joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bdac
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44bf57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44bf38
mov dl, 1
mov eax, dword [0x4117ac]
call fcn.004030cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e4c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44bf27
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00439de0
test al, al
je 0x44bf1a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44bf68
lea eax, [ebp - 0x254]
call fcn.004088b8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44bf1a
xor eax, eax
push ebp
push 0x44bf13
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44bfa0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44befc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44befc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf1a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44be1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415288
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf5e
lea eax, [ebp - 0x260]
call fcn.00403e4c
ret

Function at 0x44c88c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x465bac]
cmp byte [eax + 0xa5], 0
jne 0x44c8fd
cmp dword [0x465bc4], 0
jne 0x44c8be
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44c848
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x465bc4], eax
cmp dword [0x465bc0], 0
jne 0x44c8d9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x465bc0], eax
cmp dword [0x465bc8], 0
jne 0x44c8fd
push esp
push 0
push 0
push 0x44c7ec
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x465bc8], eax
pop edx
ret
Function at 0x44c9f4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ca0b
add esp, 0xfffffff0
call fcn.00403420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419098
mov eax, dword [0x464848]
cmp word [eax + 2], 0
jne 0x44ca33
mov eax, dword [0x464848]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044dff0
mov eax, dword [0x4648f8]
cmp word [eax + 2], 0
jne 0x44ca4d
mov eax, dword [0x4648f8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044e1e8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411390]
call fcn.004030cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411390]
call fcn.004030cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b5d4]
call fcn.00422c70
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44cbd4
mov eax, dword [0x464774]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423040
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44e788
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x464774]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bf80
test eax, eax
je 0x44cb42
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004082ac
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bfa8
test eax, eax
je 0x44cb56
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov eax, dword [0x464664]
cmp byte [eax], 0
jne 0x44cb8a
mov eax, ebx
call fcn.0044ccfc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044e964
mov eax, ebx
call fcn.0044f328
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44cbca
call fcn.00403478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44cf7c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x465bac]
cmp dword [eax + 0x30], 0
je 0x44d026
cmp dword [ebx + 0x94], 0
jne 0x44d020
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44cf0c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44d020
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44cfe6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44d020
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004136f8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44cff5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44db88
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44dbbd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x44dbca
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44eb40
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44eb81
mov eax, esi
call fcn.004354a0
test al, al
je 0x44eb81
mov eax, dword [ebx + 0x84]
call fcn.00435240
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44eb81
push 0
mov eax, dword [ebx + 0x84]
call fcn.00435240
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4522b8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4522e6
mov eax, ebx
call fcn.00452d6c
cmp dword [ebx + 0x40], 0
je 0x4522df
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x452357
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x452349
cmp dword [ebx + 8], 0
je 0x452308
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45231a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x452349
cmp dword [ebx + 8], 0
je 0x4522fb
cmp eax, 3
je 0x45232d
dec eax
jne 0x4522fb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4522fb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4522fb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x452375
cmp dword [ebx + 0x14], 0xcc
je 0x452375
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00452380
pop ebx
ret
Function at 0x5c50a0c3
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call 0x5c519f71
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0x10]
test edi, edi
je 0x5c50a0f2
mov ecx, dword [edi + 0xc]
call fcn.5c5073fb
mov ecx, edi
call fcn.5c5073fb
mov edi, dword [esi + 0x14]
test edi, edi
je 0x5c50a108
mov ecx, dword [edi + 0xc]
call fcn.5c5073fb
mov ecx, edi
call fcn.5c5073fb
mov edi, dword [esi + 0x18]
xor ebx, ebx
test edi, edi
je 0x5c50a14f
cmp dword [edi], ebx
jbe 0x5c50a140
mov eax, dword [edi + 0xc]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + ebx*4]
call fcn.5c5073fb
mov edi, dword [esi + 0x18]
inc ebx
cmp ebx, dword [edi]
jb 0x5c50a115
mov eax, edi
push 0
pop ebx
test eax, eax
je 0x5c50a14f
mov ecx, dword [edi + 0xc]
call fcn.5c5073fb
mov ecx, edi
call fcn.5c5073fb
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x5c50a165
mov ecx, dword [edi + 0xc]
call fcn.5c5073fb
mov ecx, edi
call fcn.5c5073fb
cmp dword [esi + 0xc], 1
jne 0x5c50a172
mov ecx, dword [esi]
call fcn.5c50c05c
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x5c50a1b0
mov edi, 0x5c5024d0
mov edx, ebx
movzx eax, byte [ecx + edx]
cmp al, byte [edi + edx]
jne 0x5c50a191
inc edx
cmp edx, 2
jne 0x5c50a180
jmp 0x5c50a196
sbb ebx, ebx
or ebx, 1
test ebx, ebx
je 0x5c50a1a8
push ecx
push 4
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [esi]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x5c50a1be
call fcn.5c5073fb
leave
ret

Function at 0x5c50a1c6
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, ecx
cmp esi, 3
jbe 0x5c50a1e1
mov eax, 0x88760353
jmp 0x5c50a269
push edi
xor eax, eax
push eax
push 0x8000080
push 2
push eax
push eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x5c50a24c
push 0x28
pop edx
lea ecx, [ebp - 4]
call fcn.5c507396
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x5c50a25c
mov eax, esi
and esi, 1
shr eax, 1
and eax, 1
push eax
push esi
push edi
push ebx
call fcn.5c50a046
mov esi, eax
test esi, esi
je 0x5c50a25c
mov ecx, esi
call fcn.5c50a38f
test eax, eax
je 0x5c50a253
mov ecx, esi
call fcn.5c50a0c3
mov ecx, esi
call fcn.5c5073fb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x88760361
jmp 0x5c50a268
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor eax, eax
jmp 0x5c50a268
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x88760356
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5c50c05c
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5c50d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x108]
xor esi, esi
push eax
push esi
push 0x5c5025e4
push 0x5c50257c
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x5c50c09d
mov eax, 0x88760357
jmp 0x5c50c1a1
push edi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5c50c0cb
mov eax, 0x88760361
jmp 0x5c50c1a0
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x10c], esi
cmp esi, 0xffffffff
jne 0x5c50c0f2
mov esi, 0x88760361
jmp 0x5c50c166
xor eax, eax
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
call fcn.5c50be11
test eax, eax
jne 0x5c50c140
mov esi, 0x88760356
jmp 0x5c50c14f
push edi
push esi
lea ecx, [ebp - 0x130]
call 0x5c519f71
mov esi, eax
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x130]
call fcn.5c50bd9a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jns 0x5c50c180
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x5c50c19e
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x5c50c19e
mov esi, 0x88760361
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.5c50c960
leave
ret

Function at 0x5c50cbb0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5c50cbee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5c50cbe6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5c50cbf0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5c50cbd6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5c50ccd0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5c50cd01
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5c50cd01
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5c50cd01
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7b8165b5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x71811401
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401b50
Capabilities:
Delete file

Disassembly:
push esi
call fcn.00401520
xor esi, esi
cmp eax, esi
je 0x401bdb
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x403008], esi
je 0x401bdb
cmp dword [0x40300c], esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
jbe 0x401bba
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ebx, [ebx]
mov eax, dword [0x403008]
mov ecx, dword [eax + esi*4]
push ecx
call ebp
mov edx, dword [0x403008]
mov eax, dword [edx + esi*4]
push eax
push 0
call ebx
push eax
call edi
add esi, 1
cmp esi, dword [0x40300c]
jb 0x401b90
xor esi, esi
pop ebp
mov ecx, dword [0x403008]
push ecx
push esi
call ebx
push eax
call edi
pop edi
mov dword [0x403008], esi
mov dword [0x40300c], esi
mov dword [0x403010], esi
pop ebx
xor eax, eax
pop esi
ret
Function at 0x501222c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
add byte [ebp + 7], dh
xor eax, eax
jmp 0x50122379
add byte [eax], al
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]

Function at 0x501222dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
add byte [eax], al
add byte [ebx - 0x3e], ch
add byte [ebx + 0x558bf44d], cl
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
Function at 0x50125848
Capabilities:
Encode data using xor

Disassembly:
pop es
add eax, 0x6f634954
outsb dx, byte [esi]
mov al, 0x56
adc dl, byte [eax - 0x14]
dec esi
adc dl, byte [eax]
add byte [eax], cl
inc edi
jb 0x501257a2
jo 0x501257ab
imul esp, dword [ebx + 0x73], 0xc0850000
nop
mov ah, 0x57
adc dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx*2 + 0x57bc5012], dh
adc dl, byte [eax + 0x28]
add byte [eax], al
add byte [eax], dl
jl 0x501257ab
push eax
loopne 0x5012579a
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
adc dl, byte [eax + 0x38]
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cwde
push eax
mov eax, 0x98501210
pop eax
adc dl, byte [eax + 1]
add bh, bh
push esp
pop edx
adc dl, byte [eax + 0x10]
push esp
push edx
jae 0x50125831
jne 0x50125836
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x5012575b
inc eax
add byte [eax], ch
pop eax
adc dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
pop eax
adc dl, byte [eax + 0x30]
pop eax
adc dl, byte [eax + 0x28]
add byte [eax], al
add byte [edi + edx*2 + 0x12], bl
push eax
loopne 0x5012580e
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x98501210
pop eax
adc dl, byte [eax + 1]
add bh, bh
jmp dword [ebx + ebx*2 + 0x12]
push esp
inc edx
jb 0x501258aa
jae 0x5012589f
push 0x6f736552
push edx
jae 0x501258aa
jne 0x501258af
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x501257d2
ror byte [ecx + 0x31c289d1], 0xc0
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x5012584e
ret
mov ebx, edx
mov esi, eax
lea eax, [esi + 8]
push eax
call fcn.50122158
test bl, bl
jle 0x501258b7
invalid
pop es
mov eax, esi
call sub.rtl120.bpl__System__ClassDestroy_qqrp14System_TObject
pop esi
pop ebx
ret