joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482e70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52310b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57e9a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x1dc
call fcn.00427140
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x1d0
call fcn.00427140
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c4
call fcn.00427140
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b8
call fcn.00427140
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x1ac
call fcn.00427140
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a0
call fcn.00427140
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00436f60
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00427140
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00427140
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00427140
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00427140
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00427140
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00427140
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.00427140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4845f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52329b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x134
mov eax, dword [0x57e9a8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x138]
call fcn.004bacb0
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push 0x104
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x484797
cmp dword [ebp - 0x14], 0x104
je 0x484797
push 0
lea edx, [ebp - 0x120]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x484797
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x138]
call fcn.0041d590
push 0
mov ecx, dword [ebp - 0x138]
call fcn.004853d0
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x124]
push edx
push 0
lea eax, [ebp - 0x120]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4846ef
mov dword [ebp - 0x12c], 1
push 0x557c48
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00509f58
push 0
mov ecx, dword [ebp - 0x138]
call fcn.004853d0
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x138]
add eax, 0x10
push eax
push 0x532da0
mov ecx, dword [ebp - 0x140]
push ecx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x484743
mov dword [ebp - 0x130], 1
push 0x557c48
lea edx, [ebp - 0x130]
push edx
call fcn.00509f58
push 0
mov ecx, dword [ebp - 0x138]
call fcn.004853d0
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0xc
push ecx
push str.VarFileInfoTranslation
mov edx, dword [ebp - 0x144]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x484797
mov dword [ebp - 0x134], 1
push 0x557c48
lea eax, [ebp - 0x134]
push eax
call fcn.00509f58
jmp 0x4847b1
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00509f49
mov esp, ebp
pop ebp
ret 4
Function at 0x485130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5233a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x57e9a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004852e0
test eax, eax
jne 0x485169
jmp 0x4852c7
lea ecx, [ebp - 0x18]
call fcn.004bacb0
mov dword [ebp - 4], 0
push 0x200
lea ecx, [ebp - 0x18]
call fcn.00485400
mov ecx, dword [ebp - 0x2c]
call fcn.0042e470
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d760
push eax
push 0
lea ecx, [ebp - 0x18]
call fcn.004853d0
push eax
push 0x532e30
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
lea ecx, [ebp - 0x18]
call fcn.004853d0
push eax
lea ecx, [ebp - 0x20]
call fcn.0041c890
mov byte [ebp - 4], 1
push 0
push 0x532e2c
lea ecx, [ebp - 0x20]
call fcn.0046eea0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x48521b
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041cc20
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x34]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041c930
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0041c910
jmp 0x485227
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c930
push 0x532e28
mov ecx, dword [ebp + 8]
call fcn.0046f020
push 0x532e28
mov ecx, dword [ebp + 8]
call fcn.0046ef70
mov ecx, dword [ebp + 8]
call fcn.0041cf10
movzx ecx, al
test ecx, ecx
je 0x48526d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0041c910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00427140
jmp 0x4852c7
push 0x532e30
mov ecx, dword [ebp + 8]
call fcn.0041ca10
test eax, eax
jne 0x48529b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0041c910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00427140
jmp 0x4852c7
mov dword [ebp - 0x28], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0041c910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00427140
mov eax, dword [ebp - 0x28]
jmp 0x4852c9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48b8e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523bfc
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57e9a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.SaveLoadScene::ISaveLoadPage.0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004bacb0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004bacb0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004bacb0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004bacb0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004bacb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x48b980
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523bfc
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57e9a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00427140
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00427140
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00427140
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00427140
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00427140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4afb70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525948
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x57e9a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004ae5b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CEffectUniversal.0
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.004bf070
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.004bf090
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 1
push 0
mov ecx, dword [ebp + 8]
call fcn.004853d0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 0xc]
call fcn.0041da00
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.00500d30
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x10], edx
mov ecx, dword [ebp + 0x10]
call fcn.0041da00
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.00500d30
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x2c], 0xff
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x34], 0x80
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x30], 0xffffff80
call fcn.00415330
mov dword [ebp - 0x2c], eax
push 1
mov ecx, dword [ebp - 0x2c]
call fcn.004152f0
mov dword [ebp - 0x30], eax
call fcn.00415330
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x34]
call fcn.004152f0
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x7c]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00483dd0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x3c]
mov dword [ecx + 0x38], edx
mov eax, dword [ebp - 0x14]
mov byte [eax + 4], 1
jmp 0x4afca8
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bab60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x4bab7a
mov eax, dword [ebp - 0x40]
sub eax, 0x20
mov dword [ebp - 0x44], eax
jmp 0x4bab81
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0
je 0x4bac0d
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.004121a0
mov ecx, eax
call fcn.0042e470
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0041cea0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4babfc
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0041cf30
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x4bac0b
mov dword [ebp - 4], 0
jmp 0x4bac28
mov ecx, dword [ebp + 0xc]
call fcn.0042e470
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00412170
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4bac43
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004bb680
jmp 0x4baca6
cmp dword [ebp + 0x14], 0
je 0x4baca6
cmp dword [ebp + 0x18], 0
je 0x4baca6
mov ecx, dword [ebp + 0xc]
call fcn.0041cef0
cmp eax, dword [ebp + 0x1c]
jle 0x4baca6
mov dword [ebp - 0x38], 1
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0041cef0
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004faa30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4bb160
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0041cf10
movzx eax, al
test eax, eax
jne 0x4bb18b
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0042e470
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x52f8af
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0041c950
push 0x52f8af
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.0041c950
mov esp, ebp
pop ebp
ret
Function at 0x501410
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a3f7
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x57e9a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax], vtable.GuiControl::GuiDialog.0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.004bace0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x24
call fcn.004bacb0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.004bace0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x4c], 1
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x50], 1
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x64], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x68
call fcn.004bacb0
mov byte [ebp - 4], 3
push 4
call fcn.0050a010
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5014da
mov ecx, dword [ebp - 0x10]
call fcn.005015a0
mov dword [ebp - 0x20], eax
jmp 0x5014e1
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x24
call fcn.00507c70
push 0x80
call fcn.0050a010
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0
je 0x501517
mov ecx, dword [ebp - 0x18]
call fcn.00439290
mov dword [ebp - 0x24], eax
jmp 0x50151e
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x68
call fcn.004cbc40
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x54], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x5c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5098ae
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x580c28], 0
push esi
jne 0x509821
call fcn.00509747
test eax, eax
je 0x509864
mov eax, dword [0x580c28]
cmp eax, 1
jne 0x509842
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x509864
pop esi
ret
push eax
call dword [0x580c30]
test eax, eax
jne 0x5098ac
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x509868
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x580c28]
call dword [0x580c30]
mov edi, eax
test edi, edi
je 0x50988d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x5098a9
mov edi, esi
add esi, 0xff0
push edi
push dword [0x580c28]
call dword [0x580c2c]
add edi, 0x10
cmp edi, esi
jb 0x509895
mov eax, edi
pop edi
pop esi
ret
jmp 0x50980e

Function at 0x509f49
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x57e9a8]
jne 0x509f53
repz ret
jmp fcn.0050f4bc

Function at 0x517662
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0050eea9
and dword [ebp - 4], 0
cmp dword [0x5816e4], 0
mov ebx, eax
jne 0x517713
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5177c4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x546a44
push edi
call esi
test eax, eax
je 0x5177c4
push eax
call fcn.0050ee37
mov dword [esp], 0x546a34
push edi
mov dword [0x5816e4], eax
call esi
push eax
call fcn.0050ee37
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5816e8], eax
call esi
push eax
call fcn.0050ee37
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5816ec], eax
call esi
push eax
call fcn.0050ee37
pop ecx
mov dword [0x5816f4], eax
test eax, eax
je 0x517713
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0050ee37
pop ecx
mov dword [0x5816f0], eax
mov eax, dword [0x5816f0]
cmp eax, ebx
je 0x51776b
cmp dword [0x5816f4], ebx
je 0x51776b
push eax
call fcn.0050eeb2
push dword [0x5816f4]
mov esi, eax
call fcn.0050eeb2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x51776b
test edi, edi
je 0x51776b
call esi
test eax, eax
je 0x517762
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x517762
test byte [ebp - 0xc], 1
jne 0x51776b
or dword [ebp + 0x10], 0x200000
jmp 0x5177a4
mov eax, dword [0x5816e8]
cmp eax, ebx
je 0x5177a4
push eax
call fcn.0050eeb2
pop ecx
test eax, eax
je 0x5177a4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5177a4
mov eax, dword [0x5816ec]
cmp eax, ebx
je 0x5177a4
push eax
call fcn.0050eeb2
pop ecx
test eax, eax
je 0x5177a4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5816e4]
call fcn.0050eeb2
pop ecx
test eax, eax
je 0x5177c4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5177c6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x19163c8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1916518
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x19163ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19163da
add dl, dl
jne 0x19163f9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x191644c
xor eax, eax
add dl, dl
jne 0x1916406
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19164ed
add dl, dl
jne 0x1916415
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916420
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x191642b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916436
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1916442
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x19163e5
mov eax, 1
add dl, dl
jne 0x191645a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1916465
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1916451
sub eax, ebx
mov ebx, 1
jne 0x1916498
mov ecx, 1
add dl, dl
jne 0x191647e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1916489
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1916475
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19163e5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x19164af
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19164ba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19164a6
cmp eax, 0x7d00
jae 0x19164dd
cmp eax, 0x500
jb 0x19164d8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19163e5
cmp eax, 0x7f
ja 0x19164e0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19163e5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x191650e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x19163e5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x46544fa0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x1c170665
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219