
mov edx, dword [0x10232710]
mov byte [esi + edx], cl
mov edx, dword [0x1023270c]
add edx, 1
mov dword [0x1023270c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1020f19a
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1020fc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10232704], 0x26fd
mov dword [0x1023270c], 0
mov dword [0x10232710], 0
mov dword [0x1023271c], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1020fdc8
xor eax, eax
mov ecx, 0x26fd
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jmp 0x1020fcad
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add ecx, 0x78a
mov dword [0x10232704], ecx
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1023270c], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10232710], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10232714], cl
mov dword [0x10232704], 0xb52
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10232714]
mov edx, dword [0x10232710]
mov byte [edi + edx], cl
mov edx, dword [0x1023270c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10232710]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x10232704], 0x1ac5
and ebx, 0xff
mov dword [0x1023271c], ebx
mov dword [0x10232708], 0xe6b
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov dl, cl
add dl, byte [0x10232721]
mov byte [0x10232720], dl
mov byte [0x10232721], ch
mov byte [0x10232722], cl
mov dword [0x10232704], 0x120f
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x1020fdc6
mov eax, dword [0x10232704]
mov ecx, dword [0x1023270c]
mov edx, dword [0x10232710]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], esi
jmp 0x1020fcad
jmp 0x1020fdc8
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10210690
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov eax, 0x10
call fcn.1020eb70
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x24], eax
call fcn.10001080
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x20], ecx
jne 0x102107e8
lea eax, [esi + 0x28]
mov ecx, dword [0x10232704]
add ecx, 0xfffffa3e
mov dword [0x10232708], ecx
mov dword [esi + 0x1c], eax
call fcn.1020ef50
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0x18], ecx
jne 0x102107e2
sub esp, 4
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.1020f880
add esp, 4
lea ecx, [0x1020f790]
mov edx, dword [esi + 0x24]
mov edi, dword [edx]
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], 0x129e00
mov edi, dword [0x102326f0]
mov dword [esi + 0x30], edi
mov edi, dword [0x102326f4]
mov dword [esi + 0x68], edi
mov edi, dword [0x102326f8]
mov dword [esi + 0x74], edi
mov edi, dword [0x102326fc]
mov dword [esi + 0x6c], edi
mov edi, dword [0x10232700]
mov dword [esi + 0x28], edi
mov dword [0x10232704], 0x260
mov dword [0x10232708], 0xfffff7c0
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 0x10]
cmp word [eax], 0x5a4d
mov dword [esi + 0xc], eax
jne 0x10210785
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
je 0x102107a1
mov eax, dword [esi + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x10232704], 0x7ac
mov dword [esi + 0x10], eax
jmp 0x10210763
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [esi + 0x28]
mov dword [esi + 0x78], eax
mov dword [0x10232704], 0x1606
mov eax, dword [eax + ecx + 0x50]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 8]
push ecx
push edx
call fcn.102100f0
add esp, 8
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x28]
mov dword [ecx], edx
call eax
mov eax, 1
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x102108f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.102103d0
mov ecx, eax
mov edx, dword [eax + 0x3c]
mov edx, dword [eax + edx + 0x78]
mov esi, ecx
add esi, dword [eax + edx + 0x20]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [0x10232704], 0x239b
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edi, dword [edx + esi + 0x18]
cmp edi, 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
je 0x10210a2f
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x47], bl
je 0x102109d2
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x46]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x47], dl
jne 0x10210976
mov al, byte [ebp - 0x47]
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ecx
jne 0x10210a03
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov edx, dword [ebp - 0x20]
cmp ecx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
jb 0x1021095c
jmp 0x10210a28
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x18]
add esi, dword [ecx + eax*4]
mov dword [0x10232704], 0xbb6
mov dword [ebp - 0x28], esi
jmp 0x10210a2f
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10210a2f
mov eax, dword [ebp - 0x28]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ea70
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 0xb7ec19e8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
sub eax, 0x8582fffe
je 0x40ec8b
jmp 0x40ea97
mov eax, dword [ebp - 0x20]
sub eax, 0x997d1116
je 0x40eb7b
jmp 0x40eaaa
mov eax, dword [ebp - 0x20]
sub eax, 0xa80af10a
je 0x40eb96
jmp 0x40eabd
mov eax, dword [ebp - 0x20]
sub eax, 0xb2e3a64d
je 0x40ec5d
jmp 0x40ead0
mov eax, dword [ebp - 0x20]
sub eax, 0xb7ec19e8
je 0x40eb34
jmp 0x40eae3
mov eax, dword [ebp - 0x20]
sub eax, 0xeececdf9
je 0x40ebe4
jmp 0x40eaf6
mov eax, dword [ebp - 0x20]
sub eax, 0xfa36874a
je 0x40ec69
jmp 0x40eb09
mov eax, dword [ebp - 0x20]
sub eax, 0x3c09c29a
je 0x40ecb3
jmp 0x40eb1c
mov eax, dword [ebp - 0x20]
sub eax, 0x62e496e4
je 0x40ecad
jmp 0x40eb2f
jmp 0x40ecba
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 2
mov ecx, 0xffffffff
xor ecx, 0x5e6d21a5
or eax, edx
or ecx, 0x5e6d21a5
xor eax, 0xffffffff
and eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x997d1116
jmp 0x40ecba
mov edx, dword [ebp - 0x14]
mov eax, 0x62e496e4
mov ecx, 0xa80af10a
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40ecba
mov eax, dword [0x43f554]
mov ecx, dword [0x43f550]
mov edx, eax
sub edx, 0xa61997dd
sub edx, 1
add edx, 0xa61997dd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c09c29a
mov ecx, 0xeececdf9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40ecba
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x43f554]
mov eax, dword [0x43f550]
mov edx, ecx
sub edx, 0xb3fdec84
sub edx, 1
add edx, 0xb3fdec84
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c09c29a
mov ecx, 0xb2e3a64d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40ecba
mov dword [ebp - 0x1c], 0xfa36874a
jmp 0x40ecba
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 2
xor ecx, 2
or eax, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0x8582fffe
jmp 0x40ecba
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub esp, 8
mov dword [ebp - 0x1c], 0x62e496e4
jmp 0x40ecba
add esp, 0x24
pop ebx
pop ebp
ret
mov dword [ebp - 0x1c], 0xeececdf9
jmp 0x40ea81
Function at 0x427a7b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x427aba
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x427aba
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x427aba
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x427aba
cmp dword [ecx + 0x74], 0xe
jbe 0x427aba
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42f21b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42f2b8
push ebx
push esi
call fcn.0042f1e4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042f178
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42f265
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42f2b7
push edi
push eax
call fcn.0042dcb0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42f285
call fcn.0042dcfe
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42f2b6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042f178
add esp, 0x20
test eax, eax
jne 0x42f2a4
push edi
call fcn.0042dcfe
jmp 0x42f2ac
push ebx
call fcn.0042dcfe
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4304c7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438e90
push 0x438e88
push str.FlsAlloc
push 0x1f
call fcn.00430386
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4304fb
push dword [ebp + 8]
mov ecx, esi
call dword [0x436144]
call esi
jmp 0x430501
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x430545
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438ea0
push 0x438e98
push str.FlsGetValue
push 0x21
call fcn.00430386
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43057c
push dword [ebp + 8]
mov ecx, esi
call dword [0x436144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x430584
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438ea8
push 0x438ea0
push str.FlsSetValue
push 0x22
call fcn.00430386
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4305be
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x436144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x435890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4358bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4358bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4012b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4012d1
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4012d1
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x401600
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x84
mov eax, dword [0x4d92d4]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x401645
push 0x80
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x401645
lea edx, [esp + 4]
push edx
push 0x100
lea ecx, [esi + 0x6c]
call fcn.0041d850
mov ecx, dword [esp + 0x84]
pop esi
xor ecx, esp
call fcn.0041c78e
add esp, 0x84
ret

Function at 0x401614
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x84
mov eax, dword [0x4d92d4]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x401645
push 0x80
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x401645
lea edx, [esp + 4]
push edx
push 0x100
lea ecx, [esi + 0x6c]
call fcn.0041d850
mov ecx, dword [esp + 0x84]
pop esi
xor ecx, esp
call fcn.0041c78e
add esp, 0x84
ret

Function at 0x401860
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 8]
mov dword [ecx + 0x5c], eax
mov edx, dword [esi + 0xc]
mov dword [ecx + 0x60], edx
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x64], eax
mov edx, dword [esi + 0x14]
push esi
mov dword [ecx + 0x68], edx
call fcn.00401680
mov esi, dword [esi]
mov eax, dword [esi + 4]
test eax, eax
je 0x4018a3
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4018a3
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 8

Function at 0x401c60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a47e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d92d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.00401420
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea ecx, [esi + 0x44]
mov dword [esi], vtable.FCChildWindow.0
mov dword [ecx + 4], eax
add eax, edi
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 8], edx
add edx, eax
mov dword [ecx], vtable.FCRect.0
mov dword [ecx + 0x10], edx
call fcn.0041f920
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14