joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5707b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + 0x18]
bswap ecx
push 0xbacb5221
setbe ch
mov dx, dx
movzx ecx, word [edi + ebx*8 + 4]
pushfd
call fcn.00582328
test eax, eax
lea esp, [esp + 0x24]
js 0x57e1c8
pushal
lea esp, [esp + 0x20]
jns 0x5bff18
shld edx, esi, cl
btr bx, 0xe
neg dx
and eax, 0x7fffffff
shl bx, 4
inc edx
pushfd
add eax, dword [esi + 0x2c]
lea edx, [ecx*4 + 0x3022f083]
pop edx
xchg dx, bx
mov ebx, eax
movzx edx, dl
lea edx, [eax + 2]
pushal
lea esp, [esp + 0x20]
jmp 0x5e31c1
jmp 0x5a0374
push edi
mov word [esp], sp
pushal
lea esp, [esp + 0x24]
jns 0x5bff18
clc
and eax, 0x7fffffff
shrd ebx, esp, cl
movzx ebx, al
add eax, dword [esi + 0x2c]
jmp 0x541e4e
xchg edx, eax
pushfd
not eax
jmp 0x543611

Function at 0x575811
Capabilities:
Encode data using xor

Disassembly:
pushal
bswap di
pushal
pop edi
mov edi, 0x538cf3
jmp 0x5a7b82
jmp fcn.0056b975
push edi
xchg dword [esp + 0x14], edi
pushal
mov byte [esp + 8], bh
push dword [esp + 0x10]
push dword [esp + 0x38]
ret 0x3c
lea esp, [esp + 4]
jp 0x57f345
xchg dword [esp], edi
pushfd
jmp 0x58e60c
pushfd
mov word [esp], 0x3557
pushal
xchg dword [esp + 0x24], edi
jmp 0x56a8b2
push 0xe3818a3a
mov dword [esp + 4], edi
lea edi, [ebx + 0x34ead2a5]
mov word [esp], 0x64d6
lea esp, [esp + 4]
je 0x540be8
pushfd
mov edi, 0x538cf3
mov byte [esp], bh
mov byte [esp], dh
mov byte [esp], cl
pushfd
mov edi, dword [edi + 0x16f227]
push dword [esp + 4]
jmp 0x5b2a94
mov byte [esp + 4], bh
mov edi, dword [edi + 0x16f227]
pushfd
lea edi, [edi - 0x8ee0afc]
call fcn.0057b7ea
lcall 0xc9a, 0x3abcdfc7
stosd dword es:[edi], eax
add al, ah
in al, 0xee
std
aam 0xd3
fmulp st(1)
mul byte [ebp + 0xe564a14]
xor dword [ecx - 9], 0xffffffa8
adc dword [eax + 0x1120580c], ecx
xor eax, 0xc8ab4fe0
dec ebp
mov esp, 0x17c9eeb4
jo 0x5a7b9f
push edx
popal
movsd dword es:[edi], dword [esi]
popal
cmp ebx, ecx
rcr ch, cl
or dword [ebx + 0x6e343c5f], edx
fisttp qword [ecx]
xchg ebx, eax
pop edi
cmp al, 0x34
outsb dx, byte [esi]
std
jg 0x5a7bcd
mov eax, 0xbf316e56
sbb dword [ebx], 0x715f7b03
retf 0xc3d7
lea edi, [edi - 0x8ee0afc]
push dword [esp + 8]
jmp 0x56e224

Function at 0x583c17
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
stc
push ebx
xchg dword [esp + 0x20], ebp
pushal
and bp, 0x8166
lea ebp, [esp + 0x40]
push 0xd2c11a65
cmc
clc
sub esp, 0xffffffc4
jno 0x5be155
push esp
stc
cmp dword [ebp + 8], 0
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
push ecx
mov dword [esp + 4], 0
push 0xc09393bb
lea esp, [esp + 8]
call fcn.005a3276
push ebp
jmp 0x5d5afa
Function at 0x588164
Capabilities:
Encode data using xor

Disassembly:
push ebx
lea esp, [esp + 8]
je 0x58087f
lahf
test dh, al
mov eax, dword [ebp + 0xc]
push 0x16cc7171
clc
clc
test eax, 0xffff0000
mov dword [esp], eax
mov byte [esp], 0x6e
lea esp, [esp + 4]
jne 0x5ca44d
movsx bx, cl
call fcn.00560506
push ebx
in eax, dx
test byte [eax + 0x56], cl
imul ebx, dword [edi - 0x7bf07249], 0x6f38655f
xor eax, 0x596d4077
dec edi
pop edi
push ecx
insb byte es:[edi], dx
aas
test byte [0xe1c5efb3], ah
leave
fld st(5)
loope 0x5808aa
mov ecx, 0xc34a49c
invalid
test ebx, ebx
mov dword [esp], 0x9113bdae
jmp 0x58086e
movzx cx, cl
movsx cx, al
movsx ecx, bl
sete ch
push eax
sete ch
movzx ecx, al
pushal
mov dword [esp + 0x1c], edi
pushal
movsx cx, al
pushfd
setle ch
mov ecx, esi
call fcn.00578544

Function at 0x58a23c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov dword [esp], ebx
call fcn.005b8fa9
pushfd
lea esp, [esp + 0xc]
je 0x5b8fbf
jmp 0x583a52

Function at 0x58b294
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
je 0x565672
lahf
pushal
push eax
mov ah, byte [esp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x541ab8
bt sp, 8
add esp, 8
cmp bl, ah
cmp bl, dh
pushfd
pushal
test edi, edi
jmp 0x567fac

Function at 0x58fa1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + 0x4bc42682]
mov word [esp + 8], 0xac4a
xchg dword [esp + 0x3c], edi
push 0x8a3cb879
push dword [esp + 0x40]
ret 0x44
lea esp, [esp + 8]
jne 0x565672
daa
mov edi, dword [esi + 0x2c]
pushal
inc ah
rcr ah, cl
rcl al, cl
mov dword [ebp - 4], 0
not ah
mov al, byte [esp]
jmp 0x5d050f
mov edi, edi
shl ax, 1
dec ah
cmp dword [ebp - 4], 0
push dword [esp + 0x10]
cwde
mov eax, dword [ebp + 0xc]
call fcn.005a1e3a
push 0x888f00d4
push dword [esp + 8]
mov edi, dword [edi + 0x14d2f6]
push ecx
mov dword [esp], ecx
jmp 0x570f9a

Function at 0x59feb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], edi
lea esp, [esp + 8]
je 0x565672
movzx ax, dl
inc ax
mov eax, dword [ebp - 4]
call fcn.005af6be

Function at 0x5a1e3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x5e24a8
not ah
push ecx
xchg bh, al
mov eax, dword [ebp + 0x10]
pop ebx
movzx ebx, dl
lea ebx, [ebp - 8]
pushal
jmp 0x58caf0
pushal
lea esp, [esp + 0x40]
call fcn.00542390
rcl bx, 1
movsx bx, dl
shl bl, cl
xor bh, 0x36
mov ebx, dword [ebp - 8]
test bh, 0x3c
test ax, 0xe25f
cmc
test eax, eax
call fcn.0056c5d0
push dword [esp + 4]
mov byte [esp + 0xc], dl
mov dword [ebp - 8], 0
push dword [esp + 8]
jmp 0x57a296
Function at 0x5b3056
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x565672
bts ax, bp
shld eax, ebp, 0x10
aad 0x14
mov edi, dword [esi + 0x2c]
sbb ah, 0xfc
aaa
rcl ah, cl
mov dword [ebp - 4], 0
pushfd
sal ax, 7
shl ah, 3
mov edi, edi
not eax
lea eax, [edi*4 - 0x75cd1189]
btr ax, 0xd
cmp dword [ebp - 4], 0
setle al
mov eax, dword [ebp + 0xc]
push dword [esp]
mov dword [ebp - 8], 0
mov dword [esp + 4], edx
pushal
lea esp, [esp + 0x28]
je 0x5e24a8
pushfd
mov eax, dword [ebp + 0x10]
mov word [esp], 0x78f2
jmp 0x5cb741
call fcn.00569960
in al, dx
pop edx
dec ecx
inc ebx
jbe 0x5c4768
out dx, eax
sbb ah, byte [eax - 0x7a]
ljmp 0xdbdb
pushal
lea ebx, [ebp - 8]
jmp 0x5c475e
push ecx
lea esp, [esp + 8]
je 0x5bdea5
cmp dh, 0x78
push ecx
call fcn.005a4014
not bl
setnp bl
setg bl
pushfd
lea ebx, [ebp - 8]
mov byte [esp], 0x7b
push esi
lea esp, [esp + 8]
call fcn.00542390
sbb ebx, 0xe0b2891c
mov ebx, dword [ebp - 8]
push 0x3a6868c9
test bl, 0x18
cmp cx, 0x7835
test eax, eax
jmp 0x5d8c71

Function at 0x5b839a
Capabilities:
Encode data using xor

Disassembly:
pushfd
nop
push dword [esp]
mov dword [esp + 8], eax
bswap eax
cwde
movzx eax, dl
mov eax, 0x52d98f
push dword [esp]
mov byte [esp + 8], 0x6d
push dword [esp + 4]
call fcn.00543a0c
pop edi
cld
mov ah, 0x15
mov ah, byte [ebx]
jle 0x5b83f9
outsb dx, byte [esi]
xor byte [esi + 0x3c], bh
push 0x1f496842
cdq
or al, ch
loopne 0x5b83c7
stc
int3
sbb eax, dword [edi + 0x64f2da36]
sbb dh, ah
push esp
invalid

Function at 0x5b8fa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 8]
call fcn.00547751
test al, ch
push 0x78a913ac
push ecx
pushfd
add esp, 0x10

Function at 0x5bf53c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt di, 3
test ebx, 0xffff0000
mov byte [esp + 8], ah
push dword [esp + 0xc]
push dword [esp + 0xc]
lea esp, [esp + 0x2c]
je 0x5b8fbf
pushal
mov dword [esp + 0x1c], ebx
mov byte [esp + 4], dl
lea esp, [esp + 0x1c]
call fcn.00547751
clc
call fcn.0058b294
pushal
jmp 0x58c706
Function at 0x5d3e9d
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x1c], ecx
call fcn.005d75ff
sbb dword cs:[esi - 0x25], 0xffffff8d
dec ecx
add byte [eax], ch
add byte [eax], al
add byte [esi + 0xf], ah
mov esi, 0x896655fb
out 0xc7, eax
add al, 0x24
add byte [eax], al
add byte [eax], al
mov di, sp
push 0x83ae757d
mov dword [esp], esi
lea edi, [esi + 0x25d4a84b]
pushfd
bswap di
movzx edi, cl
mov edi, eax
push 0xb5408c04
push edx
jmp 0x56e67c
call fcn.0053f560
not ch
movzx ecx, al
movsx ecx, bl
mov ecx, 0x559a02
push 0x72f69104
lea esp, [esp + 4]
jo 0x5cecdc
mov ecx, dword [ecx + 0x176433]
call fcn.005aa5a1
call fcn.0054311c
pushfd
mov dword [esp], 0x691449
call fcn.00564719
push 0xe0c27f2c
push 0xdf288433
pushal
mov dword [esp + 0x24], 2
call fcn.00566c86
pushfd
xchg dword [esp + 0x10], ecx
push dword [esp]
lea esp, [esp + 0x14]
jg 0x5cda23
push ebp
pushal
mov dword [esp + 0x20], ecx
lea esp, [esp + 0x20]
jne 0x56b7f8
bswap cx
movsx cx, bl
mov ecx, 0x559a02
pushal
pushal
lea esp, [esp + 0x40]
jo 0x5ae070
pushal
mov ecx, dword [ecx + 0x176433]
mov byte [esp], 0xfb
push 0x4002271d
lea ecx, [ecx - 0x401db355]
mov byte [esp + 4], bl
call fcn.005a1835
add dh, byte [0x4d57486b]
invalid
push esp
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 8], 0xffffffff
jmp 0x59b8f3
mov ecx, dword [ecx + 0x176433]
call fcn.00568eda
stc
call fcn.0058a57f
mov dword [esp + 4], ebx
jmp 0x569ff0
jmp 0x5880ca
call fcn.0057544c
bswap cx
setae cl
lea ecx, [ebp - 0x4d0]
jmp 0x547190
call fcn.00581af3
lea esp, [esp + 0x40]
jne 0x56cee4
push 2
jmp 0x56b9f3

Function at 0x5d510f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x567f9b
setl dl
movzx dx, bl
mov edx, 0x52bf73
call fcn.005de460
jmp 0x5d782c
push dword [esp + 8]
xchg dword [esp + 0x14], edx
pushal
mov byte [esp + 4], ah
xchg dword [esp + 0x30], edx
jmp 0x547030

Function at 0x5dcdca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop esi
mov esi, dword [esp + 0x24]
jmp 0x56e25f

Function at 0x5e248a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 8], 0
pushal
push eax
lea esp, [esp + 0x3c]
je 0x5e24a8
xchg bx, ax
movsx eax, al
setle al
mov eax, dword [ebp + 0x10]
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x640008], 0x8088405
inc edx
mov dword [ebx + 0x640008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x62454a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x6258af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x642348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x642348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x641178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6258b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x7ab050
Capabilities:
Encode data using xor

Disassembly:
dec ebp
and cl, ah
mov esi, 0xeb0000f2
jmp 0x7ab05a
add byte [edx + 3], cl
add byte [eax], al
pushal
call 0x7ab060
jmp 0x7ab05a
pushal
call 0x7ab060
pop ebp
sub ebp, 0x10
sub ebp, 0x3ab050
jmp 0x7ab076
mov eax, 0x3ab050
add eax, ebp
add eax, 0x4c
mov ecx, 0x61e
mov edx, 0x4a03fb2d
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ab08d
jmp 0x7ab0a0
cmpsb byte [esi], byte es:[edi]
loopne 0x7ab049
movsb byte es:[edi], byte [esi]
adc dword [0xecac2d2d], ebp
aad 0x2d
sub eax, 0x95e02e2d
sub dword [0x5972d2d], ebp
sub eax, 0xcfda2d2d
in eax, 0xa6
lodsb al, byte [esi]
and dword [0xe82e2d2d], ebp
mov al, byte [0xa4d10949]
sub dword [ecx], ecx
mov al, byte [0xa4d10949]
sub dword [ecx], ecx
inc ebp
lds edx, [eax + 0x23]
sub eax, 0x11f4b45
sub eax, 0x4509012c
invalid
Function at 0x40147c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x4014e6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4014c3
call fcn.00404714
mov ebx, eax
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.File__1_not_found._LastError:__2_x_
push 1
push 4
push ebx
call dword [esi + 0x1c]
add esp, 0x18
xor al, al
jmp 0x40152e
call fcn.00401393
test eax, eax
jne 0x4014e4
call fcn.00404714
mov ebx, eax
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Could_not_load__1._LastError:__2_x_
jmp 0x4014b4
mov dword [esi], eax
push str.AVCOM_Initialize
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401524
call fcn.00404714
mov ebx, eax
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AVCOM_Initialize_not_found._LastError:__1_x_
push 1
push 4
push ebx
call dword [edi + 0x1c]
add esp, 0x14
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
jmp 0x4014bf
push dword [esi + 8]
push dword [esi + 4]
call eax
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x40178c
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x40c49d
call fcn.0040c088
xor ebx, ebx
push str.REGMASTERKEY
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp + 8]
push eax
call fcn.0040192f
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
mov eax, dword [0x411e58]
mov ecx, 0x411e58
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], ebx
je 0x4017e7
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401829
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040498d
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00403427
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00403a20
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x40188e
push ebx
push 0x23
push 0x104
lea esi, [ebp - 0x10]
call fcn.004039cf
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0040338f
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
je 0x401891
mov ecx, dword [ebp + 8]
push str.ANTIVIR_PATH
lea eax, [ebp + 8]
push eax
call fcn.0040192f
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004047c8
mov esi, dword [ebp + 8]
push dword [esi - 0xc]
lea eax, [ebp - 0x10]
push esi
call fcn.004036d5
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
call fcn.00403a20
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
call fcn.00403539
mov edi, dword [ebp + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [esi - 0x10]
call fcn.00403a20
cmp dword [ebp - 0x1c], ebx
je 0x4018b7
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00403a20
mov eax, edi
call fcn.0040c12a
ret 8