joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4616ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x461750
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00461800
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a084
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461757
lea eax, [ebp - 4]
call fcn.00404a58
ret

Function at 0x46175c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x4617c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0x4617cc
lea eax, [ebp - 4]
call fcn.00461800
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.0046154c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4617c7
lea eax, [ebp - 4]
call fcn.00404a58
ret

Function at 0x462158
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x462251
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00460fb4
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409b98
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046331c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409a7c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00463390
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462258
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a7c
ret
Function at 0x462260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x462369
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00460fb4
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x46232f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409b98
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046331c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409a7c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00463390
jmp 0x462341
xor edx, edx
mov eax, ebx
call fcn.0046331c
xor edx, edx
mov eax, ebx
call fcn.00463390
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462370
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a7c
ret
Function at 0x466358
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4664c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4664a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404c40
lea eax, [ebp - 0x118]
mov edx, 0x4664e0
call fcn.00404d20
mov eax, dword [ebp - 0x118]
call fcn.00404f18
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x466416
lea eax, [ebp - 0x111]
call fcn.00409e5c
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404b48
jmp 0x46641d
mov eax, esi
call fcn.00404a58
cmp bl, 0x61
jae 0x46643e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040de0c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404aac
jmp 0x466458
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dd80
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404aac
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4664ec
call fcn.0040a59c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4664ab
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x46ef18
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0046f14c
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0046f14c
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x46ef8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x46efb1
inc esi
mov eax, edi
call fcn.0046ef70
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0046ef18
inc ebx
dec esi
jne 0x46ef9b
pop edi
pop esi
pop ebx
ret
Function at 0x46f040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x46f0b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046efb8
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0046ef70
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0046ef18
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x46f080
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f0bc
lea eax, [ebp - 4]
call fcn.00404a58
ret
Function at 0x46fd50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46ff34
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x46fef0
mov eax, dword [ebp - 4]
call fcn.004716b8
cmp ebx, eax
jge 0x46fef0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0045fcc4
mov edx, dword [0x461bf8]
call fcn.00403e0c
mov esi, eax
mov eax, esi
call fcn.00463288
test al, al
je 0x46fee6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x46feda
xor eax, eax
push ebp
push 0x46fed3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047030c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041a758
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004050a4
mov eax, dword [ebp - 8]
call fcn.00404f70
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004700cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ff1e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x46fed2
mov eax, dword [ebp - 4]
call fcn.00470390
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a084
jmp 0x46ff1e
mov eax, dword [ebp - 8]
call fcn.00404a58
jmp 0x46ff1e
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409490
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4164d0]
call fcn.0040cf9c
call fcn.004043f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ff3b
lea eax, [ebp - 0x54]
call fcn.00404a58
ret
Function at 0x473b08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x473b35
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x473bb4
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0046acc8
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x473b82
mov cx, word [esp]
sub cx, si
jmp 0x473b84
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x473b6b
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x473baa
mov cx, word [esp]
sub cx, si
jmp 0x473bac
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x473b93
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x473c11
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004737dc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x473bfc
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x473c11
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x473b12
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4788fc
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
call fcn.0047876c
test al, al
je 0x478929
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.00478864
test al, al
jne 0x47891f
call fcn.0040e79c
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
jmp 0x47895a
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, ebx
call fcn.00404f18
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
jne 0x478953
call fcn.0040e79c
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x3c
pop ebx
ret

Function at 0x47e638
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1e0], 0
je 0x47e65c
mov eax, dword [ebx + 0x1e0]
call fcn.00461228
test al, al
jne 0x47e672
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.0046154c
jmp 0x47e67f
mov eax, esi
mov edx, dword [ebx + 0x1e0]
call fcn.00404aac
add esp, 0x130
pop esi
pop ebx
ret
Function at 0x47fe88
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x480003
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.0047ea44
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.0047ea64
mov ebx, eax
jmp 0x47ffd5
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404cc8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0047fce8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408cc4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408cc4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404e64
je 0x47ffac
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404cc8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408cc4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408cc4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404e64
jne 0x47ffc6
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.0047ea84
mov ebx, eax
test ebx, ebx
jne 0x47ff07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48000a
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404a7c
lea eax, [ebp - 4]
call fcn.00404a58
ret

Function at 0x480074
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4800f4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404cc8
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, 0x480108
call fcn.00404d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4800fb
lea eax, [ebp - 0x110]
call fcn.00404a58
ret
Function at 0x4801d4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f08
xor eax, eax
push ebp
push 0x48025f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48023a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
mov eax, dword [ebp - 4]
call fcn.00404f18
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
mov edx, ebx
lea eax, [ebp - 8]
call fcn.00404c50
mov eax, dword [ebp - 8]
call fcn.00409924
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x480244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480266
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a7c
ret

Function at 0x4802f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x480370
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x1c
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404cc8
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, 0x480384
call fcn.00404d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480377
lea eax, [ebp - 0x110]
call fcn.00404a58
ret
Function at 0x4068d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 5], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406ab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebx]
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], 0
je 0x406914
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
sub eax, 0xc
movzx eax, word [eax]
jmp 0x40691b
movzx eax, word [0x5428d0]
cmp si, ax
jne 0x406924
mov al, 1
jmp 0x40694e
mov eax, dword [ebx]
test eax, eax
je 0x406940
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x406940
mov edx, dword [ebx]
mov eax, ebx
xor ecx, ecx
call fcn.0040527c
test eax, eax
je 0x406949
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
test al, al
jne 0x406aa0
cmp byte [ebp - 5], 0
je 0x406a68
mov edi, dword [ebx]
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], 0
je 0x406979
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
sub eax, 0xa
movzx eax, word [eax]
jmp 0x40697d
mov ax, 1
cmp ax, 1
jne 0x40698f
lea eax, [ebp - 4]
mov edx, dword [ebx]
call fcn.00405fe4
jmp 0x406999
lea eax, [ebp - 4]
mov edx, dword [ebx]
call fcn.00405e34
mov eax, dword [ebp - 4]
test eax, eax
je 0x4069b6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4069b6
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040524c
mov edi, eax
test edi, edi
je 0x4069c1
sub edi, 4
mov edi, dword [edi]
push edi
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.00405e6c
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004051d0
mov edi, eax
mov eax, ebx
xor ecx, ecx
mov edx, edi
call fcn.00405904
test edi, edi
jle 0x406a6f
mov eax, dword [ebx]
test eax, eax
je 0x406a0a
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x406a0a
mov edx, dword [ebx]
mov eax, ebx
xor ecx, ecx
call fcn.0040527c
mov edi, eax
test edi, edi
je 0x406a15
sub edi, 4
or al, 0x8b
inc esp
and al, 0x10
in al, dx
cmp al, 0xa1
push esi
sti
push edx
add byte [ebx + ecx*4 + 0xd], ah
xor byte [eax], al
add byte [eax], al

Function at 0x406a63
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x52fb56]
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0xc]
add ecx, 0xc
mov edx, ecx
jmp 0x406a89
xor edi, edi
cmp edi, eax
je 0x406ad5
mov edx, dword [edx]
mov dword [esp + 0x10], 0
cmp edx, ecx
je 0x406ad1
mov esi, dword [edx + 0x30]
movzx ebx, word [esi]
test bx, bx
je 0x406a83
add esi, 2
xor edi, edi
jmp 0x406ac3
movzx ebx, bx
add edi, ebx
movzx ebx, word [esi]
add esi, 2
test bx, bx
je 0x406a85
invalid

Function at 0x406cfc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov ebx, dword [ebp + ecx + 0x20]
add ebx, ebp

Function at 0x406d08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp + ecx + 0x1c]
mov dword [esp + 0xc], edx
mov ecx, dword [ebp + ecx + 0x24]
mov dword [esp + 8], ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x406e2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec esi
jne 0x406e23
cmp ebp, dword [esp + 4]
jne 0x406e4b
jmp 0x406e51

Function at 0x407098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and byte [edi + 0x3b], al
jl 0x4070c1
add al, 0x8b
sbb al, 0x24
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x33a73e77
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x58e43241
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401790
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402500
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402500
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4017f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x405058]
test esi, esi
jle 0x401910
mov eax, dword [0x40505c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401824
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401810
mov dword [esp], ebx
call fcn.00402150
mov edi, eax
test eax, eax
je 0x401937
mov eax, dword [0x40505c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402290
mov edx, dword [0x40505c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401917
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018b0
add dword [0x405058], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40505c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401790
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40182e
mov eax, dword [0x40505c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401790
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401790
lea esi, [esi]
nop