joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4338b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00420b58
and dword [ebp - 4], 0
cmp dword [0x44b18c], 0
mov ebx, eax
jne 0x433964
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x433a15
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x433a15
push eax
call fcn.00420ae6
mov dword [esp], 0x443c40
push edi
mov dword [0x44b18c], eax
call esi
push eax
call fcn.00420ae6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44b190], eax
call esi
push eax
call fcn.00420ae6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44b194], eax
call esi
push eax
call fcn.00420ae6
pop ecx
mov dword [0x44b19c], eax
test eax, eax
je 0x433964
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00420ae6
pop ecx
mov dword [0x44b198], eax
mov eax, dword [0x44b198]
cmp eax, ebx
je 0x4339bc
cmp dword [0x44b19c], ebx
je 0x4339bc
push eax
call fcn.00420b61
push dword [0x44b19c]
mov esi, eax
call fcn.00420b61
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4339bc
test edi, edi
je 0x4339bc
call esi
test eax, eax
je 0x4339b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4339b3
test byte [ebp - 0xc], 1
jne 0x4339bc
or dword [ebp + 0x10], 0x200000
jmp 0x4339f5
mov eax, dword [0x44b190]
cmp eax, ebx
je 0x4339f5
push eax
call fcn.00420b61
pop ecx
test eax, eax
je 0x4339f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4339f5
mov eax, dword [0x44b194]
cmp eax, ebx
je 0x4339f5
push eax
call fcn.00420b61
pop ecx
test eax, eax
je 0x4339f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44b18c]
call fcn.00420b61
pop ecx
test eax, eax
je 0x433a15
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x433a17
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x353c008], 0x8088405
inc edx
mov dword [ebx + 0x353c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x352556f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3525576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x3525f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x353e248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x353e248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x353d0d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3525f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0xa85370
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a854c0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa85396
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa85382
add dl, dl
jne 0xa853a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa853f4
xor eax, eax
add dl, dl
jne 0xa853ae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa85495
add dl, dl
jne 0xa853bd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa853c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa853d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa853de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa853ea
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa8538d
mov eax, 1
add dl, dl
jne 0xa85402
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa8540d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa853f9
sub eax, ebx
mov ebx, 1
jne 0xa85440
mov ecx, 1
add dl, dl
jne 0xa85426
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa85431
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8541d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8538d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa85457
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa85462
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa8544e
cmp eax, 0x7d00
jae 0xa85485
cmp eax, 0x500
jb 0xa85480
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8538d
cmp eax, 0x7f
ja 0xa85488
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa8538d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa854b6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa8538d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
add bh, bh
jne 0x405094
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
or al, 0
push edi
mov esi, dword [ecx]
lea edi, [ebp - 8]
jge 0x43ddf0
push edi
sar ch, cl
adc byte [ecx - 0xaeafae], bl
push esi
adc al, 0x8b
inc ebp
clc
pop edi
pop esi
jmp 0x40507c

Function at 0x405082
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
add bh, bh
jne 0x405094
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
or al, 0
push edi
mov esi, dword [ecx]
lea edi, [ebp - 8]
jge 0x43ddf0
push edi
sar ch, cl
adc byte [ecx - 0xaeafae], bl
push esi
adc al, 0x8b
inc ebp
clc
pop edi
pop esi
jmp 0x40507c

Function at 0x406bec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x4c74a4]
push ebx
push esi
inc eax
mov esi, ecx
mov dword [esp + 0x18], esi
je 0x406c29
sbb byte [ebx + 0x4c74a4], ah
push edi
cmp eax, 0x30
jge 0x43e847
xor ebx, ebx
mov byte [esp + 0x13], 1
mov eax, ebx
mov byte [esp + 0x22], 1
lea ecx, [esp + 0xa8]
mov dword [esp + 0x14], eax
mov byte [esp + 0x24], bl
call fcn.00405906
mov edi, dword [ebp + 8]
lea ecx, [esp + 0xa8]
push 0x8000
push edi
call fcn.00405956
test al, al
je 0x43e861
lea ecx, [esp + 0x98]
call fcn.004077c7
lea ecx, [esp + 0x98]
call fcn.00420b9b
lea ecx, [esp + 0x88]
call fcn.004077c7
lea edx, [esp + 0x88]
mov ecx, edi
call fcn.004048ae
mov edi, dword [esp + 0xb8]
lea eax, [esp + 0x44]
mov esi, dword [esp + 0xbc]
lea ecx, [esp + 0xa8]
push eax
lea eax, [esp + 0x64]
mov dword [esp + 0x48], 0x18
push eax
call fcn.004059b0
push ebx
push esi
push edi
lea ecx, [esp + 0xb4]
call fcn.00405c4e
cmp dword [esp + 0x70], 0x21335541
je 0x43e87b
lea ecx, [esp + 0x50]
call fcn.004077c7
lea ecx, [esp + 0x28]
call fcn.004077c7
push ebx
lea eax, [esp + 0x2c]
add byte [ebx - 0x3074ef15], cl
push dword [eax]
leave
push 0x244b9fc8
pop ebp
ret

Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
sar byte [esi + 0xe], cl
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x42800a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4bbd38
call fcn.00428b40
call fcn.0042a048
movzx esi, ax
push 2
call fcn.0043508a
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x427ec1
xor ebx, ebx
jmp 0x427ef4
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x427ebd
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x427ebd
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x427ef4
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00428dbc
test eax, eax
jne 0x427f08
push 0x1c
call fcn.00427fe3
pop ecx
call fcn.00429d26
test eax, eax
jne 0x427f19
push 0x10
call fcn.00427fe3
pop ecx
call fcn.00429e0b
and dword [ebp - 4], 0
call fcn.0042d812
test eax, eax
jns 0x427f33
push 0x1b
call fcn.00427fe3
pop ecx
call dword [0x48f37c]
mov dword [0x4c5228], eax
call fcn.00435173
mov dword [0x4c41f0], eax
call fcn.00434d6b
test eax, eax
jns 0x427f59
push 8
call fcn.004232f5
pop ecx
call fcn.00434fa8
test eax, eax
jns 0x427f6a
push 9
call fcn.004232f5
pop ecx
push 1
call fcn.0042332f
pop ecx
test eax, eax
je 0x427f7d
push eax
call fcn.004232f5
pop ecx
call fcn.004351d0
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x427f9f
push esi
call fcn.00423598
call fcn.00423320
jmp 0x427fd4
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00428b85
ret
call fcn.004350d7
jmp 0x427e93

Function at 0x433718
Capabilities:
Authenticate hmac
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
in al, dx
in al, 0x49
add byte [eax + ecx], ah
cmp eax, 0x80000000
jae 0x433737
movlpd xmm0, qword [0x31d8e9c0]
invalid
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [0x4c4ae4], eax
je 0x433755
push dword [0x14c5184]
add byte [eax], al
inc esi
mov dword [ebp - 0x14377418], ebx
add eax, 0x437cabb9
add byte [ebx + 0x49ba1445], cl
add al, ch
xchg edi, eax
mov ecx, fcn.00437cab
mov eax, dword [ebp + 0x14]
mov edx, 0x97e80049
push esi
cmp eax, edx
jg 0x418307
inc dword [ebx + 0x64746983]
cmp eax, 0x19
jg 0x41827d
inc dword [ebx + 0x660049f4]
push 2
pop edx
sub eax, edx
je 0x821e2e8b
dec eax
je 0x84b83c59
cmp dword [ebp + 5], eax
je 0x821e2f4a
dec eax
je 0x84b83c3e
cmp dword [ebp + 5], eax
je 0xff7db893
dec eax
je 0x4337fc
sub eax, 9
jne 0x855237da
sahf
inc ebp
fadd dword [ebx]
and edi, 0xfffffffc
or ebx, 0xffffffdc
mov ah, 0x40
dec ecx
invalid
in al, dx
jmp 0x8f528bd5
mov al, byte [eax]
fdiv qword [eax - 0xb6c0]
mov dword [ebp - 0x61ef8ac0], esi
inc ebp
fadd dword [ecx - 0x2064ffb7]
loopne 0x4337f6
or dword [ebx*8 + 0xdde05d], 0xffffff8d
inc ebp
fcomp st(5)
pop ebp
call 0xdd933f01
pop ebp
invalid
Function at 0x468a88
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468a9a
call 0xfd2e0e2a
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffe9df8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468add
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468aed
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468afe
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret

Function at 0x4693aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40a8dc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.00469200
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call 0x66819246
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x4693ee
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.0046937e
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4693d8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6acc6acb
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7126535b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x1002febf
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10030053
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
push 8
pop eax
test eax, eax
je 0x1002ffc2
push 1
mov ecx, dword [ebp - 0x54]
call fcn.1001872f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
push 2
mov ecx, dword [ebp - 8]
call fcn.1001872f
push 0
mov ecx, dword [ebp - 0x18]
call fcn.1001872f
mov dword [eax], 0xc2b2e5f5
push 2
mov ecx, dword [ebp - 8]
call fcn.1001872f
cmp dword [eax], 0
je 0x1002ffa8
push 0
mov ecx, dword [ebp - 0x18]
call fcn.1001872f
cmp dword [eax], 0
je 0x1002ffa8
mov dword [ebp - 0x1c], 1
jmp 0x1002ffac
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002ffc2
mov dword [ebp - 0x20], 1
jmp 0x1002ffc6
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jg 0x1002ffd9
mov dword [ebp - 0x24], 1
jmp 0x1002ffdd
and dword [ebp - 0x24], 0
push 1
mov ecx, dword [ebp - 8]
call fcn.1001872f
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x28]
cmp ecx, dword [eax]
je 0x1002fffc
mov dword [ebp - 0x2c], 1
jmp 0x10030000
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2c]
jl 0x10030013
mov dword [ebp - 0xc], 1
jmp 0x10030017
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov esi, dword [eax]
sub esi, dword [ebp - 0xc]
push 0
mov ecx, dword [ebp - 8]
call fcn.1001872f
cmp esi, dword [eax]
jle 0x1003003e
mov dword [ebp - 0x30], 1
jmp 0x10030042
and dword [ebp - 0x30], 0
push 0
mov ecx, dword [ebp - 0x5c]
call fcn.1001872f
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1003005d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret