joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080aa
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, ecx
mov esi, 0x4b6
push esi
mov eax, edi
call fcn.0040797a
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
xor ecx, ecx
inc eax
inc eax
mov dword [edi + 0x58], eax
push esi
inc ecx
mov eax, edi
call fcn.00407a09
xor ecx, ecx
inc esi
push esi
inc ecx
mov eax, edi
call fcn.00407a09
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x4d0]
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
push esi
push dword [edi + 4]
mov dword [edi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x408269
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, edi
mov dword [edi + 0x54], eax
call fcn.00407685
mov esi, eax
call fcn.00408343
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x409338
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x409340
mov dword [ecx*4 + 0x418f60], eax
inc ecx
cmp ecx, 0x100
jb 0x40933b
mov edx, 0x800
jmp 0x40938d
mov eax, dword [ecx*4 + 0x418b60]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x418f60]
inc ecx
mov dword [ecx*4 + 0x418f5c], eax
cmp ecx, edx
jb 0x40936c
mov dword [0x418d64], 0x413540
call fcn.0040e854
test eax, eax
jne 0x4093ae
mov dword [0x418d64], 0x413460
pop esi
ret
Function at 0x40ea05
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ea2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40ea2d
xor al, al
jmp 0x40ea48
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.004130d0
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
pop ebp
ret 4

Function at 0x4101f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x410209
leave
ret
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x41022c
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x410231
inc edi
cmp edi, dword [ebp - 8]
jb 0x410223
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x410322
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x4102b5
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x41025d
cmp cl, 0xff
jne 0x4102e4
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, dword [ebp + 0xc]
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4102f5
movzx esi, byte [edx + 0x4152e0]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
mov cl, bl
test cl, cl
je 0x4102a5
cmp cl, 0xff
jne 0x4102f2
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x41027b
dec ecx
shl edx, cl
and edx, 7
je 0x41024a
movzx ecx, byte [edx + 0x4152e0]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4152d8], 0
mov cl, byte [ebx + 4]
je 0x4102e1
test cl, cl
je 0x4102e1
cmp cl, 0xff
jne 0x41024a
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x41021e
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x41021e
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x412e1a
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x415f58
call fcn.00413118
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x418f40
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x412bdb
cmp eax, esi
jne 0x412bce
xor esi, esi
inc esi
mov ebx, esi
jmp 0x412bde
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412bb5
xor esi, esi
inc esi
mov eax, dword [0x418f3c]
cmp eax, esi
jne 0x412bf1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x412c20
mov eax, dword [0x418f3c]
test eax, eax
jne 0x412c1a
mov dword [0x418f3c], esi
push 0x4143dc
push 0x4143d0
call fcn.00412b24
pop ecx
pop ecx
test eax, eax
je 0x412c20
jmp 0x412d48
mov dword [0x4189fc], esi
mov eax, dword [0x418f3c]
cmp eax, esi
jne 0x412c44
push 0x4143cc
push 0x414388
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x418f3c], 2
test ebx, ebx
jne 0x412c50
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x418f44], 0
je 0x412c74
push 0x418f44
call fcn.00413064
pop ecx
test eax, eax
je 0x412c74
push 0
push 2
push 0
call dword [0x418f44]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x412cd0
test al, al
je 0x412c8e
cmp dword [ebp - 0x1c], 0
jne 0x412cd0
mov al, byte [esi]
test al, al
je 0x412c9e
cmp al, 0x20
ja 0x412c9e
inc esi
mov dword [ebp - 0x20], esi
jmp 0x412c8e
test byte [ebp - 0x3c], 1
je 0x412caa
movzx eax, word [ebp - 0x38]
jmp 0x412cad
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x4189f8], eax
cmp dword [0x4189ec], 0
jne 0x412d24
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x412cdf
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x412cf2
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x412c7b
cmp dword [0x4189fc], 0
jne 0x412d33
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4189f8]
jmp 0x412d54
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0041315d
ret
call fcn.004132ab
jmp 0x412b7b
Function at 0x100095d7
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10009612
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x100095f9
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1000960a
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10009614
inc edi
add eax, 0x28
cmp edi, esi
jb 0x100095ef
xor eax, eax
pop edi
pop esi
ret

Function at 0x10009c55
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
dec dword [ebx + 0x3b660c45]
inc edi
push es
jne 0x10009c6e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10009c8c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10009cea
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10009cd1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10009cda
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10009ce4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10009cc6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10009c50
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10009d37
dec eax
je 0x10009d2e
sub eax, 3
je 0x10009d25
mov dword [ebp - 4], 0x40
jmp 0x10009d54
mov dword [ebp - 4], 4
jmp 0x10009d3a
mov dword [ebp - 4], 0x20
jmp 0x10009d3a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10009d86
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10009d06
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10009597
mov eax, dword [0xff3f53af]
jne 0x10009d91
push 1
push esi
call edi
mov eax, esi
jmp 0x10009d92
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b44c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loope 0x1000b44d
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.10009508
add esp, 0xc
jmp 0x1000b50f
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.10009597
add cl, byte [ecx + ebx*4 - 0x6b]
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000b57a
lea eax, [ebp - 0x714]
push eax
call fcn.100095a7
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1000955c
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x1000b57a
jmp 0x1000af39
cmp dword [ebp - 0x37c], 0
je 0x1000b588
jmp 0x1000b63d
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1000b5e1
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1000b5e6
jmp 0x1000af39
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000b62d
lea eax, [ebp - 0x714]
push eax
call fcn.100095a7
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1000955c
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1000b638
jmp 0x1000b63d
jmp 0x1000af39
cmp dword [ebp - 0x37c], 0
jne 0x1000b6e7
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10009773
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x1000b6d3
lea eax, [ebp - 0x714]
push eax
call fcn.100095a7
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.1000963c
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x2014310
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x2014310], ecx
mov eax, dword [esi + 4]
mov dword [0x2014314], eax
mov edx, dword [esi + 8]
mov dword [0x2014318], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x201431c], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x2014320], esi
shl eax, 8
add eax, edx
mov dword [0x2014310], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x2014310], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x2014310], eax
call fcn.00401224
mov dword [0x2014314], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0xbe1000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0x1434440
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x6099669c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xc4909b7
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401638
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c88
call fcn.00410930
push edi
push dword [ebp + 8]
call fcn.00401f0b
mov edi, eax
cmp edi, 0xffffffff
pop ecx
mov dword [ebp - 4], edi
je 0x401768
push esi
xor esi, esi
push 0x2c82
lea eax, [ebp - 0x2c86]
push esi
push eax
mov word [ebp - 0x2c88], si
call sub.msvcrt.dll_memset
push 4
lea eax, [ebp - 0x2c88]
push eax
push edi
call fcn.0040253a
add esp, 0x18
cmp word [ebp - 0x2c88], 0xc350
jne 0x40175e
cmp word [ebp - 0x2c86], 0x80
jae 0x40175e
movzx eax, word [ebp - 0x2c86]
imul eax, eax, 0x59
push eax
lea eax, [ebp - 0x2c84]
push eax
push edi
call fcn.0040253a
add esp, 0xc
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40175e
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x401758
cmp word [ebp - 0x2c86], si
mov dword [ebp + 8], esi
jbe 0x401758
lea esi, [ebp - 0x2c82]
push ebx
movzx ebx, word [esi - 2]
cmp bx, 0xc000
jb 0x401708
lea eax, [esi + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
movzx ebx, ax
push dword [esi]
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x401745
push dword [esi]
push eax
push dword [esi + 4]
push dword [ebp - 4]
call fcn.00402b6e
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
movzx eax, bx
push edi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
movzx eax, word [ebp - 0x2c86]
inc dword [ebp + 8]
add esi, 0x59
cmp dword [ebp + 8], eax
jb 0x4016f0
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop edi
leave
ret 4

Function at 0x401941
Capabilities:
Link many functions at runtime

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x40194d
xor eax, eax
inc eax
pop edi
ret
push str.GDIPlus.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, edi
mov dword [esi], eax
je 0x4019e2
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GdiplusStartup
push eax
call edi
push str.GdiplusShutdown
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.GdipSaveImageToFile
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.GdipGetImageEncodersSize
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.GdipGetImageEncoders
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.GdipCreateBitmapFromHBITMAP
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.GdipDisposeImage
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GdipLoadImageFromFile
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
push str.GdipCreateHBITMAPFromBitmap
push dword [esi]
mov dword [esi + 0x20], eax
call edi
push str.GdipCreateBitmapFromFile
push dword [esi]
mov dword [esi + 0x24], eax
call edi
xor edi, edi
mov dword [esi + 0x28], eax
inc edi
mov eax, edi
pop edi
ret