joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41de8d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41df2a
push ebx
push esi
call fcn.0041de56
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041cc1e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41ded7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41df29
push edi
push eax
call fcn.00417843
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41def7
call fcn.00416dff
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41df28
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041cc1e
add esp, 0x20
test eax, eax
jne 0x41df16
push edi
call fcn.00416dff
jmp 0x41df1e
push ebx
call fcn.00416dff
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x424950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42497d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42497d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x4139c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4139c6
ret
Function at 0x401300
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 1
push str.ServicesActive
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x40138b
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
cmp esi, 0x18
jae 0x401386
push 4
push dword [esi + 0x40c024]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x401376
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40136b
cmp dword [ebp - 0x1c], 4
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
jmp 0x40137c
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
add esi, 4
test bl, bl
je 0x401333
push eax
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040577e
mov esp, ebp
pop ebp
ret

Function at 0x4013e0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x40c614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [ebp - 0x2c], edx
sub ecx, eax
je 0x401414
inc edx
mov dword [ebp - 0x2c], edx
push ebx
push esi
xor cl, cl
xor bl, bl
push edi
mov byte [ebp - 0x22], cl
xor edi, edi
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x28], edi
test bl, bl
jne 0x4014f2
cmp edi, edx
jae 0x4014f2
push 1
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4014b5
xor esi, esi
mov edi, edi
cmp esi, 0x18
jae 0x401499
push 4
push dword [esi + 0x40c024]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40148f
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401488
cmp dword [ebp - 0x1c], 4
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
add esi, 4
test bl, bl
je 0x401450
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x28]
test bl, bl
je 0x4014b5
mov edx, dword [ebp - 0x2c]
mov bl, 1
mov cl, byte [ebp - 0x22]
inc edi
jmp 0x401420
push 0x3e8
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4014df
cmp eax, 0x102
jne 0x4014df
mov edx, dword [ebp - 0x2c]
xor cl, cl
mov bl, byte [ebp - 0x21]
inc edi
mov byte [ebp - 0x22], cl
jmp 0x401423
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040577e
mov esp, ebp
pop ebp
ret
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040577e
mov esp, ebp
pop ebp
ret
Function at 0x4029a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406171
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x40c614]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x24]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x14], eax
mov al, byte [ebp + 0x28]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], ebx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], esi
mov byte [edi + 0x20], al
mov dword [edi + 0x30], 0
test al, al
jne 0x402a7f
xor ecx, ecx
mov dword [ebp + 0x28], ecx
test esi, esi
je 0x402a3e
add edx, 0xc
cmp dword [edx], ecx
cmova ecx, dword [edx]
lea edx, [edx + 0x10]
dec esi
jne 0x402a30
mov dword [ebp + 0x28], ecx
cmp ecx, 0x100000
lea edx, [ebp + 0x28]
mov eax, 0x409e74
cmovbe eax, edx
mov eax, dword [eax]
mov dword [edi + 0x28], eax
add eax, 0xa
push eax
call fcn.00405668
mov esi, eax
add esp, 4
mov eax, dword [edi + 0x24]
cmp eax, esi
je 0x402a75
push eax
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [edi + 0x24], esi
push 0
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x40
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00405668
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x402acd
push 0x402c40
push 0x402940
push dword [ebp + 0x14]
mov dword [eax], ebx
lea ebx, [eax + 4]
push 0x40
push ebx
call fcn.004057f0
jmp 0x402acf
xor ebx, ebx
mov eax, dword [edi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x402afd
test eax, eax
je 0x402afa
push 0x402c40
push dword [eax - 4]
lea esi, [eax - 4]
push 0x40
push eax
call fcn.00405852
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [edi + 0x2c], ebx
mov ecx, edi
call fcn.00402ec0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24

Function at 0x402d10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x402d2d
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
mov eax, dword [esi]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4031c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
jg 0x4031fe
jl 0x4031e2
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0x7fffffff
ja 0x4031fe
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0xffffffff
jg 0x403203
jl 0x4031fe
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x80000001
jae 0x403203
jmp 0x4032a2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
test eax, eax
je 0x40321f
mov dword [ebp - 0x14], 0
jmp 0x403226
mov dword [ebp - 0x14], 2
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x4032a2
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0xc]
jae 0x4032a2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp + 0x14]
push eax
call fcn.004023e0
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403295
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
jae 0x403297
jmp 0x4032a2
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x403245
mov esp, ebp
pop ebp
ret
Function at 0x403690
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x19], 0
jne 0x4036d1
cmp dword [esi + 0x1c], 0xffffffff
jne 0x4036d1
cmp dword [esi + 0x14], 0x10
jb 0x4036ad
mov eax, dword [esi]
jmp 0x4036af
mov eax, esi
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
sete al
mov byte [esi + 0x19], al
mov ecx, dword [esi + 0x1c]
mov esi, dword [ebp + 0xc]
cmp ecx, 0xffffffff
je 0x40378e
cmp byte [esi], 0
jne 0x40378e
cmp dword [esi + 4], 0
jne 0x40371a
cmp byte [ebp + 0x10], 0
mov edx, 0x1000002
push 0
push 0
push 0
mov eax, 2
cmovne eax, edx
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
jne 0x40371a
mov byte [esi], 1
mov eax, dword [esi + 4]
test eax, eax
je 0x40378e
cmp dword [esi + 8], 0
jne 0x40378e
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x403748
cmp eax, eax
mov byte [esi], 1
pop esi
setne al
pop ebp
ret
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004033e0
add esp, 0xc
test al, al
je 0x40377b
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40377b
mov eax, dword [esi + 8]
dec eax
add eax, ecx
mov dword [esi + 0xc], eax
xor eax, eax
cmp dword [esi + 8], eax
pop esi
setne al
pop ebp
ret
push dword [esi + 8]
mov byte [esi], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], 0
xor eax, eax
cmp dword [esi + 8], eax
pop esi
setne al
pop ebp
ret

Function at 0x405230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x40c614]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x140], ecx
lea ecx, [ebp - 0x144]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4052c5
push ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x136
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x40529d
xor bl, bl
jmp 0x4052b4
push dword [ebp - 0x140]
lea eax, [ebp - 0x13c]
mov bl, 1
push eax
push 0
push esi
call edi
add esp, 0x10
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x4052d5
push dword [ebp - 0x140]
push 0
push 0
push esi
call edi
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040577e
mov esp, ebp
pop ebp
ret
Function at 0x4052f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x40c614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x144]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x13d], 0
push 0
mov dword [ebp - 0x144], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40539a
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x144]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x405364
push ebx
lea eax, [ebp - 0x13c]
push eax
push 1
push esi
call edi
add esp, 0x10
mov byte [ebp - 0x13d], 1
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x405391
mov eax, dword [ebp - 0x148]
push dword [ebp - 0x144]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
cmp byte [ebp - 0x13d], 0
jne 0x4053a5
push ebx
push 0
push 1
push esi
call edi
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040577e
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4fac5826
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x58326daa
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42ed00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
or ebp, 0xffffffff
jmp 0x42ed22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ed29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42ed18
mov eax, 1
add ebx, ebx
jne 0x42ed3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42ed30
jne 0x42ed4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ed30
xor ecx, ecx
sub eax, 3
jb 0x42ed60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42edd2
mov ebp, eax
add ebx, ebx
jne 0x42ed6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ed78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ed9c
inc ecx
add ebx, ebx
jne 0x42ed88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ed7d
jne 0x42ed99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ed7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42edbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42edad
jmp 0x42ed1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42edbc
add edi, ecx
jmp 0x42ed1e
pop esi
mov edi, esi
mov ecx, 0x5c1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42edda
cmp byte [edi], 0
jne 0x42edda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42eddf
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42ee4e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x35154]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x351dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ee0c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x351e4]
or eax, eax
je 0x42ee48
mov dword [ebx], eax
add ebx, 4
jmp 0x42ee29
call dword [esi + 0x351e0]
mov ebp, dword [esi + 0x351e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42ee82
sub esp, 0xffffff80
jmp 0x4113bc
Function at 0x5f8f11
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
lds ebp, [esi]
mov eax, dword [0xbc064091]
and eax, 0x2bd4a22f
daa
and byte ss:[ebp - 0x24], ah
cmp al, 0x1e
js 0x5f8f56
mov dword [ebx], ecx
dec esi
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
out dx, eax
scasd eax, dword es:[edi]
push esi
add ecx, 0x38ad0d6f
cmp dword [eax + 4], ecx
sub dword [eax - 0x53faf387], ecx
push ecx
iretd
out dx, al
xor eax, 0x439b5364
das
and ch, dh
out dx, al
jge 0x5f8ece
dec ebp
xor byte [ebp - 0x1dc4677e], 0x2b
aam 0xd3
or al, 0xeb
sti
das
inc ebx
cmp eax, 0x5d8dcdf5
sbb byte [ebx + 0x279dba08], bh
xchg ecx, eax
fstp qword [eax + 0x2d]
pushfd
das
js 0x5f8f19
push es
inc ebp
mov cl, 0x6d
mov ch, bh
mov word [ebx + 0x5a], cs
movsd dword es:[edi], dword [esi]
dec esp
and ebx, dword [edx - 0x5b]
in eax, dx
popfd
jge 0x5f8f45
pop ebx
call 0xf464019e
stosd dword es:[edi], eax
push ebx
wait
mov dword [ebp + 0x61], ebx
insd dword es:[edi], dx
push 0xbe725b5
lahf
jnp 0x5f8f70
mov ebp, 0x23478d1e
push esi
push ecx
mov edi, 0x6e056bf1
fst qword [edi]
mov eax, dword [0x4c7d99e5]
int 0x28
mov ebx, dword [eax + 0x23]
jp 0x5f8ffa
int 0x68
lea ebx, [eax - 0x2ed410c5]
or dword [ebx + edi*4], 0xfffffffb
dec esi
mov ebx, 0x3d20cd5e
retf
je 0x5f8f3f
cmp byte [ebx + 0x6de53541], bl
dec eax
std
imul ecx, dword [ebp - 0x53], 0xe82b98dd
and ebx, dword [ebx]
pop edx
mov edi, dword [esi]
in eax, dx
dec esi
std
or ebx, dword [edi + eax*8]
mov edi, dword [esi + 0x6b]
invalid
sub byte [ebp + 0x2c], bl
into
cmp ebx, esi
dec ebp
mov word [ebp - 0x66], ds
fldl2e
jmp 0x5f8fe2
clc
jp 0x5f8fda
fstp qword [eax]
mov ebx, 0xc7daab63
dec esp
push dword [ecx]
inc edx
inc esi
push edi
sbb al, 0xf
cdq
invalid
mov ebp, 0xa80bb86e
fstp st(0)
and al, byte [ebx + 0x31]
and dword [edx - 0x51e7a135], esi
jmp 0x5f8f92
xor dword [ebp + 0x11eedc5e], esi
mov ebx, 0xe7ba6fe5
jno 0x5f8fb6
and dword [esi - 0x74], edx
dec edi
mov esi, 0xf94a9a5a
mov esi, 0xf94a9a5a
in al, dx
sbb edx, 0xfffffffc
dec edx
and dword [0xa98ba06], ebx
into
jl 0x5f8fcc
cli
jnp 0x5f8fd9
xchg ecx, eax
mov edx, 0x6acf6533
xchg edi, eax
cli
mov ah, 0xbe
sbb eax, 0x93053c58
dec esi
add al, 0x3f
test eax, 0xa97dbf3b
imul edx, dword [eax - 0x8b5308b], 0xffffffb9
test eax, 0x2b3a3f5c
jnp 0x5f9037
mov edi, 0x906ba97d
jne 0x5f900d
dec edx
idiv dword [ecx + 0x3a3f5ca9]
sub edi, dword [ebx - 0x11]
std
adc esp, dword [ebp - 0x33c22081]
lcall 0xae9, 0xed6a1bfb
clc
fisub word [edx - 0x41]
xchg esi, eax
jmp [eax]
Function at 0x401020
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401034
mov eax, dword [0x4380cc]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401046
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4380d0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x4010cb
mov eax, dword [ebp - 4]
mov ecx, dword [0x4380b4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x4010c6
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x1474
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1474
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x4010a7
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4010a7
xor eax, eax
jmp 0x4010cb
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40103d
mov esp, ebp
pop ebp
ret
Function at 0x401770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str.55222
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4017ea
cmp dword [ebp - 0x118], 0
je 0x4017ea
jmp 0x40184c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x40184c
mov dword [ebp - 0x120], 0x514337
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4380b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4380d0], edx
mov dword [ebp - 0x120], 0x514337
mov dword [ebp - 0x120], 0x514337
call fcn.004011e0
mov eax, dword [ebp + 8]
mov dword [0x4380cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401af0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4017ea
mov esp, ebp
pop ebp
ret

Function at 0x401850
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40186c
xor eax, eax
jmp 0x40194d
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x401884
xor eax, eax
jmp 0x40194d
push ebp
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
call fcn.00401320
mov esp, ebp
pop ebp
ret
Function at 0x401b30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
mov ecx, 1
test ecx, ecx
je 0x401bdb
mov edx, dword [0x4380c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b67
jmp 0x401bdb
cmp dword [0x4380c0], 0
jne 0x401b85
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b85
xor eax, eax
jmp 0x401bdb
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
mov ecx, dword [eax]
add ecx, dword [0x4380c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4380c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x85
mov eax, dword [0x4380c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
push eax
call fcn.004011f0
add esp, 8
mov ecx, dword [0x4380c0]
add ecx, 4
mov dword [0x4380c0], ecx
jmp 0x401b4d
mov esp, ebp
pop ebp
ret