joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4330b2
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cb1c0
call fcn.00496fcc
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
cmp dword [eax - 8], 0
je 0x43313b
test byte [ebx + 4], 1
jne 0x43313b
and dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], str..jpg
mov dword [ebp - 0x1c], str..jpeg
mov dword [ebp - 0x18], str..png
mov dword [ebp - 0x14], str..bmp
lea esi, [ebp - 0x20]
push dword [esi]
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041d0af
add esp, 0xc
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004b227d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004b2136
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43314f
inc dword [ebp - 0x10]
add esi, 4
cmp dword [ebp - 0x10], 4
jb 0x4330f9
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
xor eax, eax
jmp 0x43313e

Function at 0x434be6
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cb450
call fcn.00496fcc
sub esp, 0x4c
push dword [ebp + 8]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x434d46
push ebx
push esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.004b21aa
xor ebx, ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.0042e1f2
push ebx
lea ecx, [ebp - 0x58]
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0042e29c
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.004b21aa
mov eax, dword [0x504fc0]
mov dword [ebp - 0x10], eax
push 0x4fe574
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004b2527
lea ecx, [ebp - 0x38]
call fcn.004962bd
push ebx
lea ecx, [ebp - 0x38]
push dword [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00496382
xor esi, esi
cmp eax, ebx
je 0x434d07
push edi
lea ecx, [ebp - 0x38]
call fcn.004965a8
lea ecx, [ebp - 0x38]
mov edi, eax
call fcn.0049656b
test eax, eax
jne 0x434cfe
lea eax, [ebp + 8]
lea ecx, [ebp - 0x38]
push eax
call fcn.00496677
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.004b227d
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.004b2136
mov eax, dword [ebp - 0x38]
push 0x10
lea ecx, [ebp - 0x38]
call dword [eax + 0x38]
cmp eax, ebx
je 0x434cda
cmp dword [ebp + 0x10], ebx
je 0x434cfe
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00434be6
jmp 0x434cfc
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 8], ebx
je 0x434cf1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x58]
call fcn.0042e374
test eax, eax
je 0x434cfe
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.004349b3
add esi, eax
cmp edi, ebx
jne 0x434c78
pop edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.004962fc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004b2136
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004b2136
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.0042e260
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004b2136
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x434d54
Capabilities:
Resume thread

Disassembly:
mov eax, 0x4cb465
call fcn.00496fcc
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x1e8]
cmp eax, edi
jne 0x434d79
call fcn.00434e0f
push 1
pop eax
jmp 0x434df1
push 0x74
call fcn.004b270a
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x434d95
push esi
call fcn.004333a0
jmp 0x434d97
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi + 0x1f8], eax
je 0x434dcb
push edi
push edi
push 4
mov ecx, eax
call fcn.004b63c4
test eax, eax
jne 0x434dd0
mov ecx, dword [esi + 0x1f8]
cmp ecx, edi
je 0x434dc5
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x1f8], edi
or eax, 0xffffffff
jmp 0x434df1
mov eax, dword [esi + 0x1f8]
push edi
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x1f8]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x434e0f
Capabilities:
Resume thread

Disassembly:
mov eax, 0x4cb479
call fcn.00496fcc
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x168]
test eax, eax
jne 0x434e2e
push 1
pop eax
jmp 0x434e94
xor ebx, ebx
lea esi, [edi + 0x1fc]
push 0x78
call fcn.004b270a
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x434e54
push edi
push ebx
mov ecx, eax
call fcn.0043345a
jmp 0x434e56
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
test eax, eax
je 0x434ebf
push 0
push 0
push 4
mov ecx, eax
call fcn.004b63c4
test eax, eax
je 0x434ea3
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc ebx
add esi, 4
cmp ebx, 2
jl 0x434e36
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov ecx, dword [edi + ebx*4 + 0x1fc]
lea esi, [edi + ebx*4 + 0x1fc]
test ecx, ecx
je 0x434ebc
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi], 0
or eax, 0xffffffff
jmp 0x434e94

Function at 0x43516f
Capabilities:
Check if file exists

Disassembly:
push dword [0x509694]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435194
push 0
push 0x414
push dword [0x509694]
call fcn.0041ceb5
add esp, 0xc
ret
Function at 0x43a178
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cbe30
call fcn.00496fcc
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x5095e4
push str._sMediaProbe.exe
push edi
call fcn.004afa67
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x5095e4]
call esi
test eax, eax
jne 0x43a1bc
push str.MediaProbe.exe
mov ecx, edi
call fcn.004b22cd
push ebx
mov edi, 0x5095e8
push str._sMediaEncode.exe
push edi
call fcn.004afa67
add esp, 0xc
push dword [0x5095e8]
call esi
test eax, eax
jne 0x43a1e8
push str.MediaEncode.exe
mov ecx, edi
call fcn.004b22cd
push dword [0x5095e8]
lea eax, [ebp - 0x14]
push eax
call fcn.0041cfa4
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.Presets
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004b23db
push eax
mov ecx, 0x5095ec
mov byte [ebp - 4], 1
call fcn.004b227d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004b2136
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b2136
push ebx
mov edi, 0x5095f0
push str._sMediaPlay.exe
push edi
call fcn.004afa67
add esp, 0xc
push dword [0x5095f0]
call esi
test eax, eax
jne 0x43a25f
push str.MediaPlay.exe
mov ecx, edi
call fcn.004b22cd
cmp dword [0x5095f4], 0
jne 0x43a363
mov eax, dword [0x504fc0]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.004afa67
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a29f
mov dword [0x5095f4], 6
cmp dword [0x5095f4], 0
jne 0x43a357
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.004afa67
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a2d1
mov dword [0x5095f4], 5
cmp dword [0x5095f4], 0
jne 0x43a357
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.004afa67
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a2ff
mov dword [0x5095f4], 4
cmp dword [0x5095f4], 0
jne 0x43a357
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.004afa67
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a32d
mov dword [0x5095f4], 3
cmp dword [0x5095f4], 0
jne 0x43a357
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.004afa67
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a357
mov dword [0x5095f4], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004b2136
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x5095f8], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43a37e
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x5095f0]
call esi
test eax, eax
je 0x43a39e
xor eax, eax
push eax
push eax
push eax
push dword [0x5095f0]
jmp 0x43a3ce
push dword [0x5095e8]
call esi
test eax, eax
je 0x43a3b7
xor eax, eax
push eax
push eax
push eax
push dword [0x5095e8]
jmp 0x43a3ce
push dword [0x5095e4]
call esi
test eax, eax
je 0x43a3d6
xor eax, eax
push eax
push eax
push eax
push dword [0x5095e4]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x43b443
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4cbf28
call fcn.00496fcc
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b481
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041cfa4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b2136
lea eax, [ebp - 0x14]
push eax
call fcn.0041f1ad
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c4b6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b2136
push dword [ebp + 8]
lea edi, [esi + 0x70]
mov ecx, edi
call fcn.004b22cd
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x68]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0043b224
test eax, eax
je 0x43b4d8
mov esi, eax
jmp 0x43b50d
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
je 0x43b4f2
or esi, 0xffffffff
jmp 0x43b50d
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x2c]
or esi, 0xffffffff
cmp eax, esi
je 0x43b50d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041c523
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4aea80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.004971d0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4aeb4b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4aeb4b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4aeafe
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4aeb09
or bh, 8
and edi, 0x8000000
je 0x4aeb24
mov eax, dword [0x50d51c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4aeb4b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4f37
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b4f79
call fcn.004c4d92
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b4f79
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b4f70
xor eax, eax
jmp 0x4b4f81
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b4f87
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bc4c5
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4cddbc
call fcn.00496fcc
push ecx
push ecx
push esi
push 0x10
call fcn.004b270a
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4bc512
mov ecx, esi
call fcn.004b76f1
mov eax, dword [0x504fc0]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.004b22cd
jmp 0x4bc514
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x4eba38
push eax
mov dword [ebp - 0x10], esi
call fcn.0049862c
pop esi
Function at 0x402470
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x124]
mov ecx, eax
lea eax, [ebp - 0x13c]
mov edx, eax
mov eax, 1
call fcn.00403a80
call fcn.00403b80
push eax
test eax, eax
jne 0x402655
mov eax, dword [ebp - 4]
test eax, eax
je 0x4024d4
jmp 0x4024fc
push 0x105
lea eax, [ebp - 0x118]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x118]
lea eax, [ebp - 8]
call fcn.00404340
jmp 0x402655
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402820
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.00402880
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x402529
jmp 0x40252b
jmp 0x402542
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, 0
jl 0x402542
jmp 0x402538
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x402542
jmp 0x402504
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 0x144], 0
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x10]
mov esi, 1
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x10]
call fcn.00404380
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov ecx, ebx
mov edx, esi
call fcn.004043e0
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
call fcn.004044a0
lea edx, [ebp - 8]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4025cd
mov eax, dword [eax - 4]
cmp eax, 2
jge 0x4025d7
jmp 0x402655
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x22
je 0x4025e2
jmp 0x402655
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4025ef
mov eax, dword [eax - 4]
mov al, byte [edx + eax - 1]
cmp al, 0x22
je 0x4025f9
jmp 0x402655
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 0x148], 0
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40261a
mov ecx, dword [ecx - 4]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.004043e0
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
call fcn.004044a0
lea edx, [ebp - 8]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 8], eax
call fcn.00403c80
lea edx, [ebp - 0x148]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 0x148], 0
lea edx, [ebp - 0x144]
mov eax, edx
call fcn.00403bb0
mov dword [ebp - 0x144], 0
pop eax
test eax, eax
je 0x40269f
mov edx, str._t_nAnsiString
lea eax, [ebp - 8]
call fcn.00403f10
call fcn.00403d10
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
leave
ret
Function at 0x412340
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x41235e
jmp 0x412367
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x412378
jmp 0x412381
mov eax, dword [ebp - 4]
or eax, 8
mov dword [ebp - 4], eax
push 0x12
call sub.user32.dll_GetKeyState
movsx eax, ax
cmp eax, 0
jl 0x412392
jmp 0x41239b
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x2a0d4dcb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x526e4559
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x9dccd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9dcd1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9dcce2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9dcd80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dcdd2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dcdd8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f52c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f4f85

Function at 0x9fa0bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f9f3e

Function at 0x9ff670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9ff69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9ff69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, reloc.ole32.dll_OleUninitialize
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219