joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea60
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40efb0
call fcn.0040ed5c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40eac0
cmp eax, 0xffffffff
je 0x40eac0
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40eab9
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40eab9
cmp edx, 0x10000000
jae 0x40eab9
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40eab6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40eb40
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40eb7e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40eb76
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40eb80
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40eb66
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ec60
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ec8f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ec8f
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41b2d0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401c84
mov al, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00402545
add esp, 0x20c
ret
xor al, al
jmp 0x401c6f

Function at 0x401f60
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push 0
push 0
push str.PATH
call ebx
mov esi, eax
test esi, esi
je 0x401fff
xor ecx, ecx
mov edx, 2
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004023b7
add esp, 4
mov edi, eax
push esi
push edi
push str.PATH
call ebx
dec esi
cmp esi, eax
jne 0x401ff5
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push edi
call ebp
mov ebx, eax
test ebx, ebx
je 0x401ff4
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004023b7
add esp, 4
mov esi, eax
push ebx
push esi
push edi
call ebp
test eax, eax
je 0x401feb
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.00402bde
add esp, 4
pop ebp
push edi
call fcn.00402bde
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x40981d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b2d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004055da
mov dword [ebp - 0x14], eax
cmp dword [0x41d1a8], esi
jne 0x409910
push 0x800
push esi
push 0x4166c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40989d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4099f0
push esi
push esi
push 0x4166c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4099f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4099f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41d1a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41d1ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41d1b0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41d1b8], eax
test eax, eax
je 0x40990d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41d1b4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x409935
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409928
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40994a
push 4
pop eax
jmp 0x4099f2
cmp dword [ebp - 0x14], esi
je 0x40994a
push dword [0x41d1a8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40992f
mov eax, dword [0x41d1b4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4099a8
cmp dword [0x41d1b8], edi
je 0x4099a8
push eax
call ebx
push dword [0x41d1b8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4099a8
test eax, eax
je 0x4099a8
call ecx
test eax, eax
je 0x40999d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40999d
test byte [ebp - 8], 1
jne 0x4099a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4099d8
mov eax, dword [0x41d1ac]
cmp eax, edi
je 0x4099d5
push eax
call ebx
test eax, eax
je 0x4099d5
call eax
mov esi, eax
test esi, esi
je 0x4099d5
mov eax, dword [0x41d1b0]
cmp eax, edi
je 0x4099d5
push eax
call ebx
test eax, eax
je 0x4099d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41d1a8]
call ebx
test eax, eax
je 0x4099f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4099f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402545
mov esp, ebp
pop ebp
ret
Function at 0x41486a
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4148c4
push 0
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [esi], eax
test eax, eax
je 0x4148c4
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x414893
mov ecx, 0x20
mov eax, 0x20
cdq
idiv ecx
push 0x40
push 0x3000
lea eax, [edx + ecx]
mov dword [esi + 8], eax
shl eax, 7
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esi + 4], eax
test eax, eax
jne 0x4148c4
mov dword [esi], eax
pop esi
ret 8

Function at 0x4149ad
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
je 0x414a7e
test edx, edx
je 0x414a7e
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x414a7e
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp edx, eax
jne 0x414a7e
cmp dword [edx], 0x4550
jne 0x414a7e
mov eax, 0xe0
cmp word [edx + 0x14], ax
jb 0x414a7e
push esi
mov esi, dword [edx + 0x80]
add esi, ebx
cmp dword [esi], 0
je 0x414a7d
push ebp
push edi
lea esp, [esp]
mov eax, dword [esi + 0xc]
add eax, ebx
push str.kernel32.dll
push eax
call fcn.00402615
add esp, 8
test eax, eax
jne 0x414a73
mov edi, dword [esi]
add edi, ebx
mov eax, dword [edi]
test eax, eax
je 0x414a73
push 0x1f
lea ebp, [ebx + 2]
add ebp, eax
push str.GetLogicalProcessorInformation
push ebp
call fcn.0040aa6f
add esp, 0xc
test eax, eax
jne 0x414a69
mov eax, dword [str.DebugBreak]
mov dword [ebp], eax
mov eax, dword [0x419bf0]
mov dword [ebp + 4], eax
mov ax, word [0x419bf4]
mov word [ebp + 8], ax
mov al, byte [0x419bf6]
mov byte [ebp + 0xa], al
mov eax, dword [edi + 4]
add edi, 4
test eax, eax
jne 0x414a2e
add esi, 0x14
cmp dword [esi], 0
jne 0x414a0d
pop edi
pop ebp
pop esi
pop ebx
ret

Function at 0x414aa7
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0xfffffffb
lea esp, [esp]
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x414ac4
cmp dl, 0xcc
jne 0x414b0e
inc eax
cmp eax, 0xffffffff
jle 0x414ab7
mov al, byte [ecx]
cmp al, 0x8b
je 0x414ad4
cmp al, 0x89
jne 0x414b0e
cmp byte [ecx + 1], 0xff
jne 0x414b0e
mov eax, 0x414b12
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x41e620], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
ret 0xc
xor al, al
jmp 0x414b0b
Function at 0x10003368
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10003377
pop dword [ebp - 0x4c]
mov eax, 0xc8d3926e
add eax, 0x472ca109
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xdf7c47ac
sub dword [ebp - 0x5c], 0x912a0261
mov dword [ebp - 0x58], 0xe8bd6cc2
add dword [ebp - 0x58], 0x4975df83
mov dword [ebp - 0x54], 0x7e5c066c
add dword [ebp - 0x54], 0xcdf03dc2
mov dword [ebp - 0x50], 0xd513148b
sub dword [ebp - 0x50], 0xd513148b
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x97018ca2
sub eax, 0x87014c5a
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x518d1ae0
add dword [ebp - 0x5c], 0x22e54e76
mov dword [ebp - 0x58], 0x6fef5fda
add dword [ebp - 0x58], 0xd17d019b
mov dword [ebp - 0x54], 0x9c3c5f8f
add dword [ebp - 0x54], 0xc7330cdd
mov dword [ebp - 0x50], 0x8f95fc90
add dword [ebp - 0x50], 0x706a0370
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x35a8b
push 0
call eax
mov ecx, 0x528e3300
sub ecx, 0x528deeca
xor edi, edi
add edi, eax
mov edx, 0x4006a12
add edx, 0xc002bee
add edx, dword [ebp - 0x4c]
mov esi, 0xfd09eae7
add esi, 0xa4beb4cb
mov ebx, dword [edx]
xor dword [ebp - 0x2c], 0xe15a8da
xor ebx, esi
add dword [ebp - 0xc], 0x82d6fc7a
mov dword [edi], ebx
xor dword [ebp - 4], 0xf6ba36e1
add edi, 0xe79a09c3
sub edi, 0xe79a09bf
add edx, 0x5800d109
add edx, 0xa7ff2efb
loop 0x10003496
add eax, 0xbd82f818
add eax, 0x427e0b93
mov ebx, eax
add eax, 5
mov ecx, 0xe24ab15f
sub ecx, 0xd24ab15f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00408d33
pop ecx
test eax, eax
je 0x401046
push str.Windows_original_main_args:_n
call fcn.00408bef
xor esi, esi
pop ecx
cmp dword [0x425628], esi
jle 0x401046
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408bef
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401027
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.00402a23
call fcn.0040392e
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039b0
pop ecx
pop ecx
mov esi, eax
call fcn.00403934
xor ecx, ecx
test edi, edi
jle 0x401080
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401075
mov eax, dword [0x424010]
and dword [esi + ecx*4], 0
mov ebx, eax
test eax, eax
jne 0x401091
mov ebx, dword [esi]
mov ecx, dword [0x42400c]
test ecx, ecx
jne 0x40109d
mov ecx, dword [esi]
mov eax, dword [0x425420]
push 0
push 0
push 1
test eax, eax
setne dl
movzx edx, dl
push edx
push ebx
push ecx
push 0x41c24c
push 0x41c23c
push dword [0x425424]
push 1
push eax
push 1
push esi
push edi
call fcn.00403472
add esp, 0x38
pop edi
pop esi
pop ebx
ret

Function at 0x402a23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x402a32
pop dword [ebp - 0x10]
mov eax, 0x402a32
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x63a31691
sub dword [ebp - 0x20], 0x1550d146
mov dword [ebp - 0x1c], 0x5347d9d3
sub dword [ebp - 0x1c], 0x21148d8e
mov dword [ebp - 0x18], 0x9b4d47d6
add dword [ebp - 0x18], 0xb0fefc58
mov dword [ebp - 0x14], 0xa9359d37
sub dword [ebp - 0x14], 0xa9359d37
lea eax, [ebp - 0x20]
push eax
mov eax, 0x26c807cc
sub eax, 0x2686477c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xc0bd4b98
add dword [ebp - 0x20], 0xb3b51dbe
mov dword [ebp - 0x1c], 0x3dfac18e
sub dword [ebp - 0x1c], 0xfc8e6019
mov dword [ebp - 0x18], 0x2ce596ff
sub dword [ebp - 0x18], 0xc9762a93
mov dword [ebp - 0x14], 0xd65400ab
sub dword [ebp - 0x14], 0xd65400ab
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xb2649f0c
sub eax, 0xb222dec0
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39689
push 0
call eax
mov ecx, 0x9c86bbae
add ecx, 0x637982d2
xor ebx, ebx
add ebx, eax
mov esi, 0xa5315655
add esi, 0x5b11d3ab
add esi, dword [ebp - 0x10]
mov edi, 0xf2434079
sub edi, 0x2117aad8
sub dword [ebp - 0xc], ecx
mov edx, dword [esi]
add dword [ebp - 4], eax
xor edx, edi
add dword [ebp - 4], 0xdaf69299
mov dword [ebx], edx
xor dword [ebp - 4], 0x2aa1cff4
add ebx, 0xbb84f0ec
add ebx, 0x447b0f18
add esi, 0x62bb93ad
add esi, 0x9d446c57
loop 0x402b51
add eax, 0xecd3
xor ebx, ebx
add ebx, eax
add eax, 0x4f45ee36
add eax, 0xb0ba11cf
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x403e2f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ed2
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00402a23
pop ecx
pop ecx
test eax, eax
je 0x403ebb
test ebx, ebx
je 0x403eaf
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00402a23
pop ecx
pop ecx
test eax, eax
jle 0x403ebb
push ebx
call fcn.00403a18
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.004039f7
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e7c
xor edi, edi
cmp ebx, edi
jne 0x403ed6
xor eax, eax
jmp 0x403f42
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f05
call fcn.00403a18
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ed2
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ed2
call fcn.00403a18
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403ef5
cmp dword [ebp - 0x70], edi
je 0x403f38
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.004039f7
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004098e8
add ebp, 0x9c
leave
ret
Function at 0x408f37
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x422550
call fcn.0040dcb0
xor esi, esi
cmp dword [0x4274a8], esi
jne 0x408df7
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x408e0a
mov dword [ebp - 0x1c], esi
jmp 0x408e40
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x408e05
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x408e05
cmp dword [eax + 0x400074], 0xe
jbe 0x408e05
xor ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.0040f80c
test eax, eax
jne 0x408e51
push 0x1c
call fcn.00402a23
pop ecx
call fcn.0040d831
test eax, eax
jne 0x408e62
push 0x10
call fcn.00402a23
pop ecx
call fcn.0040dae6
mov dword [ebp - 4], esi
call fcn.00402a23
test eax, eax
jns 0x408e7b
push 0x1b
call fcn.00402a23
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4274a4], eax
call fcn.00402a23
mov dword [0x42565c], eax
call fcn.00402a23
test eax, eax
jns 0x408ea1
push 8
call fcn.00402a23
pop ecx
call fcn.0040f1ff
test eax, eax
jns 0x408eb2
push 9
call fcn.00402a23
pop ecx
push 1
call fcn.00402a23
pop ecx
cmp eax, esi
je 0x408ec5
push eax
call fcn.00402a23
pop ecx
mov eax, dword [0x425634]
mov dword [0x425638], eax
push eax
push dword [0x42562c]
push dword [0x425628]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x408ef2
push eax
call fcn.00402a23
call fcn.00408bb3
jmp 0x408f27
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040dcf5
ret
call fcn.00402a23
jmp 0x408dd6

Function at 0x4098e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x4098f2
repz ret
jmp fcn.004114ed
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x4676304a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x5e4331fa
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401eeb
cmp byte [esi + ebx - 1], 0xa
je 0x401ebf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402f70
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100273b6
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.100273b6
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10