joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43052e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x4836dc]
call fcn.0043a2e4
mov esi, eax
test esi, esi
je 0x430608
cmp dword [ebp + 0xc], 0
je 0x43057a
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x43056b
cmp dword [esi + 0x1c], 0
jne 0x43056b
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x430608
test byte [ebp + 0x10], 3
je 0x430595
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00430f99
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x4305ba
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x4305ce
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x4305eb
test ebx, ebx
je 0x4305df
push 8
jmp 0x4305f1
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x4305fe
test ebx, ebx
je 0x4305f4
push 3
pop ecx
jmp 0x4305fe
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x43112c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4311c4
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4311c1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4311c1
lea eax, [esi - 1]
push eax
push dword [0x4836dc]
call fcn.0043a2e4
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4311c3
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4311b8
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x4312ab
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x43119e
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x43126a
push eax
call esi
test al, al
jns 0x43126a
push 0x11
call esi
test al, al
js 0x43126a
push 0x10
call esi
test al, al
js 0x43126a
push 0x12
call esi
test al, al
js 0x43126a
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x43126a
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x43123e
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x431255
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x4312b5
lea eax, [esp + 0x18]
push 0x475944
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4312b5
test ebp, ebp
je 0x43128e
push 0x11
call esi
test al, al
js 0x431286
push 0x10
call esi
test al, al
js 0x431286
push 0x12
call esi
test al, al
jns 0x43128e
push 1
push ebp
call fcn.004312c1
test ebx, ebx
je 0x4312a2
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4312b5
test edi, edi
je 0x4312b5
mov eax, dword [edi + 8]
jmp 0x4312b7
and dword [esp + 0x14], 0
jmp 0x4311c3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x431521
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x483314]
push esi
test eax, eax
jne 0x431546
push fcn.0043164e
push 0x10
push 0x258
call fcn.0043a38d
mov dword [0x483314], eax
push dword [esp + 0xc]
push eax
call fcn.0043a30c
mov esi, eax
test esi, esi
je 0x431647
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x431568
mov edi, 0x47500c
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x431578
xor eax, eax
cmp word [ebx], ax
jne 0x43157d
mov ebx, 0x47596c
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x482c34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x43162e
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x4315de
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x4315e2
push 0x475974
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x4315e2
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x431606
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x43161c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x43161a
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x482c34]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x431645
cmp dword [esp + 0x14], 0xffffffff
je 0x431639
mov esi, dword [esp + 0x14]
push esi
push dword [0x483314]
call fcn.0043a2aa
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x4316c4
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x43180c
xor ecx, ecx
cmp word [eax], cx
je 0x43180c
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x43171d
cmp eax, 3
jne 0x431757
cmp word [esp + 0xa], 0x3a
jne 0x431757
cmp eax, 2
jne 0x43173b
lea eax, [esp + 8]
push 0x475974
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x43180c
push 0xfffffffffffffffe
pop edi
jmp 0x43180c
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x43176c
cmp ax, bx
jne 0x431776
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x43175f
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4317b5
test byte [esp + 0x21c], 0x10
je 0x43179c
push 0xfffffffffffffffe
pop edi
jmp 0x4317ac
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x43180a
cmp word [esp + 0x10], bp
jne 0x4317c3
cmp word [esp + 0x12], bp
je 0x4317e2
cmp word [esp + 0x10], bx
jne 0x4317d1
cmp word [esp + 0x12], bx
je 0x4317e2
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x43180a
cmp word [esp + 0x12], ax
jne 0x43180a
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x4317f7
test al, 0x10
je 0x43180a
jmp 0x431807
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x43180a
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x431860
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x4318d8
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x4318b9
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x4318b6
cmp ecx, 0x5c
je 0x4318b6
cmp ecx, 0x2f
jne 0x4318c3
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x4318a3
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4318da
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x432030
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x43206c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x43450a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x2c]
mov ebp, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43458e
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x482c34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x434586
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434577
cmp dword [esp + 0x18], ebx
jne 0x434577
push ebx
push edi
push dword [esp + 0x1c]
call fcn.00434810
mov ebp, eax
push edi
push 0
push dword [0x482c34]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x43467f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x434693
mov esi, ebx
jmp 0x43469d
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x43478e
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x434783
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x434782
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x434782
mov ebx, dword [esp + 0x10]
push 3
pop ebp
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add eax, ecx
movzx ecx, byte [ebx]
add eax, ecx
cdq
idiv ebp
mov byte [ebx], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebx, dword [esp + 0x10]
add ebx, ebp
mov dword [esp + 0x10], ebx
dec edi
jne 0x43474b
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x43478e
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8

Function at 0x435979
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x483544], eax
test eax, eax
je 0x4359a7
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x483540], eax
lea eax, [ebp - 0x114]
mov dword [0x483548], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x435a09
cmp dword [ebp - 0x104], 1
jne 0x4359de
and dword [0x483548], 0
jmp 0x435a21
cmp dword [ebp - 0x104], 2
jne 0x435a09
cmp dword [ebp - 0x110], 5
jb 0x4359d5
jne 0x435a09
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x483548]
mov dword [0x483548], eax
jmp 0x435a0e
mov eax, dword [0x483548]
test eax, eax
je 0x435a21
call fcn.00435250
neg eax
sbb eax, eax
and dword [0x483548], eax
mov esp, ebp
pop ebp
ret
Function at 0x4368c0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4368f2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4368ed
cmp dword [esp + 0xc], esi
je 0x436909
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x442de0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x442e00
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x442e00
mov eax, dword [eax + 0x44]
test eax, eax
je 0x442e00
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x453c40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x453c6f
push esi
call fcn.00453e20
add esp, 4
cmp byte [esi + 0x40], 0
je 0x453c68
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x453cf2
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x453cdd
mov eax, dword [esi + 8]
test eax, eax
je 0x453c95
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x453cd8
cmp eax, 2
je 0x453cdd
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x453c86
cmp eax, 3
je 0x453cbd
cmp eax, 1
jne 0x453c86
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x453c86
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x453c86
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00453d20
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x453d14
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.00453d20
add esp, 4
pop edi
pop esi
ret
Function at 0x453d20
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x453d4c
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x453dd2
lea ebx, [esi + 0x78]
jmp 0x453d60
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x453da6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x453d85
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x453de8
cmp eax, dword [esi + 0x60]
jb 0x453d67
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x453d60
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x454f60
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.00461180
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.00461150
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x454fa7
push edi
call fcn.00461190
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.00454bf0
mov dword [esi + 4], fcn.00454a80
mov dword [esi + 8], fcn.00454b50
mov dword [esi + 0xc], fcn.004549d0
mov dword [esi + 0x10], 0x4552c0
mov dword [esi + 0x14], 0x455250
mov dword [esi + 0x18], 0x4550b0
mov dword [esi + 0x1c], 0x454880
mov dword [esi + 0x20], 0x454730
mov dword [esi + 0x24], 0x454e60
mov dword [esi + 0x28], 0x455330
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x45508a
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x45508a
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x455079
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x455081
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x458850
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x458875
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x45887b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x458990
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x4588cd
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x458926
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x458910
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x4588f0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x458971
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x458950
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x458950
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x4588b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x775837d3
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x95a2e98
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219