joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10043f3c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10168580]
jne 0x10043f46
repz ret
jmp fcn.100441ed
Function at 0x10044c74
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [0x10168558]
add edx, 0xffffd94f
mov dword [0x10168554], edx
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, eax
add edx, 0xffffe3e9
mov esi, dword [ebp - 0x14]
cmp word [esi + ecx*2], 0
mov edi, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edi
je 0x10044d72
jmp 0x10044d51
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x10044d1b
jmp 0x10044dbf
mov eax, dword [ebp - 0x20]
add eax, 0xffffe7d7
mov dword [0x10168554], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10044dac
jmp 0x10044dbf
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10044dbf
mov eax, 1
mov dword [0x10168554], 0xb63
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x34], eax
je 0x10044dc6
jmp 0x10044dbf
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
jl 0x10044cb5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [0x10168554], ecx
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x30], eax
jne 0x10044dbf
mov dword [0x10168558], 0x7a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10044cf6
jmp 0x10044dbf
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10044ce2
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10044dc6
mov eax, dword [ebp - 0x34]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x10044de5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.100456ca
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, dword [0x10168554]
add edi, 0x20f3
mov dword [0x10168554], edi
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x10168558], 0x1487
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10044f26
jmp 0x10044eb5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
jmp 0x10044ecc
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov edx, dword [ebp - 0x34]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], eax
jb 0x10044e46
jmp 0x10044f26
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x10044ecc
jmp 0x10044ef5
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x10044e46
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
jne 0x10044e8b
mov al, byte [ebp - 0x42]
test al, 1
jne 0x10044f01
jmp 0x10044e62
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10168554], 0x954
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004533f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10168560], 0
mov byte [0x10168564], 0
mov edi, dword [0x10168554]
add edi, 0xe84
mov dword [0x10168558], edi
mov dword [0x1016855c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1004539f
xor eax, eax
mov dword [0x1016855c], 0
mov dword [ebp - 0x20], eax
jmp 0x100453d1
mov eax, dword [ebp - 0x1c]
mov dword [0x10168558], 0x8b8
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1016855c]
add eax, 1
mov dword [0x1016855c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1004539f
jmp 0x1004538e
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10168568], 0
mov edi, dword [0x10168560]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10168568], esi
mov dword [0x10168554], 0x233b
mov eax, esi
cdq
idiv ecx
mov dword [0x10168560], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10168564], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x10168564]
mov esi, dword [0x10168560]
mov byte [ebx + esi], cl
mov esi, dword [0x1016855c]
add esi, 1
mov dword [0x1016855c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x100453d1
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10045487
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x1004614d]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x10168554], 0x1540
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.10045083
mov dword [0x10168554], 0x1b9e
call fcn.10044f31
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10044593
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x100455b0
mov dword [0x10168554], 0x505
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10168554], 0x1847
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.100446f9
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x10168554], 0x14d0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x28], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x1c], ecx
mov dword [0x10168558], 0xc82
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x100455b0
mov eax, dword [0x10168554]
mov ecx, dword [ebp - 0x44]
add ecx, 0x2193
add eax, 0x2182
mov dword [0x10168554], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
Function at 0x10045886
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1016855c], 0
mov dword [0x10168560], 0
mov dword [0x1016856c], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x100459dc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add eax, 1
mov dword [0x10168554], 0x581
mov edi, ecx
add edi, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x1016855c], edx
mov dword [0x10168558], 0x20ec
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10168560], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10168564], cl
mov dword [0x10168558], 0x1c17
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10168564]
mov edx, dword [0x10168560]
mov byte [ebx + edx], cl
mov edx, dword [0x1016855c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x10168560]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1016856c], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
xor cl, byte [edx + esi]
mov byte [0x10168570], cl
mov dword [0x10168554], 0x13d7
mov dword [0x10168558], 0x1ac9
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], cl
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x38], edi
je 0x100459dc
mov eax, dword [0x10168560]
mov ecx, dword [0x1016855c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x100458df
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100459e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x10168554], 0x895
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1004492d
lea ecx, [0x10044bfd]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x68], 0x13e800
mov edx, dword [0x10168540]
mov dword [esp + 0x88], edx
mov edx, dword [0x10168544]
mov dword [esp + 0x54], edx
mov edx, dword [0x10168548]
mov dword [esp + 0x7c], edx
mov edx, dword [0x1016854c]
mov dword [esp + 0x64], edx
mov edx, dword [0x10168550]
mov dword [esp + 0x60], edx
mov dword [0x10168558], 0x1d3f
mov dword [0x10168554], 0x2324
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10045a7f
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x10045aa2
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x10045ab6
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10045a7f
mov eax, dword [esp + 0xc]
mov dword [esp + 0x44], eax
mov dword [0x10168554], 0x4417
mov dword [0x10168558], 0x94b
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x3c], edx
call fcn.10044c74
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x10045a77
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10045487
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x10], eax
jmp 0x10045a77
Function at 0x10011f6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edi, edi
cmp eax, edi
jne 0x100124a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100123a
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.010015eb
leave
ret 0x10
cmp eax, esi
jb 0x1001255
mov eax, 0x8007007a
jmp 0x100123a
lea eax, [ebp - 0x20c]
push eax
push 0x10010e8
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01001195
add esp, 0x10
cmp eax, edi
jl 0x100123a
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x1001226
push 0x10010dc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
jne 0x10012b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10012ac
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
jmp 0x100123a
push edi
push edi
push edi
push edi
call eax
jmp 0x10012ae
Function at 0x10015dc
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001a48
call fcn.01001784
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002374
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100138a
cmp eax, esi
jne 0x100137d
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100138d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001364
xor esi, esi
inc esi
mov eax, dword [0x1002370]
cmp eax, esi
jne 0x10013a0
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10013cf
mov eax, dword [0x1002370]
test eax, eax
jne 0x10013c9
mov dword [0x1002370], esi
push 0x10010b0
push 0x10010a4
call fcn.010012c6
pop ecx
pop ecx
test eax, eax
je 0x10013cf
jmp 0x10014f3
mov dword [0x1002034], esi
mov eax, dword [0x1002370]
cmp eax, esi
jne 0x10013f3
push 0x10010a0
push 0x1001098
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1002370], 2
cmp dword [ebp - 0x20], ebx
jne 0x1001400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002378], ebx
je 0x1001421
push 0x1002378
call fcn.010016fb
pop ecx
test eax, eax
je 0x1001421
push ebx
push 2
push ebx
call dword [0x1002378]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10014f3
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100148b
cmp cx, bx
je 0x1001446
cmp dword [ebp - 0x1c], ebx
jne 0x100148b
movzx ecx, word [eax]
cmp cx, bx
je 0x100145b
cmp cx, 0x20
ja 0x100145b
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1001446
test byte [ebp - 0x40], 1
je 0x1001467
movzx ecx, word [ebp - 0x3c]
jmp 0x100146a
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x10014d0
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100149c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1001430
cmp dword [0x1002034], ebx
jne 0x10014de
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x10014ff
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010017c9
ret
call fcn.010018ce
jmp 0x1001327

Function at 0x1001670
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1001683
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100167f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret
Function at 0x10016b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x10016ef
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10016e5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10016f1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10016d5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1008768
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg dword [esp], eax
sub dword [esp], eax
movzx eax, byte [edi]
cmc
mov ebp, ebp
sub dword [esp], eax
jmp 0x1008a77
push 0xffffffffffffffff
pop ecx
add ecx, 1
jmp 0x1004240
lodsd eax, dword [esi]
cld
xchg esp, edx
xchg esp, edx
nop
lea eax, [eax]
mov ah, ah
nop
lea edi, [eax + ebx]
not esp
not esp
nop
cmp ecx, dword [edx + 0x18]
je 0x1008767
jmp 0x10042fb
lea edx, [edx]
wait
mov eax, 0
push eax
sub ch, bh
add ch, bh
not dl
not dl
cld
inc dl
dec dl
nop
cld
mov eax, eax
imul eax, eax, 0x10
jmp 0x1004200
xor eax, 0xc3832ba7
nop
sub eax, dword [esp + 4]
jne 0x1004238
jmp 0x1008844
ret
push dword [ebx + 0x3c]
add eax, ecx
cld
xchg edi, eax
lea edi, [ecx]
and edi, 0x9552af9a
pop eax
jmp 0x10088da
or dh, 0x77
add edi, ebx
movzx eax, word [esi + ecx*2]
mov esi, dword [edi + eax*4]
sbb edx, edi
mov edx, ebx
add esi, ebx
jmp 0x10088a3
sbb ah, dl
xor al, 0xf9
mov edi, dword [edx + 0x1c]
mov esi, dword [edx + 0x24]
or dl, 0x88
add esi, ebx
jmp 0x10087e8
mov dl, cl
lea edx, [ebx + edx*4 - 0x5e2c5ba0]
lahf
nop
sub ecx, ebx
mov al, 0x47
xchg ecx, edx
ret 4
add ecx, eax
mov edx, dword [eax + ebx + 0x78]
lea edx, [edx + ebx]
mov esi, dword [edx + 0x20]
mov ah, 0x89
mov edi, edi
xor eax, 0x10b52364
add ah, 0xfa
lea esi, [ebx + esi]
jmp 0x1004235
sub edi, 0xffffffff
pop eax
not esp
not esp
test byte [edi], 0xff
jne 0x1004303
jmp 0x10086df
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219