joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401850
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e418
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x413090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4018b8
mov eax, 0x104
lea ecx, [ebp - 0x10]
call fcn.004020a0
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [esi - 8], 0x104
jl 0x40196e
xor ecx, ecx
push 1
mov dword [esi - 0xc], 0x104
push ecx
mov word [esi + 0x208], cx
mov edx, dword [ebp + 0xc]
push edx
push esi
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401915
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401938
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40195e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004025f0
int3

Function at 0x4023f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x413f8c
call fcn.0040289a
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x4024a4
test esi, esi
jne 0x4024a4
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x402488
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402482
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402482
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x402471
cmp esi, eax
jae 0x402475
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402463
cmp esi, eax
jb 0x402479
xor eax, eax
jmp 0x402482
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x4024ad
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x413f8c
call fcn.0040289a
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x402415
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4025a8
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4025da
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4025d6
cmp esi, eax
jae 0x4025da
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4025c8
cmp esi, eax
jb 0x4025e0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x402ae2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413090]
jne 0x402aec
repz ret
jmp fcn.00404bba

Function at 0x4087cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x413090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043ec
and dword [ebp - 0x14], 0
cmp dword [0x414d00], 0
mov dword [ebp - 0x18], eax
jne 0x40887e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408926
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408926
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x414d00], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x414d04], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x414d08], eax
call edi
push eax
call esi
mov dword [0x414d10], eax
test eax, eax
je 0x40887e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x414d0c], eax
mov eax, dword [0x414d0c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4088d7
cmp dword [0x414d10], ecx
je 0x4088d7
push eax
call esi
push dword [0x414d10]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4088d7
test ebx, ebx
je 0x4088d7
call edi
test eax, eax
je 0x4088ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4088ce
test byte [ebp - 8], 1
jne 0x4088d7
or dword [ebp + 0x10], 0x200000
jmp 0x40890a
mov eax, dword [0x414d04]
cmp eax, dword [ebp - 0x18]
je 0x40890a
push eax
call esi
test eax, eax
je 0x40890a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40890a
mov eax, dword [0x414d08]
cmp eax, dword [ebp - 0x18]
je 0x40890a
push eax
call esi
test eax, eax
je 0x40890a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x414d00]
call esi
test eax, eax
je 0x408926
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408928
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402ae2
leave
ret
Function at 0x40fb10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
jmp 0x40fb2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40fb31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40fb20
mov eax, 1
add ebx, ebx
jne 0x40fb43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40fb38
jne 0x40fb54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40fb38
xor ecx, ecx
sub eax, 3
jb 0x40fb68
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40fbda
mov ebp, eax
add ebx, ebx
jne 0x40fb73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40fb80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40fba4
inc ecx
add ebx, ebx
jne 0x40fb90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40fb85
jne 0x40fba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40fb85
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40fbc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40fbb5
jmp 0x40fb26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40fbc4
add edi, ecx
jmp 0x40fb26
pop esi
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40fc2c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10f60]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10f9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40fbe1
mov ecx, edi
jns 0x40fc10
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10fa4]
or eax, eax
je 0x40fc26
mov dword [ebx], eax
add ebx, 4
jmp 0x40fbfe
call dword [esi + 0x10fa0]
mov ebp, dword [esi + 0x10fa8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40fc60
sub esp, 0xffffff80
jmp 0x4014c0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00445490
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x808]
call fcn.00401100
add esp, 0xc
mov esi, eax
cmp dword [ebp + 8], 0
jne 0x4012e9
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1008]
mov ecx, eax
call fcn.00401250
add esp, 4
test esi, esi
js 0x4012e9
lea eax, [ebp - 0x1008]
push eax
push str.:__ls
mov eax, 0x400
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x808]
lea eax, [eax + esi*2]
push eax
call fcn.004011a0
add esp, 0x14
push 0
push str.Python_Launcher_is_sorry_to_say_...
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp + 8]
call fcn.0040f4cf
int3
Function at 0x401bf0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push pe_nt_image_headers32
push 0x46fec0
push str.VIRTUAL_ENV
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp edi, 0x100
jb 0x401c40
lea ecx, [edi*2 + 2]
push ecx
call fcn.00424b05
mov esi, eax
add esp, 4
test esi, esi
je 0x401dd9
push edi
push esi
push str.VIRTUAL_ENV
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x401c4d
test edi, edi
je 0x401ce1
mov esi, 0x46fec0
cmp word [esi], 0
je 0x401ce1
push esi
push str.Checking_for_Python_executable_in_virtual_env__ls_n
call fcn.00401220
push str.pythonw.exe
push esi
push str._lsScripts_ls
push 0xffffffffffffffff
push 0x104
push 0x4af5f0
call fcn.004011a0
add esp, 0x20
push 0x4af5f0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x4af5f0
cmp eax, 0xffffffff
jne 0x401ca5
push str.Python_executable__ls_missing_from_virtual_env_n
call fcn.00401220
add esp, 8
jmp 0x401ce1
mov eax, dword [0x4560ac]
imul esi, eax, 0x424
inc eax
mov dword [0x4560ac], eax
push 0x104
add esi, 0x4560b0
lea eax, [esi + 0x14]
push eax
call fcn.00421d98
push str.venv
push 8
push esi
mov dword [esi + 0x10], 0
call fcn.00421d98
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_IsWow64Process]
push eax
call edi
test eax, eax
je 0x401d44
cmp dword [ebp - 4], 0
je 0x401d44
push str.locating_Pythons_in_64bit_registry_n
call fcn.00401220
push 0
push 0
push 0x20119
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000001
call fcn.00401420
push 0
push 0
push 0x20119
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000002
call fcn.00401420
add esp, 0x1c
push str.locating_Pythons_in_native_registry_n
call fcn.00401220
push 0
push 0
push 0x20019
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000001
call fcn.00401420
push 0
push 0
push 0x20019
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000002
call fcn.00401420
add esp, 0x1c
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call esi
push eax
call edi
pop edi
pop esi
test eax, eax
je 0x401db8
cmp dword [ebp - 8], 0
je 0x401db8
push 1
push 0x40
push 0x20119
mov edx, str.SOFTWAREMicrosoftAppModelLookasideuserSoftwarePythonPythonCore
mov ecx, 0x80000002
call fcn.00401420
add esp, 0xc
push 0x401a30
push 0x424
push dword [0x4560ac]
push 0x4560b0
call fcn.00422170
add esp, 0x10
mov esp, ebp
pop ebp
ret
push str.Could_not_allocate_environment_buffer
push 0x68
call fcn.00401270
int3
Function at 0x401ed0
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebx
push esi
push edi
push str.pythonX
push str.py__ls
push 0xffffffffffffffff
push 0x400
push 0x4aedf0
mov ebx, str.environment
call fcn.004011a0
add esp, 0x14
push pe_nt_image_headers32
push 0x46fec0
push 0x4aedf0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp edi, 0x100
jb 0x401f41
lea ecx, [edi*2 + 2]
push ecx
call fcn.00424b05
mov esi, eax
add esp, 4
test esi, esi
je 0x401ff3
push edi
push esi
push 0x4aedf0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x401fd9
test edi, edi
jne 0x401fd4
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
cmp word [0x4700c0], si
je 0x401f86
push 0x4700c0
push 0x400
push 0x4aedf0
push esi
push str.pythonX
push str.defaults
call edi
test eax, eax
je 0x401f86
mov esi, 0x4aedf0
mov ebx, 0x4700c0
jmp 0x401fd9
cmp word [0x455ea0], si
je 0x401fbc
push 0x455ea0
push 0x400
push 0x4aedf0
push 0
push str.pythonX
push str.defaults
call edi
test eax, eax
je 0x401fbc
mov esi, 0x4aedf0
mov ebx, 0x455ea0
jmp 0x401fd9
push str.pythonX
push str.found_no_configured_value_for__ls_n
call fcn.00401220
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov esi, 0x46fec0
push ebx
push esi
push str.pythonX
push str.found_configured_value__ls_ls_in__ls_n
call fcn.00401220
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret
push str.Could_not_allocate_environment_buffer
push 0x68
call fcn.00401270
int3
Function at 0x402190
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
mov edi, ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
push edi
push str.run_child:_about_to_run__ls_n
call fcn.00401220
add esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
push 0x70
lea eax, [ebp - 0x78]
push eax
push 9
push esi
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x40237b
cmp dword [ebp - 0x7c], 0x70
jne 0x40237b
test esi, esi
je 0x40237b
or dword [ebp - 0x68], 0x3000
lea eax, [ebp - 0x78]
push 0x70
push eax
push 9
push esi
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x402236
push str.Job_information_setting_failed
push 0x65
call fcn.00401270
push 0x44
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.00405b70
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call ebx
lea edx, [ebp - 0xa0]
mov ecx, eax
call fcn.00402120
test eax, eax
jne 0x40227d
push str.stdin_duplication_failed
push 0x64
call fcn.00401270
push 0xfffffffffffffff5
call ebx
lea edx, [ebp - 0x9c]
mov ecx, eax
call fcn.00402120
test eax, eax
jne 0x40229e
push str.stdout_duplication_failed
push 0x64
call fcn.00401270
push 0xfffffffffffffff4
call ebx
lea edx, [ebp - 0x98]
mov ecx, eax
call fcn.00402120
test eax, eax
jne 0x4022bf
push str.stderr_duplication_failed
push 0x64
call fcn.00401270
push 1
push 0x402180
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x4022dc
push str.control_handler_setting_failed
push 0x65
call fcn.00401270
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xac], pe_nt_image_headers32
push eax
lea eax, [ebp - 0xd8]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40231a
push edi
push str.Unable_to_create_process_using__ls
push 0x65
call fcn.00401270
push dword [ebp - 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xffffffffffffffff
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x402363
push str.Failed_to_get_exit_code_of_process
push 0x65
call fcn.00401270
push dword [ebp - 0x7c]
push str.child_process_exit_code:__d_n
call fcn.00401220
add esp, 8
push dword [ebp - 0x7c]
call fcn.0040f4cf
push str.Job_information_querying_failed
push 0x65
call fcn.00401270
int3
Function at 0x402800
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00445490
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1004]
push edi
mov ebx, ecx
push ebx
push 0x400
push eax
push 0
push 0
push str.commands
call esi
cmp eax, 0x3ff
jne 0x40284f
push ebx
push str.read_commands:__ls:_not_enough_space_for_names_n
call fcn.00401220
add esp, 8
cmp word [ebp - 0x1004], 0
lea edi, [ebp - 0x1004]
je 0x402964
push ebx
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0
push edi
push str.commands
call esi
cmp eax, 0x3ff
jne 0x402890
push edi
push ebx
push str.read_commands:__ls:_not_enough_space_for__ls_n
call fcn.00401220
add esp, 0xc
mov ax, word [ebp - 0x804]
lea esi, [ebp - 0x804]
test ax, ax
je 0x4028c5
movzx ecx, ax
movzx eax, cx
push eax
call fcn.00424450
add esp, 4
test eax, eax
je 0x4028c5
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4028a5
jmp 0x402936
cmp word [esi], 0
je 0x402936
mov ecx, edi
call fcn.00402640
mov esi, eax
test esi, esi
jne 0x40290b
mov eax, dword [0x4af7f8]
cmp eax, 0x64
jl 0x4028f9
lea eax, [ebp - 0x804]
push eax
push edi
push 0x450980
call fcn.00401220
add esp, 0xc
jmp 0x402936
imul esi, eax, 0xa08
add esi, 0x4702d0
inc eax
mov dword [0x4af7f8], eax
push 0xffffffffffffffff
push edi
push 0x104
push esi
call fcn.00424bdb
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push eax
lea eax, [esi + 0x208]
push 0x400
push eax
call fcn.00424bdb
add esp, 0x20
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402940
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
cmp word [edi], ax
jne 0x402863
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ff2
mov esp, ebp
pop ebp
ret
Function at 0x431feb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00431be3

Function at 0x4321e9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004320bd

Function at 0x434dde
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004347a6

Function at 0x53d827
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x53d83c
popal
leave
ret 0xc

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748