joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b09f0
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5b0a6b
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005af5e4
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5b0a27
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5b0a3e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005af5e4
add esp, 4
test eax, eax
jbe 0x5b0a6b
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005af5e4
add esp, 4
cmp esi, eax
jb 0x5b0a50
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x5b1ba0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x73e510], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x5b1c36
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x73e510
mov dword [0x73e510], 0x11c
mov dword [0x73e514], 6
mov dword [0x73e518], 1
mov word [0x73e624], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x6942c4], eax
jmp 0x5b1c3b
mov eax, dword [0x6942c4]
cmp eax, esi
je 0x5b1c4a
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x5b1d6a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x5b1d68
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x5b1d68
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x5b1d68
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x5b1ca0
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x5b1d1f
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x5b1d68
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x5b1d68
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x5b1d68
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x5b1d06
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x643a5c
push 0x26
jmp 0x5b1d25
cmp word [esi + edi*2 - 4], 0x5c
je 0x5b1d33
push 0x664cf8
add edi, 1
push edi
push esi
call fcn.005b19f0
jmp 0x5b1d33
push 0x643a5c
push eax
call fcn.005b1a90
mov esi, eax
add esp, 8
test esi, esi
je 0x5b1d68
push esi
call fcn.005af5e4
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.005b2e1a
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x5b1d68
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x5b1ca0
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x5b2110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.005b1fa0
mov esi, eax
add esp, 4
test esi, esi
je 0x5b2152
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5b2134
test al, 0x50
je 0x5b2152
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x5b2147
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x10001de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10001df3
pop dword [ebp - 0x3c]
mov eax, 0x566a87ee
sub eax, 0x466a69fb
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb127cc36
sub dword [ebp - 0x4c], 0x62d586eb
mov dword [ebp - 0x48], 0xe98882c6
add dword [ebp - 0x48], 0x48aac97f
mov dword [ebp - 0x44], 0xa93b1ba
add dword [ebp - 0x44], 0x41b89274
mov dword [ebp - 0x40], 0x3a42d2ed
add dword [ebp - 0x40], 0xc5bd2d13
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4c5d4a8c
add eax, 0xc3a2e578
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x41b13f02
sub dword [ebp - 0x4c], 0xcd3ed5ac
mov dword [ebp - 0x48], 0x6d552cb8
add dword [ebp - 0x48], 0xd41734bd
mov dword [ebp - 0x44], 0x38ee94eb
sub dword [ebp - 0x44], 0xd57f287f
mov dword [ebp - 0x40], 0xefbea2d2
sub dword [ebp - 0x40], 0xefbea2d2
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x3eee2302
add eax, 0xd1120d0a
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3625c
push 0
call eax
mov ecx, 0x46a9
xor edx, edx
add edx, eax
mov ebx, 0xe70271c5
sub ebx, 0xd7020dc5
add ebx, dword [ebp - 0x3c]
mov esi, 0xf0f62ef3
sub esi, 0xd793143d
xor dword [ebp - 4], edx
mov edi, dword [ebx]
sub dword [ebp - 0x2c], 0xc2516f7a
xor edi, esi
xor dword [ebp - 0x1c], 0xdeddbaff
mov dword [edx], edi
add dword [ebp - 8], 0x1e268495
add edx, 4
add ebx, 0xebe72012
sub ebx, 0xebe7200e
loop 0x10001f11
add eax, 0x5390441e
add eax, 0xac70c959
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40597c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0xc]
push esi
push edi
push eax
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x4214e0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4059d6
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push edi
push str.iLastSvcSuccess
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 0x230]
mov dword [ebp - 0x18], 0x405b40
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
cmp dword [esi + 0x454], edi
je 0x405a16
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x405a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x454], edi
cmp dword [esi + 0x454], edi
jne 0x405a1d
mov ecx, esi
call fcn.00405bdd
pop edi
pop esi
leave
ret

Function at 0x406594
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x406580
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40659e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4065fc
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4065e3
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4065ec
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4065f6
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4065d8
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406562
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x406649
dec eax
je 0x406640
sub eax, 3
je 0x406637
mov dword [ebp - 4], 0x40
jmp 0x406666
mov dword [ebp - 4], 4
jmp 0x40664c
mov dword [ebp - 4], 0x20
jmp 0x40664c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x406698
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x406618
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00405ea9
pop esi
inc ebx
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, 0xfffffffe
je 0x409eaf
mov ecx, dword [esi + 4]
add ecx, edi
xor ecx, dword [eax + edi]
call fcn.0040797f
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add ecx, edi
xor ecx, dword [eax + edi]
pop edi
pop esi
pop ebp
jmp fcn.0040797f

Function at 0x10001020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x73
mov byte [ebp - 0x21], 0x6b
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x70
mov byte [ebp - 0x1d], 0x2e
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0
mov eax, dword [0x10002024]
mov dword [ebp - 0x10], eax
mov cx, word [0x10002028]
mov word [ebp - 0xc], cx
mov byte [0x1000300d], 0
mov byte [0x1000301a], 0
mov byte [0x10003026], 0
mov byte [0x10003032], 0
mov byte [0x10003044], 0
mov byte [0x10003051], 0
mov byte [0x10003065], 0
mov byte [0x10003073], 0
mov byte [0x10003081], 0
mov byte [0x1000308e], 0
mov byte [0x100030a1], 0
mov byte [0x100030aa], 0
push 0x100030a2
push 0x1000202c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x10003066
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0x14], 0x7bf
jne 0x100010ff
call fcn.10001000
push 1
push 0
push 0
lea edx, [ebp - 0xe]
push edx
push 0
push 0
call dword [ebp - 0x18]
push 0x10003027
push 0x10002060
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0x1000300e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x24]
push eax
call dword [ebp - 4]
mov dword [0x100030b4], eax
push 0x40
push 0x1000
push 0x1000
push 0
call dword [ebp - 0x14]
mov dword [0x100030ac], eax
push 0
push 0x100030bc
push 0x1000
mov ecx, dword [0x100030ac]
push ecx
mov edx, dword [0x100030b4]
push edx
call dword [ebp - 8]
mov eax, dword [0x100030ac]
mov cl, byte [eax]
mov byte [0x100030b8], cl
mov dword [0x100030b0], 0x42
movzx edx, byte [0x100030b8]
xor edx, 0x4e
mov dword [0x100030c0], edx
mov dword [ebp - 0x28], 0
jmp 0x100011ce
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [0x100030bc]
jae 0x100011fe
mov edx, dword [0x100030ac]
add edx, dword [ebp - 0x28]
movzx eax, byte [edx]
xor eax, dword [0x100030c0]
add eax, dword [0x100030b0]
mov ecx, dword [0x100030ac]
add ecx, dword [ebp - 0x28]
mov byte [ecx], al
jmp 0x100011c5
call dword [0x100030ac]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001c091
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001c0a0
pop dword [ebp - 0x24]
mov eax, 0xbc47b1d8
add eax, 0x53ba0ec8
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x42da5
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x46d9
mov edx, eax
mov esi, 0x10187400
add esi, dword [ebp - 0x24]
mov ebx, 0x1451c43f
xor dword [ebp - 8], 0x8a33ba5f
mov edi, dword [esi]
add dword [ebp - 0x18], 0x4772b415
sub edi, ebx
mov dword [edx], edi
sub dword [ebp - 4], 0x6164e548
add edx, 4
add esi, 0xa759877c
add esi, 0x58a67888
loop 0x1001c0e8
add eax, 0xaffb62b7
sub eax, 0xaffa5480
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10072480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1007251b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100724d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100724d2
cmp esi, ebx
jge 0x100724d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10072515
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10072515
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783d8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783d8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007252d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
mov eax, dword [ebp + 8]
je 0x10072778
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072792
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001c091
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076730
leave
ret 4

Function at 0x10072960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072996
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100729f5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001c091
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001c091
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001c091
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076730
leave
ret 0x10
Function at 0x10072a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10072a3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10072a6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10072a6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001c091
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10072a6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076730
leave
ret 8
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x4260f8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0042617b
jae 0x426106
xor ecx, ecx
call fcn.0042617b
jae 0x426135
xor eax, eax
call fcn.0042617b
jae 0x426145
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0042617b
adc al, al
jae 0x426127
jne 0x426171
stosb byte es:[edi], al
jmp 0x426109
call fcn.00426187
sub ecx, ebx
jne 0x42614e
call fcn.00426185
jmp 0x42616d
lodsb al, byte [esi]
shr eax, 1
je 0x426197
adc ecx, ecx
jmp 0x42616a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00426185
cmp eax, 0x7d00
jae 0x42616a
cmp ah, 5
jae 0x42616b
cmp eax, 0x7f
ja 0x42616c
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x426109
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x90e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0090e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90e06a
add dl, dl
jne 0x90e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90e0dc
xor eax, eax
add dl, dl
jne 0x90e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90e17d
add dl, dl
jne 0x90e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x90e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x90e075
mov eax, 1
add dl, dl
jne 0x90e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x90e0e1
sub eax, ebx
mov ebx, 1
jne 0x90e128
mov ecx, 1
add dl, dl
jne 0x90e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x90e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x90e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x90e136
cmp eax, 0x7d00
jae 0x90e16d
cmp eax, 0x500
jb 0x90e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x90e075
cmp eax, 0x7f
ja 0x90e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x90e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x90e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40d0ec], 1
mov dword [0x40d0f0], 1
mov dword [0x40d0f4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x40183d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40186d
mov eax, dword [ebp - 0xc]
and eax, 0x10
test eax, eax
jne 0x40186d
mov eax, 1
jmp 0x401872
mov eax, 0
leave
ret