joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d1a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
mov ebp, ecx
mov edx, dword [ebp + 0x48]
sub edx, 6
test edx, edx
push esi
push edi
jle 0x49d1ca
mov esi, dword [esp + 0x3c]
mov ecx, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor ecx, ecx
xor eax, eax
test edx, edx
jle 0x49d209
cmp esi, dword [ebp + 0x48]
jg 0x49d351
cmp eax, edx
jge 0x49d1fb
cmp ecx, 4
jge 0x49d1fe
mov ebx, dword [esp + eax*4 + 0x14]
lea edi, [ecx + esi*4]
add eax, 1
add ecx, 1
cmp eax, edx
mov dword [ebp + edi*4 + 0x4c], ebx
jl 0x49d1e1
cmp ecx, 4
jne 0x49d205
add esi, 1
xor ecx, ecx
cmp eax, edx
jl 0x49d1d4
cmp esi, dword [ebp + 0x48]
jg 0x49d351
mov dword [esp + 0x10], 0x585518
lea ebx, [ebx]
movzx edi, byte [esp + edx*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [edi + str.cw]
mov byte [esp + 0x14], al
movzx edi, byte [esp + edx*4 + 0x12]
movzx ebx, byte [edi + str.cw]
xor byte [esp + 0x15], bl
movzx edi, byte [esp + edx*4 + 0x13]
movzx ebx, byte [edi + str.cw]
xor byte [esp + 0x16], bl
movzx edi, byte [esp + edx*4 + 0x10]
movzx ebx, byte [edi + str.cw]
mov edi, dword [esp + 0x10]
xor al, byte [edi]
xor byte [esp + 0x17], bl
add edi, 4
cmp edx, 8
mov byte [esp + 0x14], al
mov dword [esp + 0x10], edi
mov eax, 1
je 0x49d2a1
cmp edx, eax
jle 0x49d310
jmp 0x49d290
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
add eax, 1
cmp eax, edx
jl 0x49d290
jmp 0x49d310
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
add eax, 1
cmp eax, 4
jl 0x49d2a1
movzx eax, byte [esp + 0x20]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x24], al
movzx eax, byte [esp + 0x21]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x25], al
movzx eax, byte [esp + 0x22]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x26], al
movzx eax, byte [esp + 0x23]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x27], al
mov eax, 5
jmp 0x49d300
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
add eax, 1
cmp eax, 8
jl 0x49d300
xor eax, eax
test edx, edx
jle 0x49d348
cmp esi, dword [ebp + 0x48]
jg 0x49d351
cmp eax, edx
jge 0x49d33a
nop
cmp ecx, 4
jge 0x49d33d
mov ebx, dword [esp + eax*4 + 0x14]
lea edi, [ecx + esi*4]
add eax, 1
add ecx, 1
cmp eax, edx
mov dword [ebp + edi*4 + 0x4c], ebx
jl 0x49d320
cmp ecx, 4
jne 0x49d344
add esi, 1
xor ecx, ecx
cmp eax, edx
jl 0x49d316
cmp esi, dword [ebp + 0x48]
jle 0x49d220
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ec47e
add esp, 0x28
ret 4
Function at 0x4a25e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50bc38
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004b5c30
xor eax, eax
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.FileDataSource.0
mov byte [esi + 0x30], al
mov dword [esi + 0x34], eax
call fcn.00408020
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4a2640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50bc73
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.FileDataSource.0
cmp byte [esi + 0x30], 0
mov dword [esp + 0x14], 1
je 0x4a268b
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4a268b
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
mov byte [esp + 0x14], 0
call fcn.00408310
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004b5cc0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4a46f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00404230
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
mov dword [esp + 0x40], 0
call fcn.004a4150
add esp, 0x10
test al, al
lea ecx, [esp + 8]
jne 0x4a4769
mov dword [esp + 0x30], 0xffffffff
call fcn.00404a00
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
call fcn.0046fb70
push eax
lea ecx, [esp + 0xc]
call fcn.004e81e0
push eax
call fcn.004bec50
add esp, 8
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00404a00
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4b6210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x400
push edi
mov edi, dword [esp + 0x40c]
test edi, edi
jne 0x4b622c
xor eax, eax
pop edi
add esp, 0x400
ret
push ebx
push esi
call fcn.004b6010
mov ebx, dword [esp + 0x418]
or esi, 0xffffffff
test ebx, ebx
jne 0x4b627b
mov ecx, dword [0x58bcd4]
mov eax, dword [esp + 0x410]
mov edi, edi
movzx ebx, byte [eax]
mov edx, esi
and edx, 0xff
xor edx, ebx
shr esi, 8
xor esi, dword [ecx + edx*4]
sub edi, 1
add eax, 1
test edi, edi
jne 0x4b6250
mov eax, esi
pop esi
pop ebx
not eax
pop edi
add esp, 0x400
ret
push 0x400
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004ed3e0
mov edx, dword [0x58bcd4]
mov ecx, dword [esp + 0x41c]
add esp, 0xc
push ebp
lea ecx, [ecx]
movzx eax, byte [ecx]
add dword [esp + eax*4 + 0x10], 1
mov ebp, esi
and ebp, 0xff
xor ebp, eax
shr esi, 8
xor esi, dword [edx + ebp*4]
sub edi, 1
add ecx, 1
test edi, edi
jne 0x4b62a0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add eax, ecx
add eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp + 0x1c]
mov ecx, 7
add eax, dword [esp + 0x20]
pop ebp
add eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
jmp 0x4b62f0
add edx, dword [esp + ecx*4 + 0xc]
add ecx, 1
cmp ecx, 0x80
jl 0x4b62f0
cmp ecx, 0x100
jge 0x4b631f
jmp 0x4b6310
add eax, dword [esp + ecx*4 + 0xc]
add ecx, 1
cmp ecx, 0x100
jl 0x4b6310
shr edx, 2
cmp edx, eax
sbb ecx, ecx
mov eax, esi
neg ecx
pop esi
mov word [ebx], cx
pop ebx
not eax
pop edi
add esp, 0x400
ret

Function at 0x4b6b50
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xcc
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.004e81e0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4b6bcb
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x4b6b8b
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [esi + 0x64], edx
jmp 0x4b6b92
mov dword [esi + 0x64], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x14]
push str._d._d._d._d
push eax
call fcn.004ed7f9
add esp, 0x18
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x38]
call fcn.004091c0
jmp 0x4b6bd3
lea ecx, [esi + 0x38]
call fcn.00407610
mov ecx, dword [esp + 0xcc]
mov byte [esi + 0x60], 0
pop esi
xor ecx, esp
call fcn.004ec47e
add esp, 0xcc
ret

Function at 0x4b6c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50cde3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004b7540
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.HostnameResolve.0
call fcn.00408020
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
call fcn.00408020
mov byte [esi + 0x60], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4b8930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50d0fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004230e0
xor eax, eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.MemoryData.0
mov byte [esi + 0x10], al
mov byte [esi + 0x11], 1
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call fcn.00404230
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.00408020
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 2
call fcn.004d6d00
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4dc530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50f4d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004230e0
xor eax, eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.TlsCertificateRequest.0
mov dword [esi + 0x18], eax
call fcn.004e82b0
mov dword [esi + 0x10], 0xd
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4dc5a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50f4d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.TlsCertificateRequest.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.004e8320
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], vtable.TlsHandshakeMessage.0
call fcn.00423110
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4ddc60
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x50eef8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esp + 0x40], 0
je 0x4ddc97
mov edi, dword [esi + 0x184]
jmp 0x4ddc9d
mov edi, dword [esi + 0x174]
lea ecx, [esp + 0x10]
call fcn.00404230
push 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call fcn.00404de0
push 0
lea ecx, [esp + 0x14]
call fcn.00404de0
mov eax, dword [edi + 0x3c]
shr eax, 8
push eax
lea ecx, [esp + 0x14]
call fcn.00404de0
movzx ecx, byte [edi + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404de0
mov edx, dword [edi + 0x3c]
push edx
add edi, 0x18
push edi
lea ecx, [esp + 0x18]
call fcn.004050c0
lea ecx, [esp + 0x10]
call fcn.0046fb70
push eax
lea ecx, [esp + 0x14]
call fcn.004e81e0
push eax
lea ecx, [esi + 0x98]
call fcn.00488500
lea ecx, [esp + 0x10]
call fcn.0046fb70
push eax
lea ecx, [esp + 0x14]
call fcn.004e81e0
push eax
lea ecx, [esi + 0x100]
call fcn.00443490
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.004da580
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
call fcn.00404a00
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x4063c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 1
call dword [0x408034]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_fflush]
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x407860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00407920
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x8ccbaf
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x8cc92e
or ebx, ebx
mov ebx, 0x4676f345
sub eax, eax
call fcn.008ccbeb
and eax, eax
mov ebx, eax
xor dword [edx], esi
sub eax, ebx
sub eax, 0x43f308a1
inc edx
dec ebx
add eax, ebx
cmp edx, ecx
jne fcn.008ccbaf
add ebx, 1
add ebx, 0xa023a79
inc eax
ret
Function at 0x402688
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c030], 0x8088405
inc edx
mov dword [0x40c030], edx
mul edx
mov eax, edx
ret

Function at 0x402738
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4027b0
xor eax, eax
push ebp
push 0x4027a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4027b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403e94
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40404c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403ef5
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404068
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f62
xor eax, eax
push ebp
push 0x403f5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403f44
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404088
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f62
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404043
cmp byte [ebp - 0xd], 0
jne 0x403fa4
cmp byte [ebp - 0x12], 0
je 0x404043
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403fbd
dec ebx
cmp byte [ebx], 0x2e
je 0x403fcc
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403fbc
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404043
inc ebx
cmp byte [ebp - 0x12], 0
je 0x403ff9
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404043
cmp byte [ebp - 0xd], 0
je 0x404043
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404043
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4057a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4058aa
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4057f3
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403154
jmp 0x405891
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00405754
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00405774
mov ebx, eax
test esi, esi
je 0x40581b
dec esi
test esi, esi
jl 0x40581b
cmp edi, ebx
jne 0x4057fa
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403194
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.004033ec
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004031e8
cmp eax, 2
jl 0x405891
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x405891
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004031e8
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x405891
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004031e8
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.004033ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058b1
lea eax, [ebp - 0x110]
call fcn.00403070
ret

Function at 0x405948
Capabilities:
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x405957
dec eax
and al, 0x10
setne al
ret

Function at 0x4059dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405a46
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403194
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004059c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a4d
lea eax, [ebp - 0x10c]
call fcn.00403070
ret

Function at 0x405a54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405abe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403194
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004059c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ac5
lea eax, [ebp - 0x10c]
call fcn.00403070
ret
Function at 0x407664
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x407719
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x4076e6
lea eax, [ebp - 4]
mov edx, ebx
add dl, 0x41
call fcn.00403184
lea eax, [ebp - 4]
mov edx, 0x407730
call fcn.004031f0
mov eax, dword [ebp - 4]
call fcn.004033ac
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x4076e6
inc edi
lea eax, [ebp - 4]
mov edx, ebx
add dl, 0x41
call fcn.00403184
mov edx, dword [ebp - 4]
mov eax, edi
shl eax, 9
lea eax, [eax*8 + 0x40c524]
mov ecx, 0x407730
call fcn.00403234
inc ebx
cmp ebx, 0x1a
jne 0x407685
lea edx, [ebp - 4]
mov eax, edi
call fcn.00405620
mov edx, dword [ebp - 4]
mov eax, 0x40c524
call fcn.004030c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407720
lea eax, [ebp - 4]
call fcn.00403070
ret

Function at 0x4079a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040339c
mov eax, dword [ebp - 8]
call fcn.0040339c
mov eax, dword [ebp - 0xc]
call fcn.0040339c
xor eax, eax
push ebp
push 0x407acb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004033ac
push eax
mov eax, dword [ebp - 8]
call fcn.004033ac
push eax
mov eax, dword [0x40b1d4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
push esi
mov eax, dword [0x40b1d4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_LoadResource
mov edi, eax
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x407ae4
push 0x407af0
push 0x407afc
push 0x407b08
push 0x407b14
push 0x407b20
push 0x407b2c
push 0x407b38
push 0x407b44
push 0x407b44
lea eax, [ebp - 0x14]
mov edx, 0xb
call fcn.004032a8
mov eax, dword [ebp - 0x14]
call fcn.00405be4
mov ebx, eax
push esi
mov eax, dword [0x40b1d4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
mov edx, esi
mov eax, ebx
call fcn.00405ae4
mov edx, dword [ebp - 0x10]
mov ecx, esi
mov eax, ebx
call fcn.00405af0
push edi
call sub.kernel32.dll_FreeResource
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00405af4
mov eax, ebx
call fcn.00404ea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ad2
lea eax, [ebp - 0x14]
call fcn.00403070
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403094
ret