joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cee6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 5]
push edi
mov esi, ecx
xor ebx, ebx
push eax
push 0x421cf5
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.004020e4
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], bl
mov dword [ebp - 0x14], 3
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
push eax
push 1
push ebx
mov dword [ebp - 0x24], 4
push dword [ebp - 0x20]
mov dword [ebp - 0x10], 0x101
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cfd7
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x128]
push eax
push ebx
push ebx
push 0x420c64
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x128]
lea ecx, [esi + 0x6c]
push eax
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x421590
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x40cfac
mov dword [esi + 0x64], 1
jmp 0x40cfaf
mov dword [esi + 0x64], ebx
mov ecx, 0x422a80
call fcn.004031cb
push ebx
mov ecx, esi
mov dword [esi + 0x74], eax
call sub.MFC42.DLL_CWnd::UpdateData
cmp dword [ebp - 0x20], ebx
je 0x40cfd2
push dword [ebp - 0x20]
call sub.MFC42.DLL_operatordelete
pop ecx
push 1
pop eax
jmp 0x40cfe7
cmp dword [ebp - 0x20], ebx
je 0x40cfe5
push dword [ebp - 0x20]
call sub.MFC42.DLL_operatordelete
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cfec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
push dword [esi + 0x74]
mov ecx, 0x422a80
call fcn.00403469
lea eax, [ebp - 1]
xor ebx, ebx
push eax
push 0x421cf5
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], ebx
call fcn.004020e4
lea eax, [ebp - 8]
push eax
push 2
push ebx
push dword [ebp - 0x18]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d08f
mov eax, dword [esi + 0x6c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [eax - 8]
push eax
push 1
push ebx
push 0x420c64
push dword [ebp - 8]
call edi
xor eax, eax
cmp dword [esi + 0x64], ebx
push 4
setne al
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x421590
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
pop edi
je 0x40d08a
push dword [ebp - 0x18]
call sub.MFC42.DLL_operatordelete
pop ecx
push 1
pop eax
jmp 0x40d09f
cmp dword [ebp - 0x18], ebx
je 0x40d09d
push dword [ebp - 0x18]
call sub.MFC42.DLL_operatordelete
pop ecx
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x411d53
Capabilities:
Log keystrokes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp edi, esi
je 0x411db4
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebp, eax
push 1
push ebp
push ebx
call esi
xor eax, eax
push 3
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebp
push ebx
call esi
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x411db7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
je 0x411f97
cmp dword [ebp + 0xc], esi
je 0x411f97
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
mov dword [ebp - 0x48], esi
push esi
rep stosd dword es:[edi], eax
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 8], eax
push 0x2c
lea eax, [ebp - 0x48]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x28
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jle 0x411f97
cmp dword [ebp - 0x34], esi
ja 0x411e3e
movzx eax, word [ebp - 0x3a]
imul eax, dword [ebp - 0x44]
add eax, 0x1f
push 8
and al, 0xe0
pop ecx
cdq
idiv ecx
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0x3a]
dec eax
push ebx
mov dword [ebp - 0x38], esi
je 0x411e62
sub eax, 3
je 0x411e5e
sub eax, 4
je 0x411e57
xor ebx, ebx
jmp 0x411e65
mov ebx, pe_nt_image_headers32
jmp 0x411e65
push 0x10
jmp 0x411e64
push 2
pop ebx
lea eax, [ebx*4 + 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
lea eax, [ebx*4 + 0x2c]
push eax
push esi
push edi
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x48]
push 0x28
push eax
push edi
call sub.MSVCRT.dll_memcpy
push dword [ebp - 0x34]
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0x20
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x411f78
push esi
push edi
push eax
push dword [edi + 8]
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x4216c4
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
je 0x411f9b
mov eax, dword [ebp - 0x34]
mov word [ebp - 0x16], si
add eax, 0x36
cmp ebx, esi
mov word [ebp - 0x14], si
mov dword [ebp - 0x1a], eax
jle 0x411ef0
lea eax, [eax + ebx*4]
mov dword [ebp - 0x1a], eax
cmp ebx, esi
mov word [ebp - 0x1c], 0x4d42
mov dword [ebp - 0x12], 0x36
jle 0x411f0b
lea eax, [ebx*4 + 0x36]
mov dword [ebp - 0x12], eax
push dword [ebp - 4]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [ebp - 0x1c]
push 1
push 0xe
push eax
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x48]
push 1
push 0x28
push eax
call esi
add esp, 0x20
test ebx, ebx
jle 0x411f53
shl ebx, 2
lea eax, [edi + 0x2c]
push ebx
push 0x80
push eax
call sub.MSVCRT.dll_memset
push dword [ebp - 4]
lea eax, [edi + 0x2c]
push 1
push ebx
push eax
call esi
add esp, 0x1c
push dword [ebp - 4]
push 1
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
add esp, 0x14
test edi, edi
je 0x411f76
push edi
call esi
pop ecx
xor esi, esi
cmp dword [ebp - 8], esi
pop ebx
je 0x411f88
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 4], esi
je 0x411f97
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop edi
pop esi
leave
ret
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.MSVCRT.dll_free]
call ebx
cmp edi, esi
pop ecx
je 0x411f78
push edi
call ebx
pop ecx
jmp 0x411f78
Function at 0x4189c4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x418b73
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x418b73
call fcn.004188f1
cmp byte [eax + 0x16], 0
jne 0x418a00
cmp byte [eax + 0x15], 0
jne 0x418a00
mov ecx, eax
call fcn.0041909c
and byte [ebp - 0x12c], 0
push ebx
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
mov ebx, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x12c]
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push eax
call fcn.00418957
add esp, 0xc
push dword [eax]
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [ebp - 0xc]
call fcn.00416a21
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
mov esi, 0x4224c8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.004020e4
lea eax, [ebp + 0xf]
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.004020e4
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
je 0x418b61
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x418b59
push ebx
lea eax, [ebp - 0x230]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x230]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov dword [ebp + 0xc], 0x4218bc
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x418b00
add dword [ebp + 0xc], 4
cmp dword [ebp + 0xc], 0x4218c4
jb 0x418adb
jmp 0x418b59
lea eax, [ebp - 0x12c]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xc]
push dword [ebp - 0x10]
push eax
call fcn.00418957
lea ecx, [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
je 0x418b3d
lea ecx, [ebp + 0xb]
push ecx
lea ecx, [ebp - 0x1c]
push dword [eax + 4]
push dword [eax]
call fcn.0040152a
mov eax, dword [ebp - 4]
lea ecx, [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0xc]
call fcn.0040149b
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 2
push edi
jmp 0x418a95
lea ecx, [ebp - 0x1c]
call fcn.00416a21
lea ecx, [ebp - 0x28]
call fcn.00416a21
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41909c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
mov esi, ecx
push edi
and dword [esi + 0x10], 0
lea ebx, [esi + 0x18]
mov byte [esi + 0x14], 1
mov byte [esi + 0x15], 1
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x4190cf
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x24]
cmp eax, dword [edi + 4]
jne 0x4191b3
and byte [ebp - 0x118], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 1]
lea ecx, [ebp - 0x10]
push eax
call fcn.004037f7
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x118]
mov cl, byte [ebp - 1]
mov byte [ebp - 2], cl
lea ecx, [ebp - 2]
push ecx
push eax
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x10]
push eax
call fcn.00402228
push 0xffffffffffffffff
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.00417ffc
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x419157
lea ecx, [ebp - 0x10]
call fcn.00416a21
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebx]
cmp ecx, dword [ebx + 4]
jne 0x41916c
push eax
lea eax, [ebp - 0x10]
push 0
push eax
mov ecx, ebx
call fcn.00416a2f
mov eax, dword [esi + 0x24]
lea edi, [esi + 0x24]
cmp eax, dword [edi + 4]
jne 0x4191ab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 0x10]
dec ecx
inc eax
push ecx
push eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00416a2f
push 0xffffffffffffffff
push 0x2e
mov ecx, edi
call fcn.00417ffc
cmp eax, 0xffffffff
je 0x4191ab
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.00410546
lea ecx, [ebp - 0x10]
call fcn.00416a21
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x419150
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x419150
cmp dword [esi + 0x30], 0x1fffffff
jne 0x4191e9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
cmp ax, 0x804
setne cl
dec ecx
and ecx, 0x3fb
add ecx, 0x409
mov dword [esi + 0x30], ecx
push dword [esi + 0x30]
mov ecx, esi
push edi
call fcn.00419218
jmp 0x419152
Function at 0x41a635
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi + 0x18], ecx
lea ecx, [ebp + 0xc]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x14]
push ecx
push ebx
push eax
mov byte [esi + 0x1d], 1
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
mov dword [eax], esi
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x41a679
push 1
mov byte [esi + 0x1d], bl
pop eax
jmp 0x41a681
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41a6aa
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x1d], bl
je 0x41a6e9
cmp dword [esi + 8], ebx
je 0x41a6e9
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x41a6e9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 4]
call fcn.0041a778
pop ecx
mov dword [esi + 8], ebx
mov byte [esi + 0x1d], bl
pop esi
pop ebx
ret

Function at 0x41a727
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
jne 0x41a734
mov al, 1
jmp 0x41a770
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, eax
push 0x32
call edi
cmp byte [esi + 0x1d], 0
je 0x41a76a
cmp dword [esp + 0x14], 0xffffffff
je 0x41a762
call ebp
sub eax, ebx
cmp eax, dword [esp + 0x14]
ja 0x41a766
push 0x32
jmp 0x41a749
cmp byte [esi + 0x1d], 0
pop edi
pop ebp
sete al
pop ebx
pop esi
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407a34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x407a54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040ab18
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x407a75
test byte [esp + 8], 2
je 0x407a75
mov dword [0x40f654], 0xd
mov dword [0x40f658], 5
jmp 0x407a50
xor eax, eax
ret

Function at 0x408571
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40ec78
cmp edx, dword [eax]
je 0x408593
add eax, 8
inc ecx
cmp eax, 0x40ed08
jl 0x408584
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40ec78]
jne 0x4086c1
mov eax, dword [0x40f64c]
cmp eax, 1
je 0x40869b
test eax, eax
jne 0x4085c4
cmp dword [0x40e5f4], 1
je 0x40869b
cmp edx, 0xfc
je 0x4086c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4085fb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409210
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004051c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40863e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004051c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c78c
push edi
call fcn.0040a4f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409210
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409220
lea eax, [ebp - 0xa0]
push 0x40c76c
push eax
call fcn.00409220
push dword [esi + 0x40ec7c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409220
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040ac47
add esp, 0x2c
pop edi
jmp 0x4086c1
lea eax, [ebp + 8]
lea esi, [esi + 0x40ec7c]
push 0
push eax
push dword [esi]
call fcn.004051c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x2d43700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d4378f
jae 0x2d4370e
xor ecx, ecx
call fcn.02d4378f
jae 0x2d4373d
xor eax, eax
call fcn.02d4378f
jae 0x2d4374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d4378f
adc al, al
jae 0x2d4372f
jne 0x2d43779
stosb byte es:[edi], al
jmp 0x2d43711
call fcn.02d4379b
sub ecx, ebx
jne 0x2d43756
call fcn.02d43799
jmp 0x2d43775
lodsb al, byte [esi]
shr eax, 1
je 0x2d43783
adc ecx, ecx
jmp 0x2d43772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d43799
cmp eax, 0x7d00
jae 0x2d43772
cmp ah, 5
jae 0x2d43773
cmp eax, 0x7f
ja 0x2d43774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d43711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x43b64b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
or eax, ebx
sub ebx, 0xfcffb7b9
sub eax, 0x4213784f
call fcn.0043b698
add ebx, eax
push ebx
pop ebx
add ebx, 0xb17c5739
xor dword [esi], edi
add eax, 0x8f0e7844
sub eax, eax
inc esi
add eax, ebx
or ebx, ebx
cmp esi, edx
jne fcn.0043b64b
add eax, 1
add eax, ebx
mov eax, 0x1af68455
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x8fb4040
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x7ccd7724
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x101d198
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001dfb8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10027030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
and dword [esp + 0x18], 0
push 0x1002282c
lea eax, [esp + 0x1c]
push eax
call fcn.01023578
and dword [esp + 0x30], 0
mov esi, 0x10022808
push esi
lea eax, [esp + 0x18]
push eax
call fcn.01023578
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
lea ebx, [edi + 0x2c]
push eax
mov byte [esp + 0x38], 1
call fcn.01024312
mov ecx, eax
add ecx, 4
call fcn.01024059
mov edi, eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.01018f4b
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.01018f4b
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
test eax, 0xfffffffc
jne 0x101d251
push 0x10022280
push dword [ebp + 8]
call fcn.01023578
mov eax, dword [ebp + 8]
jmp 0x101d2ff
push 0x10022840
lea eax, [esp + 0x24]
push eax
call fcn.01023578
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x38], 2
call fcn.01023578
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x38], 3
call fcn.01024312
mov ecx, eax
add ecx, 4
call fcn.01024059
mov esi, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.01018f4b
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.01018f4b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x101d2d6
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 2
test eax, eax
jbe 0x101d2d3
mov eax, dword [esi + 0xc]
push dword [eax]
call fcn.010294ce
pop ecx
mov dword [ebx], eax
jmp 0x101d2d6
and dword [ebx], 0
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
sar eax, 2
test eax, eax
ja 0x101d2e8
call fcn.0102a741
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
sub eax, 0x10
call fcn.010259c9
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8