joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433230
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xa495ecda
mov dword [esp + 0x10], 0x76853619
mov word [esp + 0x14], 0xa6ca
mov byte [esp + 0x16], 0xcf
mov edx, 0x786348c3
mov ecx, 0xbe942c40
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xd5af
jl 0x433262
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], 0xe2096eab
mov dword [esp + 0x1c], 0x9a054638
mov dword [esp + 0x20], 0x12d9de1c
mov dword [esp + 0x24], 0x4a0e3645
mov dword [esp + 0x28], 0x425c4e63
mov dword [esp + 0x2c], 0xfaa026d3
mov word [esp + 0x30], 0xbe1e
mov edx, 0x4c4e1cb6
mov ecx, 0x4780a3b8
xor eax, eax
lea esp, [esp]
mov bl, byte [esp + esi + 0x18]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x18], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x4332d0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00432dc0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x433320
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xa495ecda
mov dword [esp + 0x10], 0x76853619
mov word [esp + 0x14], 0xa6ca
mov byte [esp + 0x16], 0xcf
mov edx, 0x786348c3
mov ecx, 0xbe942c40
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xd5af
jl 0x433352
xor eax, eax
xor esi, esi
mov dword [esp + 0x18], 0xe80b7447
mov dword [esp + 0x1c], 0xa0df4c4a
mov dword [esp + 0x20], 0x18dce425
mov dword [esp + 0x24], 0x50133c26
mov dword [esp + 0x28], 0x48325471
mov dword [esp + 0x2c], 0xa62c99
mov word [esp + 0x30], 0xc424
mov edx, 0x41937d34
mov ecx, 0xf71add40
xor edi, edi
lea esp, [esp]
mov bl, byte [esp + esi + 0x18]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x18], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x4333c0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00432dc0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x433410
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xd53e9983
mov dword [esp + 0x10], 0xec39df2a
mov dword [esp + 0x14], 0x801b6e5d
mov dword [esp + 0x18], 0x39291681
mov dword [esp + 0x1c], 0xe778bf99
mov word [esp + 0x20], 0xe8d5
mov edx, 0xc5d68b2e
mov ecx, 0x198a7402
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1ab5e
jl 0x433455
xor esi, esi
xor edi, edi
mov dword [esp + 0x24], 0xd8b6642d
mov dword [esp + 0x28], 0x907c3cdb
mov dword [esp + 0x2c], 0x88cd4d5
mov dword [esp + 0x30], 0x40b42cb8
mov dword [esp + 0x34], 0x38cc44e5
mov dword [esp + 0x38], 0xf0481c49
mov edx, 0xf194e174
mov ecx, 0x289457f0
xor eax, eax
mov bl, byte [esp + esi + 0x24]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x24], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1d238
jl 0x4334b8
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00432dc0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x433510
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xd53e9983
mov dword [esp + 0x10], 0xec39df2a
mov dword [esp + 0x14], 0x801b6e5d
mov dword [esp + 0x18], 0x39291681
mov dword [esp + 0x1c], 0xe778bf99
mov word [esp + 0x20], 0xe8d5
mov edx, 0xc5d68b2e
mov ecx, 0x198a7402
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1ab5e
jl 0x433555
xor eax, eax
xor esi, esi
mov dword [esp + 0x24], 0xe80b7447
mov dword [esp + 0x28], 0xa0df4c4a
mov dword [esp + 0x2c], 0x18dce425
mov dword [esp + 0x30], 0x50133c26
mov dword [esp + 0x34], 0x48325471
mov dword [esp + 0x38], 0xa62c99
mov word [esp + 0x3c], 0xc424
mov edx, 0x41937d34
mov ecx, 0xf71add40
xor edi, edi
nop
mov bl, byte [esp + esi + 0x24]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x24], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x4335c0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00432dc0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x34
ret
Function at 0x433fc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
push esi
push edi
xor eax, eax
push ebx
xor esi, esi
mov dword [esp + 0xc], eax
mov byte [esp + 0x20], al
mov dword [esp + 0x30], 0x553ae17a
mov dword [esp + 0x34], 0xdfbb957
mov dword [esp + 0x38], 0x8519514c
mov dword [esp + 0x3c], 0xbde7a906
mov dword [esp + 0x40], 0xb559c12f
mov dword [esp + 0x44], 0x6da999bd
mov word [esp + 0x48], 0x3191
mov edx, 0x3bf312f8
mov ecx, 0x473321e9
xor edi, edi
push ebp
mov bl, byte [esp + esi + 0x34]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x34], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x434016
lea eax, [esp + 0x34]
push eax
call dword [0x4b6178]
mov ebp, eax
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], 0x5b1394bf
mov dword [esp + 0x18], 0xbfeeef46
mov dword [esp + 0x1c], 0x39fa3c33
mov word [esp + 0x20], 0xc244
mov edx, 0xe1419780
mov eax, 0x1101267a
xor ecx, ecx
mov bl, byte [esp + esi + 0x14]
sub bl, dl
xor bl, al
add eax, ecx
add edx, edi
mov byte [esp + esi + 0x14], bl
add ecx, 0x136d
inc esi
add edi, 0x170f
cmp ecx, 0x10ff6
jl 0x434075
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [0x4b61b8]
push 0
call eax
lea edx, [esp + 0x34]
xor eax, 0xa34b711d
push edx
push eax
call fcn.00432a00
mov esi, dword [esp + 0x5c]
add esp, 8
mov ecx, eax
pop ebp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edi, [ecx + 1]
pop ebx
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4340e0
sub ecx, edi
push ecx
push eax
mov ecx, esi
call fcn.00405860
pop edi
mov eax, esi
pop esi
add esp, 0x40
ret

Function at 0x437dc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4af6d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
mov eax, 0xf
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], 0
push edi
mov dword [esp + 0xc], esi
mov byte [esi + 0x1c], 0
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
test edx, edx
jne 0x437e14
mov edx, 0x550ee2
mov eax, edx
lea ebp, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437e20
sub eax, ebp
push eax
push edx
mov ecx, esi
call fcn.00405860
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x437e3f
mov edx, 0x550ee2
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437e44
sub eax, ebp
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.00405860
mov al, byte [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x38], al
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x439100
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x591150], 0
mov eax, ecx
jne 0x4391b3
push esi
xor esi, esi
mov edx, esi
shl edx, 0x18
test edx, edx
jns 0x439125
add edx, edx
xor edx, 0x4c11db7
jmp 0x439127
add edx, edx
test edx, edx
jns 0x439135
add edx, edx
xor edx, 0x4c11db7
jmp 0x439137
add edx, edx
test edx, edx
jns 0x439145
add edx, edx
xor edx, 0x4c11db7
jmp 0x439147
add edx, edx
test edx, edx
jns 0x439155
add edx, edx
xor edx, 0x4c11db7
jmp 0x439157
add edx, edx
test edx, edx
jns 0x439165
add edx, edx
xor edx, 0x4c11db7
jmp 0x439167
add edx, edx
test edx, edx
jns 0x439175
add edx, edx
xor edx, 0x4c11db7
jmp 0x439177
add edx, edx
test edx, edx
jns 0x439185
add edx, edx
xor edx, 0x4c11db7
jmp 0x439187
add edx, edx
test edx, edx
jns 0x439195
add edx, edx
xor edx, 0x4c11db7
jmp 0x439197
add edx, edx
mov dword [esi*4 + 0x590d50], edx
inc esi
cmp esi, 0x100
jl 0x439112
mov byte [0x591150], 1
pop esi
ret

Function at 0x4391c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
lea esi, [edx + ecx]
xor eax, eax
cmp edx, esi
jae 0x4391f0
mov ecx, eax
shr ecx, 0x18
xor ecx, dword [edx]
shl eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x590d50]
add edx, 4
cmp edx, esi
jb 0x4391d2
pop esi
ret
Function at 0x43be80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4affd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x74], ebp
lea esi, [edi + 8]
mov dword [edi], 0x556678
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
mov byte [esp + 0x74], 2
mov dword [esi], 0x556588
call fcn.00426ea0
mov ecx, esi
mov byte [esp + 0x74], 3
mov dword [esi + 0x20], ebp
call fcn.00439990
push 0x2c
mov byte [esp + 0x78], 4
mov dword [edi + 0x30], ebp
call fcn.004a935a
add esp, 4
cmp eax, ebp
je 0x43c0a8
mov dword [edi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [edi + 0x2c]
push ebx
mov dword [eax + 4], eax
lea esi, [edi + 0x38]
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov byte [esp + 0x78], 6
mov dword [esi], 0x54e878
call fcn.00426ea0
mov ecx, esi
mov byte [esp + 0x78], 7
mov dword [esi + 0x20], ebp
call fcn.00439990
mov byte [esp + 0x78], 8
mov byte [edi + 4], 0
cmp dword [esp + 0xa0], ebp
je 0x43bf81
lea ecx, [esp + 0x50]
mov byte [esp + 0x78], 9
mov dword [esp + 0x4c], 0x54e878
call fcn.00426ea0
mov eax, dword [esp + 0xa0]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x78], 0xa
mov dword [esp + 0x6c], eax
call fcn.00439990
lea ecx, [esp + 0x4c]
call fcn.00406ae0
lea eax, [esp + 0x4c]
mov byte [esp + 0x78], 0xb
lea ebx, [ebp + 1]
jmp 0x43bfdf
push 0x1004
call fcn.004a935a
add esp, 4
cmp eax, ebp
je 0x43bf98
mov dword [eax], ebp
mov ebx, eax
jmp 0x43bf9a
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x78], 0xc
mov dword [esp + 0x28], 0x54e878
call fcn.00426ea0
lea ecx, [esp + 0x28]
mov byte [esp + 0x78], 0xd
mov dword [esp + 0x48], ebx
call fcn.00439990
lea ecx, [esp + 0x28]
call fcn.00406ae0
lea eax, [esp + 0x28]
mov dword [esp + 0x78], 0xe
mov ebx, 2
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x58]
mov ecx, esi
mov dword [esp + 0x14], ebx
call eax
mov esi, 0x54e878
test bl, 2
je 0x43c02f
and ebx, 0xfffffffd
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x78], 0x10
cmp dword [esp + 0x48], ebp
je 0x43c019
lea ecx, [esp + 0x28]
call fcn.004059e0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x78], 0xf
call fcn.00426ec0
mov dword [esp + 0x28], 0x54e658
test bl, 1
mov dword [esp + 0x78], 8
pop ebx
je 0x43c063
mov dword [esp + 0x48], esi
mov byte [esp + 0x74], 0x12
cmp dword [esp + 0x68], ebp
je 0x43c055
lea ecx, [esp + 0x48]
call fcn.004059e0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 0x11
call fcn.00426ec0
mov dword [esp + 0x7c], esi
mov dword [esp + 0x74], 0x14
cmp dword [esp + 0x9c], ebp
je 0x43c081
lea ecx, [esp + 0x7c]
call fcn.004059e0
lea ecx, [esp + 0x80]
mov byte [esp + 0x74], 0x13
call fcn.00426ec0
mov ecx, dword [esp + 0x6c]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x6c
ret 0x24
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebp
call dword [0x4b6398]
push 0x57afb0
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x54e650
call fcn.004a9360
int3
Function at 0x444290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b0f98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 4], 0
call fcn.00442340
mov eax, dword [esp + 0xa4]
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0xa0], 1
call fcn.00442410
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
mov byte [esp + 0x98], 2
call eax
mov ecx, dword [esp + 0xa8]
mov edx, dword [eax]
mov esi, dword [esp + 0xa0]
mov edx, dword [edx + 0x30]
push ecx
push esi
mov ecx, eax
call edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0x556588
cmp dword [esp + 0x28], 0
mov byte [esp + 0x98], 4
je 0x444330
lea ecx, [esp + 8]
call fcn.00439770
lea ecx, [esp + 0xc]
mov byte [esp + 0x98], 3
call fcn.00426ec0
lea ecx, [esp + 0x2c]
mov dword [esp + 8], 0x54e658
mov byte [esp + 0x98], 0
call fcn.0043f8e0
mov ecx, dword [esp + 0x90]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x98
ret

Function at 0x446280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b11a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
lea eax, [esp + 0xc]
mov dword [esp + 8], ebx
mov ecx, dword [0x590c70]
push eax
mov dword [esp + 0x34], ebx
call fcn.00431ab0
cmp dword [eax + 0x14], 8
mov dword [esp + 0x30], 1
jb 0x4462c4
mov eax, dword [eax]
mov esi, dword [esp + 0x38]
push eax
push 0x558ac8
push 0x400
push esi
call fcn.0042ee60
add esp, 0x10
cmp dword [esp + 0x20], 8
mov dword [esp + 8], 1
mov byte [esp + 0x30], bl
jb 0x4462fc
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004a930e
add esp, 4
push 0x3b
xor edx, edx
push 0x2c
push esi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.0042e050
mov ecx, dword [esp + 0x34]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x448f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b1538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call fcn.00425120
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0
call fcn.00425370
lea ecx, [esp + 4]
call fcn.00425070
add eax, dword [esp + 0x30]
lea ecx, [esp + 4]
adc edx, dword [esp + 0x34]
push edx
push eax
call fcn.00425300
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
imul eax, eax, 0x36de1
mov edx, dword [esp + 0xc]
imul ecx, ecx, 0x558a9
imul edx, edx, 0x19919
xor eax, ecx
xor eax, edx
mov esi, eax
mov ecx, eax
shr esi, 0x10
shl ecx, 0x10
xor esi, ecx
lea ecx, [esp + 4]
xor esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00439200
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4a4f70
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x10
fild qword [0x5908a8]
push ebx
mov ebx, dword [0x4b6134]
push ebp
fstp dword [esp + 8]
push esi
fld dword [esp + 0xc]
push edi
fld st(0)
or edi, 0xffffffff
fdivr qword [0x579d38]
or esi, 0xffffffff
mov ebp, 8
fstp dword [0x5932ec]
fld st(0)
fld1
fdivrp st(1)
fstp dword [0x593300]
fld st(0)
fdivr qword [0x579d30]
fstp dword [0x5932f4]
fld st(0)
fdivr qword [0x555378]
fstp dword [0x5932f8]
fdivr qword [0x579d28]
fstp dword [0x5932e8]
lea eax, [esp + 0x18]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebx
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sbb eax, dword [esp + 0x1c]
cmp esi, eax
jb 0x4a5004
ja 0x4a5000
cmp edi, ecx
jbe 0x4a5004
mov edi, ecx
mov esi, eax
dec ebp
jne 0x4a4fd8
fild qword [0x5908b0]
mov dword [0x593328], edi
or ebx, 0xffffffff
mov dword [0x59332c], esi
fstp dword [esp + 0x10]
or edi, 0xffffffff
fld dword [esp + 0x10]
mov ebp, 8
fld st(0)
fdivr qword [0x579d38]
fstp dword [0x593304]
fld st(0)
fld1
fdivrp st(1)
fstp dword [0x5932fc]
fld st(0)
fdivr qword [0x579d30]
fstp dword [0x5932e4]
fld st(0)
fdivr qword [0x555378]
fstp dword [0x5932f0]
fdivr qword [0x579d28]
fstp dword [0x5932e0]
mov edi, edi
rdtsc
mov esi, edx
mov ecx, eax
rdtsc
sub eax, ecx
sbb edx, esi
cmp edi, edx
jb 0x4a508a
ja 0x4a5086
cmp ebx, eax
jbe 0x4a508a
mov ebx, eax
mov edi, edx
dec ebp
jne 0x4a5070
mov dword [0x593324], edi
pop edi
pop esi
pop ebp
mov dword [0x593320], ebx
pop ebx
add esp, 0x10
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1005573
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x100d058]
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x410]
push 0x12c
mov dword [ebp - 0x3a8], ecx
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x39c], eax
xor eax, eax
push ecx
push eax
mov ebx, OleLoadFromStream
push ebx
mov dword [ebp - 0x38c], edi
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x390], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1005793
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
inc dword [ebp - 0x390]
cmp byte [ebp - 0x130], 0x2e
mov dword [ebp - 0x394], 0x12c
jne 0x1005769
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x1005769
cmp dword [ebp - 0x3a0], eax
je 0x100564f
lea eax, [ebp - 0x388]
push eax
push dword [ebp - 0x3a0]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1005769
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x388]
push eax
push ebx
mov dword [ebp - 0x394], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x1005769
inc dword [ebp - 0x398]
cmp dword [ebp - 0x39c], eax
je 0x10056ae
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x39c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10056ae
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x3a4], eax
push 0x10014a0
call esi
push 0x100149c
mov ebx, eax
call esi
push 0x1001498
add ebx, eax
call esi
add ebx, eax
lea eax, [ebp - 0x25c]
push eax
call esi
add ebx, eax
lea eax, [ebp - 0x130]
push eax
call esi
lea ecx, [ebp - 0x130]
add eax, edi
push ecx
mov dword [ebp - 0x3ac], eax
call esi
mov ecx, dword [ebp - 0x3ac]
add ecx, ebx
lea eax, [eax + ecx + 1]
cmp eax, dword [ebp - 0x3a8]
jae 0x100578c
mov ebx, dword [ebp - 0x38c]
lea eax, [ebp - 0x25c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001498
push ebx
call edi
lea eax, [ebp - 0x130]
push eax
push ebx
call edi
push 0x100149c
push ebx
call edi
push ebx
call esi
lea ebx, [ebx + eax + 1]
push 0x10014a0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x130]
push eax
push ebx
call edi
push ebx
call esi
lea edi, [ebx + eax + 1]
mov dword [ebp - 0x38c], edi
mov ebx, OleLoadFromStream
push 0x12c
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x390]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x10055eb
jmp 0x1005792
mov edi, dword [ebp - 0x38c]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3a4]
mov byte [edi], 0
pop edi
pop ebx
call fcn.01003019
leave
ret 0xc