joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c32
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
mov ebp, esp
sub esp, 0x43c
xor ebx, ebx
mov dword [ebp - 0x408], ebx
mov dword [ebp - 8], 0x100
push ebp
add dword [esp], 0xfffffffc
push 0
push 0
push 0
push ebp
add dword [esp], 0xfffffff8
push ebp
add dword [esp], 0xfffffbf8
push ebx
push dword [ebp + 0xc]
call sub.ADVAPI32.dll_RegEnumKeyExA
inc ebx
cmp eax, 0x103
je 0x402d39
push eax
mov dword [ebp - 0x410], 0
push ebp
add dword [esp], 0xfffffbf4
push 0x20019
push 0
push ebp
add dword [esp], 0xfffffbf8
push dword [ebp + 0xc]
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402cd8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
add dword [esp], 0xfffffbf0
push 0
push 0
push 0
push dword [ebp - 0x40c]
call sub.ADVAPI32.dll_RegQueryInfoKeyA
push dword [ebp - 0x40c]
call sub.ADVAPI32.dll_RegCloseKey
push 0
push 0xffffffffffffffff
push ebp
add dword [esp], 0xfffffbf8
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.00403345
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x410], 0
je 0x402d2f
mov dword [ebp - 0x43c], 0x40
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x41c], 1
push ebp
add dword [esp], 0xfffffbc4
push 0
push 0x110d
push dword [ebp + 0x14]
call sub.USER32.dll_SendMessageA
pop eax
cmp eax, 0
je 0x402c44
mov esp, ebp
pop ebx
pop ebp
ret 0xc

Function at 0x402d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push esi
mov ebp, esp
sub esp, 0x410
mov esi, 0x400
push esi
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x410], eax
push 0x10
push 0x421623
push 1
push 0x41abe3
push dword [ebp + 0x10]
call fcn.004030e2
xor ebx, ebx
mov dword [ebp - 0x404], 0x400
mov dword [ebp - 0x40c], esi
push ebp
add dword [esp], 0xfffffbf4
push dword [ebp - 0x410]
push ebp
add dword [esp], 0xfffffbf8
push 0
push ebp
add dword [esp], 0xfffffbfc
push ebp
add dword [esp], 0xfffffc00
push ebx
push dword [ebp + 0x14]
call sub.ADVAPI32.dll_RegEnumValueA
cmp eax, 0xea
jne 0x402e1e
push dword [ebp - 0x410]
call sub.KERNEL32.dll_GlobalFree
mov eax, dword [ebp - 0x40c]
add eax, 0x100
mov dword [ebp - 0x40c], eax
mov esi, eax
push dword [ebp - 0x40c]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x410], eax
push ebp
add dword [esp], 0xfffffbf4
push dword [ebp - 0x410]
push ebp
add dword [esp], 0xfffffbf8
push 0
push dword [ebp - 0x410]
push ebp
add dword [esp], 0xfffffc00
push ebx
push dword [ebp + 0x14]
call sub.ADVAPI32.dll_RegEnumValueA
test eax, eax
jne 0x402e4e
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push dword [ebp - 0x408]
push ebp
add dword [esp], 0xfffffc00
push dword [ebp + 0x10]
call fcn.004030e2
inc ebx
jmp 0x402d76
push dword [ebp - 0x410]
call sub.KERNEL32.dll_GlobalFree
mov esp, ebp
pop esi
pop ebx
pop ebp
ret 8
Function at 0x403f80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push edi
push esi
mov ebp, esp
sub esp, 0x28
push 0
push 0
push 0x1032
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
test eax, eax
je 0x404100
mov ecx, 0x4d
mul ecx
push eax
push 0x42
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x41e58c], eax
test eax, eax
je 0x404100
push dword [0x41e58c]
call sub.KERNEL32.dll_GlobalLock
mov esi, eax
test eax, eax
je 0x4040cc
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], 0x40
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
mov edi, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x40
push ebp
add dword [esp], 0xffffffd8
push edi
push 0x102d
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
add esi, eax
mov byte [esi], 0x20
inc esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x40
push ebp
add dword [esp], 0xffffffd8
push edi
push 0x102d
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
add esi, eax
mov byte [esi], 0x20
inc esi
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x40
push ebp
add dword [esp], 0xffffffd8
push edi
push 0x102d
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
add esi, eax
mov word [esi], 0xd0a
add esi, 2
push 2
push edi
push 0x100c
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
mov edi, eax
test eax, eax
jns 0x403ff3
mov byte [esi], 0
push dword [ebp + 0x10]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x4040cc
call sub.USER32.dll_EmptyClipboard
push dword [0x41e58c]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x41e58c]
push 1
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
mov esp, ebp
pop esi
pop edi
pop ebp
ret 4
push dword [0x41e58c]
call sub.KERNEL32.dll_GlobalFlags
and eax, 0xff
test eax, eax
jne 0x4040eb
push dword [0x41e58c]
call sub.KERNEL32.dll_GlobalLock
push dword [0x41e58c]
call sub.KERNEL32.dll_GlobalFree
mov dword [0x41e58c], 0
mov esp, ebp
pop esi
pop edi
pop ebp
ret 4
Function at 0x404972
Capabilities:
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebp
add dword [esp], 0xfffffcb4
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push dword [ebp + 8]
call sub.KERNEL32.dll_SetCurrentDirectoryA
push ebp
add dword [esp], 0xfffffdb8
push 0x421707
call sub.KERNEL32.dll_FindFirstFileA
test eax, eax
jns 0x4049b1
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], eax
push 0x41e79c
call sub.KERNEL32.dll_SetCurrentDirectoryA
mov eax, dword [ebp - 0x21c]
cmp al, 0x2e
je 0x404a30
cmp dword [ebp + 0xc], 1
jne 0x404a23
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffef8
call fcn.00401bb4
push 0x42170b
push ebp
add dword [esp], 0xfffffef8
call fcn.00401b87
push ebp
add dword [esp], 0xfffffde4
push ebp
add dword [esp], 0xfffffef8
call fcn.00401b87
push 0x41e79c
call fcn.00401b1b
inc eax
lea eax, [eax + ebp - 0x108]
push eax
call fcn.00404ab3
jmp 0x404a30
push ebp
add dword [esp], 0xfffffde4
call fcn.00404ab3
push ebp
add dword [esp], 0xfffffdb8
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4049be
push dword [ebp - 4]
call sub.KERNEL32.dll_FindClose
push ebp
add dword [esp], 0xfffffcb4
call sub.KERNEL32.dll_SetCurrentDirectoryA
mov esp, ebp
pop ebp
ret 8

Function at 0x404ab3
Capabilities:
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, esp
sub esp, 0x148
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 0x14]
call sub.KERNEL32.dll_CreateFileA
test eax, eax
js 0x404c10
mov dword [ebp - 0x108], eax
push ebp
add dword [esp], 0xfffffef0
push 0
push 0
push dword [ebp - 0x108]
call sub.KERNEL32.dll_GetFileTime
push ebp
add dword [esp], 0xfffffee8
push ebp
add dword [esp], 0xfffffef0
call sub.KERNEL32.dll_FileTimeToLocalFileTime
push ebp
add dword [esp], 0xfffffee4
push ebp
add dword [esp], 0xfffffee6
push ebp
add dword [esp], 0xfffffee8
call sub.KERNEL32.dll_FileTimeToDosDateTime
push dword [ebp - 0x11c]
pop dword [ebp - 0x128]
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 0x104]
mov dword [ebp - 0x124], 0
push dword [ebp + 0x14]
call sub.KERNEL32.dll_GetFileAttributesA
mov dword [ebp - 0x120], eax
mov ecx, 0x2f
mov al, byte [esi]
cmp al, 0x5c
cmove eax, ecx
mov byte [edi], al
inc edi
inc esi
test al, al
jne 0x404b5f
push 0xffffffffffffffff
push 8
push 0
push 0
push 0
push 0
push 0
push ebp
add dword [esp], 0xfffffec0
push ebp
add dword [esp], 0xfffffefc
push dword [0x41e798]
call fcn.0041110b
push 0
push dword [ebp - 0x108]
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
test eax, eax
je 0x404c05
push ebx
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x144], eax
push 0
push ebp
add dword [esp], 0xfffffeb8
push ebx
push dword [ebp - 0x144]
push dword [ebp - 0x108]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 0x148], 0
je 0x404bfa
push dword [ebp - 0x148]
push dword [ebp - 0x144]
push dword [0x41e798]
call fcn.00411147
jmp 0x404bbc
push dword [ebp - 0x144]
call sub.KERNEL32.dll_GlobalFree
push dword [0x41e798]
call fcn.00411561
mov esp, ebp
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x404c19
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push dword [ebp + 8]
push 0x41e9a4
call sub.KERNEL32.dll_lstrcpyA
push 0x41af4e
push 0x41e9a4
call sub.KERNEL32.dll_lstrcatA
push 0x41ae10
push 0x41e9a4
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x404cf2
mov dword [ebp - 4], eax
mov eax, dword [0x41ae10]
test eax, 0x10
je 0x404cd5
mov eax, dword [0x41ae3c]
and eax, 0xffffff
cmp eax, 0x2e2e
je 0x404cd5
and eax, 0xffff
cmp eax, 0x2e
je 0x404cd5
push 0x41e9a4
call sub.KERNEL32.dll_lstrlenA
mov edx, eax
push edx
dec edx
cmp byte [edx + 0x41e9a4], 0x5c
jne 0x404ca1
inc edx
mov eax, 0x41e9a4
add eax, edx
push 0x41ae3c
push eax
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp + 0xc]
push 0x41e9a4
call fcn.00404972
push dword [ebp + 0xc]
push 0x41e9a4
call fcn.00404c19
pop edx
mov byte [edx + 0x41e9a4], 0
push 0x41ae10
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
or eax, eax
jne 0x404c56
push dword [ebp - 4]
call sub.KERNEL32.dll_FindClose
mov esp, ebp
pop ebp
ret 8
Function at 0x404ffa
Capabilities:
Get file size
Get system information on windows
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x24], 0
push dword [ebp + 0x1c]
call fcn.00401b1b
test eax, eax
je 0x4051bd
push ebp
add dword [esp], 0xffffffb0
call sub.KERNEL32.dll_GetSystemInfo
push 4
push 0x1000
push 0x20
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp + 0x1c]
call fcn.00405418
test eax, eax
js 0x4051ae
push 0
push 0x8000000
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 0x14]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 4], eax
test eax, eax
js 0x4051ae
push 0
push dword [ebp - 4]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4051a6
mov ecx, dword [ebp - 0x4c]
dec ecx
add eax, ecx
not ecx
and eax, ecx
push eax
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
pop eax
push 4
push 0x1000
push dword [ebp - 8]
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0xc], eax
push 0
push ebp
add dword [esp], 0xffffffec
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.dll_ReadFile
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [ebp - 0x10]
add ebx, 0xf
and ebx, 0xfffffff0
mov dword [ebp - 0x10], ebx
shr ebx, 3
push 0x10
push dword [ebp - 0x1c]
call fcn.00405542
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
push edi
push esi
call fcn.004055de
add esi, 8
add edi, 8
dec ebx
jne 0x4050f5
push dword [ebp + 0x18]
call fcn.00401efc
mov ecx, 5
mov edx, 1
test eax, eax
cmove ecx, edx
push 0
push 0
push ecx
push 0
push 2
push 0x40000000
push dword [ebp + 0x18]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 4], eax
push 0
push ebp
add dword [esp], 0xffffffec
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push 0
push ebp
add dword [esp], 0xffffffec
push 4
push ebp
add dword [esp], 0xffffffe8
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_VirtualFree
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_VirtualFree
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_VirtualFree
xor eax, eax
dec eax
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4051c9
Capabilities:
Get file size
Get system information on windows
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, esp
sub esp, 0x44
push dword [ebp + 0x1c]
call fcn.00401b1b
test eax, eax
je 0x405373
push ebp
add dword [esp], 0xffffffbc
call sub.KERNEL32.dll_GetSystemInfo
push 4
push 0x1000
push 0x20
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp + 0x1c]
call fcn.00405418
test eax, eax
js 0x405364
push 0
push 0x8000000
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 0x14]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 4], eax
test eax, eax
js 0x405364
push 0
push dword [ebp - 4]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40535c
mov ecx, dword [ebp - 0x40]
dec ecx
add eax, ecx
not ecx
and eax, ecx
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
push 2
push 0
push 0xfffffffffffffffc
push dword [ebp - 4]
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
add dword [esp], 0xfffffff0
push 4
push ebp
add dword [esp], 0xffffffec
push dword [ebp - 4]
call sub.KERNEL32.dll_ReadFile
push 0
push 0
push 0
push dword [ebp - 4]
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
add dword [esp], 0xfffffff0
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.dll_ReadFile
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [ebp - 0xc]
add ebx, 0xf
and ebx, 0xfffffff0
mov dword [ebp - 0xc], ebx
shr ebx, 3
push 0x10
push dword [ebp - 0x18]
call fcn.00405542
mov esi, dword [ebp - 8]
push esi
push esi
call fcn.00405643
add esi, 8
dec ebx
jne 0x4052d3
push dword [ebp + 0x18]
call fcn.00401efc
mov ecx, 5
mov edx, 1
test eax, eax
cmove ecx, edx
push 0
push 0
push ecx
push 0
push 2
push 0x40000000
push dword [ebp + 0x18]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 4], eax
push 0
push ebp
add dword [esp], 0xfffffff0
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 0x18]
call sub.KERNEL32.dll_VirtualFree
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 0x18]
call sub.KERNEL32.dll_VirtualFree
xor eax, eax
dec eax
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x405418
Capabilities:
Contain obfuscated stackstrings
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], 0x33323130
mov dword [ebp - 0x64], 0x37363534
mov dword [ebp - 0x60], 0x62613938
mov dword [ebp - 0x5c], 0x66656463
push dword [ebp + 0x14]
call fcn.00401b1b
test eax, eax
je 0x405527
mov dword [ebp - 0x14], eax
push 0xf0000000
push 1
push 0
push 0
push ebp
add dword [esp], 0xfffffff4
call sub.ADVAPI32.dll_CryptAcquireContextA
test eax, eax
je 0x405527
push ebp
add dword [esp], 0xfffffff0
push 0
push 0
push 0x8004
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_CryptCreateHash
test eax, eax
je 0x40551d
push 0
push dword [ebp - 0x14]
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_CryptHashData
test eax, eax
je 0x405518
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x58], 0x40
push 0
push ebp
add dword [esp], 0xffffffa8
push ebp
add dword [esp], 0xffffffac
push 2
push dword [ebp - 0x10]
call sub.ADVAPI32.dll_CryptGetHashParam
test eax, eax
je 0x405518
xor eax, eax
xor edx, edx
mov ebx, dword [ebp + 0x18]
lea edi, [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
lea esi, [ebp - 0x68]
mov al, byte [edi]
shr al, 4
mov dl, byte [esi + eax]
mov byte [ebx], dl
inc ebx
mov al, byte [edi]
and al, 0xf
mov dl, byte [esi + eax]
mov byte [ebx], dl
inc edi
inc ebx
dec ecx
jne 0x4054e2
mov byte [ebx], 0
call sub.ADVAPI32.dll_CryptDestroyHash
push 0
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_CryptReleaseContext
xor eax, eax
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call sub.ADVAPI32.dll_CryptDestroyHash
push 0
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_CryptReleaseContext
push 0x8000
push 0
push dword [ebp + 0x18]
call sub.KERNEL32.dll_VirtualFree
xor eax, eax
dec eax
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x405542
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
pushfd
mov ebp, esp
mov ecx, 0x412
mov esi, 0x41b100
mov edi, 0x41ebb4
cld
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x10]
mov edx, 0x48
test ecx, ecx
je 0x4055d9
cmp ecx, 0x38
jb 0x40556e
mov ecx, 0x38
mov edx, 0x48
mov esi, dword [ebp + 0xc]
sub edx, ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov esi, 0x41fbfc
mov ecx, 0x48
mov eax, dword [ecx + 0x41fbf8]
bswap eax
xor dword [ecx + 0x41ebb0], eax
sub ecx, 4
jne 0x405586
xor eax, eax
mov edi, 0x41ebb4
mov dword [0x41fbfc], eax
mov dword [0x41fc00], eax
mov ecx, 9
push 0x41fbfc
jmp 0x4055b7
push eax
push edi
call fcn.004055de
mov eax, edi
add edi, 8
dec ecx
jne 0x4055b6
mov ecx, 0x200
push eax
push edi
call fcn.004055de
mov eax, edi
add edi, 8
dec ecx
jne 0x4055ca
popfd
pop ebp
ret 8
Function at 0x4055de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov edx, dword [edi + 4]
xor ebx, ebx
xor ecx, ecx
xor edi, edi
xor eax, dword [edi*4 + 0x41ebb4]
rol eax, 0x10
mov cl, al
mov bl, ah
mov esi, dword [ecx*4 + 0x41effc]
rol eax, 0x10
add esi, dword [ebx*4 + 0x41ebfc]
mov cl, ah
mov bl, al
xor esi, dword [ecx*4 + 0x41f3fc]
add esi, dword [ebx*4 + 0x41f7fc]
xor edx, esi
inc edi
xchg edx, eax
cmp edi, 0x10
jne 0x4055f0
mov esi, dword [ebp + 8]
xor eax, dword [0x41ebf4]
xor edx, dword [0x41ebf8]
mov dword [esi + 4], eax
mov dword [esi], edx
popal
pop ebp
ret 8

Function at 0x405643
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov edx, dword [edi + 4]
xor ebx, ebx
xor ecx, ecx
mov edi, 0x10
xor eax, dword [edi*4 + 0x41ebb8]
rol eax, 0x10
mov cl, al
mov bl, ah
mov esi, dword [ecx*4 + 0x41effc]
rol eax, 0x10
add esi, dword [ebx*4 + 0x41ebfc]
mov cl, ah
mov bl, al
xor esi, dword [ecx*4 + 0x41f3fc]
add esi, dword [ebx*4 + 0x41f7fc]
xor edx, esi
dec edi
xchg edx, eax
jne 0x405658
mov esi, dword [ebp + 8]
xor eax, dword [0x41ebb8]
xor edx, dword [0x41ebb4]
mov dword [esi + 4], eax
mov dword [esi], edx
popal
pop ebp
ret 8
Function at 0x4056be
Capabilities:
Accept command line arguments

Disassembly:
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x41a664], eax
push 0x421720
call fcn.004012d9
test eax, eax
sete byte [0x41a71c]
call fcn.0040f4f1
push 1
call sub.KERNEL32.dll_SetErrorMode
push 0x41a8a0
call sub.COMCTL32.dll_InitCommonControlsEx
push 0
push dword [0x41a664]
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x41e354
push 0x421732
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x41e354], eax
push 0
push 1
push 0x401
push dword [0x41e354]
call sub.USER32.dll_SendMessageA
mov eax, dword fs:[0x18]
cmp eax, 0x7ffde000
setne byte [0x41a710]
jne 0x405788
push 0x421743
call sub.KERNEL32.dll_GetModuleHandleA
push 0x294
push eax
call sub.KERNEL32.dll_GetProcAddress
or eax, eax
je 0x405764
push 1
call eax
mov dword [0x41dec4], 1
mov dword [0x41ded8], 0
call fcn.00409e93
test eax, eax
je 0x4057b4
mov dword [0x41def8], eax
jmp 0x4057b4
mov dword [0x41dec4], 0
mov dword [0x41ded8], 1
mov dword [0x41a71c], 1
call fcn.00409da1
test eax, eax
je 0x4057b4
mov dword [0x41def8], eax
call sub.KERNEL32.dll_GetProcessHeap
mov dword [0x41a6b0], eax
push 0x41a8f8
call sub.GDI32.dll_CreateFontIndirectA
mov dword [0x41a6ac], eax
call fcn.004018dd
push 0
call sub.ole32.dll_CoInitialize
push 0x8000
push 0
push 0
push 2
push 0x65
push dword [0x41a664]
call sub.USER32.dll_LoadImageA
mov dword [0x41a688], eax
call fcn.004073ed
push 0x41a690
push 0x41a68c
call sub.SHELL32.dll_Shell_GetImageLists
push 0x20
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x69
push dword [0x41a664]
call sub.COMCTL32.dll_ImageList_LoadImage
mov dword [0x41df20], eax
push 0x20
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x6a
push dword [0x41a664]
call sub.COMCTL32.dll_ImageList_LoadImage
mov dword [0x41df24], eax
push ebx
push esi
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
push ebx
call sub.KERNEL32.dll_lstrlen
mov esi, eax
add esi, ebx
push ebx
call sub.SHLWAPI.dll_PathGetArgsA
cmp esi, eax
jne 0x405864
mov eax, 0
pop esi
pop ebx
push eax
push 0x405a4e
push 0
push 0x3e8
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
push dword [0x41df20]
call sub.COMCTL32.dll_ImageList_Destroy
push dword [0x41df24]
call sub.COMCTL32.dll_ImageList_Destroy
push dword [0x41a6ac]
call sub.GDI32.dll_DeleteObject
push dword [0x41def8]
call sub.KERNEL32.dll_FreeLibrary
push dword [0x41e354]
call sub.USER32.dll_DestroyWindow
call sub.ole32.dll_CoUninitialize
push 0
call sub.KERNEL32.dll_ExitProcess
Function at 0x405961
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
push edi
push esi
mov ebp, esp
sub esp, 0x28c
push ebp
add dword [esp], 0xffffff00
push 0x100
call sub.KERNEL32.dll_GetLogicalDriveStringsA
lea esi, [ebp - 0x100]
mov edi, esi
inc esi
mov al, byte [esi]
or al, al
jne 0x405986
push 0x111
push 0x160
push ebp
add dword [esp], 0xfffffd9c
push 0
push edi
call sub.SHELL32.dll_SHGetFileInfo
mov eax, dword [ebp - 0x264]
mov byte [esi - 1], 0
push dword [ebp - 0x264]
push 0xffffffffffffffff
push dword [0x41a684]
call sub.COMCTL32.dll_ImageList_ReplaceIcon
push 1
push eax
push edi
push 0
push dword [0x41a674]
call fcn.00407794
push dword [ebp - 0x264]
call sub.USER32.dll_DestroyIcon
inc esi
mov edi, esi
mov al, byte [esi]
or al, al
jne 0x405986
mov eax, 0x5c3a41
mov dword [ebp - 0x104], eax
push ebp
add dword [esp], 0xfffffefc
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 3
je 0x405a32
inc dword [ebp - 0x104]
cmp dword [ebp - 0x104], 0x5c3a5a
jle 0x4059f4
push 0
push 0
push 0x110a
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
mov esp, ebp
pop esi
pop edi
pop ebp
ret
mov byte [ebp - 0x102], 0
push ebp
add dword [esp], 0xfffffefc
push 0
call fcn.00408f2a
mov esp, ebp
pop esi
pop edi
pop ebp
ret