joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058391
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1005830d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10058500
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10058500
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100584b5
jg 0x100583ed
test eax, eax
je 0x100584ab
push 1
push 0x1000
call fcn.10048ded
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10058410
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100584a2
push 0x8000
push ebx
call fcn.1005823e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10058439
jg 0x10058434
cmp ecx, 0x1000
jb 0x10058439
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10049853
add esp, 0x10
cmp eax, 0xffffffff
je 0x1005847e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10058434
jl 0x10058465
test ecx, ecx
jne 0x10058426
push dword [ebp - 0xc]
push ebx
call fcn.1005823e
push esi
call fcn.10049a6f
add esp, 0xc
xor ebx, ebx
jmp 0x1005850e
cmp byte [edi + 0x24], 0
je 0x10058495
cmp dword [edi + 0x20], 5
jne 0x10058495
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100584a0
mov ebx, dword [edi + 0x18]
jmp 0x100584a2
xor ebx, ebx
push esi
call fcn.10049a6f
pop ecx
jmp 0x1005850e
test ecx, ecx
jg 0x10058477
jl 0x100584b5
test eax, eax
jae 0x10058477
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004e309
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100584d5
cmp byte [edi + 0x1c], 0
je 0x10058477
jmp 0x10058506
push ebx
call fcn.1005154c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10058477
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1005850e
cmp byte [edi + 0x1c], 0
je 0x1005850b
mov ebx, dword [edi + 0x18]
jmp 0x1005850e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1004e309
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10059ac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10059aed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10059aed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001de7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10083940]
jne 0x1001de86
repz ret
jmp fcn.1001e12d

Function at 0x1001e7a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10083920], 0
mov byte [0x10083924], 0
mov dword [0x10083918], 0xee6
mov dword [0x1008391c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1008391c]
add eax, 1
mov dword [0x1008391c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1001e7e5
mov dword [0x10083914], 0x2322
mov dword [0x1008391c], 0
mov eax, 0x100
mov dword [0x10083928], 0
mov ecx, dword [0x10083920]
mov edx, dword [0x1008391c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x10083928], edi
mov edx, dword [0x10083914]
add edx, 0x152a
mov dword [0x10083918], edx
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x10083920], edx
mov edx, dword [0x1008391c]
mov cl, byte [esi + edx]
mov byte [0x10083924], cl
mov edx, dword [0x10083918]
add edx, 0x1f49
mov dword [0x10083918], edx
mov edx, dword [0x10083920]
mov cl, byte [esi + edx]
mov edx, dword [0x1008391c]
mov byte [esi + edx], cl
mov edx, dword [0x10083914]
add edx, 0xfffff6d2
mov dword [0x10083918], edx
mov cl, byte [0x10083924]
mov edx, dword [0x10083920]
mov byte [esi + edx], cl
mov edx, dword [0x10083918]
add edx, 0xffffee66
mov dword [0x10083918], edx
mov edx, dword [0x1008391c]
add edx, 1
mov dword [0x1008391c], edx
cmp edx, 0x100
jl 0x1001e81f
mov eax, dword [0x10083918]
add eax, 0x1034
mov dword [0x10083914], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001e940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov dword [0x10083914], 0x18a0
mov dword [ebp - 0x30], eax
call fcn.1001e920
xor ecx, ecx
mov edx, dword [0x10083914]
add edx, 0x659
mov dword [0x10083918], edx
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
jmp 0x1001e9e6
mov eax, dword [ebp - 0x40]
add eax, 0x58f3a
mov ecx, dword [ebp - 0x40]
add ecx, 0x41d86
mov dword [0x10083914], 0x17f2
mov edx, dword [ebp - 0x40]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x44]
mov dword [esp + 8], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
call fcn.1001f120
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
mov dword [ecx + 4], 0x116600
mov dword [0x10083914], 0x1431
mov edx, dword [ebp - 0x4c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x2010
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..code
imul esi, ecx, 0x14c
mov edi, edx
add edi, esi
add edi, 0x134
imul esi, ecx, 0x14c
add edx, esi
add edx, 0x138
add ecx, 1
mov edx, dword [edx]
movzx esi, word [edi]
xor esi, edx
add esi, eax
cmp ecx, 0x4c0
mov eax, esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x1001e9e6
lea eax, [0x1002053d]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x10083914], 0xcea
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
call fcn.1001ee00
mov dword [0x10083918], 0x2521
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.1001e4b0
mov ecx, eax
mov dword [0x10083934], eax
mov eax, esp
mov edx, dword [ebp - 0x44]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x10083914], 0x5a7
mov edx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
lea edx, section..code
imul esi, eax, 0x14c
mov edi, edx
add edi, esi
add edi, 0x138
mov esi, dword [edi]
imul edi, eax, 0x14c
mov ebx, edx
add ebx, edi
add ebx, 0x130
mov edi, dword [ebx]
imul ebx, eax, 0x14c
add edx, ebx
add edx, 0x134
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x40]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], edx
call fcn.1001f7b0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
add eax, ecx
mov edx, dword [ebp - 0x60]
add edx, 1
cmp edx, 0x4c0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], edx
je 0x1001e97f
jmp 0x1001eab8
Function at 0x1001f1d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1008391c], 0
mov dword [0x10083920], 0
mov dword [0x1008392c], 0
mov dword [0x10083914], 0x1722
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x1001f31e
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10083914], 0x1f96
mov edx, dword [0x1008391c]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x1008391c], edx
mov dword [0x10083918], 0xcea
mov esi, dword [0x10083920]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10083920], edx
mov dword [0x10083918], 0xbf7
mov ecx, dword [0x1008391c]
mov bl, byte [edi + ecx]
mov byte [0x10083924], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov ecx, dword [0x10083918]
add ecx, 0x9a3
mov dword [0x10083918], ecx
mov bl, byte [0x10083924]
mov ecx, dword [0x10083920]
mov byte [edi + ecx], bl
mov ecx, dword [0x1008391c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x10083920]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x1008392c], edx
mov dword [0x10083918], 0x2aca
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x1001f229
mov dword [0x10083914], 0xabc
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001f4e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x10083918], 0x8e9
mov dword [ebp - 4], 0
mov dword [0x10083914], 0x1ca7
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [0x10083914]
add edx, 0xfffff638
mov dword [0x10083914], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10083918], 0x1f19
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1001f579
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [0x10083918], 0x5ab
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
je 0x1001f5ba
jmp 0x1001f66c
mov dword [0x10083918], 0x310
mov eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x1001f66c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edx
je 0x1001f53c
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], cl
mov al, byte [ebp - 0x25]
test al, 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jne 0x1001f579
jmp 0x1001f53c
xor eax, eax
mov dword [0x10083918], 0x14b9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x1c], eax
jne 0x1001f66c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x1c], eax
jne 0x1001f66c
xor eax, eax
mov dword [0x10083914], 0x220d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x1c], eax
jne 0x1001f66c
xor eax, eax
mov dword [0x10083914], 0x1ea0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x1c], eax
jne 0x1001f66c
xor eax, eax
mov dword [0x10083914], 0xfffff8a8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x1001f66c
xor eax, eax
mov dword [0x10083914], 0xfffff138
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1001f562
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebp
ret

Function at 0x1001f830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x10083918], 0x247b
lea eax, [fcn.1001f830]
mov dword [0x10083914], 0x99e
mov dword [ebp - 4], eax
jmp 0x1001f85d
mov eax, dword [ebp - 8]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x1001f879
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x1001f855
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 0xc], eax
mov dword [0x10083918], 0x1961
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x1001f85d
Function at 0x8d5034
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8d503e
pushal
call 0x8d5044
pop ebp
sub ebp, 0x10
sub ebp, 0x4d5034
jmp 0x8d505a
mov eax, 0x4d5034
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f3
mov edx, 0x5b9cf1d8
xor byte [eax], dl
inc eax
dec ecx
jne 0x8d5071
jmp 0x8d5084
push ebx
adc eax, 0xd8e45153
fcomp st(0)
pop ecx
sbb dword [eax], esp
fcomp st(0)
fcomp st(3)
adc eax, 0xd8d8de60
fsub dword [edx - 0x10]
fcomp st(0)
fsubr dword [edi]
cmp bl, bl
adc byte [ebx + 0x59], dl
aam 0xd8
fcomp st(0)
fistp dword [0xfcbc5588]
and al, 0x51
fdiv st(4), st(0)
mov al, 0x40
jbe 0x8d508c
fdiv dword [eax - 0x271986bf]
fxtract
cld
mov al, 0x10
adc dl, al
inc ecx
xor ch, bl
fcomp st(0)
fdiv dword [ecx]
fcomp st(0)
fmul dword [ebp - 0x27034bab]
push ebx
pop ebp
rcr al, 1
fcomp st(0)
push ebx
dec ebp
aam 0xd8
fcomp st(0)
push ebx
push ebp
enter 0xffffffffffffd8d8, 0xffffffffffffffd8
sbb dword [ecx], esi
fucompp
ficomp dword [ebx + 0x1a]
fcom qword [ecx + 0x272c5dd7]
daa
daa
test dword [edx], ebx
aam 0xd8
push ebx
push esp
cld
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7cb52aa6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x345464d0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xa83690
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x4dc000]
push edi
jmp 0xa836aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa836b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa836a0
mov eax, 1
add ebx, ebx
jne 0xa836c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa836d4
jne 0xa836f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa836f3
dec eax
add ebx, ebx
jne 0xa836e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa836b8
add ebx, ebx
jne 0xa836ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa83745
xor ecx, ecx
sub eax, 3
jb 0xa8370b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa8377a
sar eax, 1
mov ebp, eax
jmp 0xa83716
add ebx, ebx
jne 0xa83716
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa836e4
inc ecx
add ebx, ebx
jne 0xa83724
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa836e4
add ebx, ebx
jne 0xa83731
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa83726
jne 0xa83742
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa83726
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa83764
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa83756
jmp 0xa836a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa83764
add edi, ecx
jmp 0xa836a6
pop esi
mov edi, esi
mov ecx, 0x17049
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa83782
cmp byte [edi], 0xab
jne 0xa83782
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa83787
lea edi, [esi + 0x680000]
mov eax, dword [edi]
or eax, eax
je 0xa837ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x71303c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x71317c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa837b4
mov ecx, edi
jns 0xa837e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x713184]
or eax, eax
je 0xa837f9
mov dword [ebx], eax
add ebx, 4
jmp 0xa837d1
call dword [esi + 0x713180]
mov ebp, dword [esi + 0x713188]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa83833
sub esp, 0xffffff80
jmp 0x78cf52
Function at 0x438c81
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
add ebx, edi
call fcn.00438cac
dec ebx
xor dword [esi], eax
push edi
mov ebx, dword [esp]
add esp, 4
add ebx, 0xc3eb2ff4
inc esi
add edi, ebx
and ebx, edi
cmp esi, edx
jne fcn.00438c81
dec ebx
inc edi
inc edi
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x475004]
jne 0x401010
repz ret
jmp fcn.004014f3

Function at 0x407a15
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c04
and dword [ebp - 4], 0
cmp dword [0x477c9c], 0
mov ebx, eax
jne 0x407ac6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407b77
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407b77
push eax
call fcn.00404b92
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x477c9c], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x477ca0], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x477ca4], eax
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x477cac], eax
test eax, eax
je 0x407ac6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x477ca8], eax
mov eax, dword [0x477ca8]
cmp eax, ebx
je 0x407b1e
cmp dword [0x477cac], ebx
je 0x407b1e
push eax
call fcn.00404c0d
push dword [0x477cac]
mov esi, eax
call fcn.00404c0d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407b1e
test edi, edi
je 0x407b1e
call esi
test eax, eax
je 0x407b15
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407b15
test byte [ebp - 0xc], 1
jne 0x407b1e
or dword [ebp + 0x10], 0x200000
jmp 0x407b57
mov eax, dword [0x477ca0]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407b57
mov eax, dword [0x477ca4]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x477c9c]
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b77
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407b79
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409ba0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x475004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x238f3b4], 0x930
jne 0x409bca
push 0x473370
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x238f3b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x238f1f8], eax
jne 0x409bfd
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameA
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret