joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4252b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4323a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x20]
push eax
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CClientDC::CClientDC
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x20]
push edx
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call sub.MFC42.DLL_CWnd::ScreenToClient
mov eax, dword [esi + 0xf4]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x4253e6
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0xf0]
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub ecx, edi
push eax
push ecx
push edx
lea edi, [esi + 0x100]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
test edi, edi
je 0x425392
mov edi, dword [edi + 4]
mov eax, dword [esi + 0xf4]
push edi
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x108], eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
push 0xcc0020
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push ecx
mov ecx, dword [esi + 0xf4]
push edx
push 0
push 0
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0xf0]
sub ecx, edi
test edx, edx
je 0x425407
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push 0
mov eax, dword [edx + 4]
push 0
push eax
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.00426634
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x425f30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x425f92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x4261a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x426294
lea ecx, [esp + 0x10]
push ecx
push str..htm
push Ordinal_1
mov ecx, edi
call fcn.00425f30
test eax, eax
jne 0x426294
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push Ordinal_1
mov ecx, edi
call fcn.00425f30
test eax, eax
jne 0x426294
lea edx, [esp + 0x10]
push str.__1_
push edx
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x426265
lea eax, [esp + 0x10]
push 0x446410
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x426265
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x426268
mov byte [esi], 0
push 0x44640c
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x427ca0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
mov ebx, dword [esp + 0x5c]
mov ecx, dword [eax]
cmp ebx, 1
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], edx
jae 0x427cef
lea eax, [esp + 0x60]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0x64], str.Incorrect_key_length
call sub.MSVCIRT.dll_public:_void___thiscall_exception::constructor_char_const__const_const__
lea ecx, [esp + 0x10]
push 0x442a80
push ecx
call sub.MSVCRT.dll__CxxThrowException
cmp ebx, 0x38
jbe 0x427cf9
mov ebx, 0x38
mov ecx, ebx
push esi
mov esi, dword [esp + 0x5c]
mov edx, ecx
push edi
lea edi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp + 0x10]
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x437aa0
mov edi, edx
mov dword [esp + 0x64], 0x12
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x58]
mov ecx, 0x400
mov esi, 0x437ae8
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
mov esi, edx
xor edx, edx
mov dword [esp + 0x68], 4
mov edi, edx
xor edx, edx
mov dl, byte [ecx]
shl edi, 8
or edx, edi
inc ecx
inc eax
cmp eax, ebx
jne 0x427d64
xor eax, eax
lea ecx, [esp + 0x24]
mov edi, dword [esp + 0x68]
dec edi
mov dword [esp + 0x68], edi
jne 0x427d4d
mov edi, dword [esi]
add esi, 4
xor edi, edx
mov edx, dword [esp + 0x64]
mov dword [esi - 4], edi
dec edx
mov dword [esp + 0x64], edx
jne 0x427d43
xor edi, edi
lea esi, [ebp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00427e10
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x12
jb 0x427d91
lea eax, [ebp + 0x58]
mov dword [esp + 0x68], 4
mov ebx, eax
xor edi, edi
mov esi, ebx
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00427e10
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x100
jl 0x427dc7
mov eax, dword [esp + 0x68]
add ebx, 0x400
dec eax
mov dword [esp + 0x68], eax
jne 0x427dc3
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x428ab0
Capabilities:
Encode data using xor

Disassembly:
push edi
push 0x44694c
push 0x4478f4
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x428b05
mov eax, dword [0x4472e0]
push esi
xor esi, esi
test eax, eax
jbe 0x428afa
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
xor eax, eax
push edi
mov al, byte [esi + 0x438ae8]
xor eax, 0x7d
push eax
call ebx
mov eax, dword [0x4472e0]
add esp, 8
inc esi
cmp esi, eax
jb 0x428add
pop ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop esi
pop edi
ret
Function at 0x428ee0
Capabilities:
Create service

Disassembly:
push esi
push edi
call fcn.00428f60
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x428f52
mov cl, byte [esp + 0x10]
mov eax, dword [esp + 0xc]
dec cl
push 0
neg cl
push 0
push 0
sbb ecx, ecx
push 0
and ecx, 0xfffffffe
push 0
push eax
add ecx, 3
push 1
push ecx
push 1
push 0xf01ff
push str.TLGDDPP
push str.TLGDDPP
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
test edi, edi
je 0x428f52
push edi
call esi
call fcn.00428fc0
pop edi
pop esi
ret 8
pop edi
xor al, al
pop esi
ret 8

Function at 0x429030
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x42908a
push 0xf01ff
push str.TLGDDPP
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x42908a
lea eax, [esp + 8]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
setne bl
call edi
mov al, bl
pop ebx
pop edi
pop esi
add esp, 0x1c
ret
pop edi
xor al, al
pop esi
add esp, 0x1c
ret
Function at 0x4296a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x432538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00429620
lea ecx, [esp + 0x1c]
push esi
push ecx
mov dword [esp + 0x34], 0
call fcn.00429620
lea edx, [esp + 0x20]
push esi
push edx
mov byte [esp + 0x3c], 1
call fcn.00429620
lea eax, [esp + 0x48]
push esi
push eax
mov byte [esp + 0x44], 2
call fcn.00429620
mov ecx, dword [esp + 0x38]
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
push ecx
call esi
mov edx, dword [esp + 0x38]
mov ebp, eax
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x38]
push eax
call esi
mov ecx, dword [esp + 0x5c]
mov edi, eax
push ecx
add edi, ebp
call esi
mov esi, dword [esp + 0x5c]
add eax, ebx
mov edx, esi
add esp, 0x30
lea ecx, [esp + 0x30]
mov dword [edx], ebp
mov dword [edx + 4], ebx
mov dword [edx + 8], edi
mov dword [edx + 0xc], eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x429790
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [esp + 0x10]
push 0
push ecx
push esi
push eax
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x429880
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push edx
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x14]
push eax
push 0x43f1c0
push 0
push esi
push ecx
call dword [sym.imp.OLEPRO32.DLL_OleLoadPicture]
mov eax, dword [esp + 0x3c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, dword [esp + 0x40]
mov ecx, esi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [esi + 4]
lea ecx, [esp + 0x1c]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x42bcc0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x432bb2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x804
push esi
mov dword [esp + 4], 0
mov ecx, dword [ecx]
mov edx, dword [esp + 0x820]
push ecx
mov ecx, dword [esp + 0x828]
lea eax, [esp + 0xc]
push 0x800
push eax
mov eax, dword [esp + 0x828]
push ecx
push edx
push eax
mov dword [esp + 0x828], 3
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x818]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004265c8
mov dword [esp + 4], 1
lea ecx, [esp + 0x81c]
mov byte [esp + 0x810], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x820]
mov byte [esp + 0x810], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x824]
mov byte [esp + 0x810], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x810
ret 0x10

Function at 0x42bd90
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x432bc8
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x4001
push 2
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, dword [esp + 0x24]
push 0xffffffffffffffff
push 0
mov ecx, ebx
mov esi, eax
call sub.MFC42.DLL_CStringArray::SetSize
mov edi, dword [edi]
mov eax, dword [esp + 0x20]
push edi
push 0x4000
push esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x42be1f
cmp byte [esi], 0
je 0x42be1f
mov eax, dword [ebx + 8]
push esi
push eax
mov ecx, ebx
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esi + ecx + 1]
lea esi, [esi + ecx + 1]
test al, al
jne 0x42bdfb
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebx + 8]
xor ecx, ecx
test ebx, ebx
setg cl
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x42cf30
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea eax, [edi + 0x48]
cmp eax, ebx
jne 0x42cf45
xor eax, eax
jmp 0x42cf48
mov eax, dword [eax + 4]
lea ecx, [esp + 0x1c]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [esp + 0x38]
mov edx, dword [edi + 0x20]
push esi
push ebx
push 0x419
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, edi
call sub.MFC42.DLL_CWnd::GetStyle
and eax, 2
cmp al, 2
jne 0x42cfcd
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0xc]
push ebp
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
mov edi, dword [esp + 0x28]
sub eax, ecx
cdq
sub eax, edx
mov dword [esi], ebx
mov ebp, eax
mov eax, edi
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
sar ebp, 1
sar eax, 1
sub ebp, eax
mov dword [esi + 8], edx
lea eax, [ecx + ebp]
pop ebp
cmp eax, ebx
mov dword [esi + 4], eax
jge 0x42cfbc
mov dword [esi + 4], ebx
mov eax, dword [esi + 4]
add eax, edi
pop edi
mov dword [esi + 0xc], eax
pop esi
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
mov edi, dword [esp + 0x20]
sub eax, ecx
cdq
sub eax, edx
mov dword [esi + 4], ebx
mov ebx, eax
mov eax, edi
cdq
sub eax, edx
sar ebx, 1
sar eax, 1
sub ebx, eax
lea eax, [ebx + ecx]
mov dword [esi], eax
add eax, edi
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x109fc9b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x109fc9ba
pushal
call 0x109fc9c0
pop ebp
sub ebp, 0x10
sub ebp, 0x9fc9b0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x109fc9e4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x109fc9ed
mov eax, 0x9fc9b0
add eax, ebp
add eax, 0x63
mov ecx, 0x5ca
mov edx, 0xb1cfda9d
xor byte [eax], dl
inc eax
dec ecx
jne 0x109fca04
jmp 0x109fca17
push ss
push eax
push ss
adc al, 0xa1
popfd
popfd
popfd
sbb al, 0x5c
popfd
popfd
popfd
sahf
push eax
and eax, 0x9d9d9d95
daa
mov ch, 0x9d
popfd
popfd
push 0x7f
sahf
push ebp
push ss
sbb al, 0x91
popfd
popfd
popfd
sahf
pop eax
adc cl, bh
mov ecx, 0xb9991461
adc cl, bh
mov ecx, 0xb9991461
cmc
jmp 0x63d8661
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x40705a]
shl eax, 2
mov dword [0x40705e], eax
push edi
push ecx
xor eax, eax
mov edi, 0x4080f0
mov ecx, 0x4083a4
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov dword [0x40706e], edx
mov eax, dword [edx - 8]
mov dword [0x407066], eax
mov eax, dword [edx - 4]
mov dword [0x40706a], eax
sub edx, 4
mov dword [0x408100], edx
sub edx, 4
cmp edx, esp
jae 0x401054
mov esp, edx
push 0
call fcn.004032da
pop ecx
push 0x40702c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x407062], eax
push 0
jmp fcn.004067fc

Function at 0x40513c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x405158
call fcn.00405060
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x405173
test bl, 1
je 0x405173
mov dword [0x407fd8], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x405284
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4052a3
mov eax, dword [0x4078f0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4052b0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4052dd
je 0x4052ef
sub ecx, 0x100
je 0x4052fd
sub ecx, 0x100
je 0x405304
sub ecx, 0x100
je 0x4052f6
jmp 0x40530b
sub ecx, 0x600
je 0x405304
sub ecx, 0x100
je 0x4052ef
jmp 0x40530b
mov edi, 1
jmp 0x405310
mov edi, 2
jmp 0x405310
mov edi, 4
jmp 0x405310
mov edi, 5
jmp 0x405310
mov edi, 3
test byte [ebp + 0xd], 1
je 0x405337
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x407dec]
test al, 0x80
je 0x405330
mov ebx, 0x80
jmp 0x405349
mov ebx, 1
jmp 0x405349
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x405349
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40535b
je 0x405364
dec eax
je 0x40536d
jmp 0x405376
mov dword [ebp - 4], 0x80000000
jmp 0x405385
mov dword [ebp - 4], 0x40000000
jmp 0x405385
mov dword [ebp - 4], 0xc0000000
jmp 0x405385
push 1
call fcn.00404ffc
pop ecx
mov ebx, eax
jmp 0x405471
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4053a1
sub eax, 0x10
je 0x4053a8
sub eax, 0x10
je 0x4053b1
sub eax, 0x10
je 0x4053ba
jmp 0x4053ba
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4053c1
mov dword [ebp - 8], 1
jmp 0x4053c1
mov dword [ebp - 8], 2
jmp 0x4053c1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
push 0
push ebx
push edi
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40542a
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40541f
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x40541f
add ebx, 0xffffffb2
push ebx
call fcn.00404ffc
pop ecx
mov ebx, eax
jmp 0x405471
mov edi, esi
push edi
call fcn.004051f4
pop ecx
test eax, eax
je 0x40543e
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40544a
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00404d58
add esp, 8
mov ebx, eax
inc eax
jne 0x405471
push 4
call fcn.00404ffc
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40600c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4061cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x407fdc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x406284
cmp byte [0x407059], 0
je 0x40623e
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.00401290
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406227
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.00401290
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406227
lea ebx, [ebp - 0x54]
jmp 0x406228
inc ebx
call fcn.00406184
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4062a5
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x407fe0
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00401230
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x407fe3
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4062a5
cmp dword [0x407fdc], 0xffffffff
je 0x4062a5
mov eax, dword [0x407fdc]
test eax, eax
je 0x4062a5
cmp byte [eax], 0
je 0x4062a5
push esi
push eax
call fcn.00406334
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret