joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401876
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4085b0
call sub.KERNEL32.DLL_GetWindowsDirectoryA
cmp byte [0x408035], 0
je 0x4017ee
push 0x4085b0
call sub.KERNEL32.DLL_LoadLibraryA
mov eax, 0x4085d0
call fcn.00401184
mov eax, 0x4085e0
call fcn.00401184
mov eax, 0x40860c
call fcn.00401184
push 0xff8
push 0
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x408608], eax
cmp dword [0x408608], 0
je 0x401855
mov eax, 3
mov edx, dword [0x408608]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x40182b
mov eax, 0x4085f0
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x4085fc], eax
mov byte [0x4085a8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40187d
cmp byte [0x408035], 0
je 0x401875
push 0x4085b0
call sub.KERNEL32.DLL_Sleep
ret

Function at 0x401884
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4085a8], 0
je 0x401961
xor edx, edx
push ebp
push 0x40195a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x408035], 0
je 0x4018b6
push 0x4085b0
call sub.KERNEL32.DLL_LoadLibraryA
mov byte [0x4085a8], 0
mov eax, dword [0x408608]
push eax
call sub.KERNEL32.DLL_GetProfileIntA
xor eax, eax
mov dword [0x408608], eax
mov ebx, dword [0x4085d0]
jmp 0x4018e9
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov ebx, dword [ebx]
cmp ebx, 0x4085d0
jne 0x4018d7
mov eax, 0x4085d0
call fcn.00401184
mov eax, 0x4085e0
call fcn.00401184
mov eax, 0x40860c
call fcn.00401184
mov eax, dword [0x4085c8]
test eax, eax
je 0x40192f
mov edx, dword [eax]
mov dword [0x4085c8], edx
push eax
call sub.KERNEL32.DLL_GetProfileIntA
mov eax, dword [0x4085c8]
test eax, eax
jne 0x401918
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401961
cmp byte [0x408035], 0
je 0x40194f
push 0x4085b0
call sub.KERNEL32.DLL_Sleep
push 0x4085b0
call sub.KERNEL32.DLL_WinExec
ret
pop ebx
pop ebp
ret
Function at 0x402604
Capabilities:
Clear file content

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov ebx, eax
jmp 0x402616
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
mov al, byte [ebx]
test al, al
je 0x402620
cmp al, 0x20
jbe 0x40260e
cmp byte [ebx], 0x22
jne 0x402630
cmp byte [ebx + 1], 0x22
jne 0x402630
add ebx, 2
jmp 0x402616
xor ebp, ebp
mov edi, ebx
jmp 0x402679
cmp al, 0x22
jne 0x40266b
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
jmp 0x402652
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, eax
sub edx, ebx
add ebp, edx
mov ebx, eax
mov al, byte [ebx]
test al, al
je 0x40265c
cmp al, 0x22
jne 0x402644
cmp byte [ebx], 0
je 0x402679
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
jmp 0x402679
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov edx, eax
sub edx, ebx
add ebp, edx
mov ebx, eax
mov al, byte [ebx]
cmp al, 0x20
ja 0x402636
mov eax, esi
mov edx, ebp
call fcn.00403f74
mov ebx, edi
mov edi, dword [esi]
xor esi, esi
jmp 0x4026e1
cmp al, 0x22
jne 0x4026cc
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
jmp 0x4026b3
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
cmp eax, ebx
jbe 0x4026b3
mov dl, byte [ebx]
mov byte [edi + esi], dl
inc ebx
inc esi
cmp eax, ebx
ja 0x4026a8
mov al, byte [ebx]
test al, al
je 0x4026bd
cmp al, 0x22
jne 0x40269e
cmp byte [ebx], 0
je 0x4026e1
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
jmp 0x4026e1
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
cmp eax, ebx
jbe 0x4026e1
mov dl, byte [ebx]
mov byte [edi + esi], dl
inc ebx
inc esi
cmp eax, ebx
ja 0x4026d6
mov al, byte [ebx]
cmp al, 0x20
ja 0x402690
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4026f0
Capabilities:
Copy file
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403ab0
test esi, esi
jne 0x402726
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_CopyFileA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403ba0
jmp 0x402744
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402604
mov edi, eax
test esi, esi
je 0x402744
cmp dword [ebx], 0
je 0x402744
dec esi
jmp 0x40272d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402ae0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x407008], 0x8088405
inc edx
mov dword [ebx + 0x407008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x402b24
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x402b50
cmp edx, 3
ja 0x402be6
call dword [ebx + 0x24]
test eax, eax
je 0x402b50
call fcn.00402588
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x402afc
mov dword [ebx + 0x1c], 0x4027c8
cmp byte [ebx + 0x48], 0
je 0x402bcd
mov eax, 0xc0000000
mov dl, byte [0x40700c]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x407054]
mov ecx, 2
sub edi, 3
je 0x402baf
mov ecx, 3
inc edi
je 0x402baf
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x402baf
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
cmp eax, 0xffffffff
je 0x402bed
mov dword [ebx], eax
jmp 0x402bfd
mov dword [ebx + 0x24], 0x4027c8
cmp edi, 3
je 0x402bdd
push 0xfffffffffffffff6
jmp 0x402bdf
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetCurrentThreadId
jmp 0x402bc4
mov eax, 0x66
jmp 0x402bf8
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_TlsSetValue
call fcn.00402588
pop edi
pop esi
pop ebx
ret

Function at 0x403254
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x407010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4032ec
push 0x80000002
call sub.KERNEL32.DLL_RaiseException
test eax, eax
jne 0x4032cc
xor eax, eax
push ebp
push 0x4032c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403308
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032cc
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetStdHandle
ret
mov ax, word [0x407010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x407010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404518
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4045c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4045af
mov edi, dword [eax + 0xc]
xor ebx, ebx
mov eax, esi
call fcn.00403ab0
jmp 0x4045a4
push dword [esi]
push 0x4045e0
mov eax, dword [edi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.00403bf8
push dword [ebp - 0x1d4]
mov eax, esi
mov edx, 3
call fcn.00403d0c
inc ebx
cmp dword [edi + ebx*4], 0
jne 0x404573
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4045cf
lea eax, [ebp - 0x1d4]
call fcn.00403ab0
ret
Function at 0x4045e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov dword [ebp - 0x48], 0x10000
xor eax, eax
mov dword [ebp - 0x44], eax
fild qword [ebp - 0x48]
fmul dword [0x404700]
fistp qword [ebp - 0x48]
wait
call fcn.004043fc
mov ebx, eax
call fcn.004043fc
cmp ebx, eax
je 0x40460b
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call fcn.004043fc
lea edx, [ebx + 0x3e8]
cmp eax, edx
jb 0x40461c
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
fild qword [ebp - 0x50]
fistp qword [ebp - 0x38]
wait
cmp dword [ebp - 4], 0
jae 0x404657
fild qword [ebp - 0x38]
fild qword [ebp - 0x48]
faddp st(1)
fistp qword [ebp - 0x38]
wait
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
fild qword [ebp - 0x50]
fistp qword [ebp - 0x40]
wait
cmp dword [ebp - 8], 0
jae 0x40467b
fild qword [ebp - 0x40]
fild qword [ebp - 0x48]
faddp st(1)
fistp qword [ebp - 0x40]
wait
fild qword [ebp - 0x38]
fild qword [ebp - 0x48]
fmulp st(1)
fild qword [ebp - 0x40]
faddp st(1)
fistp qword [ebp - 0x28]
wait
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
fild qword [ebp - 0x50]
fistp qword [ebp - 0x38]
wait
cmp dword [ebp - 0xc], 0
jae 0x4046b0
fild qword [ebp - 0x38]
fild qword [ebp - 0x48]
faddp st(1)
fistp qword [ebp - 0x38]
wait
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
fild qword [ebp - 0x50]
fistp qword [ebp - 0x40]
wait
cmp dword [ebp - 0x10], 0
jae 0x4046d4
fild qword [ebp - 0x40]
fild qword [ebp - 0x48]
faddp st(1)
fistp qword [ebp - 0x40]
wait
fild qword [ebp - 0x38]
fild qword [ebp - 0x48]
fmulp st(1)
fild qword [ebp - 0x40]
faddp st(1)
fistp qword [ebp - 0x30]
wait
fild qword [ebp - 0x30]
fild qword [ebp - 0x28]
fsubp st(1)
fdiv dword [0x404704]
fstp xword [ebp - 0x20]
wait
fld xword [ebp - 0x20]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404b60
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x40710c], 0
jne 0x404c32
mov byte [0x40710c], 1
xor eax, eax
mov dword [0x4070f4], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call fcn.00404404
cmp dword [esp + 0x1c], 3
ja 0x404ba8
cmp dword [esp + 0x1c], 3
jne 0x404c08
cmp dword [esp + 0x20], 0x33
jbe 0x404c08
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x404c3c
push 0x80000002
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x404c32
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x404c6c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
test eax, eax
jne 0x404c32
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCreateKeyA
cmp byte [esp + 8], 0x31
jne 0x404c32
cmp byte [esp + 9], 0
jne 0x404c32
jmp 0x404c1d
push 0
push 0x404c6c
push 0x404c74
call fcn.004043f4
test eax, eax
je 0x404c32
mov eax, dword [0x4070f0]
call main
push eax
call fcn.00404414
mov dword [0x4070f4], eax
add esp, 0xac
ret
Function at 0x404f90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e34
xor eax, eax
push ebp
push 0x404ff9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403b48
push 0
mov eax, dword [ebp - 8]
call fcn.00403c4c
push eax
lea eax, [ebp - 8]
call fcn.00403e9c
push eax
mov eax, dword [0x4088c0]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405000
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ad4
ret

Function at 0x405158
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403e34
mov eax, dword [ebp - 8]
call fcn.00403e34
xor eax, eax
push ebp
push 0x405201
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call main
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 0xc], 0x3ff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call main
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.00403c34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405208
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ad4
ret
Function at 0x405210
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403e34
mov eax, dword [ebp - 8]
call fcn.00403e34
xor eax, eax
push ebp
push 0x40541c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x40525f
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x40525f
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00403ee4
cmp byte [ebp + 8], 2
jne 0x405332
mov eax, dword [ebp - 4]
call fcn.00403c4c
add eax, eax
add eax, 2
call fcn.00402474
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403c4c
mov ecx, eax
add ecx, ecx
add ecx, 2
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00403fd8
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push esi
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x40531f
mov eax, dword [ebp - 8]
call fcn.00403c4c
add eax, eax
add eax, 2
call fcn.00402474
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00403c4c
mov ecx, eax
add ecx, ecx
add ecx, 2
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00403fd8
mov cl, byte [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00405004
mov edi, eax
test edi, edi
jle 0x405302
mov eax, dword [ebp - 0xc]
push eax
mov al, byte [ebp + 8]
push eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov ecx, edi
mov eax, ebx
call fcn.004050b0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov word [eax + edi*2], 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCreateKeyA
mov eax, ebx
call fcn.00402494
jmp 0x405326
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, esi
call fcn.00402494
jmp 0x405401
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call main
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4053fa
mov eax, dword [ebp - 8]
call fcn.00403c4c
add eax, eax
add eax, 2
call fcn.00402474
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00403c4c
mov ecx, eax
add ecx, ecx
add ecx, 2
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00403fd8
mov cl, byte [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00405004
mov edi, eax
test edi, edi
jle 0x4053dd
mov eax, 0xffff
call fcn.00402474
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push eax
mov al, byte [ebp + 8]
push eax
mov ecx, edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004050b0
mov edx, edi
dec edx
test edx, edx
jl 0x4053d5
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx + eax]
push ecx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
pop esi
mov word [ecx + eax*2], si
inc eax
dec edx
jne 0x4053bf
mov eax, dword [ebp - 0x10]
call fcn.00402494
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov word [eax + edi*2], 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCreateKeyA
mov eax, ebx
call fcn.00402494
jmp 0x405401
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405423
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ad4
ret
Function at 0x405a6c
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e34
mov eax, dword [ebp - 8]
call fcn.00403e34
xor eax, eax
push ebp
push 0x405afa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x405ad3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call main
push eax
mov eax, dword [ebp - 4]
call main
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405adf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b01
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ad4
ret
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000c455
pop dword [ebp - 0x44]
mov eax, 0xe7817216
sub eax, 0xd780adc1
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3c84d
push 0
mov eax, 0x40b30ee6
add eax, 0xcf4e317e
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x78d644d4
sub ecx, 0x78d5eea8
xor edx, edx
add edx, eax
mov ebx, 0x71c89bf
add ebx, 0x8e4fc41
add ebx, dword [ebp - 0x44]
mov edi, 0x7dea95a6
sub edi, 0x59576767
mov esi, dword [ebx]
sub dword [ebp - 0x18], 0x75bda3f1
sub esi, edi
xor dword [ebp - 0x2c], ebx
mov dword [edx], esi
sub dword [ebp - 4], edi
add edx, 0x2bd58c64
sub edx, 0x2bd58c60
add ebx, 0x92e90c73
sub ebx, 0x92e90c6f
loop 0x1000c4b6
add eax, 0x14b83
mov ebx, eax
add eax, 0xf79857ae
add eax, 0x867a857
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4031b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov eax, 0x5ba8a8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.005a883c
mov word [ebp - 0x20], 0x18
push ebx
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 4]
inc dword [ebp - 0x14]
push ecx
inc dword [ebp - 0x14]
call fcn.00404f18
mov word [ebp - 0x20], 0xc
mov word [ebp - 0x20], 0x24
xor ecx, ecx
add esp, 8
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
inc dword [ebp - 0x14]
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, 0x5cd218
call fcn.00403110
lea ecx, [ebp - 8]
mov eax, dword [ecx]
push eax
push ebx
call fcn.00402e24
add esp, 8
mov esi, eax
sub dword [ebp - 0x14], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401c2c
mov word [ebp - 0x20], 0xc
cmp esi, 0xffffffff
jne 0x403247
mov ecx, dword [ebp - 4]
push ecx
push ebx
call fcn.00402e24
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
jne 0x403270
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
sub dword [ebp - 0x14], 2
call fcn.00401c2c
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x403384
mov word [ebp - 0x20], 0x30
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 4]
lea eax, [ebp - 0xc]
call fcn.004fccb8
lea edi, [ebp - 0xc]
inc dword [ebp - 0x14]
cmp dword [edi], 0
je 0x403295
mov eax, dword [edi]
jmp 0x40329a
mov eax, 0x5ba3f2
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005b7fac
mov word [ebp - 0x20], 0xc
mov cl, byte [ebp + 0xc]
push ecx
push 0
push 0
push esi
push edi
mov ecx, dword [ebp - 4]
push ecx
push ebx
call fcn.00402ed0
add esp, 0x1c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call fcn.0040338c
add esp, 0xc
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x48]
push eax
push esi
call sub.KERNEL32.DLL_GetFileTime
push esi
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call fcn.00402b78
add esp, 0x14
push edi
push ebx
call fcn.004031a0
add esp, 8
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push ebx
call fcn.00402c0c
add esp, 0xc
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push ebx
call fcn.00402c38
add esp, 0xc
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push ebx
call fcn.00402c64
add esp, 0xc
call sub.WINMM.DLL_timeGetTime
mov edx, eax
mov eax, ebx
test eax, eax
je 0x403365
mov dword [eax + 0x3c], edx
mov eax, dword [eax + 8]
test eax, eax
jne 0x40335b
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
sub dword [ebp - 0x14], 2
call fcn.00401c2c
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429b00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov eax, 0x5ca37c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.005a883c
mov dword [ebp - 0x10], 2
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.005b7030
inc dword [ebp - 0x10]
inc dword [ebp - 0x10]
lea edx, [ebp - 0x3c]
mov word [ebp - 0x1c], 0xc
mov dword [ebx], 0
lea ecx, [ebp - 0x38]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push edx
push ecx
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x30]
push ecx
push eax
mov word [ebp - 0x1c], 0x18
lea edx, [ebp + 0xc]
lea ecx, [ebp - 4]
push edx
push ecx
call fcn.00429c38
add esp, 8
mov esi, eax
add dword [ebp - 0x10], 2
cmp dword [esi], 0
jne 0x429b87
mov eax, 0x5ca348
jmp 0x429b89
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
push eax
lea eax, [ebp - 4]
sub dword [ebp - 0x10], 2
mov edx, 2
call fcn.00407750
pop ecx
test ecx, ecx
je 0x429bb3
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0x34]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov word [ebp - 0x1c], 0x24
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
call fcn.00429c38
add esp, 8
mov esi, eax
add dword [ebp - 0x10], 2
cmp dword [esi], 0
jne 0x429bdb
mov edi, 0x5ca349
jmp 0x429bdd
mov edi, dword [esi]
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x44]
push ecx
push edi
call sub.KERNEL32.DLL_GetDiskFreeSpaceExA
push eax
lea eax, [ebp - 8]
sub dword [ebp - 0x10], 2
mov edx, 2
call fcn.00407750
pop ecx
test ecx, ecx
je 0x429c12
mov ecx, dword [ebp - 0x4c]
mov dword [ebx + 8], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebx + 0xc], ecx
sub dword [ebp - 0x10], 2
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00401c2c
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret