joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bdf4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46bf9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46bf80
mov dl, 1
mov eax, dword [0x417aa0]
call fcn.004037b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040464c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46bf6f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004597a8
test al, al
je 0x46bf62
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46bfb0
lea eax, [ebp - 0x254]
call fcn.0040a148
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46bf62
xor eax, eax
push ebp
push 0x46bf5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46bfe8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46bf44
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46bf44
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf62
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46be65
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c4d8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bfa6
lea eax, [ebp - 0x260]
call fcn.0040464c
ret

Function at 0x46c8e8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a5bc4]
cmp byte [eax + 0xa5], 0
jne 0x46c959
cmp dword [0x4a5bdc], 0
jne 0x46c91a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46c8a4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a5bdc], eax
cmp dword [0x4a5bd8], 0
jne 0x46c935
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a5bd8], eax
cmp dword [0x4a5be0], 0
jne 0x46c959
push esp
push 0
push 0
push 0x46c848
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a5be0], eax
pop edx
ret
Function at 0x46cfec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a5bc4]
cmp dword [eax + 0x30], 0
je 0x46d096
cmp dword [ebx + 0x94], 0
jne 0x46d090
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46cf7c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46d090
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46d056
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46d090
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419d94
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46d065
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46dbf4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46dc29
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040473c
jmp 0x46dc36
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046a0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46ed60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46eda1
mov eax, esi
call fcn.00454d70
test al, al
je 0x46eda1
mov eax, dword [ebx + 0x84]
call fcn.00454a6c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46eda1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00454a6c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x47d2a4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47d2ac
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47d49e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x47d4b4
mov eax, esi
call fcn.0047b130
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004046a0
lea ecx, [ebp - 0x10]
mov edx, 0x47d4c8
mov eax, esi
call fcn.0047b130
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004046a0
lea ecx, [ebp - 0x14]
mov edx, 0x47d4e0
mov eax, esi
call fcn.0047b130
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004046a0
lea ecx, [ebp - 0x18]
mov edx, 0x47d4fc
mov eax, esi
call fcn.0047b130
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004046a0
lea ecx, [ebp - 0x1c]
mov edx, 0x47d518
mov eax, esi
call fcn.0047b130
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004046a0
lea ecx, [ebp - 0x24]
mov edx, 0x47d530
mov eax, esi
call fcn.0047b130
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408a7c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409048
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x47d548
mov eax, esi
call fcn.0047b130
mov eax, dword [ebp - 0x28]
call fcn.00474c08
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x47d558
mov eax, esi
call fcn.0047b130
mov eax, dword [ebp - 0x2c]
call fcn.00474c08
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x47d570
mov eax, esi
call fcn.0047b130
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409048
inc eax
je 0x47d441
lea ecx, [ebp - 0x34]
mov edx, 0x47d570
mov eax, esi
call fcn.0047b130
mov eax, dword [ebp - 0x34]
call fcn.0040900c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aab8
fstp qword [ebp - 0x3c]
wait
call fcn.0040ae28
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x47d45c
lea ecx, [ebp - 0x40]
mov edx, 0x47d570
mov eax, esi
call fcn.0047b130
mov eax, dword [ebp - 0x40]
call fcn.00474c08
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x47d580
mov eax, esi
call fcn.0047b130
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004046a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d4a5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404670
ret
Function at 0x484230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48428a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00484220
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00473874
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00473474
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484291
lea eax, [ebp - 4]
call fcn.0040464c
ret
Function at 0x487b68
Capabilities:
Hash data using sha1

Disassembly:
xor edx, edx
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x487ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [ebx + 0xa0]
cmp eax, 0xffffffff
je 0x487d5d
cmp eax, 0x40
jbe 0x487d0f
lea edx, [ebx + 0x44]
mov eax, ebx
call fcn.00487b98
mov dword [ebx + 0xa0], 0x14
mov edx, 0x40
mov eax, dword [ebx + 0xa0]
sub edx, eax
mov edi, ebx
mov ecx, edi
add ecx, eax
mov eax, ecx
call fcn.00407534
mov edx, edi
mov eax, 0x10
xor dword [edx], 0x36363636
add edx, 4
dec eax
jne 0x487d30
lea eax, [ebx + 0x44]
call fcn.00487b68
lea ecx, [ebx + 0x44]
mov eax, ebx
mov edx, 0x40
call fcn.00487c48
mov dword [ebx + 0xa0], 0xffffffff
test esi, esi
jle 0x487d6e
lea ecx, [ebx + 0x44]
mov edx, esi
mov eax, dword [esp]
call fcn.00487c48
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x48f0b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404afc
xor eax, eax
push ebp
push 0x48f115
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x48f0f8
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00493f08
mov eax, dword [ebp - 8]
call fcn.00493ebc
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x48f0fa
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f11c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404670
ret

Function at 0x48f124
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404afc
xor eax, eax
push ebp
push 0x48f1f0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48f1cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x48f1b0
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00493f08
mov eax, dword [ebp - 0x10]
call fcn.00493ebc
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x48f1b4
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f1d2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x490270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
add esi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 8]
test ebx, ebx
jle 0x4902a4
call fcn.004933cc
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.00493368
inc dword [esi]
dec ebx
jne 0x49028d
pop esi
pop ebx
pop ebp
ret
Function at 0x4908f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404afc
xor eax, eax
push ebp
push 0x4909ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040464c
cmp dword [ebp - 4], 0
je 0x490954
mov eax, dword [ebp - 4]
call fcn.0049401c
test al, al
je 0x490954
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.00409aec
jmp 0x490965
lea eax, [ebp - 0x109]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.00409cc8
mov eax, dword [ebp - 0x110]
call fcn.0049401c
test al, al
jne 0x4909a1
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x109]
call fcn.00409cc8
mov eax, dword [ebp - 0x114]
call fcn.00494398
lea eax, [ebp - 0x109]
push eax
push 0
push 0x4909fc
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.00409cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4909f5
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404670
lea eax, [ebp - 4]
call fcn.0040464c
ret
Function at 0x493174
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x4931a0
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x4a4538]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x49317a
pop esi
pop ebx
ret

Function at 0x493368
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x4a6118
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x4a44bc]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x4a44bc]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x4933ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x493415
call fcn.004933cc
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.00493368
inc dword [esi]
dec ebx
jne 0x4933fe
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49341c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x493450
call fcn.004933cc
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.00493368
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x49342f
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49401c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404afc
xor eax, eax
push ebp
push 0x49406d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b0c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x494051
test al, 0x10
jne 0x494055
xor ebx, ebx
jmp 0x494057
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494074
lea eax, [ebp - 4]
call fcn.0040464c
ret

Function at 0x4941d4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4941fc
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004048bc
jmp 0x494205
mov eax, ebx
xor edx, edx
call fcn.00404c98
add esp, 0x104
pop ebx
ret
Function at 0x494cb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x494cc9
add esp, 0xfffffff0
call fcn.00403b58
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.00404afc
mov eax, dword [ebp + 0xc]
call fcn.00404afc
xor eax, eax
push ebp
push 0x494de8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0x9c]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x580]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x494d69
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.004908f8
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.004046a0
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.004046a0
mov byte [ebx + 0x50], 1
jmp 0x494d80
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.004046a0
lea eax, [ebx + 0x54]
call fcn.0040464c
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.00493764
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
test byte [0x4a6134], 2
jne 0x494dc5
xor eax, eax
mov al, byte [0x4a6135]
cmp ax, word [0x4a40e0]
jne 0x494dc5
cmp word [0x4a40dc], 0xd
je 0x494dc5
call fcn.00495590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494def
lea eax, [ebp - 8]
call fcn.0040464c
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404670
ret

Function at 0x495280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [0x4a4818]
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
mov esi, eax
xor ecx, ecx
push ebp
push 0x4952e0
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, edx
dec eax
test al, al
jb 0x4952d6
inc eax
xor edx, edx
mov dl, byte [esi]
xor edx, dword [ebp - 4]
and edx, 0xff
mov ecx, dword [0x4a44bc]
mov edx, dword [ecx + edx*4]
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xffffff
xor edx, ecx
mov dword [ebp - 4], edx
inc esi
dec al
jne 0x4952aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4952ea
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4981fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xf0]
mov edx, dword [ebp + 0xc]
call fcn.00409aec
push eax
lea eax, [ebp - 0xa0]
mov edx, dword [ebp + 0x10]
call fcn.00409aec
push eax
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.00409aec
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4999fc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor edx, edx
push ebp
push 0x499b5d
push dword fs:[edx]
mov dword fs:[edx], esp
sub al, 1
jb 0x499a20
je 0x499a3a
dec al
je 0x499a54
jmp 0x499b0f
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x4a6234]
mov ebx, eax
jmp 0x499b14
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x4a6234]
mov ebx, eax
jmp 0x499b14
push 0x80
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4f0]
call fcn.00404b0c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x499a85
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4f0]
call fcn.004095e4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x374]
call fcn.00409a20
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
test dword [eax + 0x1e46], 0x200
jbe 0x499ae8
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4f0]
mov dl, 1
call fcn.00494110
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 0x4f0
call fcn.004046a0
push 0
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x4a6234]
mov ebx, eax
jmp 0x499b14
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4f0]
call fcn.00404b0c
push eax
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x4a6234]
mov ebx, eax
jmp 0x499b14
mov ebx, 0xc
test ebx, ebx
je 0x499b47
push 0x499b74
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, ebx
call fcn.00498bdc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax + 0x3230]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x94]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499b64
lea eax, [ebp - 4]
call fcn.0040464c
ret

Function at 0x49ad14
Capabilities:
Terminate process

Disassembly:
push ecx
test edx, edx
je 0x49ad3c
push esp
push edx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x49ad3c
push 0xffffffffffffffff
mov eax, dword [esp + 4]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
pop edx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x40104e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 0xc], ecx
jbe 0x401068
mov dl, byte [esp + 8]
xor byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x40105a
ret

Function at 0x401069
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 0xc], ecx
jbe 0x401089
movzx edx, byte [eax + ecx*2]
xor dx, word [esp + 8]
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x401075
ret