joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3046dfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x20]
mov eax, dword [ebp - 8]
mov ecx, 0x20
call fcn.30402998
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jb 0x3046e153
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x10
jae 0x3046e0ed
mov eax, dword [ebp - 0x10]
add eax, eax
mov edx, dword [ebp - 0xc]
shr edx, 1
and edx, 1
add eax, edx
shl eax, 7
lea eax, [eax*8 + 0x304ae0b0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
and eax, 0xff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
inc eax
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add eax, 0xf
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
and eax, 0xff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
inc eax
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add eax, 0xf
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor dword [eax + edx*4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jb 0x3046e037
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x304b55b8]
mov dword [ebp - 0x18], eax
mov eax, 0x20
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
shr eax, cl
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov edx, dword [edx + ebx*4]
shl edx, cl
or eax, edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jne 0x3046e10a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jne 0x3046e028
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x3046e023
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0xf
sub eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
xor dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x3046e158
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30473164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ebx, dword [0x304c58a4]
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call ebx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x20], eax
mov ebx, dword [0x304c58a4]
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
call ebx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax]
mov eax, dword [ebp - 0x1c]
call fcn.30473134
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 4]
add dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 6]
mov eax, dword [ebp - 0x28]
call fcn.30473134
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 8]
mov eax, dword [ebp - 0x18]
call fcn.30473134
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 0xa]
mov eax, dword [ebp - 0x14]
call fcn.30473134
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
add dword [ebp - 0x10], 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x304731ba
mov eax, dword [ebp - 0x10]
movzx edx, word [eax]
mov eax, dword [ebp - 0x1c]
call fcn.30473134
mov word [ebp - 2], ax
mov ax, word [ebp - 0x24]
mov edx, dword [ebp - 0x10]
add ax, word [edx + 2]
mov word [ebp - 4], ax
mov ebx, dword [0x304c58a4]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov ax, word [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add ax, word [edx + 4]
mov word [ebp - 2], ax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 6]
mov eax, dword [ebp - 0x28]
call fcn.30473134
mov word [ebp - 4], ax
mov ebx, dword [0x304c58a4]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30473ddc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
add eax, 0x100
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [ebp - 8]
and al, 0xff
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov eax, dword [ebp - 8]
and eax, 0xff
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 4]
mov byte [edx + eax], cl
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov dword [ebp - 8], edx
inc dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jne 0x30473e0b
mov esp, ebp
pop ebp
ret
Function at 0x304761d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
and eax, 0xff
imul eax, eax, 0x1010101
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
xor eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x304761f9
mov esp, ebp
pop ebp
ret
Function at 0x3047621c
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x304b8614
lea eax, [ebp - 0x108]
call fcn.304761d4
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x18]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x304b8614]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x304b8814]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x3047624f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x304b8714
lea eax, [ebp - 0x108]
call fcn.304761d4
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x17]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x304b8614]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x304b8c14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x400], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x304762b0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x304b8614
lea eax, [ebp - 0x108]
call fcn.304761d4
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x16]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x304b8714]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x304b9014]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x800], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x30476315
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x304b8714
lea eax, [ebp - 0x108]
call fcn.304761d4
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x15]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x108]
movzx eax, byte [eax + 0x304b8714]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x304b9414]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0xc00], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x3047637a
mov esp, ebp
pop ebp
ret
Function at 0x30476e78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov byte [eax - 0x100], 1
mov word [ebp - 2], 1
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax - 0x101]
add eax, eax
mov word [ebp - 4], ax
test byte [ebp - 3], 1
je 0x30476ead
xor word [ebp - 4], 0x1f5
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 4]
mov byte [edx + eax - 0x100], cl
inc word [ebp - 2]
cmp word [ebp - 2], 0x100
jne 0x30476e8c
mov word [ebp - 2], 1
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax - 0x100]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 2]
mov byte [edx + eax - 0x200], cl
inc word [ebp - 2]
cmp word [ebp - 2], 0xff
jne 0x30476ed0
pop ecx
pop ebp
ret

Function at 0x30476f4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.30402998
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call fcn.30402998
mov ebx, dword [0x304c55a4]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 0
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
xor eax, eax
mov al, byte [ebp - 0xd]
movzx eax, byte [eax*8 + 0x304b9a14]
call fcn.30476efc
pop ecx
xor edx, edx
mov dl, byte [ebp - 0xd]
mov byte [ebp + edx - 0x1e], al
mov byte [ebp - 0xe], 1
push ebp
xor eax, eax
mov al, byte [ebp - 0xe]
xor edx, edx
mov dl, byte [ebp - 0xd]
lea edx, [edx*8 + 0x304b9a14]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xe]
movzx edx, byte [ebp + edx - 0x16]
call fcn.30476efc
pop ecx
xor edx, edx
mov dl, byte [ebp - 0xd]
xor byte [ebp + edx - 0x1e], al
inc byte [ebp - 0xe]
cmp byte [ebp - 0xe], 8
jne 0x30476fbe
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 8
jne 0x30476f98
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
shl eax, 8
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0xd]
movzx edx, byte [ebp + edx - 0x1e]
xor eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 8
jne 0x30477015
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30477fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
jmp 0x30477fbb
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x30477fb7
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x30478018
xor eax, eax
push ebp
push 0x30478011
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30478018
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret

Function at 0x304788d4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x30415b54]
call fcn.304050c8
xor eax, eax
push ebp
push 0x30478a18
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x304c4058], 0
jne 0x30478927
mov ecx, dword [0x304c52ac]
mov dl, 1
mov eax, dword [0x30407a48]
call fcn.3040cd14
call fcn.30404064
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.304030cc
mov eax, ebx
call fcn.30404f78
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x30478a28
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.30406068
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.30404f88
test eax, eax
jle 0x304789bf
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x304789b8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.30404970
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.30404958
mov eax, dword [ebp - 0x48]
pop edx
call fcn.3040899c
test eax, eax
jne 0x304789b8
mov ebx, 0x15
jmp 0x304789c4
mov ebx, 0x10
jmp 0x304789c4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x304c4058]
call fcn.3047882c
mov eax, dword [ebp - 8]
call fcn.3047882c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.30406080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30478a1f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.3040470c
lea eax, [ebp - 0x10]
mov edx, dword [0x30415b54]
call fcn.30405198
ret
Function at 0x304898f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3048997d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.30404d34
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.30404ba8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.304049a8
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.30404d34
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x3047bab0]
call fcn.3047adb4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.3040473c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x30489984
lea eax, [ebp - 0xc]
call fcn.304046e8
ret

Function at 0x3049e0a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.304046e8
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x3049e124
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x3049e11c
mov dword [ebp - 0x10], 0x105
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x115]
push eax
push 0
push 0
push 0x3049e144
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea edx, [ebp - 0x115]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
call fcn.304047d8
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x304abf50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.30404b98
xor eax, eax
push ebp
push 0x304abfec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.3040473c
lea eax, [ebp - 0xc]
mov edx, 0x401
call fcn.30404d34
lea eax, [ebp - 0xc]
call fcn.30404c00
mov edx, 0x400
call fcn.30407444
push 0x400
lea eax, [ebp - 0xc]
call fcn.30404c00
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
jbe 0x304abfce
mov eax, dword [ebp - 0xc]
call fcn.30404ba8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.304048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x304abff3
lea eax, [ebp - 0xc]
call fcn.304046e8
lea eax, [ebp - 4]
call fcn.304046e8
ret
Function at 0x406294
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4062b8
xor eax, eax
test eax, eax
je 0x4062ca
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4062ca
xor ecx, ecx
jmp 0x4062cd
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4063b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42229c], 0
push esi
jne 0x4063f0
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4063ca
mov dword [ecx*4 + 0x422298], eax
inc ecx
cmp ecx, 0x100
jl 0x4063c5
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406421
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422298]
xor eax, esi
inc ecx
dec edx
jne 0x406403
pop edi
not eax
pop esi
ret 0xc

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
mov ecx, 0x11116d5a
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x4c7f7248
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x2dbd2406
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x7dfa248a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219