joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ec
mov eax, dword [0x432070]
xor eax, esp
mov dword [esp + 0x1e8], eax
mov edx, dword [ebp + 8]
lea ecx, [esp + 4]
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.00402eb0
add esp, 4
test eax, eax
jne 0x4031f6
lea eax, [esp + 0x58]
push eax
push 0x202
call dword [0x4231c0]
test eax, eax
je 0x403172
push eax
push 0x42f17c
jmp 0x4031d9
cmp dword [esp + 0x48], 0
je 0x403191
push 0x42f1a0
call fcn.00402a00
add esp, 4
lea ecx, [esp + 8]
call fcn.00404e70
jmp 0x4031c2
push 0x42f1c0
call fcn.00402a00
add esp, 4
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xc]
push eax
push 0x42f1e0
call fcn.00402a00
add esp, 0xc
lea edx, [esp + 0x28]
lea ecx, [esp + 8]
call fcn.00404720
call dword [0x4231b0]
cmp eax, 0xffffffff
jne 0x4031e1
call dword [0x423184]
push eax
push 0x42f1fc
call fcn.00402a00
add esp, 8
mov ecx, dword [esp + 0x1ec]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0040744f
mov esp, ebp
pop ebp
ret
push dword [esi]
push 0x42f138
call fcn.00402a00
add esp, 8
push 1
call fcn.0040f8e7
int3

Function at 0x403620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42283a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x432070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00405140
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4036e0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0x423254
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x42f2a4
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0040992b
add esp, 8
mov dword [ebp - 0x24], 0x4232a0
lea eax, [ebp - 0x24]
push 0x4311ec
push eax
call fcn.004099e7
push edi
push esi
call fcn.00405488
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040744f
mov esp, ebp
pop ebp
ret 4

Function at 0x41626b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004160ea
Function at 0x4237c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
jmp 0x4237da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4237e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4237d0
mov eax, 1
add ebx, ebx
jne 0x4237f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4237e8
jne 0x423804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4237e8
xor ecx, ecx
sub eax, 3
jb 0x423818
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42388a
mov ebp, eax
add ebx, ebx
jne 0x423823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423830
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423854
inc ecx
add ebx, ebx
jne 0x423840
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423835
jne 0x423851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423835
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423874
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423865
jmp 0x4237d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423874
add edi, ecx
jmp 0x4237d6
pop esi
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x4238d3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423891
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23030]
or eax, eax
je 0x4238cd
mov dword [ebx], eax
add ebx, 4
jmp 0x4238ae
call dword [esi + 0x2302c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x423904
cmp al, 0xef
ja 0x4238f7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4238d9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4238e6
mov ebp, dword [esi + 0x23034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423938
sub esp, 0xffffff80
jmp 0x403e61
Function at 0x40106a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x40107d
xor eax, eax
jmp 0x4011e9
push esi
push edi
call fcn.0040103e
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
not edi
mov ecx, 0xff
test edx, edx
je 0x4010ae
test bl, 3
je 0x4010ae
movzx esi, byte [ebx]
xor esi, edi
and esi, ecx
shr edi, 8
xor edi, dword [eax + esi*4]
inc ebx
dec edx
mov dword [ebp + 0x10], edx
jne 0x401095
push 4
mov esi, ebx
pop ebx
cmp edx, 0x10
jb 0x401189
shr edx, 4
mov dword [ebp + 0xc], edx
xor edi, dword [esi]
add esi, ebx
mov edx, edi
and edx, ecx
mov dword [ebp - 4], edx
mov edx, edi
shr edx, 8
mov edi, dword [ebp - 4]
xor edx, dword [eax + edi*4]
sub dword [ebp + 0x10], 0x10
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
xor edx, dword [esi]
add esi, ebx
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
mov edi, edx
shr edx, 8
and edi, ecx
xor edx, dword [eax + edi*4]
xor edx, dword [esi]
add esi, ebx
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
xor edx, dword [esi]
add esi, ebx
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
mov edi, edx
and edi, ecx
shr edx, 8
xor edx, dword [eax + edi*4]
dec dword [ebp + 0xc]
mov edi, edx
jne 0x4010c2
mov edx, dword [ebp + 0x10]
cmp edx, ebx
jb 0x4011ca
shr edx, 2
mov dword [ebp + 0xc], edx
xor edi, dword [esi]
sub dword [ebp + 0x10], ebx
mov edx, edi
and edx, ecx
shr edi, 8
xor edi, dword [eax + edx*4]
add esi, ebx
mov edx, edi
and edx, ecx
shr edi, 8
xor edi, dword [eax + edx*4]
mov edx, edi
and edx, ecx
shr edi, 8
xor edi, dword [eax + edx*4]
mov edx, edi
and edx, ecx
shr edi, 8
xor edi, dword [eax + edx*4]
dec dword [ebp + 0xc]
jne 0x401196
cmp dword [ebp + 0x10], 0
je 0x4011e3
movzx edx, byte [esi]
xor edx, edi
and edx, ecx
shr edi, 8
xor edi, dword [eax + edx*4]
inc esi
dec dword [ebp + 0x10]
jne 0x4011d0
mov eax, edi
pop edi
not eax
pop esi
pop ebx
leave
ret
Function at 0x403132
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp + 0xc], ebx
test ebx, ebx
je 0x4031bc
mov eax, dword [0x4f1074]
mov edi, 0x2000
test eax, eax
jg 0x403189
push edi
push dword [0x4f106c]
push dword [0x4f1090]
call fcn.00419c37
add esp, 0xc
mov dword [0x4f1074], eax
test eax, eax
je 0x4031c4
js 0x4031cb
add dword [0x4f10a0], edi
mov ecx, dword [0x4f106c]
mov dword [0x4f1070], ecx
adc dword [0x4f10a4], 0
mov esi, ebx
cmp ebx, eax
jb 0x403191
mov esi, eax
push esi
push dword [0x4f1070]
push dword [ebp + 8]
call fcn.0040a7a0
mov eax, dword [0x4f1074]
add dword [ebp + 8], esi
add dword [0x4f1070], esi
sub eax, esi
add esp, 0xc
sub ebx, esi
mov dword [0x4f1074], eax
jne 0x40314c
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
sub eax, ebx
jmp 0x4031bf
push 0x401
mov esi, 0x41da60
push esi
call fcn.0040b780
pop ecx
push eax
push esi
push 0x424f80
call dword [0x4f1380]
add esp, 0x10
xor eax, eax
jmp 0x4031bf

Function at 0x4031f0
Capabilities:
Read file on windows

Disassembly:
push edi
xor edi, edi
cmp dword [0x4f1188], edi
je 0x403200
or eax, 0xffffffff
pop edi
ret
cmp dword [0x42503c], edi
jg 0x403229
jl 0x403212
cmp dword [0x425038], edi
ja 0x403229
or eax, 0xffffffff
add dword [0x425038], eax
mov dword [0x4f1074], edi
pop edi
adc dword [0x42503c], eax
ret
push esi
cmp dword [0x4f1074], edi
jg 0x40329f
mov esi, 0x2000
push esi
push dword [0x4f106c]
push dword [0x4f1090]
call fcn.00419c37
add esp, 0xc
mov dword [0x4f1074], eax
cmp eax, edi
jne 0x40325a
or eax, 0xffffffff
jmp 0x4032b5
jge 0x403284
push 0x401
mov esi, 0x41da60
push esi
call fcn.0040b780
pop ecx
push eax
push esi
push 0x424f80
call dword [0x4f1380]
add esp, 0x10
push 3
call fcn.0040dd21
add dword [0x4f10a0], esi
mov eax, dword [0x4f106c]
mov dword [0x4f1070], eax
adc dword [0x4f10a4], edi
call fcn.004030c8
mov eax, dword [0x4f1070]
dec dword [0x4f1074]
mov al, byte [eax]
inc dword [0x4f1070]
movzx eax, al
pop esi
pop edi
ret
Function at 0x4032b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x4f10ac]
push edi
mov edi, dword [0x4f10a8]
add edi, dword [ebp + 8]
push 0
adc esi, dword [ebp + 0xc]
mov ebx, 0x2000
push ebx
push esi
push edi
call fcn.0040ced0
mov dword [ebp + 8], eax
mov eax, edi
sub eax, dword [ebp + 8]
mov ecx, esi
sbb ecx, edx
test esi, esi
jg 0x40332a
jl 0x4032f5
test edi, edi
jae 0x40332a
push 1
push 0x41e288
push dword [0x4f108c]
mov esi, 0x4e5064
push 0x41e1f8
push esi
call fcn.0040ab01
add esp, 0x10
push eax
push esi
push 0x424f80
call dword [0x4f1380]
add esp, 0x10
push 3
pop eax
jmp 0x4033a8
cmp eax, dword [0x4f10a0]
jne 0x40333a
cmp ecx, dword [0x4f10a4]
je 0x403387
push 0
push ecx
push eax
push dword [0x4f1090]
call fcn.0040cde4
push ebx
push dword [0x4f106c]
mov dword [0x4f10a0], eax
push dword [0x4f1090]
mov dword [0x4f10a4], edx
call fcn.00419c37
add esp, 0x1c
mov dword [0x4f1074], eax
test eax, eax
jg 0x403376
push 0x33
jmp 0x403327
mov ecx, dword [ebp + 8]
sub eax, ecx
mov dword [0x4f1074], eax
mov eax, dword [0x4f106c]
jmp 0x40339f
mov edx, dword [0x4f1070]
mov eax, dword [0x4f106c]
mov ecx, dword [ebp + 8]
sub edx, eax
sub edx, ecx
add dword [0x4f1074], edx
add eax, ecx
mov dword [0x4f1070], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40608b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [0x4f109c]
push edi
mov edi, dword [0x4f1098]
push 0
mov ebx, 0x2000
push ebx
push esi
push edi
call fcn.0040ced0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov ecx, edx
cdq
mov dword [ebp - 8], ecx
cmp ecx, edx
jl 0x406181
jg 0x4060d2
cmp dword [ebp - 0xc], eax
jbe 0x406181
sub edi, dword [ebp - 0xc]
push 0
sbb esi, ecx
push esi
push edi
push dword [0x4f1090]
call fcn.0040cde4
mov esi, dword [ebp - 0xc]
push esi
push dword [0x4f106c]
mov dword [0x4f10a0], eax
push dword [0x4f1090]
mov dword [0x4f10a4], edx
call fcn.00419c37
add esp, 0x1c
mov dword [0x4f1074], eax
cmp eax, esi
je 0x40611a
push 2
pop eax
jmp 0x406284
mov ecx, dword [0x4f106c]
mov eax, ecx
sub eax, dword [ebp + 0x14]
lea eax, [eax + esi - 4]
jmp 0x40614e
cmp byte [eax], 0x50
jne 0x40614d
push 4
push dword [ebp + 0x10]
push eax
call fcn.0040b80b
mov ecx, dword [0x4f106c]
add esp, 0xc
test eax, eax
je 0x406159
mov eax, dword [0x4f1070]
dec eax
mov dword [0x4f1070], eax
cmp eax, ecx
jae 0x40612b
jmp 0x40616e
mov eax, ecx
sub eax, dword [0x4f1070]
mov dword [ebp - 4], 1
add dword [0x4f1074], eax
push 3
push ecx
push dword [0x4f10b4]
call fcn.0040a7a0
add esp, 0xc
jmp 0x406192
sub edi, dword [ebp - 0xc]
sbb esi, ecx
mov dword [0x4f10a0], edi
mov dword [0x4f10a4], esi
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
sbb ecx, dword [ebp - 8]
push 0
pop esi
push esi
add eax, 0x1fff
push ebx
adc ecx, esi
push ecx
push eax
call fcn.0040e540
xor edi, edi
mov dword [ebp + 0x14], eax
inc edi
jmp 0x406273
cmp edi, dword [ebp + 0x14]
jg 0x40627c
add dword [0x4f10a0], 0xffffe000
push esi
adc dword [0x4f10a4], 0xffffffff
push dword [0x4f10a4]
push dword [0x4f10a0]
push dword [0x4f1090]
call fcn.0040cde4
push ebx
push dword [0x4f106c]
push dword [0x4f1090]
call fcn.00419c37
add esp, 0x1c
mov dword [0x4f1074], eax
cmp eax, ebx
jne 0x406112
mov eax, dword [0x4f106c]
lea ecx, [eax + 0x1fff]
jmp 0x406240
cmp byte [ecx], 0x50
jne 0x40623f
push 4
push dword [ebp + 0x10]
push ecx
call fcn.0040b80b
add esp, 0xc
test eax, eax
mov eax, dword [0x4f106c]
je 0x40624c
mov ecx, dword [0x4f1070]
dec ecx
mov dword [0x4f1070], ecx
cmp ecx, eax
jae 0x40621d
jmp 0x406261
mov ecx, eax
sub ecx, dword [0x4f1070]
mov dword [ebp - 4], 1
add dword [0x4f1074], ecx
push 3
push eax
push dword [0x4f10b4]
call fcn.0040a7a0
add esp, 0xc
inc edi
cmp dword [ebp - 4], esi
je 0x4061bc
xor eax, eax
cmp dword [ebp - 4], esi
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407065
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x423410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
cmp dword [0x4f109c], edi
jg 0x40715f
jl 0x407097
cmp dword [0x4f1098], 0x2000
ja 0x40715f
push edi
push edi
push edi
push dword [0x4f1090]
call fcn.0040cde4
push dword [0x4f1098]
push dword [0x4f106c]
push dword [0x4f1090]
call fcn.00419c37
mov edx, dword [0x4f1098]
add esp, 0x1c
mov dword [0x4f1074], eax
cmp eax, edx
jne 0x40717b
mov ecx, dword [0x4f106c]
lea eax, [edx + ecx - 0x16]
jmp 0x407103
cmp byte [eax], 0x50
jne 0x407102
push 4
push 0x423008
push eax
call fcn.0040b80b
add esp, 0xc
test eax, eax
je 0x40710e
mov eax, dword [0x4f1070]
mov ecx, dword [0x4f106c]
dec eax
mov dword [0x4f1070], eax
cmp eax, ecx
jae 0x4070de
jmp 0x40717b
mov eax, dword [0x4f106c]
sub eax, dword [0x4f1070]
add dword [0x4f1074], eax
mov eax, dword [0x4f1070]
sub eax, dword [0x4f106c]
push 0x16
cdq
add eax, dword [0x4f10a0]
adc edx, dword [0x4f10a4]
mov dword [0x425028], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x42502c], edx
call fcn.00403132
pop ecx
pop ecx
test eax, eax
jne 0x4071e1
push 0x33
pop eax
jmp 0x4072ae
push 0x12
push 0x423008
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040608b
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jne 0x40711f
cmp dword [0x424fbc], 0
push ebx
mov ebx, 0x401
mov esi, 0x4e5064
mov edi, 0x424f80
jne 0x40719d
cmp dword [0x424f88], 0
je 0x4071be
push ebx
push dword [0x4f108c]
push 0x41e11c
push esi
call fcn.0040ab01
add esp, 0xc
push eax
push esi
push edi
call dword [0x4f1380]
add esp, 0x10
push ebx
push 0x41e06c
push esi
call fcn.0040ab01
pop ecx
pop ecx
push eax
push esi
push edi
call dword [0x4f1380]
add esp, 0x10
push 2
pop eax
pop ebx
jmp 0x4072ae
lea eax, [ebp - 0x18]
push eax
call fcn.00403fd9
movzx eax, ax
mov dword [0x4f1138], eax
lea eax, [ebp - 0x16]
push eax
call fcn.00403fd9
movzx eax, ax
mov dword [0x4f113c], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403fd9
movzx eax, ax
cdq
mov dword [0x4f1128], eax
lea eax, [ebp - 0x12]
push eax
mov dword [0x4f112c], edx
call fcn.00403fd9
movzx eax, ax
cdq
mov dword [0x4f1130], eax
lea eax, [ebp - 0x10]
push eax
mov dword [0x4f1134], edx
call fcn.00403fed
mov dword [0x4f1118], eax
lea eax, [ebp - 0xc]
push eax
mov dword [0x4f111c], edi
call fcn.00403fed
mov dword [0x4f1120], eax
lea eax, [ebp - 8]
push eax
mov dword [0x4f1124], edi
call fcn.00403fd9
add esp, 0x1c
mov word [0x4f1148], ax
call fcn.00406704
mov esi, eax
cmp esi, 1
jg 0x4072ac
call fcn.00406289
cmp eax, edi
je 0x40728a
cmp esi, eax
jge 0x4072ac
mov esi, eax
jmp 0x4072ac
mov eax, dword [0x4f1120]
add eax, dword [0x4f1118]
mov ecx, dword [0x4f1124]
adc ecx, dword [0x4f111c]
mov dword [0x425030], eax
mov dword [0x425034], ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040da8f
leave
ret
Function at 0x409074
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa008
call fcn.00410740
mov eax, dword [0x423410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xa004]
push 0xa000
push eax
call fcn.00403132
pop ecx
pop ecx
test eax, eax
je 0x4090f0
mov esi, dword [ebp - 0x9fc8]
lea esi, [ebp + esi - 0xa004]
movzx eax, word [esi + 0x14]
lea ebx, [eax + esi + 0x18]
xor eax, eax
xor edi, edi
cmp ax, word [esi + 6]
jae 0x4090f0
mov dword [ebp - 0xa008], ebx
push 0x41e5f4
push dword [ebp - 0xa008]
call fcn.0040b400
pop ecx
pop ecx
test eax, eax
je 0x409103
movzx eax, word [esi + 6]
add dword [ebp - 0xa008], 0x28
inc edi
cmp edi, eax
jl 0x4090ca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor edx, edx
pop ebx
call fcn.0040da8f
leave
ret
imul edi, edi, 0x28
lea esi, [edi + ebx]
push dword [esi + 0x14]
push dword [esi + 0x10]
push 0x41e5d8
call fcn.00410675
mov eax, dword [esi + 0x14]
add esp, 0xc
add eax, dword [esi + 0x10]
jmp 0x4090f2
Function at 0x4068c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068e9
xor eax, eax
test eax, eax
je 0x4068fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068fc
xor ecx, ecx
jmp 0x4068ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ac], 0
push esi
jne 0x406a59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a33
mov dword [ecx*4 + 0x4275a8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275a8]
xor eax, esi
inc ecx
dec edx
jne 0x406a6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219