joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462400
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4625ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46258c
mov dl, 1
mov eax, dword [0x418368]
call fcn.00403350
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040d0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46257b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00450134
test al, al
je 0x46256e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4625bc
lea eax, [ebp - 0x254]
call fcn.0040917c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46256e
xor eax, eax
push ebp
push 0x462567
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4625f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x462550
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404340
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x462550
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46256e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x462471
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c690
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4625b2
lea eax, [ebp - 0x260]
call fcn.004040d0
ret

Function at 0x462ee0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47dc0c]
cmp byte [eax + 0xa5], 0
jne 0x462f51
cmp dword [0x47dc24], 0
jne 0x462f12
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x462e9c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47dc24], eax
cmp dword [0x47dc20], 0
jne 0x462f2d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x47dc20], eax
cmp dword [0x47dc28], 0
jne 0x462f51
push esp
push 0
push 0
push 0x462e40
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x47dc28], eax
pop edx
ret
Function at 0x4630a4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4630bb
add esp, 0xfffffff0
call fcn.004036a4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004204a0
mov eax, dword [0x47cba8]
cmp word [eax + 2], 0
jne 0x4630e3
mov eax, dword [0x47cba8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464824
mov eax, dword [0x47cc6c]
cmp word [eax + 2], 0
jne 0x4630fd
mov eax, dword [0x47cc6c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464a1c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417dc0]
call fcn.00403350
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417dc0]
call fcn.00403350
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4229dc]
call fcn.00429fbc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x463284
mov eax, dword [0x47ca98]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a38c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x464fcc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47ca98]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c974
test eax, eax
je 0x4631f2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b70
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c99c
test eax, eax
je 0x463206
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404340
mov eax, dword [0x47c944]
cmp byte [eax], 0
jne 0x46323a
mov eax, ebx
call fcn.004633ac
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004651a8
mov eax, ebx
call fcn.00465b6c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46327a
call fcn.004036fc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46362c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47dc0c]
cmp dword [eax + 0x30], 0
je 0x4636d6
cmp dword [ebx + 0x94], 0
jne 0x4636d0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4635bc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4636d0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x463696
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4636d0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a2b4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4636a5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x464238
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46426d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041c0
jmp 0x46427a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404124
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x465384
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4653c5
mov eax, esi
call fcn.0044b6d8
test al, al
je 0x4653c5
mov eax, dword [ebx + 0x84]
call fcn.0044b3d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4653c5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044b3d4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x466750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00466718
mov eax, dword [ebx]
call fcn.00404390
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x466796
mov eax, ebx
mov edx, 0x4667a4
call fcn.00404398
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4667a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00466718
mov eax, dword [ebx]
call fcn.00404390
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4667ee
mov eax, ebx
mov edx, 0x4667fc
call fcn.00404398
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476634
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.00406e4c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
jb 0x476668
cmp dword [esp + 8], 1
jb 0x476668
cmp dword [esp + 0x10], 2
je 0x47666c
xor eax, eax
jmp 0x47666e
mov al, 1
add esp, 0x94
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x38682144
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3dd505b5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4244c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e08c
and dword [ebp - 4], 0
cmp dword [0x44c380], 0
mov ebx, eax
jne 0x424576
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424627
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424627
push eax
call fcn.0041e01a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c380], eax
call esi
push eax
call fcn.0041e01a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c384], eax
call esi
push eax
call fcn.0041e01a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c388], eax
call esi
push eax
call fcn.0041e01a
pop ecx
mov dword [0x44c390], eax
test eax, eax
je 0x424576
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e01a
pop ecx
mov dword [0x44c38c], eax
mov eax, dword [0x44c38c]
cmp eax, ebx
je 0x4245ce
cmp dword [0x44c390], ebx
je 0x4245ce
push eax
call fcn.0041e095
push dword [0x44c390]
mov esi, eax
call fcn.0041e095
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4245ce
test edi, edi
je 0x4245ce
call esi
test eax, eax
je 0x4245c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4245c5
test byte [ebp - 0xc], 1
jne 0x4245ce
or dword [ebp + 0x10], 0x200000
jmp 0x424607
mov eax, dword [0x44c384]
cmp eax, ebx
je 0x424607
push eax
call fcn.0041e095
pop ecx
test eax, eax
je 0x424607
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424607
mov eax, dword [0x44c388]
cmp eax, ebx
je 0x424607
push eax
call fcn.0041e095
pop ecx
test eax, eax
je 0x424607
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c380]
call fcn.0041e095
pop ecx
test eax, eax
je 0x424627
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424629
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x536d4438
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
mov ecx, 0x192b6531
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004451e0
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x808]
call fcn.00401100
add esp, 0xc
mov esi, eax
cmp dword [ebp + 8], 0
jne 0x4012e9
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x1008]
mov ecx, eax
call fcn.00401250
add esp, 4
test esi, esi
js 0x4012e9
lea eax, [ebp - 0x1008]
push eax
push str.:__ls
mov eax, 0x400
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x808]
lea eax, [eax + esi*2]
push eax
call fcn.004011a0
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
push 0x44fb48
push 2
call fcn.00420c25
add esp, 4
push eax
call fcn.004010a0
add esp, 0xc
push dword [ebp + 8]
call fcn.0040f3b0
int3
Function at 0x401c00
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0x100
push 0x46fea0
push str.VIRTUAL_ENV
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp edi, 0x100
jb 0x401c50
lea ecx, [edi*2 + 2]
push ecx
call fcn.00424945
mov esi, eax
add esp, 4
test esi, esi
je 0x401de9
push edi
push esi
push str.VIRTUAL_ENV
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x401c5d
test edi, edi
je 0x401cf1
mov esi, 0x46fea0
cmp word [esi], 0
je 0x401cf1
push esi
push str.Checking_for_Python_executable_in_virtual_env__ls_n
call fcn.00401220
push str.python.exe
push esi
push str._lsScripts_ls
push 0xffffffffffffffff
push 0x104
push 0x4af5d0
call fcn.004011a0
add esp, 0x20
push 0x4af5d0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x4af5d0
cmp eax, 0xffffffff
jne 0x401cb5
push str.Python_executable__ls_missing_from_virtual_env_n
call fcn.00401220
add esp, 8
jmp 0x401cf1
mov eax, dword [0x45608c]
imul esi, eax, 0x424
inc eax
mov dword [0x45608c], eax
push 0x104
add esi, 0x456090
lea eax, [esi + 0x14]
push eax
call fcn.00421c78
push str.venv
push 8
push esi
mov dword [esi + 0x10], 0
call fcn.00421c78
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_IsWow64Process]
push eax
call edi
test eax, eax
je 0x401d54
cmp dword [ebp - 4], 0
je 0x401d54
push str.locating_Pythons_in_64bit_registry_n
call fcn.00401220
push 0
push 0
push 0x20119
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000001
call fcn.00401430
push 0
push 0
push 0x20119
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000002
call fcn.00401430
add esp, 0x1c
push str.locating_Pythons_in_native_registry_n
call fcn.00401220
push 0
push 0
push 0x20019
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000001
call fcn.00401430
push 0
push 0
push 0x20019
mov edx, str.SOFTWAREPythonPythonCore
mov ecx, 0x80000002
call fcn.00401430
add esp, 0x1c
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call esi
push eax
call edi
pop edi
pop esi
test eax, eax
je 0x401dc8
cmp dword [ebp - 8], 0
je 0x401dc8
push 1
push 0x40
push 0x20119
mov edx, str.SOFTWAREMicrosoftAppModelLookasideuserSoftwarePythonPythonCore
mov ecx, 0x80000002
call fcn.00401430
add esp, 0xc
push 0x401a40
push 0x424
push dword [0x45608c]
push 0x456090
call fcn.00421fb0
add esp, 0x10
mov esp, ebp
pop ebp
ret
push str.Could_not_allocate_environment_buffer
push 0x68
call fcn.00401270
int3
Function at 0x401ee0
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebx
push esi
push edi
push str.pythonX
push str.py__ls
push 0xffffffffffffffff
push 0x400
push 0x4aedd0
mov ebx, str.environment
call fcn.004011a0
add esp, 0x14
push 0x100
push 0x46fea0
push 0x4aedd0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp edi, 0x100
jb 0x401f51
lea ecx, [edi*2 + 2]
push ecx
call fcn.00424945
mov esi, eax
add esp, 4
test esi, esi
je 0x402003
push edi
push esi
push 0x4aedd0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x401fe9
test edi, edi
jne 0x401fe4
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
cmp word [0x4700a0], si
je 0x401f96
push 0x4700a0
push 0x400
push 0x4aedd0
push esi
push str.pythonX
push str.defaults
call edi
test eax, eax
je 0x401f96
mov esi, 0x4aedd0
mov ebx, 0x4700a0
jmp 0x401fe9
cmp word [0x455e80], si
je 0x401fcc
push 0x455e80
push 0x400
push 0x4aedd0
push 0
push str.pythonX
push str.defaults
call edi
test eax, eax
je 0x401fcc
mov esi, 0x4aedd0
mov ebx, 0x455e80
jmp 0x401fe9
push str.pythonX
push str.found_no_configured_value_for__ls_n
call fcn.00401220
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov esi, 0x46fea0
push ebx
push esi
push str.pythonX
push str.found_configured_value__ls_ls_in__ls_n
call fcn.00401220
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret
push str.Could_not_allocate_environment_buffer
push 0x68
call fcn.00401270
int3