joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107be892
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ecx
jmp 0x108a138e
inc ecx
jmp 0x1085683a
xor ecx, 0x434925ce
jmp 0x10361219
inc ecx
cmp cl, 0x69
jmp 0x10749a8d
dec ecx
stc
jmp 0x1037e487
xor ebx, ecx
add ebp, ecx
jmp 0x1077a6df
jmp ebp
push ebp
push ecx
movzx ecx, sp
push ebx
movsx ebx, dx
xchg bl, ch
push edi
mov bx, si
movzx bx, dl
movsx edi, sp
push edx
cdq
push eax
cwde
rdtsc
push esi
pushfd
mov di, 0x1753
rdtsc
cdq
mov edx, 0
push edx
movzx edi, bx
mov edi, dword [esp + 0x28]
mov bl, 0xdf
inc edi
test sp, dx
add si, 0x7667
xor edi, 0x2c107e9c
dec edi
movsx ebp, bp
rol ax, 0x52
not edi
mov ebp, 0x5815555a
mov si, ax
rol edi, 1
btc ebx, esi
sal ch, cl
lea edi, [edi + edx]
adc ah, dh
mov esi, esp
sub esp, 0xc0
neg ch
shld ecx, edi, 0xa
mov ebx, edi
mov eax, 0
sub ebx, eax
lea ebp, [0x107be90a]
bswap cx
add ecx, 0x30650654
mov ecx, dword [edi]
add edi, 4
test esp, 0x1aa25e04
stc
jmp 0x1087d627
not ecx
jmp 0x103d2a38
xor ecx, ebx
cmp edx, 0x66f710e6
test dh, bl
add ecx, 0x6e382317
jmp 0x10358454
dec ecx
neg ecx
jmp 0x10441e8c
Function at 0x45559d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x4555ad
lea esi, [ecx - 0x9a]
jmp 0x4555af
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x4555e3
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x4555d4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4555e9
cmp dword [ebp + 0xc], 0
jne 0x4555e3
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x455601
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x9a]
call fcn.004550f3
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x4558c6
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c20c8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c20cc]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
cmp eax, 3
je 0x45590e
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
jmp 0x45594f
push 8
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004840d0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x45593b
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jmp 0x455941
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp eax, esi
ja 0x455963
jb 0x45594f
cmp ecx, 0x400
jae 0x455963
push ecx
push str._d_Bytes
push ebx
call fcn.0041cbb1
add esp, 0xc
jmp 0x455a37
push edi
cmp eax, esi
ja 0x4559f0
jb 0x455976
cmp ecx, 0x100000
jae 0x4559ac
push esi
mov edi, ecx
push 0x64
shrd edi, eax, 0xa
and ecx, 0x3ff
push esi
shr eax, 0xa
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a4f0
mov ecx, eax
or ecx, edx
jne 0x4559a0
push edi
push str._d_KB
jmp 0x455a1b
push eax
push edi
push str._d._d_KB
jmp 0x455a2d
cmp eax, esi
ja 0x4559f0
jb 0x4559ba
cmp ecx, 0x40000000
jae 0x4559f0
push esi
mov edi, ecx
push 0x19000
shrd edi, eax, 0x14
and ecx, 0xfffff
push esi
shr eax, 0x14
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a4f0
mov ecx, eax
or ecx, edx
jne 0x4559e7
push edi
push str._d_MB
jmp 0x455a1b
push eax
push edi
push str._d._d_MB
jmp 0x455a2d
push esi
mov edi, ecx
push 0x6400000
shrd edi, eax, 0x1e
and ecx, 0x3fffffff
push esi
shr eax, 0x1e
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a4f0
mov ecx, eax
or ecx, edx
jne 0x455a26
push edi
push str._d_GB
push ebx
call fcn.0041cbb1
add esp, 0xc
jmp 0x455a36
push eax
push edi
push str._d._d_GB
push ebx
call fcn.0041cbb1
add esp, 0x10
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004841c7
leave
ret 8
Function at 0x45a420
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x4b956d
call fcn.00484f9f
mov esi, ecx
push str.ck_W_vN
lea ecx, [ebp - 0x10]
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x64
mov ecx, 0x4ebc68
call fcn.0041bf4a
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040dd20
push 0xd
push 0x7d0
call fcn.0044723e
push 0
push 0x79
call fcn.0044736d
fld dword [0x4c4c80]
add esp, 0xc
lea ecx, [esi + 0x276]
fstp dword [esp]
call fcn.00458c13
cmp dword [esi + 0x40f], 0
je 0x45a461
mov dword [esi + 0x40b], 1
jmp 0x45a493
mov eax, dword [esi + 0x92]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x45a48c
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0045a05f
jmp 0x45a493
mov ecx, esi
call fcn.00458b28
call fcn.00485077
ret
Function at 0x45a609
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0x254
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x254], eax
push 0xc
mov eax, 0x4b95bb
call fcn.00484f9f
xor ebx, ebx
push 0x250
lea eax, [ebp + 4]
push ebx
push eax
mov esi, ecx
mov dword [ebp], ebx
call fcn.004840d0
add esp, 0xc
lea eax, [ebp]
push eax
lea ecx, [esi + 0x353]
call fcn.0046c450
cmp dword [ebp + 0xc], ebx
ja 0x45a664
cmp dword [ebp + 8], 1
jb 0x45a801
push 0x2711
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shrd eax, ecx, 0xa
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
shr ecx, 0xa
mov ecx, dword [ebp + 0x14]
shrd eax, ecx, 0xa
mov dword [ebp - 0x14], eax
shr ecx, 0xa
fild dword [ebp - 0x14]
fidiv dword [ebp - 0x18]
fld dword [esi + 0x3eb]
fsubr qword [0x4c0cc8]
fmulp st(1)
call fcn.0048dae0
cmp dword [esi + 0x407], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 0x10], edi
jne 0x45a6c6
call ebx
mov dword [esi + 0x407], eax
call ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [esi + 0x3ff]
jne 0x45a6fb
cmp edx, dword [esi + 0x403]
jne 0x45a6fb
sub eax, dword [esi + 0x407]
xor edx, edx
mov ecx, 0x3e8
div ecx
cmp eax, 0x5a
jb 0x45a70d
mov ecx, esi
call fcn.0045a5b5
jmp 0x45a70d
mov dword [esi + 0x407], eax
mov dword [esi + 0x3ff], ecx
mov dword [esi + 0x403], edx
cmp edi, 0x3c
jl 0x45a73b
lea eax, [esi + 0x3f7]
cmp dword [eax], 0
jne 0x45a73b
push 0xc
push 0x7d0
mov dword [eax], 1
call fcn.0044723e
push 0
push 0x78
call fcn.0044736d
add esp, 0x10
cmp edi, dword [esi + 0x3df]
je 0x45a775
fild dword [ebp - 0x10]
push ecx
lea ecx, [esi + 0x276]
fadd dword [esi + 0x3eb]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp dword [esp]
call fcn.00458c13
push edi
push 1
lea ecx, [esi + 0x574]
mov dword [esi + 0x3df], edi
call fcn.00440f8a
push str.ck_W_vN
lea ecx, [ebp - 0x10]
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push edi
mov ecx, 0x4ebc68
call fcn.0041bf4a
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 0x3ff
and edx, ecx
add eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x14]
cdq
and edx, ecx
add eax, edx
mov edi, eax
sar edi, 0xa
lea eax, [esi + 0x3e3]
sar ebx, 0xa
cmp edi, dword [eax]
je 0x45a801
push 0x4ecda4
lea ecx, [ebp - 0x14]
mov dword [eax], edi
call fcn.0040ba90
push ebx
push edi
lea eax, [ebp - 0x14]
push 0x90
push eax
mov dword [ebp - 4], 1
call fcn.00455b29
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x254]
xor ecx, ebp
call fcn.004841c7
add ebp, 0x258
leave
ret
Function at 0x45a964
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 4
mov eax, 0x4b9650
call fcn.00484f9f
mov esi, ecx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x45a980
xor eax, eax
jmp 0x45ab6c
mov ecx, dword [eax]
cmp ecx, 0xe16
jne 0x45aab7
push 0
push 1
push 0x4ec298
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x45ab69
mov eax, dword [esi + 0x92]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
test eax, eax
je 0x45aa0b
cmp dword [esi + 0x3a3], 0
jne 0x45aa0b
lea eax, [ebp + 0xc]
lea edi, [esi + 0x353]
push eax
mov ecx, edi
call fcn.0046c5c7
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.0040dd20
test ebx, ebx
je 0x45aa0b
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0046c5c7
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040dd20
cmp dword [esi + 0x34b], 0x63
mov edi, 0x4ebc68
jg 0x45aa54
push 0x4c30c8
lea ecx, [ebp + 0xc]
mov dword [esi + 0x34b], 0x64
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x34b]
mov ecx, edi
call fcn.0041bf4a
mov ecx, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040dd20
call fcn.00446f6f
test eax, eax
jne 0x45aa8a
call fcn.00447064
test eax, eax
jne 0x45aa8a
inc eax
mov dword [esi + 0x3db], eax
push eax
add esi, 0x3a7
push esi
mov ecx, edi
call fcn.0041bf6d
push 2
mov ecx, edi
call fcn.0041bf84
jmp 0x45a979
push 2
mov ecx, edi
mov dword [esi + 0x3db], 1
call fcn.0041bf84
push 0
push 0xbb8
push 0x2714
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x45a979
cmp ecx, 0xe15
jne 0x45ab2d
mov edi, dword [eax + 8]
test edi, edi
je 0x45ab23
cmp dword [edi], 0x61
jb 0x45aaf4
push 0x4c30c8
lea ecx, [ebp + 0xc]
call fcn.0040b680
lea eax, [ebp + 0xc]
push eax
push dword [edi]
mov ecx, 0x4ebc68
mov dword [ebp - 4], 1
call fcn.0041bf4a
mov ecx, dword [ebp + 0xc]
jmp 0x45ab1b
push str.ck_W
lea ecx, [ebp - 0x10]
call fcn.0040b680
lea eax, [ebp - 0x10]
push eax
push dword [edi]
mov ecx, 0x4ebc68
mov dword [ebp - 4], 2
call fcn.0041bf4a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, dword [edi]
mov dword [esi + 0x34b], eax
jmp 0x45ab69
cmp ecx, 0xe17
jne 0x45ab45
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, esi
call fcn.004588f3
jmp 0x45ab69
cmp ecx, 0xe13
jne 0x45ab69
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, esi
call fcn.004588f3
push 0x21
call fcn.0041b962
mov ecx, eax
call fcn.00474f5d
xor eax, eax
inc eax
call fcn.00485077
ret 8
Function at 0x45e53f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x45e54f
lea esi, [ecx - 0x9a]
jmp 0x45e551
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x45e585
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x45e576
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45e58b
cmp dword [ebp + 0xc], 0
jne 0x45e585
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x45e5a3
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x9a]
call fcn.0045da1d
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x45e7d5
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c20c8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c20cc]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
cmp eax, 3
je 0x45e81d
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
jmp 0x45e85e
push 8
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004840d0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x45e84a
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jmp 0x45e850
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp eax, esi
ja 0x45e872
jb 0x45e85e
cmp ecx, 0x400
jae 0x45e872
push ecx
push str._d_Bytes
push ebx
call fcn.0041cbb1
add esp, 0xc
jmp 0x45e946
push edi
cmp eax, esi
ja 0x45e8ff
jb 0x45e885
cmp ecx, 0x100000
jae 0x45e8bb
push esi
mov edi, ecx
push 0x64
shrd edi, eax, 0xa
and ecx, 0x3ff
push esi
shr eax, 0xa
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a4f0
mov ecx, eax
or ecx, edx
jne 0x45e8af
push edi
push str._d_KB
jmp 0x45e92a
push eax
push edi
push str._d._d_KB
jmp 0x45e93c
cmp eax, esi
ja 0x45e8ff
jb 0x45e8c9
cmp ecx, 0x40000000
jae 0x45e8ff
push esi
mov edi, ecx
push 0x19000
shrd edi, eax, 0x14
and ecx, 0xfffff
push esi
shr eax, 0x14
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a4f0
mov ecx, eax
or ecx, edx
jne 0x45e8f6
push edi
push str._d_MB
jmp 0x45e92a
push eax
push edi
push str._d._d_MB
jmp 0x45e93c
push esi
mov edi, ecx
push 0x6400000
shrd edi, eax, 0x1e
and ecx, 0x3fffffff
push esi
shr eax, 0x1e
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a4f0
mov ecx, eax
or ecx, edx
jne 0x45e935
push edi
push str._d_GB
push ebx
call fcn.0041cbb1
add esp, 0xc
jmp 0x45e945
push eax
push edi
push str._d._d_GB
push ebx
call fcn.0041cbb1
add esp, 0x10
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004841c7
leave
ret 8
Function at 0x46b89d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x4c5fd0
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
test eax, eax
je 0x46b906
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46b8e7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Q360InstallerMainWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x46b908
push edi
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 4]
call fcn.0046b779
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
leave
ret 0xc

Function at 0x46c367
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x46c350
push eax
push eax
mov dword [ebp - 4], eax
call fcn.0048e60c
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
leave
ret

Function at 0x46ca0e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 0x46c9f7
push eax
push eax
mov dword [ebp - 4], eax
mov dword [esi + 0x4c], eax
call fcn.0048e60c
mov dword [esi + 0x20], eax
add esp, 0x18
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x8596ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0085976e
jae 0x8596fb
xor ecx, ecx
call fcn.0085976e
jae 0x859725
xor eax, eax
call fcn.0085976e
jae 0x859736
mov al, 0x10
call fcn.0085976e
adc al, al
jae 0x859717
jne 0x859763
stosb byte es:[edi], al
jmp 0x8596fc
call fcn.0085977a
dec ecx
loop 0x859742
mov eax, ebp
call fcn.00859778
jmp 0x859764
lodsb al, byte [esi]
shr eax, 1
je 0x85978a
adc ecx, 2
mov ebp, eax
jmp 0x859764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00859778
cmp eax, 0x7d00
jae 0x859762
cmp eax, 0x500
jae 0x859763
cmp eax, 0x7f
ja 0x859764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8596fc
pop ebp
ret 8
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4b9320
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x76000]
push edi
jmp 0x4b933a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b9341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9330
mov eax, 1
add ebx, ebx
jne 0x4b9353
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b9364
jne 0x4b9383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9383
dec eax
add ebx, ebx
jne 0x4b9370
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b9348
add ebx, ebx
jne 0x4b937f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b93d5
xor ecx, ecx
sub eax, 3
jb 0x4b939b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b940a
sar eax, 1
mov ebp, eax
jmp 0x4b93a6
add ebx, ebx
jne 0x4b93a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9374
inc ecx
add ebx, ebx
jne 0x4b93b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9374
add ebx, ebx
jne 0x4b93c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b93b6
jne 0x4b93d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b93b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b93f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b93e6
jmp 0x4b9336
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b93f4
add edi, ecx
jmp 0x4b9336
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b9412
cmp byte [edi], 0x13
jne 0x4b9412
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b9417
lea edi, [esi + 0xb5000]
mov eax, dword [edi]
or eax, eax
je 0x4b948f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc011c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc0270]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b9444
mov ecx, edi
jns 0x4b9473
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc0274]
or eax, eax
je 0x4b9489
mov dword [ebx], eax
add ebx, 4
jmp 0x4b9461
call dword [esi + 0xc0284]
mov ebp, dword [esi + 0xc0278]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b94c3
sub esp, 0xffffff80
jmp 0x4165c1