joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a5320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
cmp edx, eax
jle 0x100a538c
push eax
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6460
call fcn.10022310
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10022310
add esp, 4
mov ecx, eax
call fcn.100504a0
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.10022310
add esp, 4
mov ecx, eax
call fcn.10049750
push eax
call fcn.10095120
add esp, 4
cmp byte [0x100e7784], 0
je 0x100a5453
jmp 0x100a545a
mov ecx, dword [ebx + 0x34]
shl ecx, 4
cmp edx, ecx
jg 0x100a53e3
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6460
call fcn.10022310
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10022310
add esp, 4
mov ecx, eax
call fcn.100504a0
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.10022310
add esp, 4
mov ecx, eax
call fcn.100504a0
mov edx, 0x100fcc88
mov ecx, eax
call fcn.10022310
jmp 0x100a5371
cmp eax, 0x10
jb 0x100a5453
add eax, 0xfffffff0
cmp edx, eax
jle 0x100a53f2
lea edx, [eax + 1]
mov eax, dword [ebx]
add edx, eax
mov dword [ebp + 8], edx
lea edi, [eax + 0x10]
add edi, ecx
cmp edi, edx
jae 0x100a5453
movzx eax, byte [edi]
lea edx, [edi + 3]
movzx ecx, byte [edi + 1]
mov esi, 7
imul eax, eax, 0x101
add eax, ecx
lea esp, [esp]
movzx ecx, byte [edx - 1]
lea edx, [edx + 2]
imul eax, eax, 0x101
add ecx, eax
imul eax, ecx, 0x101
movzx ecx, byte [edx - 2]
add eax, ecx
and eax, 0x7fffff
dec esi
jne 0x100a5420
push eax
mov ecx, ebx
call fcn.100a5170
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x100a5402
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100e6460
call fcn.10026460
push 1
call fcn.100af0c2
int3

Function at 0x100a54f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x100a5540
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6460
call fcn.10022310
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.10022310
add esp, 4
mov ecx, eax
call fcn.100504a0
push eax
call fcn.10095120
add esp, 4
cmp byte [0x100e7784], 0
jne 0x100a5552
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.100a5470
pop ebp
ret 8
mov ecx, 0x100e6460
call fcn.10026460
push 1
call fcn.100af0c2
int3
Function at 0x100a5fa0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x100e8260
mov word [0x100e8760], 0
push esi
dec eax
mov word [0x100e8260], 0x301
push edi
mov edi, 0x100e8260
mov byte [0x100e8763], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x100e8760], bl
inc ebx
cmp ebx, 0x100
jl 0x100a5fd5
mov byte [0x100e7fe0], 0x63
mov ebx, 1
mov byte [0x100e8143], 0
jmp 0x100a6020
movzx eax, bl
mov ecx, 0x100e835f
movzx eax, byte [eax + 0x100e8760]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x100e7fe0], al
movzx eax, al
mov byte [eax + 0x100e80e0], bl
inc ebx
cmp ebx, 0x100
jl 0x100a6020
mov al, 1
mov edx, 0x100e81e0
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x100e8258
jl 0x100a6068
mov ecx, dword [0x100031ac]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x100e7fe0]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x100e80e0]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100e8360], edx
test cl, cl
je 0x100a610c
test bl, bl
je 0x100a610c
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x100e8760]
movzx edx, byte [edx + 0x100e8760]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100e8260]
mov byte [ebp - 1], al
jmp 0x100a6110
mov byte [ebp - 1], 0
test ch, ch
je 0x100a613c
test bl, bl
je 0x100a613c
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x100e8760]
movzx edx, byte [edx + 0x100e8760]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100e8260]
mov byte [ebp - 2], al
jmp 0x100a6140
mov byte [ebp - 2], 0
mov al, byte [0x100031ae]
test al, al
je 0x100a616e
test bl, bl
je 0x100a616e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100e8760]
movzx edx, byte [edx + 0x100e8760]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x100e8260]
jmp 0x100a6170
xor bh, bh
mov al, byte [0x100031af]
test al, al
je 0x100a619e
test bl, bl
je 0x100a619e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100e8760]
movzx edx, byte [edx + 0x100e8760]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x100e8260]
jmp 0x100a61a0
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100e7be0], edx
inc esi
cmp esi, 0x100
jl 0x100a6095
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cf370
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100cf440
push 0xffffffffffffffff
push 0x100e4eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x100026c8]
cmp eax, 0xffffffff
jne 0x100cf479
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100cf486
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100cf4ed
jmp 0x100cf4bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100cf52a
test edi, edi
jne 0x100cf530
push 0x100cf040
push 0x100e76a0
call fcn.100cece0
mov eax, dword [0x100026c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100cf4ed
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100cf516
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100cf516
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100cf568
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100cf559
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100cf530
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100cf4b0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100cf5c7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100cf5ac
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100cf5c7
jmp 0x100cf5a0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100cf5a0
jmp 0x100cf5c7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100cf5c5
cmp esi, dword [eax + 8]
jne 0x100cf5c5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100cf5b5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100cf5db
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100cf5db
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100cf070
cmp esi, ebx
jne 0x100cf580
mov ebp, dword [esp + 0x14]
jmp 0x100cf4b0
Function at 0x100cf440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100cf440
push 0xffffffffffffffff
push 0x100e4eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10001840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x100026c8]
cmp eax, 0xffffffff
jne 0x100cf479
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100cf486
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100cf4ed
jmp 0x100cf4bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100cf52a
test edi, edi
jne 0x100cf530
push 0x100cf040
push 0x100e76a0
call fcn.100cece0
mov eax, dword [0x100026c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100cf4ed
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100cf516
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100cf516
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100cf568
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100cf559
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100cf530
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100cf4b0
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100cf5c7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100cf5ac
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100cf5c7
jmp 0x100cf5a0
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100cf5a0
jmp 0x100cf5c7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100cf5c5
cmp esi, dword [eax + 8]
jne 0x100cf5c5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100cf5b5
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100cf5db
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100cf5db
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100cf070
cmp esi, ebx
jne 0x100cf580
mov ebp, dword [esp + 0x14]
jmp 0x100cf4b0
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.73i4outz]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.73i4outz]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.73i4outz]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.73i4outz]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.73i4outz]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.73i4outz]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1351c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x135b2
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push 0x80d
call fcn.000129fd
cmp dword [ebp + 8], eax
jne 0x1359a
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
cmp dword [ebp - 8], esp
je 0x1358d
push 6
call fcn.00015c1e
add esp, 4
mov dword [ebp - 4], eax
jmp 0x135b2
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], 0
mov eax, 0xc0000003
jmp 0x135f5
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], eax
cmp dword [ebp + 0x18], 0
jle 0x135eb
mov dword [ebp - 8], esp
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [ebp - 8], esp
je 0x135eb
push 6
call fcn.00015c1e
add esp, 4
mov eax, 0
jmp 0x135f5
mov esp, ebp
pop ebp
ret 0x18
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
nop
mov ecx, 0x27c057da
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2cff3239
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
mov ecx, 0x3b344dc5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..7LWLf
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x6a694112
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b908
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x48948c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x403c50
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x403c5c
mov al, 1
jmp 0x403dff
mov dword [ebp - 0x10], 8
call fcn.0040bbe0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0040bbe0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040bb10
add esp, 8
movzx eax, al
test eax, eax
je 0x403c9f
xor al, al
jmp 0x403dff
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00403010
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00403130
mov ecx, eax
call fcn.00403f80
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.0040c290
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00403130
mov ecx, eax
call fcn.00403f80
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00404a70
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x403d1a
cmp dword [ebp - 0x6c], 1
je 0x403d21
cmp dword [ebp - 0x6c], 3
je 0x403dbb
jmp 0x403dd3
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00403130
mov ecx, eax
call fcn.00403f80
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x403d84
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00403130
mov ecx, eax
call fcn.00403f80
push eax
call fcn.00435ef1
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x403d84
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040df60
mov al, byte [ebp - 0x61]
jmp 0x403dff
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x403da7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040df60
mov al, byte [ebp - 0x62]
jmp 0x403dff
cmp dword [ebp - 0x38], 0
jne 0x403db9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004030a0
jmp 0x403deb
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040df60
mov al, byte [ebp - 0x63]
jmp 0x403dff
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040df60
mov al, byte [ebp - 0x64]
jmp 0x403dff
jmp 0x403cb2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004313c7
mov esp, ebp
pop ebp
ret