joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046ba1
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x10093d43
call fcn.100871aa
mov edi, dword [ebp + 8]
mov dword [edi], 0x1001953c
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ebx, [edi + 4]
push ebx
call fcn.10044dc2
lea eax, [esi - 0x10]
call fcn.1007924a
and dword [edi + 0x10], 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10023ed7
push 0
push 0x10003bd0
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.10023a76
test al, al
je 0x10046c58
cmp byte [ebp + 0x10], 0
jne 0x10046c58
push dword [ebp + 0xc]
mov esi, ebx
call fcn.10044e7f
push 0xc
call fcn.1007c44a
mov esi, eax
pop ecx
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x10046c88
mov dword [esi], 0x100194ac
and dword [esi + 4], 0
mov byte [ebp - 4], 7
call fcn.100238bb
mov ecx, ebx
mov dword [esi + 8], eax
call fcn.1006af43
call eax
jmp 0x10046c83
lea eax, [ebp - 0x28]
call fcn.10024236
test al, al
je 0x10046c8f
cmp byte [ebp + 0x10], 0
jne 0x10046c8f
push 8
call fcn.1007c44a
mov esi, eax
pop ecx
test esi, esi
je 0x10046c88
mov dword [esi], 0x100193e4
call fcn.100238bb
mov dword [esi + 4], eax
jmp 0x10046c8a
xor esi, esi
mov dword [edi + 0x10], esi
jmp 0x10046ca5
push dword [ebp + 0xc]
mov esi, ebx
call fcn.10044e7f
mov ecx, ebx
call fcn.1006af43
call eax
mov dword [edi + 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.10024209
mov eax, edi
call fcn.10087296
ret 0xc

Function at 0x100470a0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 8], eax
xor eax, eax
push eax
push eax
push esi
push 0x1004706b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x100553df
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x10093746
call fcn.100871aa
xor ebx, ebx
push ebx
push 0x100b6154
mov edi, 0x100b6050
push edi
mov dword [ebp - 0x14], ebx
push ebx
push dword [ebp + 8]
call fcn.10086c45
add esp, 0x14
cmp eax, ebx
je 0x10055426
lea esi, [ebp - 0x18]
call fcn.10042a90
mov eax, dword [eax]
mov dword [ebp - 0x14], 1
mov byte [ebp - 0xd], 1
cmp dword [eax - 0xc], ebx
je 0x10055429
mov byte [ebp - 0xd], bl
test byte [ebp - 0x14], 1
je 0x1005543a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
cmp byte [ebp - 0xd], bl
je 0x1005559a
push ebx
push 0x100b6090
push edi
push ebx
push dword [ebp + 8]
call fcn.10086c45
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x100555a4
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov eax, esi
mov dword [ebp - 4], ebx
call fcn.10036d17
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
cmp dword [ebp - 0x1c], ebx
je 0x100554e3
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.10036d17
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.10025d87
mov byte [ebp - 4], 2
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x14]
call fcn.10058c46
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
jmp 0x1005550d
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.10036d17
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.10058274
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
mov edi, 0x100b6050
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10055592
push ebx
push 0x100b61bc
push edi
push ebx
push dword [ebp + 8]
call fcn.10086c45
add esp, 0x14
cmp eax, ebx
je 0x10055549
cmp dword [eax + 0xf4], 4
jne 0x10055549
mov bl, 1
lea eax, [esi - 0x10]
call fcn.1007924a
mov al, bl
jmp 0x1005559c
push 0x10011360
lea eax, [ebp + 8]
push eax
call fcn.100580f9
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea edi, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.100589df
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 5
push dword [eax]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.1007924a
jmp 0x1005553d
lea eax, [esi - 0x10]
call fcn.1007924a
mov al, 1
call fcn.10087296
ret 8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push 0x1001142c
push ebx
call dword [eax + 4]
xor al, al
jmp 0x1005559c
Function at 0x100555bb
Capabilities:
Check mutex on windows

Disassembly:
push 0
mov eax, 0x1008dc40
call fcn.100871aa
mov edi, ecx
mov ebx, dword [ebp + 8]
and dword [ebx], 0
lea esi, [ebx + 4]
mov ecx, 0x100aee70
call fcn.10079180
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 8], ecx
mov byte [ebx + 0x14], 0
mov dword [ebx + 0x18], eax
cmp byte [edi + 8], 0
je 0x1005566e
add edi, 4
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
push 0x10011460
lea eax, [ebp + 0xc]
push eax
je 0x10055622
call fcn.10058a90
mov byte [ebp - 4], 1
jmp 0x1005562d
mov edi, ecx
call fcn.10058a90
mov byte [ebp - 4], 2
mov edi, esi
call fcn.10058274
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.1007924a
push dword [esi]
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx], eax
cmp eax, edi
jne 0x10055672
push dword [esi]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10055672
mov byte [ebx + 0x14], 1
mov eax, ebx
call fcn.10087296
ret 0x14

Function at 0x10055cc1
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [esi], 0x1001a774
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 4]
sub eax, 0x10
pop esi
jmp fcn.1007924a
Function at 0x10057462
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x10097884
call fcn.100871aa
mov esi, dword [ebp + 8]
mov dword [esi], 0x1001a7e0
xor ebx, ebx
mov dword [esi + 4], 0x1001886c
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x20], 0x100188bc
mov byte [ebp - 4], 1
push 0xc00
mov dword [esi + 0x3c], ebx
call fcn.1007c44a
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x100574d3
push eax
call fcn.10027cb6
jmp 0x100574d5
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x100b8508], eax
call fcn.100277f7
push 4
call fcn.1007c44a
pop ecx
cmp eax, ebx
je 0x100574f7
mov dword [eax], 0x1001a7e8
jmp 0x100574f9
xor eax, eax
push 0x1001a9f8
mov dword [0x100b8514], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x1005752a
push 0x100146a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], 0x20000
cmp eax, ebx
je 0x1005752a
lea ecx, [ebp - 0x14]
push ecx
call eax
push 0x100641de
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10023ed7
mov byte [ebp - 4], 3
call fcn.10069675
mov edi, eax
lea eax, [ebp - 0x2c]
call fcn.1002426c
mov ecx, dword [0x100b8508]
neg al
sbb al, al
inc al
mov byte [ecx], al
mov eax, dword [0x100b8508]
push ebx
mov dword [eax + 0x990], edi
push 0x10003bd0
lea eax, [ebp - 0x28]
push eax
call fcn.10023a76
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x2c]
call fcn.10024236
mov ecx, dword [0x100b8508]
mov dword [ecx + 0xbf0], 1
cmp byte [ebp - 0xd], bl
je 0x100575aa
mov dword [ecx + 0xbf0], 3
cmp al, bl
je 0x100575b8
mov dword [ecx + 0xbf0], 2
lea ecx, [ebp - 0x2c]
call fcn.10024209
mov eax, esi
call fcn.10087296
ret 4
Function at 0x1005f853
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [esi + 4]
push eax
mov dword [esi], 0x1001a820
call fcn.10057462
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.1007eb10
add esp, 0xc
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x100138fc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jle 0x1005f8f0
mov edx, 0x10011614
lea eax, [ebp - 0x204]
mov cx, word [eax]
cmp cx, word [edx]
jne 0x1005f8e1
test cx, cx
je 0x1005f8dd
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x1005f8e1
add eax, 4
add edx, 4
test cx, cx
jne 0x1005f8bb
xor eax, eax
jmp 0x1005f8e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1005f8f0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.1007b431
leave
ret
Function at 0x10062b38
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10098d4a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [edi + 0x10]
mov dword [esp + 0x28], ebx
push eax
lea esi, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
call fcn.100281b0
cmp dword [esp + 0x20], ebx
ja 0x10062ce8
jb 0x10062b9b
cmp dword [esp + 0x1c], 2
ja 0x10062ce8
lea eax, [esp + 0x1c]
push eax
call fcn.10064093
mov dword [esp + 0x40], ebx
push dword [eax]
lea eax, [esp + 0x1c]
push eax
call fcn.100580f9
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10062c0e
push 0x100145e8
lea eax, [esp + 0x2c]
push eax
call fcn.100580f9
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 3
call fcn.10028371
mov dword [esp + 0x2c], 0x10018818
push 0x1009c414
lea eax, [esp + 0x30]
push eax
call fcn.10081847
mov ecx, edi
call fcn.10053d88
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.10053dbc
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.100791e7
push ebx
push dword [esp + 0x18]
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10062c65
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x10062c5e
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10062c65
mov byte [esp + 0x13], 1
jmp 0x10062c69
mov byte [esp + 0x13], bl
lea eax, [esi - 0x10]
call fcn.1007924a
cmp byte [esp + 0x13], bl
je 0x10062caf
push 1
push edi
call fcn.10054272
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.1007924a
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10014628
lea eax, [esp + 0x2c]
push eax
call fcn.100580f9
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 5
call fcn.10028371
mov dword [esp + 0x2c], 0x10018818
push 0x1009c414
lea eax, [esp + 0x30]
jmp 0x10062c08
mov ecx, edi
call fcn.10063f0b
test al, al
jne 0x10062c9d
push 0x10014660
lea eax, [esp + 0x2c]
push eax
call fcn.100580f9
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], 6
call fcn.10028371
mov dword [esp + 0x2c], 0x10018824
push 0x1009c460
lea eax, [esp + 0x30]
jmp 0x10062c08
Function at 0x10063f0b
Capabilities:
Get file size

Disassembly:
push 0x2c
mov eax, 0x10092ef2
call fcn.100871aa
mov esi, ecx
mov eax, dword [esi]
mov dword [ebp - 0x20], esi
call dword [eax + 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.10064093
push ebx
push 0x80
push 3
push 1
push SysReAllocStringLen
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
lea edi, [ebp - 0x28]
call fcn.100280e5
cmp eax, ebx
jge 0x10063fbc
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x10014ac4
push eax
call fcn.10078ea6
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10028371
mov esi, 0x100187e8
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.1002a3dc
push 0x1009c2fc
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], esi
call fcn.10081847
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.1007924a
mov byte [ebp - 4], bl
cmp dword [ebp - 0x28], ebx
je 0x10063fe4
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.10064093
push ecx
mov byte [ebp - 4], 5
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
push ecx
call fcn.100580f9
lea eax, [ebp - 0x1c]
push eax
call fcn.10067166
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [esi]
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push ecx
mov ecx, esi
call dword [eax + 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.10067166
xor eax, eax
cmp dword [ebp - 0x14], ebx
setne al
cmp eax, ebx
jne 0x10064047
push 0x80004005
call fcn.100791b8
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.1007d19f
cmp eax, ebx
mov eax, dword [ebp - 0x14]
pop ecx
sete bl
pop ecx
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, bl
call fcn.10087296
ret
Function at 0x10086860
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
cmp edi, 8
mov dword [ebp - 0x50], eax
ja 0x10086895
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.1007eb10
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.10086960
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.10086750
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.10086960
xor eax, eax
push 0x40
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push eax
add esi, 0x28
push esi
call fcn.1007eb10
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b431
mov esp, ebp
pop ebp
ret 8
Function at 0x42c4b0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.0042c860
ret 0x18

Function at 0x42c740
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0xfffffff
imul eax, eax, 8
jo 0x42c760
test ecx, 0x10000000
je 0x42c75d
or eax, 0x80000000
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42c770
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0x3fffffff
imul eax, eax, 2
jo 0x42c79a
test ecx, 0x40000000
je 0x42c78d
or eax, 0x80000000
test ecx, 0x80000000
je 0x42c797
or al, 1
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]

Function at 0x42c7a0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, esi
and ecx, 0x3ffffff
imul ecx, ecx, 0x20
jo 0x42c7de
and eax, 0xf8000000
cdq
and edx, 0x7ffffff
add eax, edx
sar eax, 0x1b
and eax, 0x1f
or ecx, eax
test esi, 0x4000000
pop esi
je 0x42c7d9
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42c7f0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, eax
xor edx, ecx
jge 0x42c805
add eax, ecx
jo 0x42c816
ret 8
xor eax, 0x80000000
add eax, ecx
jo 0x42c816
xor eax, 0x80000000
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x42c820
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
mov eax, ebx
and ecx, 1
imul ecx, ecx, 0x40000000
jo 0x42c857
and al, 0xfc
cdq
and edx, 3
add eax, edx
sar eax, 2
and eax, 0x3fffffff
or ecx, eax
test bl, 2
pop ebx
je 0x42c852
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x408dc9
Capabilities:
Set socket configuration

Disassembly:
pop esi
xor eax, 0x1cac0002
and ebx, dword [esi + 4]
add byte [eax], al
dec ecx
cmp ecx, 1
ja 0x4090de
xor edx, edx
mov dl, byte [ecx - 0x7f2a24f0]
inc dword [eax - 0x6b]
pop ds
nop
inc eax
add byte [ebx - 0x2dd5f738], cl
mov ecx, dword [esi + 0x38]
and ecx, 2
cmp cl, 2
les edx, [edx + eax*8 + 0x2f74c23b]
mov ecx, dword [esi + 4]
lea eax, [ebp - 4]
dec edx
add al, 0x66
push 8
push 0xffff
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
sar eax, cl
dec ebx
test byte [edx + 2], ah
mov byte [0xfe45ed00], al
test esi, ebp
mov eax, dword [esi + 0x38]
je 0x408e3a
or al, 2
mov ecx, 0xc0333846
xor al, 0x8b
in eax, 0x5d
ret 0x6a
and al, 0x21
mov dword [esi + 0x38], ebp
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x8c
cmp al, 0xc0
mov edx, ebp
test byte [edi + ecx + 0x5f], dh
int3
je 0x4090f6
add byte [eax], al
add byte [esi - 0x57], bl
in eax, 0x5d
ret 0xc
mov edi, edi
jo 0x409089
inc eax
add byte [esi + 0x480218e7], ah
fild dword [eax]
add cl, byte [edi + 0x19770040]
sub al, byte [eax]
ficomp word [eax + eax*2]
add byte [ecx], al
sub dword [edx], eax
add al, 5
pop esp
xchg byte [0x5050d05], al
add eax, 0x8b550405
in al, dx
inc esi
in al, dx
sub al, 0x8b
push es
mov bh, 0x8b
dec ebp
or al, 0x56
push edx
push eax
lea edx, [ebp - 0x2c]
push ecx
invalid

Function at 0x40b540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
nop
jmp 0x40b498
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
nop
jmp 0x40b4b2
xor eax, eax
jmp 0x40b4c1
lodsb al, byte [esi]
nop
jmp 0x40b4cd
cmp al, 0x61
nop
jl 0x40b4ec
nop
jmp 0x40b4df
sub al, 0x20
nop
jmp 0x40b4ec
nop
jmp 0x40b4fb
ror edi, 0xd
add edi, eax
nop
dec ecx
jne 0x40b4a0
nop
push edx
push edi
nop
jmp 0x40b519
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
jmp 0x40b52a
add eax, edx
jmp 0x40b53b
mov eax, dword [eax + 0x78]
test eax, eax
je 0x40b6ee
add eax, edx
mov ecx, dword [eax + 0x18]
jmp 0x40b557
push eax
nop
mov ebx, dword [eax + 0x20]
and bl, ch
invalid
add ebx, edx
nop
jmp 0x40b57a
nop
test ecx, ecx
je 0x40b6de
add dword [eax], eax
invalid
nop
nop
xor edi, edi
nop
dec ecx
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
jmp 0x40b6ec
pop eax
nop
nop
jmp 0x40b6fe
pop edi
pop edx
mov edx, dword [edx]
nop
jmp 0x40b711
jmp 0x40b484