joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4840d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4841d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4841f0
call fcn.00407e88
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete bl
test bl, bl
je 0x48413a
push 0xa
lea eax, [ebp - 0xe]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x48413e
xor eax, eax
jmp 0x484140
mov al, 1
mov ebx, eax
test bl, bl
je 0x48415b
lea eax, [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.00408900
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.00408900
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0041cb68
mov eax, dword [ebp - 0x1c]
mov edx, 0x484204
call fcn.00408c3c
jne 0x4841a2
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0041cb68
mov eax, dword [ebp - 0x20]
mov edx, 0x484218
call fcn.00408c3c
jne 0x4841a2
mov eax, edi
mov edx, dword [0x4e1190]
mov ecx, 0
call fcn.00408560
jmp 0x4841b1
mov eax, edi
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00408560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4841db
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407ac0
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x488188
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4882cb
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4881df
push 0x20a
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [0x4e4c50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 4]
call fcn.00407be8
jmp 0x4882b2
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
mov eax, ebx
call fcn.00488124
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.0048814c
mov ebx, eax
test esi, esi
je 0x488207
dec esi
test esi, esi
jl 0x488207
cmp edi, ebx
jne 0x4881e6
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x214]
mov edx, edi
call fcn.00408900
mov eax, dword [ebp - 0x214]
mov ecx, ebx
sub ecx, edi
sar ecx, 1
jns 0x488229
adc ecx, 0
mov edx, 1
call fcn.00408c74
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x48824f
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x4882b2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x4882b2
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x488276
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x4882b2
mov eax, edx
mov dword [ebp - 0x218], eax
mov ebx, dword [ebp - 0x218]
test ebx, ebx
je 0x48829a
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00408c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4882d2
lea eax, [ebp - 0x214]
call fcn.00407a60
ret

Function at 0x48f328
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x48f365
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x48f353
mov al, 7
jmp 0x48f39e
cmp edx, 5
jb 0x48f39e
mov al, 5
cmp dword [esp + 8], 1
jb 0x48f39e
mov al, 6
jmp 0x48f39e
cmp eax, 1
jne 0x48f39c
mov al, 1
cmp dword [esp + 4], 4
ja 0x48f381
cmp dword [esp + 4], 4
jne 0x48f383
cmp dword [esp + 8], 0xa
jb 0x48f383
mov al, 2
cmp dword [esp + 4], 4
ja 0x48f398
cmp dword [esp + 4], 4
jne 0x48f39e
cmp dword [esp + 8], 0x5a
jb 0x48f39e
mov al, 3
jmp 0x48f39e
xor eax, eax
add esp, 0x11c
ret
Function at 0x4981c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x498260
call sub.user32.dll_RegisterWindowMessageW
mov edi, eax
mov dl, 1
mov eax, dword [0x4362ec]
call fcn.00405e44
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x49824f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push fcn.00498064
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x498239
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00440ec0
mov edx, dword [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.user32.dll_PostMessageW
inc esi
dec ebx
jne 0x49821c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498256
mov eax, dword [ebp - 0xc]
call fcn.00405e74
ret

Function at 0x4982d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dl, 1
call fcn.00462ca0
mov dword [ebp - 8], eax
push 0x4983d0
call sub.user32.dll_RegisterWindowMessageW
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x4362ec]
call fcn.00405e44
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4983c0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
call fcn.00498288
mov ebx, eax
test ebx, ebx
je 0x49832f
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.00498064
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x498346
mov eax, dword [ebp - 4]
push eax
push fcn.00498064
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x498385
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00440ec0
mov ebx, eax
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x498381
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageW
call fcn.0040724c
jmp 0x4983c7
inc edi
dec esi
jne 0x498354
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jle 0x4983aa
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00440ec0
mov ebx, eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4983c7
mov eax, dword [ebp - 4]
call fcn.00405e74
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afc7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4afe74
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
jne 0x4afcb6
mov eax, dword [ebx + 0xc]
mov dword [eax + 0x5db], 7
jmp 0x4afe59
mov eax, dword [ebx + 0x4c]
call fcn.004b1790
mov esi, eax
mov dword [ebx + 0x50], esi
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.004b1764
xor edx, edx
push ebp
push 0x4afe52
push dword fs:[edx]
mov dword fs:[edx], esp
movzx eax, byte [0x4afe84]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x4afe94
mov eax, 0x4afedc
call fcn.0047b4f0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx + 8]
mov edx, 0x4aff00
call fcn.00424b6c
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.0048b9e4
lea ecx, [ebp - 0x10]
mov edx, 0x4aff20
mov eax, 0x4aff3c
call fcn.0047b4f0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x14]
call fcn.0048b9e4
mov eax, dword [ebx + 0x14]
call fcn.0048c218
lea ecx, [ebp - 0x14]
mov edx, 0x4aff68
mov eax, 0x4aff84
call fcn.0047b4f0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x18]
call fcn.0048b9e4
mov eax, dword [ebx + 0x18]
mov dl, 1
call fcn.0048aaf0
mov eax, dword [ebx + 0x18]
call fcn.0048c218
mov eax, dword [ebx + 0x1c]
call fcn.0048c260
mov eax, dword [ebx + 0x20]
call fcn.0048c260
mov eax, dword [ebx + 0x14]
call fcn.0048c218
lea ecx, [ebp - 0x18]
mov edx, 0x4affb0
mov eax, 0x4afff0
call fcn.0047b4f0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
call fcn.0048b9e4
mov eax, dword [ebx + 0x24]
call fcn.0048c218
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x28]
call fcn.0048b9e4
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x2e]
call fcn.0048c6a4
mov eax, dword [ebx + 0x28]
call fcn.0048c218
lea ecx, [ebp - 4]
mov edx, 0x4b0020
mov eax, 0x4b00b0
call fcn.0047b4f0
movzx eax, byte [0x4b00cc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax + 8]
mov edx, 0x4aff00
mov eax, dword [ebp - 4]
call fcn.00424b6c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00407e88
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
call fcn.0048b9e4
mov eax, dword [ebx + 0x2c]
call fcn.0048c218
lea ecx, [ebp - 0x20]
mov edx, 0x4b00dc
mov eax, 0x4b0204
call fcn.0047b4f0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx + 0x30]
call fcn.0048c218
mov eax, dword [ebx + 0xc]
call fcn.0048c244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afe59
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afe7b
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407ac0
ret
Function at 0x4c90b0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebx], 0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4c90da
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4c9198
call fcn.004c31c0
mov dword [ebp - 8], eax
jmp 0x4c90ed
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4c9208
call fcn.004c31c0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c917a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004c40d8
test al, al
je 0x4c912d
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x4c912d
mov eax, dword [ebp - 8]
call fcn.00405e74
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4c927c
call fcn.004c31c0
mov dword [ebp - 8], eax
jmp 0x4c9130
mov byte [ebx], 1
mov eax, dword [ebp - 8]
call fcn.004c40d8
test al, al
je 0x4c9157
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4c914e
mov dword [ebp - 4], 0xffffffff
jmp 0x4c9164
mov dword [ebp - 4], 1
jmp 0x4c9164
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004c40e4
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9181
mov eax, dword [ebp - 8]
call fcn.00405e74
ret

Function at 0x4c92bc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c9375
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0x4c9390
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0041d7b4
push dword [ebp - 0x10]
push 0x4c93e0
push 0x4c9410
push 0x4c942c
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00408b8c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004c31c0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c9353
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004c40d8
test al, al
jne 0x4c933d
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c935a
mov eax, dword [ebp - 8]
call fcn.00405e74
ret
Function at 0x4cdcdc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4cdcf1
add esp, 0xfffffff0
call fcn.004063e4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cded2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], cl
mov dl, 1
mov eax, dword [0x499700]
call fcn.00499c34
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x4cd39c]
call fcn.004cd5bc
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
mov eax, ebx
call fcn.004cd6a8
mov eax, dword [ebp - 4]
fstp qword [eax + 0x40]
wait
push 0
mov ecx, 0x4cdf0c
mov dl, 1
mov eax, dword [0x4a24a0]
call fcn.004a2744
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x4cdf28
call sub.user32.dll_RegisterWindowMessageW
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0x4cdf48
call sub.user32.dll_RegisterWindowMessageW
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, 0x4cdf80
call fcn.00489588
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
mov eax, ebx
xor edx, edx
call fcn.0048b890
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, 0x4cdfac
call fcn.0048c4ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0048ab3c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebx + 0x46c], eax
mov dword [ebx + 0x468], 0x4cef08
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
push 0x4cecb4
push 0
push 1
push 0
lea ecx, [ebp - 8]
mov eax, ebx
mov edx, 1
call fcn.00488638
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push 0
push 0
push 0
push 0
mov edx, 0x4cdfc4
mov eax, esi
movzx ecx, word [0x4cdfc4]
call fcn.00488d74
push 0
push 0
push 0
push 0
mov edx, 0x4cdfc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4cdfc4]
call fcn.00488d74
push 0
push 0
push 0
push 0
mov edx, 0x4cdfc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4cdfc8]
call fcn.00488d74
push 0
push 0
push 0
push 0
mov edx, 0x4cdfc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4cdfc4]
call fcn.00488d74
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 0
push 0x4cdfcc
mov eax, dword [0x4e4c50]
push eax
call sub.user32.dll_LoadIconW
push eax
push 0x414
push 0x4cdf80
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2d]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0048ab3c
mov ecx, eax
mov dl, 1
mov eax, dword [0x498aa4]
call fcn.00498b4c
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cdedc
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4cdef4
call fcn.0040643c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d4620
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4d482b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d4806
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00495ec4
mov ecx, ebx
movzx edx, byte [ebp - 2]
movzx eax, byte [ebp - 1]
call fcn.004b4ffc
test bl, bl
je 0x4d4679
movzx edx, byte [ebp - 2]
movzx eax, byte [ebp - 1]
call fcn.004cb59c
call fcn.004c8c4c
xor eax, eax
push ebp
push 0x4d477e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [0x4e17f8]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0046eeb0
push 1
mov eax, dword [0x4e1b14]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0046eeb0
push 1
mov eax, dword [0x4e19f0]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0046eeb0
push 1
mov eax, dword [0x4e176c]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0046eeb0
push 1
mov eax, dword [0x4e19c4]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0046eeb0
push 1
mov eax, dword [0x4e1b28]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0046eeb0
mov edx, dword [0x4e15d4]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4d4848
call fcn.00408b04
mov eax, dword [ebp - 8]
mov dl, 1
call fcn.0046f560
mov edx, dword [0x4e15d4]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x4d486c
call fcn.00408b04
mov eax, dword [ebp - 0xc]
mov dl, 1
call fcn.0046f560
mov edx, dword [0x4e15d4]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x4d4890
call fcn.00408b04
mov eax, dword [ebp - 0x10]
mov dl, 1
call fcn.0046f560
mov edx, dword [0x4e15d4]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x4d48bc
call fcn.00408b04
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.0046f560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4788
xor eax, eax
push ebp
push 0x4d47c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x4d48e4
mov eax, 0x80000001
call fcn.00462258
mov cl, 1
mov edx, 0x4d48e4
mov eax, 0x80000002
call fcn.00462258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d47cc
mov eax, dword [0x4e172c]
mov eax, dword [eax]
mov ecx, 0x4d4924
mov edx, 0x4d4950
call fcn.00461fec
call fcn.0049d54c
push 0
mov eax, dword [0x4e1a74]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x4d49bc
call fcn.00474d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4832
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00407ac0
ret

Function at 0x40894e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x4085d8
mov eax, 0xde786b1f
call fcn.0040897a
sub ecx, 0x926255d2
xor dword [edi], esi
add edi, 1
cmp edi, ebx
jne fcn.0040894e
mov eax, eax
sub eax, 0xe0e1b820
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0xba44974
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x650c2468
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x68694bd0
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x3486454d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x14943fd9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x34a80122
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219