joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push ecx
call fcn.00405940
add esp, 8
test eax, eax
jne 0x4069c7
ret
cmp dword [esp + 4], 0xfa8
je 0x4069e4
push str.Not_System_Flag_file.
push 0xd09bfc
call dword [0x4a1204]
xor eax, eax
ret
mov ecx, dword [0x4c239c]
test ecx, ecx
push esi
push edi
je 0x406a1f
push ebx
mov bl, byte [eax + 0xfa0]
xor esi, esi
mov edx, eax
xor bl, 0xb1
mov edi, 0xfa0
mov cl, byte [edx]
xor cl, bl
xor cl, 0xf4
mov byte [edx], cl
and ecx, 0xff
xor ecx, 0xd3
add esi, ecx
inc edx
dec edi
jne 0x406a03
pop ebx
mov edi, dword [0xd0abec]
mov esi, eax
mov ecx, 0x3e8
push eax
rep movsd dword es:[edi], dword [esi]
call dword [0x4a1190]
pop edi
mov eax, 1
pop esi
ret

Function at 0x40d940
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x40d987
mov ecx, dword [esi + 0x10]
cmp ecx, 3
je 0x40d958
cmp ecx, 2
jne 0x40d966
push eax
call dword [0x4a10c8]
mov dword [esi + 0x10], 1
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [0x4a117c]
mov ecx, dword [esi]
push ecx
call dword [0x4a1290]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [esi + 8]
push edx
push 0
push esi
push 0x40d8b0
push 0
push 0
mov dword [esi + 0x10], 1
call fcn.0044f2cb
add esp, 0x18
test eax, eax
mov dword [esi], eax
jne 0x40d9ae
pop esi
ret
mov ecx, dword [esi + 0xc]
push ecx
push eax
call dword [0x4a11d0]
mov eax, 1
pop esi
ret
Function at 0x40d9c0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xc
mov eax, dword [0x8c3adc]
push ebp
mov ebp, dword [0x8c39d0]
push esi
mov esi, dword [eax + 0x80]
mov eax, dword [esi + ebp + 0xc]
add esi, ebp
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
je 0x40da8b
push ebx
jmp 0x40d9fa
mov esi, dword [esp + 0x14]
lea edx, [eax + ebp]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00474180
add dword [esp + 0x18], eax
mov ebx, dword [esi + 0x10]
mov esi, dword [esi]
mov eax, dword [esi + ebp]
add esi, ebp
add esp, 8
add ebx, ebp
test eax, eax
je 0x40da72
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx]
add edx, ecx
test eax, 0x80000000
mov dword [esp + 0x18], edx
je 0x40da41
and eax, 0x7fffffff
jmp 0x40da5b
lea edx, [eax + ebp + 2]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00474180
add esp, 8
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esi + 4]
add esi, 4
add ebx, 4
test eax, eax
mov dword [esp + 0x10], ecx
jne 0x40da27
mov eax, dword [esp + 0x14]
add eax, 0x14
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x40d9f6
xor edi, edi
pop ebx
mov eax, dword [0x8c35bc]
mov esi, dword [0x8c39d4]
mov edx, dword [esp + 0x14]
push eax
push esi
mov dword [0x8c3eec], edi
mov dword [0x4c2014], edx
call fcn.00474180
mov ecx, dword [0x8c35bc]
mov dword [0x8c3ee8], eax
add esp, 8
xor eax, eax
cmp ecx, edi
jbe 0x40dad2
cmp byte [esi + eax], 0xcc
jne 0x40dacd
inc dword [0x8c3eec]
inc eax
cmp eax, ecx
jb 0x40dac1
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x4111f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xd06ba4]
sub esp, 8
test eax, eax
je 0x41120f
mov eax, dword [0xd06ba8]
push 0x8000
push 0
push eax
call dword [0x4a11fc]
push ebx
mov ebx, dword [0x4ba6f4]
push esi
push edi
push 0x40
push 0x3000
push ebx
push 0
call dword [0x4a11f4]
mov esi, eax
test esi, esi
jne 0x411235
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [0x4f9be4]
test eax, eax
jne 0x4112a7
cmp ebx, 0x400
mov edi, ebx
jb 0x41124d
mov edi, 0x400
call fcn.00415eb0
xor ecx, ecx
test edi, edi
mov dword [esp + 0x10], eax
jle 0x411290
push ebp
mov eax, ecx
cdq
mov ebp, 0xb4
idiv ebp
mov al, byte [ecx + 0x4ba6f8]
sub edx, 0x5a
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsin
fstp dword [esp + 0x10]
mov dl, byte [esp + 0x10]
xor al, dl
mov byte [ecx + 0x4ba6f8], al
inc ecx
cmp ecx, edi
jl 0x41125d
pop ebp
mov eax, dword [esp + 0x10]
push eax
call fcn.00415ef0
add esp, 4
mov dword [0x4f9be4], 1
push 0x4ba6f8
push esi
call fcn.0040a2c0
mov eax, dword [0xd07b98]
xor edi, edi
add esp, 8
cmp eax, edi
mov dword [0xd06ba4], esi
mov dword [0xd06ba8], esi
mov dword [0xd06bac], esi
mov dword [0xd06bb0], esi
mov esi, dword [0x4a1194]
mov dword [0xd06bcc], 1
mov dword [0xd06bb8], edi
mov dword [0xd06bbc], ebx
mov dword [0xd07b78], 0xffffffff
mov dword [0xd07b7c], edi
mov dword [0xd07b9c], 0x3e8
jne 0x411329
push 0xfa0
push 0x40
call esi
cmp eax, edi
mov dword [0xd07b98], eax
jne 0x411329
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [0xd07ba0], edi
jne 0x41134c
push 0xfa0
push 0x40
call esi
cmp eax, edi
mov dword [0xd07ba0], eax
jne 0x41134c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x415390
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [0x8c35bc]
mov ecx, dword [0x8c39d4]
xor edx, edx
test eax, eax
push esi
jbe 0x4153ac
cmp byte [ecx], 0xcc
jne 0x4153a8
inc edx
inc ecx
dec eax
jne 0x4153a2
mov esi, dword [0x4c28f0]
push eax
mov eax, esp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp eax, eax
je 0x4153c4
addps xmm7, xmmword [ebx]
adc eax, 0x8c3eec
pop eax
cmp edx, dword [0x8c3eec]
je 0x4153d1
xor eax, eax
pop esi
ret
mov eax, dword [0xd0abc4]
push 0
push 0
push 0x4c28f8
push eax
call fcn.004761f0
mov ecx, dword [0xd0abc4]
add esp, 0x10
push esi
push ecx
call dword [0x4a11c4]
push eax
call dword [0x4a11d4]
pop esi
mov eax, 1
ret
Function at 0x4157b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push 0
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x80000000
push ebx
push 0
push ebp
call fcn.00405350
add esp, 0x20
cmp eax, 0xffffffff
jne 0x4157e5
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
mov edi, dword [0x4a1290]
push eax
call edi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x415816
push 0xffffffffffffffff
push eax
call dword [0x4a117c]
mov edx, dword [esi + 0xc]
push edx
call edi
mov dword [esi + 0xc], 0
mov dword [esi], 0
mov edi, dword [0x4a1204]
push ebp
lea eax, [esi + 0x20]
push eax
call edi
push ebx
lea ecx, [esi + 0x124]
push ecx
call edi
lea edx, [esi + 0x10]
push edx
push 0
push esi
push 0x415690
push 0
push 0
mov dword [esi], 1
call fcn.0044f2cb
add esp, 0x18
test eax, eax
mov dword [esi + 0xc], eax
pop edi
jne 0x415857
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x14]
push ecx
push eax
call dword [0x4a11d0]
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4171e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.004164d0
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.004164d0
mov esi, eax
lea eax, [esi + 0x1f]
shr eax, 3
lea ecx, [eax + esi + 4]
push ecx
push 0x40
call dword [0x4a1194]
mov edx, dword [ebp - 8]
mov ebx, eax
push esi
push edx
lea edi, [ebx + 4]
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx], esi
call fcn.0040a280
mov edx, eax
mov esi, 0x400
add esp, 0xc
cmp edx, esi
mov dword [ebp - 0xc], edx
jae 0x41723a
mov esi, edx
wait
fnstcw word [ebp - 8]
mov ecx, dword [ebp - 8]
test ch, 3
jne 0x417253
mov al, cl
and al, 0x3f
cmp al, 0x3f
jne 0x417253
test ch, 0xc
je 0x41726a
mov ax, word [ebp - 8]
and ax, 0xfcff
or ax, 0x3f
and ax, 0xf3ff
mov word [ebp - 2], ax
fldcw word [ebp - 2]
mov dword [ebp - 8], ecx
xor ecx, ecx
test esi, esi
jle 0x4172a1
mov eax, ecx
cdq
mov ebx, 0xb4
idiv ebx
mov bl, byte [edi + ecx]
sub edx, 0x5a
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsin
fstp dword [ebp - 4]
mov dl, byte [ebp - 4]
xor bl, dl
mov byte [edi + ecx], bl
inc ecx
cmp ecx, esi
jl 0x417273
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
fldcw word [ebp - 8]
mov ecx, dword [ebp + 8]
add edx, 4
push edx
push ebx
call fcn.004164d0
push eax
call fcn.00406090
add esp, 0xc
test eax, eax
push ebx
jne 0x4172d1
call dword [0x4a1190]
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
call dword [0x4a1190]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4172e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.004164d0
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.004164d0
mov esi, eax
lea eax, [esi + 0x1f]
shr eax, 3
lea ecx, [eax + esi + 4]
push ecx
push 0x40
call dword [0x4a1194]
mov edx, dword [ebp - 8]
mov ebx, eax
push esi
push edx
lea edi, [ebx + 4]
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebx], esi
call fcn.0040a280
mov esi, 0x400
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x10], eax
jae 0x417338
mov esi, eax
wait
fnstcw word [ebp - 8]
mov ecx, dword [ebp - 8]
test ch, 3
jne 0x417351
mov al, cl
and al, 0x3f
cmp al, 0x3f
jne 0x417351
test ch, 0xc
je 0x417368
mov ax, word [ebp - 8]
and ax, 0xfcff
or ax, 0x3f
and ax, 0xf3ff
mov word [ebp - 2], ax
fldcw word [ebp - 2]
mov dword [ebp - 8], ecx
xor ecx, ecx
test esi, esi
jle 0x41739c
mov eax, ecx
cdq
mov ebx, 0xb4
idiv ebx
mov bl, byte [edi + ecx]
sub edx, 0x5a
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsin
fstp dword [ebp - 4]
mov dl, byte [ebp - 4]
xor bl, dl
mov byte [edi + ecx], bl
inc ecx
cmp ecx, esi
jl 0x417371
mov ebx, dword [ebp - 0xc]
fldcw word [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004164d0
mov ecx, edi
mov esi, eax
call fcn.004164d0
mov ecx, dword [ebp - 0x10]
push ecx
push ebx
push eax
push esi
call fcn.00405fd0
add esp, 0x10
test eax, eax
push ebx
jne 0x4173d8
call dword [0x4a1190]
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
call dword [0x4a1190]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4173f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.004164d0
push eax
call fcn.00405940
mov esi, eax
add esp, 8
test esi, esi
jne 0x417420
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, ebx
call fcn.004164d0
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov edi, 0x400
cmp eax, edi
mov dword [ebp - 8], eax
jae 0x41743b
mov edi, eax
wait
fnstcw word [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
test ch, 3
jne 0x417456
mov dl, cl
and dl, 0x3f
cmp dl, 0x3f
jne 0x417456
test ch, 0xc
je 0x41746d
mov ax, word [ebp - 0xc]
and ax, 0xfcff
or ax, 0x3f
and ax, 0xf3ff
mov word [ebp - 2], ax
fldcw word [ebp - 2]
mov dword [ebp - 4], ecx
xor ecx, ecx
test edi, edi
jle 0x4174a3
mov eax, ecx
cdq
mov ebx, 0xb4
idiv ebx
mov bl, byte [esi + ecx + 4]
sub edx, 0x5a
mov dword [ebp - 0xc], edx
fild dword [ebp - 0xc]
fsin
fstp dword [ebp - 0xc]
mov al, byte [ebp - 0xc]
xor bl, al
mov byte [esi + ecx + 4], bl
inc ecx
cmp ecx, edi
jl 0x417476
mov ebx, dword [ebp + 8]
fldcw word [ebp - 4]
mov edx, dword [ebp - 0x10]
lea ecx, [esi + 4]
push ecx
push edx
call fcn.0040a2c0
add esp, 8
push esi
call dword [0x4a1190]
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.00415f80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4174d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, ebx
call fcn.004164d0
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.00405940
mov esi, eax
add esp, 8
test esi, esi
jne 0x417500
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push edi
mov edi, 0x400
cmp eax, edi
mov dword [ebp - 8], eax
jae 0x417511
mov edi, eax
wait
fnstcw word [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
test ch, 3
jne 0x41752c
mov dl, cl
and dl, 0x3f
cmp dl, 0x3f
jne 0x41752c
test ch, 0xc
je 0x417543
mov ax, word [ebp - 0xc]
and ax, 0xfcff
or ax, 0x3f
and ax, 0xf3ff
mov word [ebp - 2], ax
fldcw word [ebp - 2]
mov dword [ebp - 4], ecx
xor ecx, ecx
test edi, edi
jle 0x417579
mov eax, ecx
cdq
mov ebx, 0xb4
idiv ebx
mov bl, byte [esi + ecx + 4]
sub edx, 0x5a
mov dword [ebp - 0xc], edx
fild dword [ebp - 0xc]
fsin
fstp dword [ebp - 0xc]
mov al, byte [ebp - 0xc]
xor bl, al
mov byte [esi + ecx + 4], bl
inc ecx
cmp ecx, edi
jl 0x41754c
mov ebx, dword [ebp + 8]
fldcw word [ebp - 4]
mov ecx, dword [ebp - 8]
push ecx
push 0x40
call dword [0x4a1194]
lea edx, [esi + 4]
mov edi, eax
push edx
push edi
call fcn.0040a2c0
add esp, 8
push esi
call dword [0x4a1190]
mov edx, edi
mov ecx, ebx
call fcn.00415f80
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.00415f80
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [0x4d416c]
test eax, eax
push esi
push edi
mov edi, dword [esp + 0xc]
je 0x4741bd
xor edx, edx
mov ecx, 0x4d416c
mov eax, edx
mov esi, 8
test al, 1
je 0x4741aa
shr eax, 1
xor eax, 0xedb88320
jmp 0x4741ac
shr eax, 1
dec esi
jne 0x47419d
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x4d456c
jb 0x474196
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x4741ea
inc ecx
xor edx, edx
mov dl, byte [edi]
mov esi, eax
and esi, 0xff
shr eax, 8
xor edx, esi
mov edx, dword [edx*4 + 0x4d416c]
xor eax, edx
inc edi
dec ecx
jne 0x4741cc
pop edi
not eax
pop esi
ret
Function at 0x479600
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x20]
xor ebx, ebx
test eax, eax
push edi
je 0x4796d2
mov edi, dword [0x4a1180]
push ebx
push ebx
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x34], eax
call edi
mov dword [esi + 0x38], eax
mov ecx, dword [0x4e7198]
xor eax, eax
test ecx, ecx
jle 0x479657
lea ecx, [esi + 0x44]
mov edx, dword [esi + 0x24]
inc eax
imul edx, eax
mov dword [ecx - 4], edx
mov edx, dword [esi + 0x34]
mov dword [ecx], edx
mov edx, dword [0x4e7198]
add ecx, 8
cmp eax, edx
jl 0x47963b
mov ecx, dword [esi + eax*8 + 0x38]
lea edx, [esi + 0xc8]
push edx
push 0
push esi
dec ecx
mov dword [esi + eax*8 + 0x38], ecx
push 0x47a2f0
mov dword [esi + eax*8 + 0x40], 0xffffffff
mov ecx, dword [esi + 0x38]
push 0
push 0
mov dword [esi + eax*8 + 0x44], ecx
call fcn.0044f2cb
add esp, 0x18
test eax, eax
mov dword [esi + 0x30], eax
je 0x4796fd
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [esi + 0x40]
push edx
mov edx, dword [0x4e7198]
inc edx
push edx
push eax
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
je 0x4796cc
mov eax, dword [esi + 0x34]
mov ebx, dword [0x4a1290]
push eax
call ebx
mov ecx, dword [esi + 0x38]
push ecx
call ebx
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov eax, edi
pop edi
pop esi
pop ebx
ret
lea edx, [esi + 0xc8]
push edx
push 0
push esi
push 0x47a4d0
push 0
push 0
call fcn.0044f2cb
add esp, 0x18
test eax, eax
mov dword [esi + 0x30], eax
jne 0x4796fd
pop edi
pop esi
mov eax, 0x80004001
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x47a160
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x47a16d
xor eax, eax
pop esi
ret
lea eax, [esi + 0xd0]
push eax
push 0
push esi
push 0x47a200
push 0
push 0
call fcn.0044f2cb
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0xcc], eax
pop esi
mov eax, ecx
ret
Function at 0x48eb60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x131c
call fcn.0044fbe0
mov eax, dword [esp + 0x1320]
push ebx
push ebp
push esi
push edi
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0048ea30
sub esp, 8
mov edi, esp
mov eax, 0x48ea90
mov dword [edi], eax
push 0
lea edx, [esp + 0x58]
mov ecx, 0x48eaf0
mov dword [edi + 4], ecx
mov dword [esp + 0x28], edx
push 0
lea eax, [esp + 0x74]
mov edx, fcn.00479130
push eax
lea ecx, [esp + 0x30]
mov dword [edi + 8], edx
mov esi, 0x48eb50
push ecx
mov dword [edi + 0xc], esi
call fcn.0049cd70
add esp, 0x20
test eax, eax
jge 0x48ebd3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x131c
ret
lea edx, [esp + 0x5c]
push 0xffffffffffffffff
push edx
call fcn.0049f420
mov esi, eax
lea eax, [esp + 0x64]
push 0xffffffffffffffff
push eax
call fcn.0049de80
mov ecx, eax
imul ecx, dword [esi + 4]
shl ecx, 1
lea edx, [ecx + 0x24]
mov dword [esp + 0x2c], edx
mov dx, word [esi + 4]
mov esi, dword [esi + 8]
mov eax, 0x10
mov dword [esp + 0x38], eax
mov word [esp + 0x4a], ax
mov word [esp + 0x3e], dx
mov dword [esp + 0x40], esi
mov eax, dword [esp + 0x3e]
and eax, 0xffff
shl eax, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
mov word [esp + 0x48], ax
mov eax, dword [esp + 0x48]
and eax, 0xffff
imul eax, esi
add esp, 0x10
mov dword [esp + 0x40], ecx
add ecx, 0x2c
push ecx
push 0
mov dword [esp + 0x20], 0x46464952
mov dword [esp + 0x28], 0x45564157
mov dword [esp + 0x2c], 0x20746d66
mov word [esp + 0x34], 1
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0x61746164
call dword [0x4a1194]
mov ebp, eax
test ebp, ebp
jne 0x48ec8f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x131c
ret
mov ecx, 0xb
lea esi, [esp + 0x18]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 1
push 2
push 0
push 0x1000
lea edx, [esp + 0x340]
push edx
lea eax, [esp + 0x74]
push eax
lea ebx, [ebp + 0x2c]
call fcn.0049f850
add esp, 0x1c
test eax, eax
je 0x48ed0c
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, ebx
lea esi, [esp + 0x32c]
rep movsd dword es:[edi], dword [esi]
add ebx, eax
lea eax, [esp + 0x10]
push eax
push 1
mov ecx, edx
push 2
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0x1000
lea ecx, [esp + 0x340]
push ecx
lea edx, [esp + 0x74]
push edx
call fcn.0049f850
add esp, 0x1c
test eax, eax
jne 0x48ecc8
lea eax, [esp + 0x5c]
push eax
call fcn.0049cc70
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x131c
ret
Function at 0x403300
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x2b8767c]
mov ecx, dword [0x2b84588]
sub esp, 0x424
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x4033f7
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x2b8767c], 0x959
jne 0x4033dd
call edi
push 0
lea eax, [esp + 0x34]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0x402cb8
push 0x402d60
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [esp + 0x14]
push edx
call fcn.00403140
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403340
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
Function at 0x408e90
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430c30]
jne 0x408e9a
repz ret
jmp fcn.0040b9ac

Function at 0x40b177
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405327
and dword [ebp - 4], 0
cmp dword [0x431fc4], 0
mov ebx, eax
jne 0x40b228
push 0x402ac4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ab8
push edi
call esi
test eax, eax
je 0x40b2d9
push eax
call fcn.004052b5
mov dword [esp], 0x402aa8
push edi
mov dword [0x431fc4], eax
call esi
push eax
call fcn.004052b5
mov dword [esp], 0x402a94
push edi
mov dword [0x431fc8], eax
call esi
push eax
call fcn.004052b5
mov dword [esp], 0x402a78
push edi
mov dword [0x431fcc], eax
call esi
push eax
call fcn.004052b5
pop ecx
mov dword [0x431fd4], eax
test eax, eax
je 0x40b228
push 0x402a60
push edi
call esi
push eax
call fcn.004052b5
pop ecx
mov dword [0x431fd0], eax
mov eax, dword [0x431fd0]
cmp eax, ebx
je 0x40b280
cmp dword [0x431fd4], ebx
je 0x40b280
push eax
call fcn.00405330
push dword [0x431fd4]
mov esi, eax
call fcn.00405330
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b280
test edi, edi
je 0x40b280
call esi
test eax, eax
je 0x40b277
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b277
test byte [ebp - 0xc], 1
jne 0x40b280
or dword [ebp + 0x10], 0x200000
jmp 0x40b2b9
mov eax, dword [0x431fc8]
cmp eax, ebx
je 0x40b2b9
push eax
call fcn.00405330
pop ecx
test eax, eax
je 0x40b2b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2b9
mov eax, dword [0x431fcc]
cmp eax, ebx
je 0x40b2b9
push eax
call fcn.00405330
pop ecx
test eax, eax
je 0x40b2b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431fc4]
call fcn.00405330
pop ecx
test eax, eax
je 0x40b2d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b2db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405540
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x90c
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x114]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [edx + 0x941]
cmp al, 0x3a
je 0x4055a0
cmp byte [edx + 0x940], 0x5c
je 0x4055a0
cmp al, 0x5c
je 0x4055a0
mov edi, dword [esp + 0x91c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x940]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 3
mov ecx, ebx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x24]
push 0x80000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40560e
lea ecx, [esp + 0x10]
push ecx
push 0x21
push 0x42b5c8
call fcn.00409860
add esp, 0xc
or eax, esi
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
lea edx, [esp + 0xc]
push 0
push edx
lea eax, [esp + 0x11c]
push 0x800
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x405657
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
push 0x21
push 0x42b5c8
call fcn.00409860
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x114]
push edx
call fcn.00415180
mov al, byte [esp + 0x118]
add esp, 4
test al, al
lea esi, [esp + 0x114]
je 0x4056c6
mov bl, 0x6d
cmp byte [esi], 0x69
jne 0x40569f
cmp byte [esi + 4], bl
jne 0x40569f
push 8
push str.inf_mode
push esi
call fcn.00415140
add esp, 0xc
test eax, eax
je 0x4056b5
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x405681
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x90c
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x90c
ret 4
Function at 0x405f10
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push 0
push str.vs98
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405f50
mov eax, 1
add esp, 0x208
ret
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add esp, 0x208
ret