joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd148
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x59c1e0], 0
je 0x4dd289
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x596744]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4dd289
mov eax, dword [0x59c1e4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x59c1e0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4dd258
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x59c1e0]
call fcn.00443c04
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4dd250
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x4dd250
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4dd250
mov eax, dword [ebp - 0x14]
call fcn.004e8b2c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4dd250
push ebp
call fcn.004dd104
pop ecx
test al, al
jne 0x4dd250
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004775b0
test al, al
je 0x4dd250
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004775b0
cmp byte [ebp - 1], 0
je 0x4dd250
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00457a94
test al, al
je 0x4dd250
mov edx, dword [ebp - 0x14]
mov eax, dword [0x59c1e4]
call fcn.004dc85c
inc edi
dec ebx
jne 0x4dd1ad
mov eax, dword [0x59c1e4]
cmp dword [eax + 8], 0
jle 0x4dd270
mov eax, dword [0x59c1e4]
call fcn.004dc914
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4dd289
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004dcf68
pop ecx
test al, al
jne 0x4dd289
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e56d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.USER32.DLL_GetMessagePos
call fcn.00457a7c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004df710
test ebx, ebx
jne 0x4e572b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004e5554
mov ebx, eax
test ebx, ebx
je 0x4e5821
cmp esi, ebx
je 0x4e5754
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4e5769
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4e57a1
add eax, 0xffffff5f
sub eax, 2
jb 0x4e57b9
dec eax
sub eax, 2
jb 0x4e57cd
dec eax
sub eax, 2
jb 0x4e57c3
jmp 0x4e57d7
add eax, 0xfffffdff
sub eax, 2
jb 0x4e57b9
dec eax
sub eax, 2
jb 0x4e57cd
dec eax
sub eax, 2
jb 0x4e57c3
jmp 0x4e57d7
mov byte [esp + 0x120], 0
jmp 0x4e57df
mov byte [esp + 0x120], 2
jmp 0x4e57df
mov byte [esp + 0x120], 1
jmp 0x4e57df
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004b95c0
mov esi, eax
call fcn.004dbf48
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004e10d0
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4e5823
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4fda84
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4fdb71
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4fdb43
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x4fdb32
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004768b0
mov eax, dword [ebp - 4]
call fcn.004fd7c4
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.USER32.DLL_SetClipboardData
test eax, eax
jne 0x4fdb1b
mov ecx, dword [0x5969fc]
mov dl, 1
mov eax, dword [0x43887c]
call fcn.00463f5c
call fcn.00477dfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdb39
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
Function at 0x4fdda8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4fde50
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4fde23
mov edx, ebx
mov eax, dword [0x4a2ae4]
call fcn.004aae14
test al, al
je 0x4fde13
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004aad2c
call fcn.00477ef0
jmp 0x4fde57
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4fdddb
mov ecx, dword [0x596b00]
mov dl, 1
mov eax, dword [0x4fd6d8]
call fcn.00463f5c
call fcn.00477dfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fde57
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4fde60
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4fdebc
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdec3
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4fdecc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4fdf21
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdf28
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4fdf98
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4fe00d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004fd7c4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.004aadf0
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4fdff7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe014
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4fe01c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4fe091
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004fd7c4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4fe07b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe098
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x57c4fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x57c518
call fcn.0057d674
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x57c537
test bl, 1
je 0x57c537
call fcn.00583ce4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x580488
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.0057b2b0
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.0057b360
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0057b360
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x594f29
lea ecx, [ebp - 0x200]
push ecx
call fcn.0057b2b0
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.0057b360
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.00581928
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x580599
push esi
call fcn.0057b360
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0057b360
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0057a52c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x580570
xor eax, eax
jmp 0x580620
push esi
call fcn.0057b360
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0057b360
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0057b1df
add esp, 0xc
jmp 0x5805d9
mov edi, dword [ebx + 0x24]
push edi
call fcn.0057b360
pop ecx
push eax
push esi
call fcn.0057b360
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0057b360
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0057a54c
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x5805d9
xor eax, eax
jmp 0x580620
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0057b2b0
add esp, 8
push 0x594f2b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0057b2b0
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.0057b2b0
add esp, 8
push 0x594f2d
mov edx, dword [ebx + 0x24]
push edx
call fcn.0057b2b0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x583c78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x583ca5
jmp 0x583cdc
call fcn.00583c28
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0057b360
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0057b360
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x583d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x595568], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x583e3a
cmp dword [0x595564], 0
jne 0x583e3a
cmp dword [0x595764], 0
je 0x583df4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00583730
add esp, 8
mov ebx, eax
test eax, eax
jne 0x583dda
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00583730
add esp, 8
mov ebx, eax
test eax, eax
jne 0x583dda
lea ebx, [ebp - 0x84]
jmp 0x583ddb
inc ebx
call fcn.00583d18
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x583e75
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x59556c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0057b360
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x59556f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x583e75
cmp dword [0x595564], 0
je 0x583e54
cmp dword [0x595564], 0xffffffff
je 0x583e75
push esi
call dword [0x595564]
pop ecx
mov eax, dword [0x595568]
test eax, eax
je 0x583e75
cmp dword [0x595568], 0xffffffff
je 0x583e75
cmp byte [eax], 0
je 0x583e75
push esi
push eax
call fcn.00583c78
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004fd0
Capabilities:
Encode data using xor

Disassembly:
jb 0x10004f9f
mov cl, 0xf5
dec esp
xor byte [edi], 0x10
into
invalid
cwde
mov fs, esp
sti
sub ch, byte [ecx + 0x5af26b32]
test al, 0x47
add eax, 0xd76e6f89
mov eax, 0xd50221d0
push es
xor dh, dl
push ecx
mov bh, 0xe2
aad 0x71
je 0x10004fb0
sub byte [ebx + 0x19f8fa38], ch
xor edi, esp
push edx
fidiv dword [ebx]
std
xor ah, al
xor al, 0xd
mov al, byte [0x96b03bac]
lodsb al, byte [esi]
cmp esi, dword [eax + 0x6e0cdb96]
lodsb al, byte [esi]
cmp esi, dword [eax + 0x6e0cdb96]
jo 0x10005043
xchg edi, eax
pop ebp
dec ebx
aaa
inc edi
jo 0x10004f78
push esi
inc ebx
ja 0x10004ff2
mov byte [ecx + 0x71], bh
push edi
loop 0x10005039
add dword [eax + 6], edx
dec eax
pop es
aaa
pop ds
test eax, 0xecfdcdab
stosd dword es:[edi], eax
int 0xfd
in al, dx
xor dword [ebx - 0x179d44da], edx
cmpsd dword [esi], dword es:[edi]
jae 0x10005078
stosb byte es:[edi], al
xor ebp, edi
xchg esi, eax
mov edx, 0x1ff6b416
cmp dword [esi - 0x2f36c632], ecx
out 0xb4, eax
invalid
mov byte [edx], dh
invalid
invalid
Function at 0x1043d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1043d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1043d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1043d06a
add dl, dl
jne 0x1043d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1043d0dc
xor eax, eax
add dl, dl
jne 0x1043d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1043d17d
add dl, dl
jne 0x1043d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1043d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1043d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1043d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1043d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1043d075
mov eax, 1
add dl, dl
jne 0x1043d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1043d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1043d0e1
sub eax, ebx
mov ebx, 1
jne 0x1043d128
mov ecx, 1
add dl, dl
jne 0x1043d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1043d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1043d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1043d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1043d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1043d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1043d136
cmp eax, 0x7d00
jae 0x1043d16d
cmp eax, 0x500
jb 0x1043d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1043d075
cmp eax, 0x7f
ja 0x1043d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1043d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1043d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1043d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], edx
push ebx
mov dword [ebp - 0xc], eax
xor ecx, ecx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 8], eax
shr esi, 8
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], eax
jbe 0x403df0
mov edi, dword [ebp + 0xc]
nop
movzx ebx, word [edx + ecx*2]
mov edx, ebx
movzx ecx, bl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x403df0
movzx ecx, bl
cmp esi, ecx
jne 0x403dd4
cmp eax, edx
jge 0x403dd4
mov ecx, dword [ebp - 0xc]
movzx esi, cl
movzx ecx, byte [eax + edi]
cmp cx, si
je 0x403de7
inc eax
cmp eax, edx
jl 0x403dc3
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 8]
jae 0x403df0
mov edx, dword [ebp - 0x14]
jmp 0x403da0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x14]
xor eax, eax
mov bl, 1
test edi, edi
je 0x403e27
mov esi, dword [ebp + 0x10]
nop
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x403e18
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x403e1a
mov edx, ecx
sub dword [ebp - 8], edx
js 0x403e27
inc eax
xor bl, 1
cmp eax, edi
jb 0x403e00
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404102
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20f4
push ebx
push esi
push edi
push edi
push esi
add esp, 4
xor edi, 0x11b99
jmp 0x40411f
jmp 0x404125
pop edi
push eax
and eax, 0x8100
and eax, 0xe26
xor eax, 0x1255
or eax, 0x14990
pop eax
mov eax, 0x4d
mov word [ebp - 0x2030], ax
mov ecx, 0x42
mov word [ebp - 0x202e], cx
mov edx, 0x53
mov word [ebp - 0x202c], dx
mov eax, 0x65
mov word [ebp - 0x202a], ax
mov ecx, 0x72
mov word [ebp - 0x2028], cx
mov edx, 0x76
mov word [ebp - 0x2026], dx
mov eax, 0x69
mov word [ebp - 0x2024], ax
mov ecx, 0x63
mov word [ebp - 0x2022], cx
mov edx, 0x65
mov word [ebp - 0x2020], dx
mov eax, 0x2e
mov word [ebp - 0x201e], ax
mov ecx, 0x65
mov word [ebp - 0x201c], cx
mov edx, 0x78
mov word [ebp - 0x201a], dx
mov eax, 0x65
mov word [ebp - 0x2018], ax
xor ecx, ecx
mov word [ebp - 0x2016], cx
mov dword [ebp - 0x1064], 1
push esi
xor esi, 0xa5c7
sub esi, 0xb5a9
or esi, 0x153e7
pop esi
push eax
and eax, 0xee5a
call fcn.00404217
add byte [edx + 0x3a], cl
cmp eax, 0x494a5043