joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100485b0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1004864d
push ebx
push esi
call fcn.10048579
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100412da
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100485fa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004864c
push edi
push eax
call fcn.1003fcec
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1004861a
call fcn.1003fcb2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004864b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100412da
add esp, 0x20
test eax, eax
jne 0x10048639
push edi
call fcn.1003fcb2
jmp 0x10048641
push ebx
call fcn.1003fcb2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10048650
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10048661
pop esi
ret
push ebx
push edi
push esi
call fcn.10048579
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003fcec
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10048689
push ebx
push esi
push edi
call fcn.1002e210
add esp, 0xc
push 0
call fcn.1003fcb2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10048a59
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004869e

Function at 0x1004ad3f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1003e1f5
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1004adae
cmp esi, dword [ebp - 4]
je 0x1004ada9
cmp dword [ebp + 0xc], 0
je 0x1004ada9
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1004ad86
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1004a87c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1004adb0
xor eax, eax
inc eax
jmp 0x1004adb0
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1004ae15
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006a264]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1003e1f5
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1003e1f5
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1004ae8c
cmp word [ecx], dx
je 0x1004ae8c
mov eax, dword [0x1005b63c]
push edi
dec eax
push eax
push 0x1005b528
call fcn.1004adb4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1004aeff
cmp word [eax], dx
je 0x1004aeff
mov eax, dword [edi]
test eax, eax
je 0x1004aeb0
cmp word [eax], dx
je 0x1004aeb0
lea eax, [ebp - 0x10]
push eax
call fcn.1004a782
jmp 0x1004aeb9
lea eax, [ebp - 0x10]
push eax
call fcn.1004a81d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1004af29
mov eax, dword [0x1005b524]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1005b218
call fcn.1004adb4
add esp, 0xc
test al, al
je 0x1004af29
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1004aef4
cmp word [eax], di
je 0x1004aef4
lea eax, [ebp - 0x10]
push eax
call fcn.1004a782
pop ecx
jmp 0x1004af2b
lea eax, [ebp - 0x10]
push eax
call fcn.1004a81d
jmp 0x1004aef1
mov eax, dword [edi]
test eax, eax
je 0x1004af16
cmp word [eax], dx
je 0x1004af16
lea eax, [ebp - 0x10]
push eax
call fcn.1004a737
pop ecx
jmp 0x1004af29
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1004aff4
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1004ac39
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1004aff4
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1004aff4
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1004aff4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1004af81
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100426e3
test ebx, ebx
je 0x1004afef
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100426e3
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1004aff4
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1004aff4
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1004e29d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1004aff6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002cba9
leave
ret
Function at 0x1004f4d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004f4fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004f4fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x51e320
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0051e407
push 0xf050f840
jmp 0x51e46d
mov edi, dword [esp + 0x2c]
jmp 0x51e4bf
bsr ebx, ecx
jle 0x51e457
jg 0x51e457
inc ax
jmp 0x51e4a7
sub esp, 0x1c
xchg bx, ax
jmp 0x51e474
jmp 0x51e77c
lea esi, [esp + 0x1c]
xchg al, ah
neg dh
jo 0x51e491
jno 0x51e491
xor al, 0xbe
sub al, 0x4b
invalid
bsf si, cx
jbe 0x51e48a
sub esp, 0x1c
xchg bx, ax
inc ax
jmp 0x51e4a7
mov bl, 0x5c
neg ebx
jmp 0x51e5fe
lea edx, [edx*4]
lea ebx, [edi + ebp]
mov ax, sp
jmp 0x51e53f
pushfd
add dx, bx
cmc
jmp 0x51e59e
cmc
jmp 0x51e59e
lea eax, [edx + esi]
mov ebx, dword [esp]
stc
xchg bl, ah
stc
mov dx, 0x18e3
jmp 0x51e5d4
not edi
mov bx, 0xa592
mov edx, 0xfcf8367d
mov ebx, dword [esp]
adc bx, 0x906a
jmp 0x51e5bd
ror edi, 0
jnp 0x51e572
lea eax, [edx + esi]
call fcn.0051e640
dec ebp
fimul word [ebx + ebp - 0x1a]
push eax
mov ebp, 0x35c6a333
xor byte [esi + 0x5a23e0a1], 0xb5
jno 0x51e564
pushfd
add dx, bx
jmp 0x51e56f
bsr ax, cx
jbe 0x51e6aa
mov bl, dh
jmp 0x51e6ac
lea edx, [edx*4]
lea ebx, [edi + ebp]
mov ax, sp
mov bl, 0x5c
neg ebx
lea eax, reloc.MSVCRT.dll__iob
setns bl
mov ax, si
jmp 0x51e589
mov ecx, edi
stc
jle 0x51e5ed
jg 0x51e555
not edi
mov eax, edi
neg ebx
jne 0x51e6dd
ror ebx, cl
dec ax
mov bx, di
jmp 0x51e6c0
mov bl, dh
lea esp, [esp + 4]
jmp 0x51e694
dec ax
mov bx, di
sets dh
jmp 0x51e722
sets dh
lea ebx, reloc.MSVCRT.dll__iob
jmp 0x51e728
ror ebx, cl
jmp 0x51e6b2
bt dx, cx
mov bx, 0xbfb3
lea esp, [esp + 2]
jmp 0x51e731
rdtsc
sub esp, 0xa
jb 0x51e6e1
bt dx, cx
jmp 0x51e708
mov bx, 0xbfb3
lea esp, [esp + 2]
jmp 0x51e731
lea ebx, reloc.MSVCRT.dll__iob
not edi
xchg dh, dl
lea ebx, [eax + esi]
jmp 0x51e6f7
lea esp, [esp + 8]
xor edi, 0x20370459
mov al, 0x57
not edx
mov bh, 0x18
jmp 0x51e754
call fcn.0051e4e4
add edi, dword [esi]
mov bx, 0xdd58
rdtsc
rdtsc
jmp fcn.0051e764
sub esp, 0xa4
mov ebp, esp
mov ax, sp
neg cl
ja 0x51e74f
setnp ah
jmp 0x51e685

Function at 0x51e3ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
lea esp, [esp]
mov dword [esp], edi
jmp 0x51e416

Function at 0x51e407
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp]
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0051e3c1
pushfd
jmp 0x51e325
Function at 0x523353
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
jle 0x523355
pop dx
xchg cx, ax
dec edx
lea esp, [esp + 2]
jmp 0x523365
jmp 0x52333d
pop dx
xchg cx, ax
jmp 0x523360
dec edx
lea esp, [esp + 2]
inc edi
jmp 0x52348d
add edi, 0x3293899c
dec ch
jmp 0x5233db
lea ecx, [edx*4]
inc ax
je 0x523385
jne 0x523385
bsr cx, di
lea eax, [ebx + esi]
sub esp, 0x1f
neg cl
xchg word [esp + 0x1a], cx
sub esp, 0x10
jmp 0x5233ff
rol edi, 0
setb ch
mov eax, 0xfce7818a
rdtsc
lea edx, [ebx*4]
jmp 0x52339b
jns 0x5233a8
bsr cx, di
lea eax, [ebx + esi]
jmp 0x523415
bsr cx, dx
jmp 0x5233c5
lea esp, [esp + 3]
jmp 0x52343e
sub esp, 0x1f
neg cl
xchg word [esp + 0x1a], cx
jmp 0x5233b9
push bp
mov eax, 0x24038834
lea esp, [esp + 2]
jmp 0x523462
lea esp, [esp + 0x2c]
dec edi
mov ax, dx
rdtsc
mov ecx, edi
jmp 0x523421
mov ax, 0xc0b9
jmp 0x5234a4
add edi, 0x5ac054fd
cmp dx, si
ja 0x52344c
mov ax, 0xc0b9
mov al, byte [esp]
jmp 0x5234a7
mov cl, byte [esp]
jmp 0x5234b1
bswap ecx
mov dx, si
cmp ah, 0xd
jo 0x5233f9
bsr cx, dx
jmp 0x5233c5
mov al, byte [esp]
add edi, dword [esi]
mov dl, byte [esp]
bsf eax, ebx
jmp 0x523513
mov edx, edi
jmp 0x5234ec
add edx, reloc.MSVCRT.dll__iob
jle 0x5234d6
movzx ecx, byte [edx]
jmp 0x5234fd
neg edx
lea edx, reloc.MSVCRT.dll__iob
mov eax, dword [esp]
mov ax, bp
jmp 0x523525
jbe 0x523476
mov cl, byte [esp]
jmp 0x5234b1

Function at 0x52e302
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushal
lea edx, [ecx + esi]
popal
call fcn.0052f351
cmp byte [esi - 0x77], ah
invalid
invalid
je 0x52e335
add cl, byte [ebp - 0x76fddb9c]
sbb al, 0x24

Function at 0x52e323
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.0052e30d
push ebp
mov bl, ah
mov ebx, 0x10a92dbc
mov ebx, 0x8dbc1eef
mov bh, bl
jmp 0x52e38a
xchg word [esp], bp
mov si, word [esp + 1]
push ax
mov esi, dword [esp + 4]
mov bx, word [esp]
push ax
jmp 0x52e39f
lea ebx, reloc.MSVCRT.dll__iob
push esi
mov bh, cl
mov bp, 0x5dcd
push dx
mov ebx, dword [esp]
jmp 0x52e36d
lea esp, [esp]
mov byte [esp], dh
bswap ebp
lea ebx, [eax + ecx]
mov bl, bh
lea esp, [esp + 2]
jmp 0x52e452
lea esp, [esp + 0x19]
mov ebx, 0x11c54990
lea esp, [esp + 3]
mov ebx, dword [esp + 0xc]
lea esp, [esp + 0x14]
call fcn.0052e3d8
mov ebp, dword [esp + 8]
pushal
bswap ebx
setg bh
lea ebx, [edx + 0x4f]
pop dword [esp + 6]
jmp 0x52e41b

Function at 0x52e363
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pushfd
pop word [esp]
call fcn.0052e323

Function at 0x52e3d8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov byte [esp + 4], al
push esp
mov dword [esp + 2], ecx
setns cl
not cl
mov cx, bp
jmp 0x52e3f4
push dword [esp + 3]
jmp 0x52e3bc
mov ebx, dword [esp]
mov bl, 0x3e
xchg ecx, ebx
pushfd
xchg byte [esp], ch
mov cl, ch
jmp 0x52e403
bswap ecx
pushfd
pop ecx
push ebx
mov bh, 0x27
lea ebx, reloc.MSVCRT.dll__iob
jmp 0x52e3de
mov dword [esp], eax
xchg ah, al
call fcn.0052e435
sti
inc esi
push esp
sbb eax, 0x5f4afecb
daa
fcmovnbe st(0), st(5)
inc esp
neg esi
Function at 0x5dae8b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call fcn.005d9ae7
mov eax, dword [eax + 0xc]
jmp 0x5dae5b
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
mov eax, dword fs:[0x30]
jmp 0x5dae17
push eax
jmp 0x5d9ae2
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x5dae45
mov word [esp], bp
mov word [esp], bx
jmp 0x5dae2d
Function at 0x408923
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.00408948
push 0xc711415c
mov ecx, dword [esp]
add esp, 4
and ecx, ecx
xor dword [eax], ebx
sub ecx, ecx
and edi, edi
inc eax
cmp eax, esi
jne fcn.00408923
add ecx, edi
ret
Function at 0x407050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push ebx
sub esp, 0x124
mov ebx, dword [esp + 0x130]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x407257
cmp byte [ebx], 0
je 0x407223
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x407248
test al, 0x10
je 0x407223
mov dword [esp + 4], ebx
mov eax, 0x104
lea esi, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x4070c0
and edx, 0x8080
jne 0x4070e6
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
lea edx, [ecx + 0x233]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x407239
mov dword [esp + 4], esi
lea esi, [eax + 0x22c]
mov dword [esp], esi
call sub.ntdll.dll_strcpy
cmp byte [ebx + 0x22c], 0
je 0x4071c0
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x407130
and edx, 0x8080
jne 0x407156
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
cmp byte [ebx + ecx + 0x22b], 0x2f
je 0x4071c0
mov ecx, esi
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x407170
and edx, 0x8080
jne 0x407196
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
cmp byte [ebx + ecx + 0x22b], 0x5c
je 0x4071c0
mov dword [esp], esi
call sub.ntdll.dll_strlen
mov word [eax + esi], 0x5c
lea esi, [esi]
lea edi, [edi]
mov dword [esp], esi
call sub.ntdll.dll_strlen
mov word [eax + esi], 0x2a
mov eax, 0xffffffff
xor edx, edx
mov dword [ebx + 0x224], eax
xor ecx, ecx
xor esi, esi
mov dword [ebx + 0x228], edx
xor eax, eax
mov edx, 0x104
mov dword [ebx + 0x118], ecx
xor ecx, ecx
mov word [ebx + 0x11c], si
lea esi, [ebx + 0x120]
mov word [ebx + 0x11e], ax
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sub.ntdll.dll_memset
add esp, 0x124
mov eax, ebx
pop ebx
pop esi
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
xor eax, eax
add esp, 0x124
pop ebx
pop esi
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x407230
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x407230
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x407230

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
mov eax, 1
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
mov ecx, edi
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x42c2d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x444097
call fcn.00412f37
mov dword [ebp - 8], str.C:workplaces.exe
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.00412af0
mov dword [ebp - 0x14], eax
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00412af0
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x64265dc2
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3362637d
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219