joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movdqu xmm0, xmmword [ecx]
push ebx
push esi
push edi
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 4
lea esi, [ebp - 0x13]
sub edx, ecx
lea edi, [ebp - 0x12]
sub esi, ecx
lea ebx, [ebp - 0x11]
sub edi, ecx
movdqu xmmword [ebp - 0x14], xmm0
sub ebx, ecx
lea ecx, [ecx]
dec dword [ebp - 4]
lea ecx, [ecx + 4]
movzx eax, byte [edx + ecx - 4]
movzx eax, byte [eax + 0x4155a0]
mov byte [ecx - 4], al
movzx eax, byte [esi + ecx - 4]
movzx eax, byte [eax + 0x4155a0]
mov byte [ecx - 3], al
movzx eax, byte [edi + ecx - 4]
movzx eax, byte [eax + 0x4155a0]
mov byte [ecx - 2], al
movzx eax, byte [ebx + ecx - 4]
movzx eax, byte [eax + 0x4155a0]
mov byte [ecx - 1], al
jne 0x401c80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4020b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movdqu xmm0, xmmword [ecx]
push ebx
push esi
push edi
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 4
lea esi, [ebp - 0x13]
sub edx, ecx
lea edi, [ebp - 0x12]
sub esi, ecx
lea ebx, [ebp - 0x11]
sub edi, ecx
movdqu xmmword [ebp - 0x14], xmm0
sub ebx, ecx
lea ecx, [ecx]
dec dword [ebp - 4]
lea ecx, [ecx + 4]
movzx eax, byte [edx + ecx - 4]
movzx eax, byte [eax + 0x4156a0]
mov byte [ecx - 4], al
movzx eax, byte [esi + ecx - 4]
movzx eax, byte [eax + 0x4156a0]
mov byte [ecx - 3], al
movzx eax, byte [edi + ecx - 4]
movzx eax, byte [eax + 0x4156a0]
mov byte [ecx - 2], al
movzx eax, byte [ebx + ecx - 4]
movzx eax, byte [eax + 0x4156a0]
mov byte [ecx - 1], al
jne 0x4020e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403080
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [0x41ef3c]
push esi
push edi
mov edi, dword [0x41f064]
mov byte [ebp - 1], cl
test edi, edi
je 0x4030dc
mov ecx, dword [0x41ef30]
lea eax, [ebx + 1]
mov esi, edi
lea edx, [ecx + 3]
sub ecx, ebx
mov ebx, ecx
mov edi, edi
movzx ecx, byte [edx - 3]
lea edx, [edx + 4]
mov byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [ebx + eax - 4]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 5]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 4]
mov byte [eax - 2], cl
dec esi
jne 0x4030b0
mov ebx, dword [0x41ef3c]
mov ecx, dword [0x41f060]
mov esi, edi
mov edx, dword [0x41f068]
lea eax, [ecx + 1]
imul eax, edx
mov dword [ebp - 0x1c], eax
cmp edi, eax
jae 0x4031e4
mov dword [ebp - 0x10], ebx
mov edi, edi
xor edx, edx
mov ebx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp - 0x14], ebx
div edi
mov ecx, eax
mov dword [ebp - 0x18], eax
imul ecx, edi
cmp ecx, esi
jne 0x403169
mov ecx, ebx
mov edx, ebx
shr ecx, 8
movzx eax, cl
shr edx, 0x10
shr ebx, 0x18
movzx eax, byte [eax + 0x4155a0]
mov byte [ebp - 8], al
movzx eax, dl
movzx eax, byte [eax + 0x4155a0]
mov byte [ebp - 7], al
movzx eax, byte [ebx + 0x4155a0]
mov ebx, dword [ebp - 0x18]
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x14]
movzx eax, al
mov ebx, dword [ebx*4 + 0x415570]
movzx eax, byte [eax + 0x4155a0]
mov byte [ebp - 5], al
xor ebx, dword [ebp - 8]
jmp 0x4031b8
cmp edi, 6
jbe 0x4031b8
mov eax, esi
sub eax, ecx
cmp eax, 4
jne 0x4031b8
movzx eax, bl
movzx eax, byte [eax + 0x4155a0]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 8
movzx eax, al
movzx eax, byte [eax + 0x4155a0]
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
movzx eax, byte [eax + 0x4155a0]
mov byte [ebp - 0xa], al
movzx eax, byte [ebx + 0x4155a0]
mov byte [ebp - 9], al
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
add ecx, 4
xor eax, ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [0x41ef3c]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x403100
mov ecx, dword [0x41f060]
mov edx, dword [0x41f068]
cmp byte [ebp - 1], 0
je 0x40320d
cmp ecx, 1
jbe 0x40320d
lea eax, [edx*4]
lea esi, [eax + ebx]
mov dword [ebp - 0x1c], eax
lea edi, [ecx - 1]
mov ebx, eax
mov ecx, esi
call fcn.00402230
add esi, ebx
dec edi
jne 0x403201
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4037a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea eax, [ecx + 1]
mov edx, 4
jmp 0x4037b0
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 5], cl
movzx ecx, byte [eax - 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 4], cl
movzx ecx, byte [eax - 3]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 3], cl
movzx ecx, byte [eax - 2]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 2], cl
dec edx
jne 0x4037b0
ret
Function at 0x403860
Capabilities:
Listen for remote procedure calls

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 3
je 0x40387d
push str.Error_in_arguments._r_n
call fcn.00405383
add esp, 4
mov eax, 1
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
mov edi, dword [ebx + 4]
cmp byte [edi], 0
je 0x4038cf
lea ecx, [ecx]
inc esi
cmp byte [esi + edi], 0
jne 0x403890
test esi, esi
je 0x4038cf
lea eax, [esi*2 + 2]
push eax
push 0
push 0x41f010
call fcn.004096e0
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x4038cf
jmp 0x4038c0
mov al, byte [ecx + edi]
mov byte [ecx*2 + 0x41f010], al
inc ecx
cmp ecx, esi
jl 0x4038c0
mov edi, dword [ebx + 8]
xor esi, esi
cmp byte [edi], 0
je 0x40391f
lea esp, [esp]
inc esi
cmp byte [esi + edi], 0
jne 0x4038e0
test esi, esi
je 0x40391f
lea eax, [esi*2 + 2]
push eax
push 0
push 0x41ef90
call fcn.004096e0
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x40391f
jmp 0x403910
mov al, byte [ecx + edi]
mov byte [ecx*2 + 0x41ef90], al
inc ecx
cmp ecx, esi
jl 0x403910
push 0
push 0x41f010
push 0xa
push str.ncacn_ip_tcp
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
pop edi
pop esi
pop ebx
test eax, eax
je 0x40394e
push str.Error_in_RpcServerUseProtseqEp_function._r_n
call fcn.00405383
add esp, 4
mov eax, 2
pop ebp
ret
push 0
push 0x4d2
push 0x11
push 0
push 0
push 0x41b9c0
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
je 0x40397f
push eax
push str.RpcServerRegisterIfEx_failed_with_code__i._r_n
call fcn.00405383
add esp, 8
mov eax, 3
pop ebp
ret
push str.KMS_Server_Emulator_running..._r_n
call fcn.00405383
add esp, 4
push 0
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
je 0x4039b4
push eax
push str.RpcServerListen_failed_with_code__i._r_n
call fcn.00405383
add esp, 8
mov eax, 4
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4048f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
push 0x10
mov dword [ebp - 0xc], esi
call fcn.0040522e
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 8], eax
inc esi
mov dword [ebp - 4], 8
movdqu xmmword [edi], xmm0
lea ecx, [ecx]
lea eax, [edi + 1]
mov edx, 4
jmp 0x404930
movzx ecx, byte [esi - 1]
lea eax, [eax + 4]
xor byte [eax - 5], cl
movzx ecx, byte [esi]
xor byte [eax - 4], cl
movzx ecx, byte [esi + 1]
xor byte [eax - 3], cl
movzx ecx, byte [esi + 2]
add esi, 4
xor byte [eax - 2], cl
dec edx
jne 0x404930
mov ecx, edi
call fcn.00403420
dec dword [ebp - 4]
jne 0x404920
mov ebx, dword [ebp - 8]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xc]
movdqu xmmword [ebx], xmm0
movq xmm0, qword [ecx + 0x80]
movq qword [ebx], xmm0
mov eax, dword [ecx + 0x88]
mov dword [ebx + 8], eax
mov ax, word [ecx + 0x8c]
lea ecx, [edi + 0xf]
mov word [ebx + 0xc], ax
lea eax, [ebx + 0xf]
mov byte [ebx + 0xe], 0x80
cmp edi, eax
ja 0x4049c0
cmp ecx, ebx
jb 0x4049c0
mov esi, ebx
mov ecx, edi
sub esi, edi
mov edx, 0x10
lea ebx, [ebx]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x4049b0
jmp 0x4049d0
movdqu xmm1, xmmword [ebx]
movdqu xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqu xmmword [edi], xmm1
mov ecx, edi
call fcn.00403420
push ebx
call fcn.00405203
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4049f0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x24], ebx
movdqu xmm0, xmmword [ecx]
movdqu xmmword [ebp - 0x124], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
movdqu xmmword [ebp - 0x114], xmm0
mov dword [ebp - 0x10], eax
movdqu xmm0, xmmword [ecx + 0x20]
mov eax, dword [ebx + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x18]
movdqu xmmword [ebp - 0x104], xmm0
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
movdqu xmm0, xmmword [ecx + 0x30]
mov ebx, 0x30
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x120]
movdqu xmmword [ebp - 0xf4], xmm0
mov edi, edi
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax + 0x30]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
dec ebx
jne 0x404a70
mov ebx, dword [ebp - 0x24]
xor edi, edi
mov ecx, dword [ebp - 0x10]
mov esi, ecx
mov eax, ecx
rol eax, 7
ror esi, 0xb
xor esi, eax
mov eax, ecx
ror eax, 6
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, dword [ebp - 8]
and eax, dword [ebp - 0x10]
xor ecx, eax
add esi, ecx
mov ecx, dword [ebp - 4]
add esi, dword [edi + 0x41bc28]
mov edx, ecx
add esi, dword [ebp + edi - 0x124]
mov eax, ecx
add esi, dword [ebp - 0x20]
add edi, 4
rol eax, 0xa
ror edx, 0xd
xor edx, eax
mov eax, ecx
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, eax
and eax, dword [ebp - 4]
xor ecx, dword [ebp - 4]
and ecx, dword [ebp - 0x14]
xor ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
add edx, ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
add ecx, esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [edx + esi]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp edi, 0x100
jb 0x404ab0
add dword [ebx], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 4], eax
mov eax, dword [ebp - 0x14]
add dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0xc], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x18], eax
add dword [ebx + 0x10], ecx
mov eax, dword [ebp - 0x20]
add dword [ebx + 0x1c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4050a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
push esi
push edi
test edx, edx
je 0x4051dc
cmp dword [ebp + 0xc], 0
je 0x4051dc
test eax, eax
je 0x4051dc
movdqu xmm0, xmmword [edx]
mov eax, 0x10
movdqu xmmword [ebp - 0x4c], xmm0
cmp eax, 0x40
jae 0x4051ee
mov byte [ebp + eax - 0x4c], 0
inc eax
cmp eax, 0x40
jb 0x4050ec
movdqa xmm2, xmmword [str.6666666666666666H]
xor eax, eax
movdqa xmm3, xmmword [0x41bd40]
lea esp, [esp]
movdqu xmm1, xmmword [ebp + eax - 0x4c]
movdqa xmm0, xmm2
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x94], xmm0
movdqa xmm0, xmm3
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0xd4], xmm0
add eax, 0x10
cmp eax, 0x40
jb 0x405110
push 0x126
call fcn.0040522e
add esp, 4
mov edi, eax
push 0x60
call fcn.0040522e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x94]
push 0x40
push eax
push edi
call fcn.0040a5b0
add esp, 0xc
lea ecx, [edi + 0x40]
push 0xe6
push dword [ebp + 0xc]
push ecx
call fcn.0040a5b0
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0x40
push eax
push esi
call fcn.0040a5b0
add esp, 0xc
lea eax, [esi + 0x40]
mov edx, edi
mov ecx, 0x126
push eax
call fcn.00404b80
add esp, 4
mov edx, esi
mov ecx, 0x60
push dword [ebp - 0x50]
call fcn.00404b80
add esp, 4
push edi
call fcn.00405203
add esp, 4
push esi
call fcn.00405203
add esp, 4
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004051f4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004051f4
mov esp, ebp
pop ebp
ret
call fcn.004055ec
int3
Function at 0x4094f5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004076cc
mov dword [ebp - 0x14], eax
cmp dword [0x41eec0], esi
jne 0x4095e8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x409575
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4096c8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4096c8
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4096c8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41eec0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41eec4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41eec8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41eed0], eax
test eax, eax
je 0x4095e5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41eecc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40960d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409600
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x409622
push 4
pop eax
jmp 0x4096ca
cmp dword [ebp - 0x14], esi
je 0x409622
push dword [0x41eec0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x409607
mov eax, dword [0x41eecc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x409680
cmp dword [0x41eed0], edi
je 0x409680
push eax
call ebx
push dword [0x41eed0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x409680
test eax, eax
je 0x409680
call ecx
test eax, eax
je 0x409675
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x409675
test byte [ebp - 8], 1
jne 0x409680
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4096b0
mov eax, dword [0x41eec4]
cmp eax, edi
je 0x4096ad
push eax
call ebx
test eax, eax
je 0x4096ad
call eax
mov esi, eax
test esi, esi
je 0x4096ad
mov eax, dword [0x41eec8]
cmp eax, edi
je 0x4096ad
push eax
call ebx
test eax, eax
je 0x4096ad
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41eec0]
call ebx
test eax, eax
je 0x4096c8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4096ca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004051f4
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6e3c5b90
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x407e4a5c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42597f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x425985
ret

Function at 0x4288b8
Capabilities:
Encode data using xor

Disassembly:
rcl byte [ebx + ebp*8], 6
xor cx, word [edx]
add edx, 2
cmp edx, eax
jl 0x4288bc
mov eax, ecx
ret

Function at 0x49892d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x498975
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4989b4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00404889
mov esi, eax
test esi, esi
jle 0x49899e
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00404ad9
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
xor dl, 0xff
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x498984
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x498963
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49897c
lea eax, [ebp - 0xc]
call fcn.004045d1
ret

Function at 0x4c5440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
in al, 0x53
push esi
push edi
test dl, dl
je 0x4c5450
add esp, 0xfffffff0
call fcn.00403be7
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a8f
xor eax, eax
push ebp
push 0x4c54a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004c124f
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041996b
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041996b
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041996b
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041996b
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00419993
push esi
lea edi, [esi + 0x44]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c54a7
lea eax, [ebp - 4]
call fcn.004045ef
ret
Function at 0x4c9760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test dl, dl
je 0x4c9775
add esp, 0xfffffff0
call fcn.00403bec
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a94
xor eax, eax
push ebp
push 0x4c9779
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
call fcn.00404648
lea eax, [esi + 8]
call fcn.004045f4
mov dword [esi + 0x30], 0xffffffff
lea eax, [ebp - 0x14]
call fcn.004b45cc
push esi
lea edi, [esi + 0xc]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
lea edi, [esi + 0x1c]
add esi, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov byte [esi + 0x2c], 0
mov dword [esi + 0x34], 0xffffffff
mov byte [esi + 0x38], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9780
lea eax, [ebp - 4]
call fcn.004045f4
ret
Function at 0x401400
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x41]
test al, al
je 0x4014ae
push ebx
push ebp
mov ebp, dword [esi + 0x30]
push edi
lea edi, [ebp + 1]
cmp edi, 0x10
jle 0x40141e
xor edi, edi
mov eax, dword [esi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
mov ecx, dword [ebp*4 + 0x4091b0]
mov edx, dword [esi + 0x48]
add edx, ecx
mov eax, edi
mov dword [esi + 0x48], edx
mov ecx, dword [esi + 0x48]
cdq
idiv dword [esi + 0x2c]
mov eax, dword [esi + 8]
push 0
mov dword [esi + 0x30], edx
mov edx, dword [esi + 0xc]
push edx
mov edx, dword [esi + 0x44]
push eax
mov eax, dword [esi + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi*4 + str.eqmidF0]
mov edx, dword [edi*4 + 0x40b00c]
mov ebp, dword [esi + 0x20]
push 0
push 2
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push eax
push ebp
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [esi + 0x20]
push 5
push eax
call ebx
cmp edi, 0x10
pop edi
pop ebp
pop ebx
jne 0x4014ae
mov ecx, dword [esi + 0x1c]
push ecx
push 0x6a
call fcn.004038d0
add esp, 8
mov ecx, esi
mov byte [esi + 0x41], 0
call fcn.00401770
pop esi
ret