joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403690
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9cc8
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x4036cb
lea eax, [ebp - 0x454]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x4036b8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ebx, dword [ebp - 0x10]
xor esi, esi
call edi
cmp esi, 0x2b259d
jle 0x4036f2
cmp ebx, 0x785074d5
jne 0x4036fb
inc esi
cmp esi, 0x1c1b
jl 0x4036e0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x206d47
jg 0x40372d
inc esi
cmp esi, 0x4f6a4
jl 0x403710
cmp dword [0x8fb080], 0x400
jne 0x403767
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [ebp - 0x30]
call fcn.00403800
push 0
mov dword [ebp - 4], 0
call fcn.00403b34
add esp, 4
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00403820
mov ecx, dword [0x4dc13c]
mov edx, dword [0x4dc110]
mov dword [0x8fb080], ecx
mov dword [0x8fb084], edx
call fcn.004033c0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
nop
push 0
call edi
cmp esi, 0x2b259d
jle 0x4037a4
cmp ebx, 0x785074d5
jne 0x4037ad
inc esi
cmp esi, 0x11915
jl 0x403790
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0x8fb080], 0x51f
jne 0x4037d2
lea eax, [ebp - 0x54]
push eax
call esi
sub edi, 1
jne 0x4037c0
mov eax, dword [0x8f9fd4]
mov dword [0x8fa614], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4044a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4db0c8]
jne 0x4044aa
repz ret
jmp fcn.00406c0e
Function at 0x4030c0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
cmp dword [0x845080], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 0xc], eax
jne 0x4030f9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [0x425ef8]
mov ebx, dword [0x425efc]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0x9e3779b9
mov dword [ebp - 0x28], ecx
call fcn.004030b0
mov edx, dword [0x425f00]
mov eax, dword [0x425f04]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x403140
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov ecx, dword [0x845080]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x4031a8
push 0
lea ecx, [ebp - 0x42c]
push ecx
push 0x402590
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
xor edx, edx
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], ax
mov ecx, dword [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0x845080]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4031c2
mov dword [0x84461c], 0xedeb2e40
jmp 0x4031d4
cmp ecx, 0x3eb
jne 0x4031d4
mov dword [0x843fd0], 0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add edx, esi
mov dword [ebp - 0x14], edx
mov edx, esi
shr edx, cl
mov dword [0x844618], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x845080], 0xc
jne 0x403232
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov edx, dword [ebp - 0xc]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, edx
xor ecx, eax
mov dword [ebp - 4], ecx
sub esi, ecx
mov eax, dword [ebp - 0x20]
sub dword [ebp - 8], eax
sub edi, 1
jne 0x403140
cmp dword [0x845080], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x403299
push 0
push 0x4025c4
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4032b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x845080]
mov ecx, dword [0x843fd4]
shr eax, 3
sub esp, 0x408
test eax, eax
jbe 0x40338a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x845080], 0x959
jne 0x403370
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x4025f8
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004030c0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4032f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403680
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4237e8
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x4036bb
lea eax, [ebp - 0x454]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x4036a8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ebx, dword [ebp - 0x10]
xor esi, esi
call edi
cmp esi, 0x2b259d
jle 0x4036e2
cmp ebx, 0x785074d5
jne 0x4036eb
inc esi
cmp esi, 0x1c1b
jl 0x4036d0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x206d47
jg 0x40371d
inc esi
cmp esi, 0x4f6a4
jl 0x403700
cmp dword [0x845080], 0x400
jne 0x403757
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [ebp - 0x30]
call fcn.004037f0
push 0
mov dword [ebp - 4], 0
call fcn.00403b24
add esp, 4
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00403810
mov ecx, dword [0x42613c]
mov edx, dword [0x426110]
mov dword [0x845080], ecx
mov dword [0x845084], edx
call fcn.004033b0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
nop
push 0
call edi
cmp esi, 0x2b259d
jle 0x403794
cmp ebx, 0x785074d5
jne 0x40379d
inc esi
cmp esi, 0x11915
jl 0x403780
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0x845080], 0x51f
jne 0x4037c2
lea eax, [ebp - 0x54]
push eax
call esi
sub edi, 1
jne 0x4037b0
mov eax, dword [0x843fd4]
mov dword [0x844614], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404490
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4250c8]
jne 0x40449a
repz ret
jmp fcn.00406bfe
Function at 0x40681f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404511
and dword [ebp - 4], 0
cmp dword [0x426a10], 0
mov ebx, eax
jne 0x4068d0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406981
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406981
push eax
call fcn.0040449f
mov dword [esp], 0x4019ac
push edi
mov dword [0x426a10], eax
call esi
push eax
call fcn.0040449f
mov dword [esp], 0x401998
push edi
mov dword [0x426a14], eax
call esi
push eax
call fcn.0040449f
mov dword [esp], 0x40197c
push edi
mov dword [0x426a18], eax
call esi
push eax
call fcn.0040449f
pop ecx
mov dword [0x426a20], eax
test eax, eax
je 0x4068d0
push 0x401964
push edi
call esi
push eax
call fcn.0040449f
pop ecx
mov dword [0x426a1c], eax
mov eax, dword [0x426a1c]
cmp eax, ebx
je 0x406928
cmp dword [0x426a20], ebx
je 0x406928
push eax
call fcn.0040451a
push dword [0x426a20]
mov esi, eax
call fcn.0040451a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406928
test edi, edi
je 0x406928
call esi
test eax, eax
je 0x40691f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40691f
test byte [ebp - 0xc], 1
jne 0x406928
or dword [ebp + 0x10], 0x200000
jmp 0x406961
mov eax, dword [0x426a14]
cmp eax, ebx
je 0x406961
push eax
call fcn.0040451a
pop ecx
test eax, eax
je 0x406961
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406961
mov eax, dword [0x426a18]
cmp eax, ebx
je 0x406961
push eax
call fcn.0040451a
pop ecx
test eax, eax
je 0x406961
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426a10]
call fcn.0040451a
pop ecx
test eax, eax
je 0x406981
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406983
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438c95
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop esi
sub eax, 0xf777ff10
and eax, ecx
or eax, eax
call fcn.00438cd1
push ecx
pop eax
sub eax, ecx
and eax, eax
xor dword [ebx], esi
inc eax
inc ebx
or ecx, ecx
cmp ebx, edx
jne fcn.00438c95
sub eax, 0xa1f652f0
sub ecx, 1
ret
Function at 0xd2c150
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd2c2a0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd2c176
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2c162
add dl, dl
jne 0xd2c181
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2c1d4
xor eax, eax
add dl, dl
jne 0xd2c18e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd2c275
add dl, dl
jne 0xd2c19d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2c1a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2c1b3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2c1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd2c1ca
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd2c16d
mov eax, 1
add dl, dl
jne 0xd2c1e2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd2c1ed
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2c1d9
sub eax, ebx
mov ebx, 1
jne 0xd2c220
mov ecx, 1
add dl, dl
jne 0xd2c206
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2c211
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2c1fd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2c16d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd2c237
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd2c242
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd2c22e
cmp eax, 0x7d00
jae 0xd2c265
cmp eax, 0x500
jb 0xd2c260
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2c16d
cmp eax, 0x7f
ja 0xd2c268
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd2c16d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd2c296
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd2c16d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40306c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x845088], 0x594
push edi
mov dword [ebp - 8], eax
jne 0x4030a2
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x425ef8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x425efc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.00403065
mov eax, dword [0x425f00]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x425f04]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x845088], 0xc
mov dword [ebp - 4], eax
jne 0x403130
push esi
lea eax, [ebp - 0x830]
push eax
push 0x4024f0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x845088]
cmp eax, 0xfa9
jne 0x40314c
mov dword [0x844624], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403159
mov dword [0x843fd4], esi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ebx
shr edx, cl
lea eax, [edi + ebx]
mov dword [ebp - 0x14], eax
mov dword [0x844620], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x845088], 0xc
jne 0x4031af
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
add edi, edx
add eax, dword [ebp - 0x24]
xor eax, edi
xor dword [ebp - 4], eax
sub ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0040305e
dec dword [ebp - 0x18]
jne 0x4030db
cmp dword [0x845088], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], ebx
jne 0x403206
push esi
push 0x402588
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x845088]
mov ecx, dword [0x843fd8]
sub esp, 0x400
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4032b3
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x845088], 0x959
jne 0x4032a5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
call fcn.0040306c
add edi, 8
dec ebx
jne 0x403238
pop edi
pop ebx
pop esi
leave
ret
Function at 0x404370
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4250c8]
jne 0x40437a
repz ret
jmp fcn.00406ade

Function at 0x4066ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043f1
and dword [ebp - 4], 0
cmp dword [0x426a10], 0
mov ebx, eax
jne 0x4067b0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406861
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406861
push eax
call fcn.0040437f
mov dword [esp], 0x4019ac
push edi
mov dword [0x426a10], eax
call esi
push eax
call fcn.0040437f
mov dword [esp], 0x401998
push edi
mov dword [0x426a14], eax
call esi
push eax
call fcn.0040437f
mov dword [esp], 0x40197c
push edi
mov dword [0x426a18], eax
call esi
push eax
call fcn.0040437f
pop ecx
mov dword [0x426a20], eax
test eax, eax
je 0x4067b0
push 0x401964
push edi
call esi
push eax
call fcn.0040437f
pop ecx
mov dword [0x426a1c], eax
mov eax, dword [0x426a1c]
cmp eax, ebx
je 0x406808
cmp dword [0x426a20], ebx
je 0x406808
push eax
call fcn.004043fa
push dword [0x426a20]
mov esi, eax
call fcn.004043fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406808
test edi, edi
je 0x406808
call esi
test eax, eax
je 0x4067ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4067ff
test byte [ebp - 0xc], 1
jne 0x406808
or dword [ebp + 0x10], 0x200000
jmp 0x406841
mov eax, dword [0x426a14]
cmp eax, ebx
je 0x406841
push eax
call fcn.004043fa
pop ecx
test eax, eax
je 0x406841
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406841
mov eax, dword [0x426a18]
cmp eax, ebx
je 0x406841
push eax
call fcn.004043fa
pop ecx
test eax, eax
je 0x406841
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426a10]
call fcn.004043fa
pop ecx
test eax, eax
je 0x406861
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406863
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x34e34f33
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x8b94c5e
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x438cab
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edi
and ebx, eax
sub ebx, ebx
sub esp, 4
mov dword [esp], eax
pop eax
call fcn.00438ce5
add eax, 0xf1e115d5
and ebx, ebx
sub eax, ebx
xor dword [esi], edi
add ebx, eax
and eax, ebx
push ebx
mov ebx, dword [esp]
add esp, 4
inc esi
dec ebx
cmp esi, ecx
jne fcn.00438cab
mov eax, ebx
mov eax, eax
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x4b5c782f
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x381f48ba
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219