joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xa3ce00]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46f30b
je 0x46f35e
cmp ebx, 0x20
jbe 0x46f364
cmp ebx, 0x40
jbe 0x46f3aa
jmp 0x46f44b
test ebx, ebx
je 0x46f354
add eax, 0x10
test ax, 0xff0
je 0x46f340
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x805b00]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x805c00]
jmp 0x46f328
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46f328
pxor xmm1, xmmword [0xa3ce10]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa3ce10]
pxor xmm2, xmmword [0xa3ce20]
pxor xmm3, xmmword [0xa3ce30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa3ce10]
pxor xmm2, xmmword [0xa3ce20]
pxor xmm3, xmmword [0xa3ce30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46f4aa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xa3c7e6], 0
je 0x470b9a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46f2d0
jmp fcn.0040d4d0

Function at 0x471ab0
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.KERNEL32.DLL_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x471aca
mov ecx, 0x14
jmp 0x471ad3
shl ecx, 2
add ecx, 0xe10
mov dword [0xa3c93c], ecx
ret
Function at 0x438581
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x4385a0
cmp eax, dword [esp + 0x28]
je 0x4385b7
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x438597
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x4db29d6
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x331c3282
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x407d38
Capabilities:
Encode data using add xor sub operations

Disassembly:
or cl, cl
jne 0x407d6c
mov ecx, 0xa
test dword [eax + 4], 0x148b5f00
and al, 0x83
in al, dx
cld
mov ebx, 0xe13cb317
xor edx, ebx
xor edx, 0x2ef933fa
pop eax
mov ecx, eax
push ecx
mov esi, edi
push esi
mov esi, 0x400020
mov edi, 0x5c85
xor esi, edi
add byte [ebx], dh
idiv dword [ecx]
mov ecx, 0
xor ecx, dword [esi]
xor ecx, edx
mov dword [eax], ecx
add esi, 4
mov ebx, 0xfffffffc
sub eax, ebx
mov ecx, 0x6025
mov edi, 0x400300
xor ecx, edi
xor ecx, esi
cmp ecx, 0
jne 0x407d6f
ret

Function at 0x407d45
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or cl, cl
jne 0x407d6c
mov ecx, 0xa
test dword [eax + 4], 0x148b5f00
and al, 0x83
in al, dx
cld
mov ebx, 0xe13cb317
xor edx, ebx
xor edx, 0x2ef933fa
pop eax
mov ecx, eax
push ecx
mov esi, edi
push esi
mov esi, 0x400020
mov edi, 0x5c85
xor esi, edi
add byte [ebx], dh
idiv dword [ecx]
mov ecx, 0
xor ecx, dword [esi]
xor ecx, edx
mov dword [eax], ecx
add esi, 4
mov ebx, 0xfffffffc
sub eax, ebx
mov ecx, 0x6025
mov edi, 0x400300
xor ecx, edi
xor ecx, esi
cmp ecx, 0
jne 0x407d6f
ret

Function at 0x408dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00404dd4
jmp 0x408e12
mov eax, ebx
mov edx, esi
call fcn.00404c98
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e1c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x408e3e
movzx eax, word [esp]
jmp 0x408e40
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40ba24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40bb5c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40bb46
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40ba81
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40bb46
cmp dword [ebp - 0x14], 0
jne 0x40ba98
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404c98
pop ebx
pop eax
mov ecx, ebx
push ecx
mov esi, eax
add esp, 0xfffffffc
mov dword [esp], esi
mov edi, eax
xor edi, 0xffffffff
and edi, 0x8b55ff8b
and eax, 0x74aa0074
or eax, edi
push 0x56993f
mov ebx, 0x2b4c9f93
shr ebx, 7
pop edx
xor ebx, edx
sub eax, ebx
je 0x40bb37
invalid
mov ecx, dword [esp]
add esp, 4
mov esi, ecx
add esp, 0xfffffffc
mov dword [esp], esi
mov ebx, 0x4aeea0f
xor ecx, ebx
xor ecx, 0x4aecff0
and ecx, 0xffff
mov edx, 0
mov ebx, 0
xor edx, ebx
or edx, ecx
je 0x40bb37
mov edi, dword [esp]
add esp, 4
mov eax, edi
xor eax, 0xffffffff
and eax, 0x83ec8b55
and edi, 0x7c1374aa
or edi, eax
mov ebx, 0x6900b1bf
shr ebx, 7
xor ebx, 0xd20163
add ebx, edi
je 0x40bb3d
ret
mov esi, dword [esp]
add esp, 4
mov eax, 0x5556529a
shr eax, 2
mov edi, 0x15151db2
xor edi, eax
call edi
lea esp, [esp + 4]
jmp dword [esp - 4]
invalid

Function at 0x40c5a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d98
mov eax, esi
mov edx, 8
test al, 1
je 0x40c5bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c5be
shr eax, 1
dec edx
jne 0x40c5af
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c5a8
pop esi
ret

Function at 0x40c5d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d94], 0
jne 0x40c5f7
call fcn.0040c5a0
push 1
push 0x417d94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40c622
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c5fd
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40e050
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040e004
test al, al
jne 0x40e071
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40e0bd
xor eax, eax
push ebp
push 0x40e0ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404d24
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e0b4
lea eax, [ebp - 0xc]
call fcn.0040e040
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e2fc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40e304
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40e3f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040b8ec
mov edx, dword [ebp - 8]
mov ecx, 0x40e40c
xor eax, eax
call fcn.0040e1e0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x40e3bf
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40e31e
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.0040de08
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00407e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040be74
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x68
call fcn.0040ddd8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406c78]
call fcn.00409740
call fcn.00403f88
jmp 0x40e31e
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e3f8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c90
ret

Function at 0x40e420
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x412c7c]
cmp dword [eax], 2
jne 0x40e488
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40e443
xor eax, eax
jmp 0x40e497
lea eax, [esp + 8]
push eax
push 0x40e49c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40e488
xor eax, eax
jmp 0x40e497
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x40e4c4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40e51e
inc esi
xor edi, edi
cmp edi, 1
jne 0x40e4ea
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x40e4f8
cmp edi, 1
jle 0x40e4f8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040e050
test eax, eax
jne 0x40e51e
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40e51e
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40e51e
inc edi
dec esi
jne 0x40e4da
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40e528
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e54c
mov eax, dword [ebp - 4]
jmp 0x40e54f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e554
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x40e5a1
xor ebx, ebx
jmp 0x40e596
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407af8
test eax, eax
jne 0x40e595
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40e64b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e577
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x40e5ad
je 0x40e5b6
jmp 0x40e5bf
call fcn.0040bba4
mov esi, eax
jmp 0x40e5c1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x40e5c1
xor esi, esi
test si, si
je 0x40e64b
xor ebx, ebx
jmp 0x40e5e7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x40e5e6
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e64b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e5ce
xor ebx, ebx
jmp 0x40e640
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40e63f
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x40e634
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0040e528
push eax
mov eax, esi
call fcn.0040e528
pop edx
cmp edx, eax
jne 0x40e63f
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e64b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e5f6
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x404f90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
lea eax, [ebp - 4]
push eax
push 0x4d2ae0
push dword [ebp + 0x10]
call fcn.0040b550
push 0x4d2ee0
push 0x4703e0
push 0x48b140
call fcn.00401770
push 0x4d32e0
push 0x4703e0
push 0x489540
call fcn.00401770
push 0x47035c
push str.D:P2TFHTEST
call fcn.00417c68
add esp, 0x2c
test eax, eax
setne byte [0x4d1ed2]
test eax, eax
je 0x404ff7
push eax
call fcn.0041797a
add esp, 4
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
mov edi, dword [ebp + 8]
push 0x7f00
push 0
mov dword [ebp - 0x50], 0x30
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], 0x405100
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
mov dword [ebp - 0x34], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x7f00
push 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], str.GMASKEW
call esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push edi
push 0
push 0
push dword [0x480004]
push dword [section..data]
push 0
push 0
push 0xcf0000
push str.DISKRETISIERUNG_DER_SCHEIBE
push str.GMASKEW
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push dword [ebp + 0x14]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call ebx
test eax, eax
je 0x4050f3
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x20]
push eax
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call ebx
test eax, eax
jne 0x4050d7
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405330
Capabilities:
Read file on windows

Disassembly:
call fcn.00404640
push 0x48b140
push str.PARAM00
push 0x48a940
push str._s_s_s
push 0x48b940
call fcn.00401770
push 0x4709e8
push 0x48b940
call fcn.00417c68
add esp, 0x1c
mov dword [0x4c3718], eax
test eax, eax
je 0x405380
push eax
call fcn.0041797a
add esp, 4
mov byte [0x4d1e46], 1
jmp 0x405390
movsd xmm0, qword [0x4705e8]
movsd qword [0x4a1f08], xmm0
push 0x48b140
push str.STRBIB
push 0x48a940
push str._s_s_s
push 0x48b940
call fcn.00401770
push 0x47035c
push 0x48b940
call fcn.00417c68
add esp, 0x1c
mov dword [0x4c3718], eax
test eax, eax
je 0x40542e
push esi
push eax
push 1
push 0x2a8
push 0x4a1a40
call fcn.00444513
push dword [0x4c3718]
call fcn.0041797a
mov ecx, 1
add esp, 0x14
mov edx, ecx
mov esi, ecx
movsx ecx, cx
mov eax, ecx
movzx edx, dx
shl eax, 4
add eax, ecx
cmp word [eax*4 + 0x4a1a42], 0
jle 0x405415
mov byte [0x4d1e45], 1
movzx edx, si
lea eax, [edx + 1]
mov word [0x4c351e], ax
movzx ecx, ax
movzx edx, ax
movzx esi, ax
cmp ax, 9
jle 0x4053f3
pop esi
call fcn.00405210
push 0x4a1ce8
push 0x48b140
call fcn.00405c10
add esp, 8
mov byte [0x4d1e46], 1
call fcn.004055d0
cmp byte [0x4d1e45], 0
je 0x40545f
call fcn.00405680
mov eax, 6
push 0x4a1ce8
push 0x48b140
mov word [0x4c350c], ax
call fcn.00405c10
add esp, 8
cmp byte [0x4d1c13], 0
jne 0x4054b7
push 0x4a1ce8
call fcn.00405e00
add esp, 4
cmp byte [0x48bf30], 0xbc
je 0x405485
call fcn.00405e70
cmp byte [0x48bf30], 0xbc
je 0x405485
call fcn.00405f20
cmp byte [0x48bf30], 0xbc
je 0x40549b
call fcn.00405f30
cmp byte [0x48bf30], 0xbc
je 0x4054a9
call fcn.00405f80
cmp byte [0x48bf30], 0xbc
je 0x405596
cmp byte [0x4d1c14], 0
je 0x4054e7
call fcn.004066a0
jmp 0x4054ec
call fcn.004062f0
mov al, byte [0x48bf30]
cmp al, 0xbc
je 0x405584
nop dword [eax]
cmp word [0x4a1f78], 0
jle 0x405514
call fcn.00406a00
mov al, byte [0x48bf30]
cmp al, 0xbc
je 0x4054d7
nop dword [eax + eax]
cmp word [0x4a1f7a], 0
jle 0x405556
cmp byte [0x4d1c14], 0
je 0x40553a
call fcn.00406a10
jmp 0x40553f
call fcn.00406a20
mov al, byte [0x48bf30]
cmp al, 0xbc
je 0x405500
call fcn.00405e60
mov al, byte [0x48bf30]
cmp al, 0xbc
je 0x405520
cmp byte [0x4d1c10], 0
je 0x405571
push 0x4a1ce8
call fcn.00406a30
mov al, byte [0x48bf30]
add esp, 4
cmp al, 0xbc
jne 0x4055ad
cmp word [0x4a1f7a], 0
jg 0x40552a
jmp 0x4054d7
call fcn.00405f80
cmp byte [0x48bf30], 0xbc
jne 0x4054d7
call fcn.00405f30
cmp byte [0x48bf30], 0xbc
jne 0x4054c5
jmp 0x4054a9
mov eax, dword [str.NoName]
mov dword [0x48b540], eax
mov ax, word [0x4709f8]
mov word [0x48b544], ax
mov al, byte [0x4709fa]
mov byte [0x48b546], al
ret
Function at 0x405680
Capabilities:
Read file on windows

Disassembly:
push 0x48b140
push str.STRBIB
push 0x48a940
push str._s_s_s
push 0x48b940
call fcn.00401770
push 0x48b940
call fcn.004046a0
push 0x47035c
push 0x48b940
call fcn.00417c68
push eax
push 1
push 0x2a8
push 0x4a1a40
mov dword [0x4c3718], eax
call fcn.00444513
mov eax, dword [0x4c3718]
add esp, 0x30
test eax, eax
je 0x4056e3
push eax
call fcn.0041797a
add esp, 4
push 0x48b140
push str.DIARY
push 0x48a940
push str._s_s_s
push 0x48b940
call fcn.00401770
push 0x47035c
push 0x48b940
call fcn.00417c68
push eax
push 1
push 0x16e0
push 0x4cccc0
mov dword [0x4c3718], eax
call fcn.00444513
push dword [0x4c3718]
call fcn.0041797a
add esp, 0x30
ret

Function at 0x405a20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x480080]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x489540]
lea ecx, [ecx + 1]
mov byte [ecx + 0x48913f], al
test al, al
jne 0x405a40
mov ecx, 0x489140
mov byte [0x4d1c13], al
mov eax, dword [ebp + 8]
mov dword [0x4a2030], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405a68
sub ecx, edx
push 1
push ecx
push 0x489140
call fcn.0040bab0
push 1
push 1
push 0x48b140
call fcn.0040bab0
add esp, 0x18
cmp byte [0x48b140], 0x2e
jne 0x405ae4
cmp byte [0x48b141], 0
mov edx, 1
je 0x405ac9
cmp dx, 0x50
jge 0x405ac9
movsx ecx, dx
inc edx
mov al, byte [ecx + 0x48b140]
mov byte [ebp + ecx - 0x405], al
movsx eax, dx
cmp byte [eax + 0x48b140], 0
jne 0x405aa6
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x404]
lea ecx, [ecx + 1]
mov byte [ecx + 0x48b13f], al
test al, al
jne 0x405ad0
push 0x48b140
push 0x48a940
push 0x489540
push 0x48ad40
push 0x48bf2c
push 0x4d1c0f
call fcn.0040b6e0
push 0x4702a2
push 0x4702a2
push 0x48b140
push 0x4702a4
push 0x48b140
call fcn.0040b9b0
mov eax, dword [0x48bf2c]
add esp, 0x2c
cmp byte [0x4d1ed2], 0
mov dword [0x48bf24], eax
je 0x405b74
push edi
push str.D:P2DATA1TRACE
push 0x488940
call fcn.00401770
push 0x488940
call fcn.004448d1
mov edi, 0x488940
add esp, 0xc
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405b60
mov ax, word [0x4702a0]
mov word [edi], ax
pop edi
call fcn.00405d40
call fcn.00405cc0
call fcn.00405280
movsd xmm0, qword [0x4705c8]
push 0x47035c
push str.SIGNUMV
mov byte [0x4d1ed3], 0
mov byte [0x4d1ed1], 0
movsd qword [0x4a1f00], xmm0
mov byte [0x4d1c14], 1
mov byte [0x482800], 0
call fcn.00417c68
add esp, 8
mov dword [0x4c3718], eax
test eax, eax
je 0x405bd3
push eax
call fcn.0041797a
add esp, 4
or eax, 0xffffffff
mov word [0x4a1f7e], ax
call fcn.004057f0
xor eax, eax
cmp byte [0x4d1ed3], al
jne 0x405bf7
cmp byte [0x480c50], al
sete al
add eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bb90
mov esp, ebp
pop ebp
ret