joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f4dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51f584]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048a647
and dword [ebp - 0x14], 0
cmp dword [0x52624c], 0
mov dword [ebp - 0x18], eax
jne 0x48f58f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48f637
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48f637
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x52624c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x526250], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x526254], eax
call edi
push eax
call esi
mov dword [0x52625c], eax
test eax, eax
je 0x48f58f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x526258], eax
mov eax, dword [0x526258]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x48f5e8
cmp dword [0x52625c], ecx
je 0x48f5e8
push eax
call esi
push dword [0x52625c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48f5e8
test ebx, ebx
je 0x48f5e8
call edi
test eax, eax
je 0x48f5df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48f5df
test byte [ebp - 8], 1
jne 0x48f5e8
or dword [ebp + 0x10], 0x200000
jmp 0x48f61b
mov eax, dword [0x526250]
cmp eax, dword [ebp - 0x18]
je 0x48f61b
push eax
call esi
test eax, eax
je 0x48f61b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48f61b
mov eax, dword [0x526254]
cmp eax, dword [ebp - 0x18]
je 0x48f61b
push eax
call esi
test eax, eax
je 0x48f61b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x52624c]
call esi
test eax, eax
je 0x48f637
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48f639
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00482279
leave
ret

Function at 0x49cce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
push esi
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49ccf0
sub eax, esi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x49cd14
movsx esi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, esi
cmp edx, eax
jne 0x49cd04
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.004e7b9b
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
pop esi
mov eax, edx
jns 0x49cd40
add eax, 0x7fffffff
pop ebp
ret 4
Function at 0x4a6980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8d26
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1c], bl
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0x20], bl
push 0x14
mov byte [ebp - 4], 1
mov dword [esi + 0x4c], ebx
call fcn.00482680
add esp, 4
cmp eax, ebx
je 0x4a6a34
mov dword [esi + 0x48], eax
mov dword [eax], eax
mov eax, dword [esi + 0x48]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x48]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x48]
mov byte [eax + 0x10], 1
mov ecx, dword [esi + 0x48]
mov byte [ecx + 0x11], 1
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], 0xf
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], ebx
call fcn.00482799
push 0x518328
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.0048ac0f
int3
Function at 0x4a7da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x4a7dcf
cmp ecx, eax
jne 0x4a7dcf
mov ecx, ebx
call fcn.004a6f20
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x4a7ead
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a7de5
sub eax, edi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x4a7e10
lea esp, [esp]
movsx edi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, edi
cmp edx, eax
jne 0x4a7e00
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.004e7b9b
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x4a7e3a
add edx, 0x7fffffff
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edx
cmp dword [ebx + 0x24], eax
ja 0x4a7e4f
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x4a7e78
cmp dword [ecx], esi
jne 0x4a7e70
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x4a7e80
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x4a7e80
cmp dword [ecx], esi
jne 0x4a7e80
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x4a7ea0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
push esi
mov dword [edx + 4], eax
call fcn.00482624
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x4a7dd8
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4c3e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed043
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
call fcn.00482680
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4c3ed5
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.004be760
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov eax, 0x5206e0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c4c90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eab08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.004be760
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, 0x5206e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x80], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c5110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eab08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.004be760
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 8], 0x5206e0
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c7110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eab08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.004be760
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x5206e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c7260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed043
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x51f584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x48
call fcn.00482680
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4c72f3
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.004be760
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x5206e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a810
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc0
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x1c]
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xcc]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
mov dword [esi], edx
lea edx, [esp + 0x18]
and ecx, 0xffff
push edx
push edi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xa]
and ecx, 0xffff
and edx, 0xffff
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 8]
and ecx, 0xffff
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc4]
test eax, eax
lea edi, [edx + ecx]
je 0x44a8b9
mov edx, dword [0x651d64]
push 0x651a98
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, edi
pop edi
cdq
mov ecx, eax
mov eax, 0x88888889
xor ecx, edx
sub ecx, edx
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esi + 0x18], edx
lea eax, [edx + edx*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x18]
shl edx, 2
sub ecx, edx
xor edx, edx
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0xc0]
add eax, ecx
test eax, eax
mov eax, dword [esi + 0x20]
setl dl
shl edx, 1
and al, 0xfd
or edx, eax
mov eax, esi
or edx, 1
mov dword [esi + 0x20], edx
pop esi
add esp, 0xc0
ret

Function at 0x459567
Capabilities:
Encode data using xor

Disassembly:
push es
das
cmp eax, 0xbd0f20c8
and dword [edi + 0x70a94305], ebx
popfd
enter 0xffffffffffffe5de, 0x7f
pop es
mov esp, 0x3a27ed2b
and al, 0xed
and bh, byte [esi + 0x4e37d06]
in eax, dx
daa
cmp ah, byte [ebp*8 + 0x7d06be22]
jecxz 0x45958d
add ebx, edi
xor al, 0x5e
jb 0x45957e
push ebp
and byte [esi - 0x9dc0a15], dl
sub ah, byte [ebp + eax*2 + 0x54d991d4]
stosb byte es:[edi], al
sbb dh, byte [eax + 0x38]
dec esp
in al, 0xbe
cmp byte [esp - 0x42], cl
scasd eax, dword es:[edi]
pop es
or bl, bl
jmp 0x4595f0
mov ch, 0x13
add ebx, dword [edi + 0x1a]
stosb byte es:[edi], al
fcomp dword [ebx]
aad 0x65
imul ebp
sahf
mov esp, 0xa3708fe6
cli
dec esi
ret 0x8cf4
pop ebp
dec eax
ja 0x4595a0
sub ah, byte [ecx]
and edi, dword [edx + edi - 0x27]
imul edx, esi, 0xffffffc8
salc
add eax, esi
or eax, 0x47a78c29
jg 0x4595d3
xchg dl, al
salc
adc al, 0xf3
fidiv dword [edx*8 - 0x3839088b]
jl 0x459690
mov dl, 0xf4
sub eax, 0x4c5b5f46
lcall 0xa63e, 0x46011116
invalid
inc ebx
mov dh, 0x3b
add eax, 0xa7742ef0
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
retf
Function at 0x4a2e27
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx - 0x8db0d5c], ecx
test dword [ebx + 0x578b0cc2], esi
push esi
xchg esp, eax
jns 0x4a2e6c
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
inc esp
dec eax
aas
aas
lds esi, [ebx - 0x70]
xchg byte [ebx - 0xc874b6b], dh
enter 0xffffffffffffd825, 0xffffffffffffffe1
fsub st(1)
inc edi
invalid
jg 0x4a2ea4
fcomp qword [ecx]
inc edi
loop 0x4a2e93
pop es
jg 0x4a2e64
rcr byte fs:[ebp + 0x35], 1
mov edx, 0x37d5889b
mov dword [edx - 0x21], 0xbd79fbc8
cmpsd dword [esi], dword es:[edi]
add eax, 0x615dece8
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
jno 0x4a2e48
xor ah, byte [esi - 0x3d]
invalid
jl 0x4a2ea3
cmc
salc
invalid
lodsb al, byte [esi]
int3

Function at 0x5c35a7
Capabilities:
Encode data using xor

Disassembly:
jne 0x5c35e9
fucompp
pop es
add dword [ebx - 0x6d8f78b4], eax
inc eax
inc ecx
mov eax, dword [0xc0b334bb]
jb 0x5c35bf
imul esi, dword [eax - 0x3e2c0d11], 0x47
rol ecx, cl
inc edi
hlt
das
mov al, 0xc0
xchg ebx, eax
cld
or edi, ecx
invalid
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x419410
Capabilities:
Accept command line arguments
Read .ini file

Disassembly:
sub esp, 0x414
lea eax, [esp + 0x20c]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x21c]
push ecx
mov edi, eax
call ebx
push str.system.ini
lea edx, [esp + 0x18]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea edx, [esp + 0x14]
mov edi, eax
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [esp + 0x14]
push eax
call ebx
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test edi, edi
mov ebp, eax
je 0x4194b5
mov ecx, dword [0x4d18dc]
push 0x4d15e0
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push ebp
push esi
push ebx
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x4194df
push str.install.exe
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4194df
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x414
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x414
ret