joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a1b0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x4433ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
mov esi, ecx
lea ecx, [ebp - 0x43]
push ebx
push ecx
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0x44], bl
call fcn.00423450
push 0x3f
lea edx, [ebp - 0xe3]
push ebx
push edx
mov byte [ebp - 0xe4], bl
call fcn.00423450
push 0x3f
lea eax, [ebp - 0x83]
push ebx
push eax
call fcn.00423450
add esp, 0x24
xor eax, eax
jmp 0x41a210
mov ecx, eax
shr ecx, 3
movsx edx, byte [ecx + esi]
mov ecx, eax
and ecx, 7
shl edx, cl
inc eax
sar edx, 7
and dl, 1
mov byte [ebp + eax - 0x45], dl
cmp eax, 0x40
jb 0x41a210
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x44]
call fcn.0041a590
mov ecx, 8
lea esi, [ebp - 0xe4]
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [ebp - 0xc4]
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edx, dword [ebp - 0xe8]
lea eax, [ebp - 0xa4]
push eax
mov ecx, esi
lea ebx, [ebp - 0x24]
call fcn.0041a330
inc esi
cmp esi, 0x10
jl 0x41a263
mov ecx, 8
lea esi, [ebp - 0xa4]
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
mov esi, ebx
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsx ecx, byte [eax + 0x43c7f8]
movzx edx, byte [ebp + ecx - 0x85]
mov ecx, dword [ebp - 0xe8]
mov byte [ecx + eax + 0x600], dl
movsx edx, byte [eax + 0x43c7f9]
movzx edx, byte [ebp + edx - 0x85]
mov byte [ecx + eax + 0x601], dl
movsx edx, byte [eax + 0x43c7fa]
movzx edx, byte [ebp + edx - 0x85]
mov byte [ecx + eax + 0x602], dl
movsx edx, byte [eax + 0x43c7fb]
movzx edx, byte [ebp + edx - 0x85]
mov byte [ecx + eax + 0x603], dl
add eax, 4
cmp eax, 0x40
jl 0x41a2a1
mov eax, ecx
lea edi, [eax + 0x600]
lea esi, [eax + 0x680]
call fcn.0041a810
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b499
mov esp, ebp
pop ebp
ret 4
Function at 0x41a590
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, str.:2_
mov edi, 0x43c569
mov edx, 0x43c56a
mov ebx, 0x43c56b
sub esi, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x10
nop
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
mov ebx, dword [ebp - 8]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
dec dword [ebp - 4]
jne 0x41a5c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a610
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, 0x43c5ab
sub ebx, eax
mov dword [ebp - 8], ebx
push esi
mov ebx, 0x43c5ac
sub ebx, eax
push edi
mov dword [ebp - 0xc], ebx
mov esi, 0x43c5a8
mov edi, 0x43c5a9
mov edx, 0x43c5aa
mov ebx, 0x43c5ad
sub esi, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 8
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
mov ebx, dword [ebp - 8]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
mov ebx, dword [ebp - 0xc]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 4], bl
mov ebx, dword [ebp - 0x10]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 5], bl
add eax, 6
dec dword [ebp - 4]
jne 0x41a653
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a790
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, 0x43c7d8
mov edi, 0x43c7d9
mov edx, 0x43c7da
mov ebx, 0x43c7db
sub esi, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 8
nop
movsx ebx, byte [esi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
movsx ebx, byte [edi + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 1], bl
movsx ebx, byte [edx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 2], bl
mov ebx, dword [ebp - 8]
movsx ebx, byte [ebx + eax]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax + 3], bl
add eax, 4
dec dword [ebp - 4]
jne 0x41a7c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b499
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4433ec]
jne 0x41b4a3
repz ret
jmp fcn.0042018f
Function at 0x42d33f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4433ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004202f4
and dword [ebp - 0x14], 0
cmp dword [0x445ee8], 0
mov dword [ebp - 0x18], eax
jne 0x42d3f2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42d49a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x42d49a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x445ee8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x445eec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x445ef0], eax
call edi
push eax
call esi
mov dword [0x445ef8], eax
test eax, eax
je 0x42d3f2
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x445ef4], eax
mov eax, dword [0x445ef4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42d44b
cmp dword [0x445ef8], ecx
je 0x42d44b
push eax
call esi
push dword [0x445ef8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42d44b
test ebx, ebx
je 0x42d44b
call edi
test eax, eax
je 0x42d442
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42d442
test byte [ebp - 8], 1
jne 0x42d44b
or dword [ebp + 0x10], 0x200000
jmp 0x42d47e
mov eax, dword [0x445eec]
cmp eax, dword [ebp - 0x18]
je 0x42d47e
push eax
call esi
test eax, eax
je 0x42d47e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42d47e
mov eax, dword [0x445ef0]
cmp eax, dword [ebp - 0x18]
je 0x42d47e
push eax
call esi
test eax, eax
je 0x42d47e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x445ee8]
call esi
test eax, eax
je 0x42d49a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42d49c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b499
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5e50bdc
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
mov eax, str.__a
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7d6153b
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403460
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x403486
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40351a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4034d5
cmp eax, 0x40
je 0x4034d5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x403479
cmp eax, 0x40
je 0x403479
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x403479
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x403a48
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x40bab8]
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x403a84
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x28], eax
add esp, 0x14
pop ebx
leave
ret
call sym._GetLastError_0
jmp 0x403a72
Function at 0x403ba8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x403bd1
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x403c98
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x403cbc
cmp edi, 5
je 0x403cc1
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x403c5b
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call dword [ebp - 0x2c]
mov edi, eax
cmp eax, 7
je 0x403cc1
cmp eax, 8
jne 0x403cbc
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403cac
test edx, edx
je 0x403bc8
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
jne 0x403bcb
call sym._GetLastError_0
jmp 0x403bcb
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x403be6
call dbg.fc_key_init_once
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
jmp 0x403c6b
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x403d38
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403da8
test edx, edx
jne 0x403d84
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x403db7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x403d57
call dbg.fc_key_init_once
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
jmp 0x403d50
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
lea esi, [esi]
Function at 0x403e9c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x403f81
test edx, edx
jne 0x403f20
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x403f13
lea esi, [ebp - 0x20]
jmp 0x403ed3
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x403f0a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x403f48
cmp eax, 8
jne 0x403f74
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x403ed0
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x403ebf
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x403f18
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call dbg.fc_key_init_once
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
jmp 0x403eb8

Function at 0x403f94
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x403fb8
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40400c
test edx, edx
jne 0x403fe8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40401c
call sym._abort
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x403fcb
call dbg.fc_key_init_once
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
jmp 0x403fc4
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
Function at 0x4040b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40413c
test edx, edx
jne 0x404118
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x4040fc
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x40410d
call sym._abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x4040f5
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x4040d7
call dbg.fc_key_init_once
mov eax, dword [0x40bab8]
mov edx, dword [eax + 0x28]
jmp 0x4040d0
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x70d8519c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x1777cbd
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403bfc
Capabilities:
Encrypt data using tea

Disassembly:
sub esp, 0x28
and dword [esp + 8], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], edi
mov eax, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x30], eax
call fcn.00403287
mov ebx, dword [esp + 0x18]
mov eax, dword [esi + 0xc]
add ebx, 0x23f
mov edi, dword [esi + 8]
push 0x20
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], eax
pop esi
mov dword [esp + 0x20], 2
add dword [esp + 0x20], 3
mov edx, dword [esp + 0x1c]
mov eax, edx
shl eax, 4
add eax, edi
mov dword [esp + 0x24], 0xedeb2e40
cmp dword [0x67e9a4], 0xfa9
mov dword [esp + 0x10], eax
lea ecx, [ebx + edx]
mov eax, dword [0x67e9e8]
cmove eax, dword [esp + 0x24]
and dword [esp + 0x24], 0
cmp dword [0x67e9a4], 0x3eb
mov dword [0x67e9e8], eax
mov eax, dword [0x67e9f0]
cmove eax, dword [esp + 0x24]
mov dword [0x67e9f0], eax
mov eax, dword [esp + 0x1c]
shr eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x28]
xor eax, ecx
mov dword [0x67e9ec], 0xf4ea3dee
xor eax, dword [esp + 0x10]
sub ebp, eax
mov dword [esp + 0x14], eax
mov eax, ebp
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
mov eax, ebp
shr eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
add dword [esp + 0x14], eax
lea eax, [ebx + ebp]
xor eax, dword [esp + 0x14]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov edx, 0x9e3779b9
lea ecx, [esp + 0x18]
call fcn.00403bf0
dec esi
je 0x403d20
mov ebx, dword [esp + 0x18]
jmp 0x403c4a
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], ebp
mov dword [edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x41419f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407a86
mov dword [ebp - 0x14], eax
cmp dword [0x67fb64], esi
jne 0x414292
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41421f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x414372
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x414372
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414372
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x67fb64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x67fb68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x67fb6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x67fb74], eax
test eax, eax
je 0x41428f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x67fb70], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4142b7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4142aa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4142cc
push 4
pop eax
jmp 0x414374
cmp dword [ebp - 0x14], esi
je 0x4142cc
push dword [0x67fb64]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4142b1
mov eax, dword [0x67fb70]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41432a
cmp dword [0x67fb74], edi
je 0x41432a
push eax
call ebx
push dword [0x67fb74]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41432a
test eax, eax
je 0x41432a
call ecx
test eax, eax
je 0x41431f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41431f
test byte [ebp - 8], 1
jne 0x41432a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41435a
mov eax, dword [0x67fb68]
cmp eax, edi
je 0x414357
push eax
call ebx
test eax, eax
je 0x414357
call eax
mov esi, eax
test esi, esi
je 0x414357
mov eax, dword [0x67fb6c]
cmp eax, edi
je 0x414357
push eax
call ebx
test eax, eax
je 0x414357
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x67fb64]
call ebx
test eax, eax
je 0x414372
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x414374
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406cc0
mov esp, ebp
pop ebp
ret