joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453eb4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x453ecb
add esp, 0xfffffff0
call fcn.00403f00
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041c47c
mov eax, dword [0x482bf4]
cmp word [eax + 2], 0
jne 0x453ef3
mov eax, dword [0x482bf4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004554a0
mov eax, dword [0x482d2c]
cmp word [eax + 2], 0
jne 0x453f0d
mov eax, dword [0x482d2c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00455698
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41345c]
call fcn.00403bac
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41345c]
call fcn.00403bac
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f0b8]
call fcn.00426574
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x454094
mov eax, dword [0x482a7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00426944
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x455c38
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x482a7c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dd40
test eax, eax
je 0x454002
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409794
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dd68
test eax, eax
je 0x454016
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404c20
mov eax, dword [0x482888]
cmp byte [eax], 0
jne 0x45404a
mov eax, ebx
call fcn.004541bc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00455e14
mov eax, ebx
call fcn.004567d8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45408a
call fcn.00403f58
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45443c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x483be4]
cmp dword [eax + 0x30], 0
je 0x4544e6
cmp dword [ebx + 0x94], 0
jne 0x4544e0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4543cc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4544e0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4544a6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4544e0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00415c38
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4544b5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455048
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45507d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404aa0
jmp 0x45508a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a04
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455ff0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456031
mov eax, esi
call fcn.0043c800
test al, al
je 0x456031
mov eax, dword [ebx + 0x84]
call fcn.0043c528
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456031
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c528
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45731c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404e60
xor eax, eax
push ebp
push 0x45739a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404e70
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x457365
mov eax, dword [ebx + 4]
call fcn.00404e70
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4573a1
lea eax, [ebp - 4]
call fcn.004049b0
ret
Function at 0x45839c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x458539
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402ad4
cmp word [ebx + 0xa2], 0
je 0x4583e5
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4583f9
lea esi, [ebp - 8]
jmp 0x4583fb
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x458408
xor edi, edi
jmp 0x458415
mov eax, dword [ebx + 0x80]
call fcn.00404e70
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404e70
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00457ad4
mov eax, dword [ebp - 0x14]
call fcn.00404e70
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404e70
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404e70
push eax
mov eax, ebx
call fcn.00457c08
push eax
mov eax, ebx
call fcn.00457bdc
push eax
mov eax, ebx
call fcn.00457b90
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004579a0
mov eax, dword [ebp - 0x18]
call fcn.00404e70
push eax
mov eax, dword [ebx + 8]
call fcn.00404e70
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x45849e
call fcn.0040e5cc
xor edx, edx
push ebp
push 0x458517
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4584dc
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4584d2
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45851e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x458548
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x458574
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404e70
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x458599
call fcn.0040e5cc
xor eax, eax
push ebp
push 0x4585d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4585b9
call fcn.0040e5cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4585d7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x462910
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
call fcn.0045e6f8
test al, al
jne 0x462924
call fcn.0045e710
call fcn.0045e6e4
mov dword [0x482168], eax
push 0x462b0c
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x462978
mov edx, 0x8000
mov eax, 0x462b20
call fcn.0040ebf4
mov dword [0x482164], eax
mov eax, dword [0x482164]
mov dword [0x482168], eax
push 0x462b0c
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x462ade
push 0x462b2c
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x462ade
push 0x462b38
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x462ade
mov eax, dword [ebp - 4]
mov dword [0x482128], eax
mov eax, dword [ebp - 8]
mov dword [0x48212c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x482130], eax
push 0x462b48
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482134], eax
push 0x462b54
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482138], eax
push 0x462b60
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48213c], eax
push 0x462b70
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482140], eax
push 0x462b80
mov eax, dword [0x482168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482144], eax
mov edx, 0x8000
mov eax, 0x462b98
call fcn.0040ebf4
mov dword [0x48216c], eax
cmp dword [0x48216c], 0
je 0x462b08
push 0x462ba8
mov eax, dword [0x48216c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482148], eax
push 0x462bc0
mov eax, dword [0x48216c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482158], eax
push 0x462bd8
mov eax, dword [0x48216c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48214c], eax
push 0x462bf4
mov eax, dword [0x48216c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482150], eax
push 0x462c14
mov eax, dword [0x48216c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x482154], eax
push 0x462c30
mov eax, dword [0x48216c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48215c], eax
jmp 0x462b08
call fcn.00461cfc
mov eax, 0x462280
mov dword [0x482128], eax
mov eax, 0x462650
mov dword [0x48212c], eax
mov eax, fcn.00462224
mov dword [0x482130], eax
mov byte [0x482160], 1
mov esp, ebp
pop ebp
ret
Function at 0x479918
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404c20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c70
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
jne 0x479973
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c70
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov esp, ebp
pop ebp
ret

Function at 0x479978
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404c20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c70
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
jne 0x4799d3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c70
mov edx, eax
dec edx
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov esp, ebp
pop ebp
ret

Function at 0x47a4c4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov dword [0x483e2c], 0x94
push 0x483e2c
call sub.kernel32.dll_GetVersionExA
test eax, eax
je case.0x47a500.7
push ebp
call fcn.0047a2b8
pop ecx
mov eax, dword [0x483e30]
add eax, 0xfffffffd
cmp eax, 7
ja case.0x47a500.7
jmp dword [eax*4 + 0x47a507]
mov byte [ebp - 1], 4
jmp case.0x47a500.7
mov eax, dword [0x483e34]
sub eax, 1
jb 0x47a546
sub eax, 9
je 0x47a55b
sub eax, 0x50
je 0x47a561
jmp case.0x47a500.7
cmp dword [0x483e3c], 2
jne 0x47a555
mov byte [ebp - 1], 5
jmp case.0x47a500.7
mov byte [ebp - 1], 1
jmp case.0x47a500.7
mov byte [ebp - 1], 2
jmp case.0x47a500.7
mov byte [ebp - 1], 3
jmp case.0x47a500.7
mov eax, dword [0x483e34]
sub eax, 1
jb 0x47a578
je 0x47a57e
dec eax
je 0x47a584
jmp case.0x47a500.7
mov byte [ebp - 1], 6
jmp case.0x47a500.7
mov byte [ebp - 1], 7
jmp case.0x47a500.7
mov byte [ebp - 1], 8
jmp case.0x47a500.7
mov eax, dword [0x483e34]
sub eax, 1
jb 0x47a59e
je 0x47a5a4
dec eax
je 0x47a5aa
dec eax
je 0x47a5b0
jmp case.0x47a500.7
mov byte [ebp - 1], 9
jmp case.0x47a500.7
mov byte [ebp - 1], 0xa
jmp case.0x47a500.7
mov byte [ebp - 1], 0xb
jmp case.0x47a500.7
mov byte [ebp - 1], 0xc
jmp case.0x47a500.7
mov byte [ebp - 1], 0xd
cmp dword [0x483e30], 6
setb byte [0x483e28]
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret
Function at 0x47ad90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47ae11
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
test eax, eax
jns 0x47adce
call fcn.00403b1c
push eax
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00404c20
mov eax, dword [ebp - 0x14]
pop edx
call fcn.00408fd8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4e4
jne 0x47adfb
mov dword [ebp - 8], 0x4e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae18
lea eax, [ebp - 0x14]
call fcn.004049b0
ret

Function at 0x47ae20
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 4
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47aea6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47ae95
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.00402948
mov eax, dword [ebp - 8]
push eax
push 0x10
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae9c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x47bb88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x47bc34
push 0x47bc3c
mov eax, dword [0x483664]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x483664]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x413db0]
call fcn.00403bac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x483664]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0041812c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x14]
call fcn.00403bdc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x44
test eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
push edi
jne 0x40107f
push 0x7f00
push 0
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], 0x401110
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], str.APSEMAIL
mov dword [esp + 0x44], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push esi
push 0
push 0
push 0xc8
push 0xc8
push 0x64
push 0x64
push 0x20000000
push str.The_Uttams_Hello_Prog
push str.APSEMAIL
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
je 0x4010ff
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
jne 0x4010e0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
Function at 0x4011c0
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp + 0xe4]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x415d14
push eax
call edi
mov ebx, dword [esp + 0x224]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xf4]
push ebx
push ecx
call esi
lea edx, [esp + 0xf4]
push str..ttf
push edx
call esi
push 0x180
lea eax, [esp + 0xf8]
push 0x8101
push eax
call fcn.00401740
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
jne 0x401234
push str.Couldnt_create_data_file
call fcn.004016c0
add esp, 4
mov ecx, dword [esp + 0x220]
mov edx, dword [esp + 0x21c]
push ecx
push edx
push ebp
call fcn.004014a0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401262
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
push ebp
call fcn.004013c0
add esp, 4
lea eax, [esp + 0xf4]
lea ecx, [esp + 0x174]
push eax
push ecx
call edi
lea edx, [esp + 0x10]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xb4]
push eax
push ecx
call edi
lea edx, [esp + 0xb4]
push str._fonts
push edx
call esi
lea eax, [esp + 0x10]
push str._fonts_
push eax
call esi
lea ecx, [esp + 0x10]
push ebx
push ecx
call esi
lea edx, [esp + 0x10]
push str..ttf
push edx
call esi
lea eax, [esp + 0x50]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x50]
push 0x415cdc
push ecx
call esi
lea edx, [esp + 0x50]
push ebx
push edx
call esi
lea eax, [esp + 0x50]
push str..fot
push eax
call esi
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x178]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x1b4]
push ebx
push ecx
call edi
lea edx, [esp + 0x1b4]
push str..ttf
push edx
call esi
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x1b4]
push eax
lea edx, [esp + 0x54]
push ecx
push edx
push 0
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceA]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0xf4]
push ecx
call fcn.00401390
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x401390
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4013a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4013a9
xor eax, eax
test eax, eax
je 0x4013ba
push eax
call fcn.00401cf0
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret