joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aba90
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x44
push 4
push 0x5427f8
call fcn.00466fd0
mov dword [esp + 8], eax
mov ecx, dword [eax]
add esp, 8
test ecx, ecx
je 0x4abab4
lea edx, [esp]
cmp edx, ecx
jae 0x4abb08
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
lea ecx, [esp + 4]
push 0x1c
lea edx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
jne 0x4abaef
mov eax, dword [esp]
cmp dword [eax], 0
jne 0x4abb08
mov ecx, dword [esp + 0x24]
lea edx, [esp]
dec ecx
not ecx
and ecx, edx
mov dword [eax], ecx
jmp 0x4abb04
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 8]
lea edx, [ecx + eax + 0x8000]
mov eax, dword [esp]
mov dword [eax], edx
mov eax, dword [esp]
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
mov eax, 1
mov dword [edx], ecx
add esp, 0x44
ret
Function at 0x4abb20
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x5427f4]
push ebp
push esi
push edi
push eax
call fcn.00442f70
mov eax, dword [esp + 0x14]
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x4abc71
push str.unicode
push ebp
mov dword [0x5432f4], 0x536288
call fcn.00442ef0
mov ecx, dword [0x5432f4]
mov dword [0x5427f4], eax
add esp, 8
cmp dword [ecx + 0x68], ebp
jne 0x4abcec
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push str.kernel32
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
cmp edi, ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
je 0x4abbe3
push str.GetFileAttributesExW
push edi
call esi
mov edx, dword [0x5432f4]
push str.CreateHardLinkW
push edi
mov dword [edx + 0x68], eax
call esi
mov ecx, dword [0x5432f4]
push str.FindFirstFileExW
push edi
mov dword [ecx + 0x6c], eax
call esi
mov edx, dword [0x5432f4]
push str.GetVolumeNameForVolumeMountPointW
push edi
mov dword [edx + 0x70], eax
call esi
mov ecx, dword [0x5432f4]
push str.GetLongPathNameW
push edi
mov dword [ecx + 0x74], eax
call esi
mov edx, dword [0x5432f4]
push edi
mov dword [edx + 0x78], eax
call ebp
push str.advapi32
call ebx
mov edi, eax
pop ebx
test edi, edi
je 0x4abcec
push str.GetFileSecurityW
push edi
call esi
mov ecx, dword [0x5432f4]
push str.ImpersonateSelf
push edi
mov dword [ecx + 0x7c], eax
call esi
mov edx, dword [0x5432f4]
push str.OpenThreadToken
push edi
mov dword [edx + 0x80], eax
call esi
mov ecx, dword [0x5432f4]
push str.RevertToSelf
push edi
mov dword [ecx + 0x84], eax
call esi
mov edx, dword [0x5432f4]
push str.MapGenericMask
push edi
mov dword [edx + 0x88], eax
call esi
mov ecx, dword [0x5432f4]
push str.AccessCheck
push edi
mov dword [ecx + 0x8c], eax
call esi
mov edx, dword [0x5432f4]
push edi
mov dword [edx + 0x90], eax
call ebp
pop edi
pop esi
pop ebp
ret
mov eax, dword [0x536250]
mov dword [0x5432f4], 0x5361e8
cmp eax, ebp
mov dword [0x5427f4], ebp
jne 0x4abcec
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
cmp esi, ebp
je 0x4abcec
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GetFileAttributesExA
push esi
call edi
mov ecx, dword [0x5432f4]
push str.CreateHardLinkA
push esi
mov dword [ecx + 0x68], eax
call edi
mov edx, dword [0x5432f4]
push str.GetVolumeNameForVolumeMountPointA
push esi
mov dword [edx + 0x6c], eax
mov eax, dword [0x5432f4]
mov dword [eax + 0x70], ebp
mov ecx, dword [0x5432f4]
mov dword [ecx + 0x78], ebp
call edi
mov edx, dword [0x5432f4]
push esi
mov dword [edx + 0x74], eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
ret
Function at 0x4c2110
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x320
push ebp
push esi
mov esi, dword [esp + 0x330]
push edi
xor edi, edi
push esi
mov dword [esp + 0x10], edi
call fcn.0046e130
add esp, 4
push str.netapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x4c22d8
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push ebx
push str.NetApiBufferFree
push ebp
call esi
mov edi, eax
push str.NetGetDCName
push ebp
mov dword [esp + 0x20], edi
call esi
push str.NetUserGetInfo
push ebp
mov ebx, eax
call esi
test eax, eax
mov dword [esp + 0x20], eax
je 0x4c22bf
test ebx, ebx
je 0x4c22bf
test edi, edi
je 0x4c22bf
mov eax, dword [esp + 0x334]
push 0x40
push eax
or edi, 0xffffffff
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x4c21f4
lea ecx, [esp + 0x24]
push ecx
call fcn.0046e130
lea edx, [esp + 0x28]
lea eax, [esi + 1]
push edx
push 0xffffffffffffffff
push eax
call fcn.0047cd40
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
call ebx
lea edx, [esp + 0x24]
mov ebx, eax
push edx
call fcn.0046e340
mov ecx, dword [esp + 0x338]
add esp, 4
sub esi, ecx
test ebx, ebx
mov edi, esi
jne 0x4c22b2
lea eax, [esp + 0x24]
push eax
call fcn.0046e130
mov edx, dword [esp + 0x338]
lea ecx, [esp + 0x28]
push ecx
push edi
push edx
call fcn.0047cd40
mov edx, dword [esp + 0x24]
add esp, 0x10
lea ecx, [esp + 0x1c]
push ecx
push 1
push eax
push edx
call dword [esp + 0x30]
test eax, eax
jne 0x4c22a5
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 0x10]
test esi, esi
je 0x4c2255
cmp word [esi], 0
je 0x4c2255
mov ecx, dword [esp + 0x338]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push esi
call fcn.0047cc10
add esp, 0xc
jmp 0x4c228f
lea edx, [esp + 0x128]
push 0x104
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov esi, dword [esp + 0x338]
lea eax, [esp + 0x128]
push esi
push 2
push eax
call fcn.0047cc10
push 0xffffffffffffffff
push str._users_default
push esi
call fcn.0046e150
add esp, 0x18
mov ecx, dword [esp + 0x338]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
call dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
call fcn.0046e340
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4c22bf
push eax
call dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
jne 0x4c2340
mov esi, dword [esp + 0x334]
mov edi, eax
mov eax, dword [esp + 0x330]
cmp byte [eax], 0x2a
je 0x4c2334
push str.system.ini
lea edx, [esp + 0x24]
push 0x104
push edx
push 0x542250
push eax
push str.Password_Lists
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
jbe 0x4c2334
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea ecx, [esp + 0x20]
push 3
push ecx
push esi
call fcn.0046e150
mov eax, dword [esi]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x320
ret
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x320
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x320
ret
Function at 0x4ce0e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jle 0x4ce0fa
mov ecx, dword [esp + 4]
push esi
mov esi, dword [ecx]
add ecx, 4
xor eax, esi
dec edx
jne 0x4ce0ef
pop esi
ret
Function at 0x4db8b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
cmp eax, dword [edi]
jle 0x4db8db
lea ecx, [esp + 8]
push esi
push ecx
call fcn.004c3e70
add esp, 8
test eax, eax
jne 0x4db936
mov ecx, dword [edi]
mov esi, edi
jmp 0x4db8ef
lea edx, [esp + 8]
push edi
push edx
call fcn.004c3e70
add esp, 8
test eax, eax
jne 0x4db936
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
jle 0x4db90e
push ebx
mov edx, dword [esp + 0x18]
mov edi, dword [esi + 0xc]
mov edi, dword [edi + eax*4]
mov ebx, dword [edx + eax*4]
xor ebx, edi
mov dword [edx + eax*4], ebx
inc eax
cmp eax, ecx
jl 0x4db8f6
pop ebx
lea eax, [esp + 8]
push eax
call fcn.004dced0
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push edx
call fcn.004dc2d0
lea eax, [esp + 0x14]
push eax
call fcn.004c03f0
add esp, 0x10
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4de1e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call fcn.004de3a0
push 0x205c
call fcn.0044ffd0
mov ebx, dword [esp + 0x44]
mov esi, eax
mov ecx, 0x817
xor eax, eax
mov edi, esi
add esp, 4
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x10], ebx
mov dword [esi], eax
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.DLL_GetConsoleCP]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x1c]
push str.cp_d
push ecx
call edi
call sub.KERNEL32.DLL_GetCurrentThreadId
mov ebp, dword [esp + 0x48]
push esi
push str.file_lx
push ebp
mov dword [esi + 0x1c], eax
call edi
push ebx
push esi
push ebp
push 0x53ca50
call fcn.00456080
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateThread]
add esp, 0x28
mov dword [esi + 0xc], eax
test bl, 2
je 0x4de2d9
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleMode]
mov eax, dword [esp + 0x10]
and al, 0xe7
or al, 2
mov dword [esp + 0x10], eax
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetConsoleMode]
push 0
push 1
push 1
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x2c], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x38], eax
call edi
lea edx, [esp + 0x14]
mov dword [esi + 0x3c], eax
push edx
push 0
push esi
push 0x4de660
push pe_nt_image_headers32
push 0
call ebp
push 2
push eax
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
test bl, 4
je 0x4de327
push 0
push 1
push 1
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x28], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4de730
push pe_nt_image_headers32
push 0
call ebp
push 2
push eax
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov ecx, dword [esi + 0xc]
push str.auto
push str._translation
push ecx
push 0
call fcn.00459f90
mov edx, dword [esi + 0xc]
push 0x5347a0
push str._eofchar
push edx
push 0
call fcn.00459f90
mov eax, dword [0x5432f4]
add esp, 0x20
cmp dword [eax], 0
je 0x4de36e
mov ecx, dword [esi + 0xc]
push str.unicode
push str._encoding
push ecx
jmp 0x4de37c
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x18]
push edx
push str._encoding
push eax
push 0
call fcn.00459f90
mov eax, dword [esi + 0xc]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4deb50
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor eax, eax
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [ebx]
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4debb2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x4deb9d
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [ebx]
push 1
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
jne 0x4debb2
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4ded80
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
mov esi, dword [esp + 0x14]
lea ebx, [esi + 0x68]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esi + 0x9c]
mov edx, dword [esp + 0x18]
sub ecx, ebp
mov dword [esi + 0x9c], ecx
mov ecx, dword [esp + 0x20]
xor eax, eax
push edi
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
mov eax, dword [esi]
push ecx
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4dee15
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 0x3e5
je 0x4dedfb
sub eax, 0x7c
je 0x4dee15
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x20]
mov edx, dword [esi]
push 1
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
jne 0x4dee15
pop edi
pop esi
pop ebp
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0x9c]
push ebx
mov ecx, dword [eax]
sub ecx, ebp
add edx, ecx
mov dword [esi + 0x9c], edx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4df2b0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.004def60
push 0xa0
call fcn.0044ffd0
mov ebx, dword [esp + 0x24]
mov esi, eax
mov ecx, 0x28
xor eax, eax
mov edi, esi
xor ebp, ebp
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
mov dword [esi + 0xc], ebx
mov dword [esi], edi
mov dword [esi + 8], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], 1
mov dword [esi + 0x9c], ebp
mov dword [esi + 0x98], ebp
mov dword [esi + 0x20], 0xa
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 0x38], eax
mov eax, 0x1000
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x20]
push esi
push str.file_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x2c]
push ebx
push esi
push ecx
push 0x53caa0
call fcn.00456080
mov edx, dword [esi + 0x34]
add esp, 0x20
mov dword [esi + 8], eax
mov eax, dword [esi + 0x30]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetupComm]
push 0xf
push edi
call dword [sym.imp.KERNEL32.DLL_PurgeComm]
push 0x5432a0
push edi
call dword [sym.imp.KERNEL32.DLL_SetCommTimeouts]
lea ecx, [esi + 0x68]
push ecx
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventA]
test bl, 2
je 0x4df387
push ebp
push ebp
push 1
push ebp
call edi
mov dword [esi + 0x4c], eax
test bl, 4
je 0x4df3d7
push ebp
push ebp
push 1
push ebp
call edi
push ebp
push 1
push 1
push ebp
mov dword [esi + 0x60], eax
call edi
push ebp
push ebp
push ebp
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
push ebp
push ebp
push ebp
mov dword [esi + 0x84], eax
call edi
lea edx, [esp + 0x10]
mov dword [esi + 0x88], eax
push edx
push ebp
push esi
push 0x4df410
push pe_nt_image_headers32
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 8]
push str.auto
push str._translation
push eax
push ebp
call fcn.00459f90
mov ecx, dword [esi + 8]
push 0x5347a0
push str._eofchar
push ecx
push ebp
call fcn.00459f90
mov eax, dword [esi + 8]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4e1e00
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GlobalAddAtomA]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
test eax, eax
mov dword [esp + 8], edi
jne 0x4e1e2c
mov word [esp + 0x10], 0
jmp 0x4e1e34
push eax
call esi
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4e1e43
mov word [esp + 0x12], ax
jmp 0x4e1e4b
push eax
call esi
mov word [esp + 0x12], ax
push edi
call fcn.0044f150
lea eax, [esp + 0xc]
push eax
call fcn.004e1ec0
add esp, 8
lea ecx, [esp + 8]
push ecx
push 0x4e20c0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e1e88
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp word [esp + 0x10], 0
mov esi, dword [sym.imp.KERNEL32.DLL_GlobalDeleteAtom]
je 0x4e1e9d
mov ecx, dword [esp + 0x10]
push ecx
call esi
cmp word [esp + 0x12], 0
je 0x4e1eac
mov edx, dword [esp + 0x12]
push edx
call esi
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4e3c52
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522248
push 0x4e4222
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x543318], 0xffffffff
or dword [0x543328], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5432d8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x5432d4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x54332c], eax
call fcn.004e428b
cmp dword [0x53d5f0], 0
jne 0x4e3cd5
push 0x4e4288
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.004e4270
push 0x52430c
push 0x524208
call sub.MSVCRT.dll__initterm
mov eax, dword [0x5432d0]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x5432cc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x524104
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.0040128a
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0xfd4c04
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfd4c0e
pushal
call 0xfd4c14
pop ebp
sub ebp, 0x10
sub ebp, 0xbd4c04
jmp 0xfd4c2a
mov eax, 0xbd4c04
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bd
mov edx, 0x8bd469d9
xor byte [eax], dl
inc eax
dec ecx
jne 0xfd4c41
jmp 0xfd4c54
push edx
adc al, 0x52
push eax
in eax, 0xd9
fstpnce st(1), st(0)
pop eax
sbb byte [ecx], ah
fstpnce st(1), st(0)
fstpnce st(2), st(0)
adc al, 0x61
fstp st(1)
fstpnce st(1), st(0)
arpl cx, si
fstpnce st(1), st(0)
fldcw word [esi]
cmp ebx, edx
adc dword [edx + 0x58], edx
aad 0xd9
fstpnce st(1), st(0)
ficomp dword [esp + edx*2]
mov ebp, 0xdd5025fd
std
mov dword [ecx - 0x26062f8f], esi
mov cl, 0x83
wait
inc esp
fstpnce st(0), st(0)
cmc
std
mov cl, 0x50
dec eax
xchg edx, eax
sub dh, byte [ecx]
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407358
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4505391f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cdf0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2c97430
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x6ceb72b6
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x3c7e506c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219