joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4140a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x414172
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor eax, eax
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040270c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor eax, eax
mov al, byte [ebx + 0x38]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
push edi
push 0x41418c
push dword [ebp - 4]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.004034a0
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406d74
mov eax, dword [ebp - 0x5c]
call fcn.004035a4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x414157
mov eax, dword [ebp - 0x50]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414179
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.004031ac
ret
Function at 0x416090
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebx
push esi
test dl, dl
je 0x41609e
add esp, 0xfffffff0
call fcn.00402a40
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00402940
lea eax, [esi + 0x24]
xor ecx, ecx
mov edx, 0x94
call fcn.0040270c
mov dword [esi + 0x24], 0x94
lea eax, [esi + 0x24]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [0x458664], 0
jne 0x416127
push 0x416234
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x458664], eax
push 0x416240
mov eax, dword [0x458664]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458674], eax
cmp dword [esi + 0x28], 6
jae 0x416112
push 0x416258
mov eax, dword [0x458664]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458694], eax
push 0x416270
mov eax, dword [0x458664]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x45869c], eax
cmp dword [0x458668], 0
jne 0x416169
push 0x41628c
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x458668], eax
push 0x416298
mov eax, dword [0x458668]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x45867c], eax
push 0x4162b4
mov eax, dword [0x458668]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458680], eax
cmp dword [0x45866c], 0
jne 0x416196
push 0x4162d0
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x45866c], eax
push 0x4162e0
mov eax, dword [0x45866c]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458678], eax
cmp dword [0x458670], 0
jne 0x416217
push 0x4162f0
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x458670], eax
push 0x416300
mov eax, dword [0x458670]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458684], eax
push 0x416318
mov eax, dword [0x458670]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458688], eax
push 0x416330
mov eax, dword [0x458670]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x45868c], eax
push 0x416348
mov eax, dword [0x458670]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458690], eax
push 0x416360
mov eax, dword [0x458670]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x458698], eax
mov eax, esi
test bl, bl
je 0x41622c
call fcn.00402a98
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x417238
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esp]
mov ebp, 3
cdq
idiv ebp
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
cmp ecx, dword [esp + 4]
jge 0x4172cb
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [edi + 2]
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x456458]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x456458]
mov byte [esi + ebx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x456458]
mov byte [esi + ebx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x456458]
mov byte [esi + ebx + 3], al
add ebx, 4
add edi, 3
add ecx, 3
cmp ecx, dword [esp + 4]
jl 0x417262
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
je 0x417339
xor eax, eax
mov al, byte [edi]
shl eax, 0x10
cmp ecx, 2
jne 0x4172f2
xor edx, edx
mov dl, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x456458]
mov byte [esi + ebx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x456458]
mov byte [esi + ebx + 1], dl
cmp ecx, 2
jne 0x41732c
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x456458]
mov byte [esi + ebx + 2], al
jmp 0x417331
mov byte [esi + ebx + 2], 0x3d
mov byte [esi + ebx + 3], 0x3d
add ebx, 4
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42569c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x45882c
mov eax, esi
mov edx, 8
test al, 1
je 0x4256b8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4256ba
shr eax, 1
dec edx
jne 0x4256ab
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4256a4
mov byte [0x458c2c], 1
pop esi
ret

Function at 0x4256d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x458c2c], 0
jne 0x4256eb
call fcn.0042569c
mov eax, edi
dec eax
test eax, eax
jl 0x425714
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x45882c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4256f5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x432a30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x248], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x432be1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x144]
mov ecx, 0x432bf8
mov edx, edi
call fcn.0040342c
mov eax, dword [ebp - 0x144]
call fcn.004035a4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x432bbd
lea eax, [ebp - 0x140]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x114]
call fcn.0040272c
lea eax, [ebp - 0x244]
mov edx, 0x432bfc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.0040269c
je 0x432b9c
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
call fcn.0040333c
mov eax, dword [ebp - 0x144]
mov edx, 0x432c08
call fcn.004034f0
je 0x432b9c
test byte [ebp - 0x140], 0x10
je 0x432b71
cmp byte [ebx + 0x1f], 0
jbe 0x432b21
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004033b4
mov ecx, dword [ebp - 0x144]
mov edx, edi
mov eax, ebx
call fcn.00432928
cmp byte [ebx + 0x1c], 0
jne 0x432b9c
push edi
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004033b4
push dword [ebp - 0x248]
push 0x432c14
lea eax, [ebp - 0x144]
mov edx, 3
call fcn.004034a0
mov edx, dword [ebp - 0x144]
mov eax, ebx
call fcn.00432a30
lea eax, [ebp - 0x140]
mov dword [ebx + 0x10], eax
jmp 0x432b9c
cmp byte [ebx + 0x1f], 1
je 0x432b9c
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004033b4
mov ecx, dword [ebp - 0x144]
mov edx, edi
mov eax, ebx
call fcn.00432928
cmp byte [ebx + 8], 0
jne 0x432bb7
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x432a9a
push esi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432be8
lea eax, [ebp - 0x248]
call fcn.00403188
lea eax, [ebp - 0x144]
call fcn.00403188
ret
Function at 0x43dbec
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x43dbf5
xchg dword [ebp - 4], ecx
push ebx
push esi
test dl, dl
je 0x43dc0d
add esp, 0xfffffff0
call fcn.00402a40
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x43e040
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
push esi
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00411714
mov dword [ebx + 0x34], esi
mov dl, 1
mov eax, dword [0x411b48]
call fcn.00402940
mov esi, eax
mov dword [ebx + 0xc], esi
push 1
lea eax, [esi + 0xc]
mov ecx, 1
mov edx, dword [0x411b20]
call fcn.00404288
add esp, 4
push 0
lea eax, [esi + 0x10]
mov ecx, 1
mov edx, dword [0x411b34]
call fcn.00404288
add esp, 4
mov dl, 1
mov eax, dword [0x415294]
call fcn.00402940
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, esi
mov dword [eax + 4], 0xd
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
mov dl, 1
mov eax, dword [0x41538c]
call fcn.004153e8
mov dword [ebx + 0x14], eax
mov dl, 1
mov eax, dword [0x4155c8]
call fcn.00402940
mov esi, eax
mov dword [ebx + 0x18], esi
mov eax, esi
mov dword [eax + 8], eax
mov dword [eax + 4], 0x415708
mov dl, 1
mov eax, dword [0x411c84]
call fcn.00402940
mov esi, eax
mov dword [ebx + 0x1c], esi
mov eax, esi
mov byte [eax + 5], 1
mov dx, 3
call fcn.00411cec
mov dl, 1
mov eax, dword [0x4114c4]
call fcn.0041151c
mov esi, eax
mov dword [ebx + 0x20], esi
mov edx, 0x64
mov eax, esi
call fcn.004115f4
xor edx, edx
mov eax, esi
call fcn.00411600
xor edx, edx
mov eax, esi
call fcn.0041160c
mov byte [esi + 0x14], 0
mov dl, 1
mov eax, dword [0x412430]
call fcn.00402940
mov esi, eax
mov dword [ebx + 0x24], esi
lea edx, [ebp - 0x24]
mov eax, 0x186a0
call fcn.0040e58c
std
dec dword [ebp + 0x468ddc55]
add al, 0x8b
or eax, 0x40d854
Function at 0x441108
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x441178
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x441162
mov esi, 0x20000000
cmp byte [ebp - 1], 0
je 0x441140
or esi, 0x80000000
push esi
mov eax, ebx
call fcn.004033e0
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004038d0
mov eax, dword [ebp - 8]
call fcn.004038e0
push eax
push edi
call sub.winhttp.dll_WinHttpAddRequestHeaders
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44117f
lea eax, [ebp - 8]
call fcn.0040378c
ret

Function at 0x441284
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44134d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00403188
xor eax, eax
mov dword [ebp - 0x10], eax
test edi, edi
je 0x441337
mov dword [ebp - 0xc], 0xfa
lea eax, [ebp - 8]
mov edx, 0xfa
call fcn.00403998
test esi, esi
je 0x4412d5
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004038e0
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.winhttp.dll_WinHttpQueryHeaders
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x44131b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
jne 0x44131b
mov edx, dword [ebp - 0xc]
shr edx, 1
lea eax, [ebp - 8]
call fcn.00403998
test esi, esi
je 0x4412cc
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
jmp 0x4412cc
test bl, bl
je 0x441337
mov edx, dword [ebp - 0xc]
shr edx, 1
lea eax, [ebp - 8]
call fcn.00403998
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004033cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441354
lea eax, [ebp - 8]
call fcn.0040378c
ret

Function at 0x4416b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
test ebx, ebx
je 0x441713
cmp dword [ebx + 0x3c], 0
je 0x4416e2
mov eax, ebx
call fcn.00407d60
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp 0x441713
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.00407d68
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x441713
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x441713
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x442c64
Capabilities:
Clear file content
Receive http response

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x442de4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x68], 0
jne 0x442c92
xor esi, esi
jmp 0x442dc8
mov esi, 0x3e3
cmp byte [ebx + 0xc4], 0
je 0x442ccd
mov eax, dword [ebx + 0x34]
sub eax, 0xc8
je 0x442cb6
sub eax, 6
je 0x442cb6
xor esi, esi
jmp 0x442dc8
mov eax, dword [ebx + 0x68]
call fcn.004416b0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
fild qword [ebp - 0x18]
fstp qword [ebp - 0x10]
wait
jmp 0x442cd5
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x68]
cmp dword [eax + 0x3c], 0
je 0x442d1c
cmp dword [ebx + 0x3c], 0
jne 0x442cef
cmp dword [ebx + 0x38], 0x2800
jbe 0x442d1c
jmp 0x442cf1
jle 0x442d1c
cmp byte [ebx + 0xc4], 0
je 0x442d11
mov eax, dword [ebx + 0x68]
call fcn.00407d60
mov edx, dword [ebx + 0x38]
sub edx, eax
mov eax, dword [ebx + 0x68]
call fcn.00407d70
jmp 0x442d1c
mov eax, dword [ebx + 0x68]
mov edx, dword [ebx + 0x38]
call fcn.00407d70
push 0x2800
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x442c50]
call fcn.00404288
add esp, 4
jmp 0x442dbe
push edi
push 0x2800
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.winhttp.dll_WinHttpReadData
test eax, eax
jne 0x442d5c
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
jmp 0x442dc8
cmp byte [ebx + 8], 0
jne 0x442dc8
cmp dword [edi], 0
jne 0x442d79
xor esi, esi
mov eax, dword [ebx + 0x68]
call fcn.00407d68
push eax
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x442dc8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x68]
mov ecx, dword [edi]
call fcn.00407d9c
cmp eax, dword [edi]
jae 0x442d93
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
jmp 0x442dc8
cmp byte [ebx + 8], 0
jne 0x442dc8
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebx + 0x18c]
call fcn.0040e38c
cmp byte [ebx + 8], 0
je 0x442d3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442deb
lea eax, [ebp - 4]
mov edx, dword [0x442c50]
call fcn.00404294
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c010
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4f804c
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x4f8044]
sub esp, 4
test ebx, ebx
je 0x40c05b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40c054
test esi, esi
je 0x40c054
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40c030
mov dword [esp], 0x4f804c
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40c240
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40c290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40c364
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40c2ce
cmp eax, 4
jne 0x40c2f0
test esi, esi
je 0x40c2e2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x40c2d4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40c32f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x40c321
cmp ecx, 0x40
je 0x40c2e2
cmp ecx, 4
je 0x40c2e2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040c240
lea esi, [esi]
Function at 0x415bf0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.msvcrt.dll_setlocale
test eax, eax
je 0x415cc4
mov dword [esp], eax
mov esi, eax
mov ebx, esp
call sub.msvcrt.dll_strlen
lea edx, [eax + 1]
add eax, 0x10
shr eax, 4
shl eax, 4
call fcn.00417b40
sub esp, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 4], 0x4b4e84
mov dword [esp], 2
mov esi, eax
call sub.msvcrt.dll_setlocale
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x415cd0
mov dword [esp + 4], esi
mov dword [esp], 2
call sub.msvcrt.dll_setlocale
mov eax, esi
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x415cc0
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov edi, eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_GetCPInfo
sub esp, 8
test eax, eax
je 0x415cc0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x415d10
xor edi, edi
mov esp, ebx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x415c82
mov dword [esp], str.LC_CTYPE
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x415c82
mov dword [esp], str.LANG
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x415c82
mov eax, esi
jmp 0x415c82
mov esp, ebx
jmp 0x415cc4

Function at 0x417ec0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x417ef0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x417f18
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sub.KERNEL32.dll_GetLastError
Function at 0x41c100
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x4f8a64], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreW
sub esp, 0x10
mov dword [0x4f8a68], eax
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x41c168
mov dword [esp + 4], 0x41c010
mov dword [esp], eax
mov dword [0x4f8a60], eax
call fcn.0041c760
test eax, eax
jne 0x4a83f9
add esp, 0x1c
ret
call sub.KERNEL32.dll_GetLastError
jmp 0x41c158