joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441280
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x1007c
push edi
push esi
push ebx
call fcn.0049fe4c
xor edx, edx
sub esp, eax
xor eax, eax
mov word [esp + 0x70], ax
mov eax, dword [esp + 0x10090]
lea edi, [esp + 0x20]
mov word [esp + 0x20], dx
movzx ebp, byte [eax]
mov eax, ebp
test al, al
je 0x44132e
xor eax, eax
mov esi, ebp
mov ebp, eax
lea esi, [esi]
nop
mov eax, 0x28
lea ebx, [edi + ebp*2]
sub eax, ebp
cmp word [edi + ebp*2], 0
je 0x4412e4
lea esi, [esi]
add ebx, 2
sub eax, 1
cmp word [ebx], 0
jne 0x4412d8
test eax, eax
je 0x4af433
mov dword [esp], ebx
add ebp, 1
call sub.msvcrt.dll_wcslen
lea edx, [esp + 0x1e]
mov ecx, esi
mov byte [esp + 0x1f], 0
lea eax, [ebx + eax*2]
mov dword [esp + 8], 2
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 0x1e], cl
call sub.msvcrt.dll_mbstowcs
mov eax, dword [esp + 0x10090]
movzx esi, byte [eax + ebp]
mov eax, esi
test al, al
jne 0x4412c0
lea ebx, [esp + 0x70]
mov dword [esp + 8], 0x10000
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [eax - 1]
sub esp, 0xc
xor eax, eax
cmp edx, 0xffff
ja 0x44135f
mov dword [esp], ebx
call sub.msvcrt.dll__wcsdup
add esp, 0x1007c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x441370
Capabilities:
Set environment variable

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x7c
mov word [esp + 0x20], ax
mov eax, dword [esp + 0x90]
lea edi, [esp + 0x20]
movzx ebp, byte [eax]
mov eax, ebp
test al, al
je 0x44140e
xor eax, eax
mov esi, ebp
mov ebp, eax
lea esi, [esi]
nop
mov eax, 0x28
lea ebx, [edi + ebp*2]
sub eax, ebp
cmp word [edi + ebp*2], 0
je 0x4413c4
lea esi, [esi]
add ebx, 2
sub eax, 1
cmp word [ebx], 0
jne 0x4413b8
test eax, eax
je 0x4af438
mov dword [esp], ebx
add ebp, 1
call sub.msvcrt.dll_wcslen
lea ecx, [esp + 0x1e]
mov edx, esi
mov byte [esp + 0x1f], 0
lea eax, [ebx + eax*2]
mov dword [esp + 8], 2
mov dword [esp + 4], ecx
mov dword [esp], eax
mov byte [esp + 0x1e], dl
call sub.msvcrt.dll_mbstowcs
mov eax, dword [esp + 0x90]
movzx esi, byte [eax + ebp]
mov eax, esi
test al, al
jne 0x4413a0
mov eax, dword [esp + 0x94]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x458e00
Capabilities:
Set environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov dword [esp], str.NUITKA_ONEFILE_BINARY
mov ebx, dword [esp + 0xa0]
call fcn.00441280
test eax, eax
je 0x458f48
mov dword [esp], eax
mov edi, 0x4e
lea esi, [esp + 0x30]
mov ebp, 0x28
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.python39.dll_PyUnicode_FromWideChar]
mov ebx, eax
xor eax, eax
mov word [esp + 0x30], ax
mov dword [esp + 0x1c], ebx
mov ebx, edi
mov edi, esi
lea esi, [esi]
cmp word [edi], 0
mov eax, ebp
mov esi, edi
je 0x458e74
lea esi, [esi]
add esi, 2
sub eax, 1
cmp word [esi], 0
jne 0x458e68
test eax, eax
je 0x4af4c4
mov dword [esp], esi
add edi, 2
call sub.msvcrt.dll_wcslen
lea edx, [esp + 0x2e]
mov byte [esp + 0x2e], bl
lea eax, [esi + eax*2]
mov dword [esp + 8], 2
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
mov eax, 1
lea ecx, [ebp - 1]
sub eax, ebp
movzx ebx, byte [eax + 0x4b91a7]
test bl, bl
je 0x458ec8
mov ebp, ecx
jmp 0x458e58
lea eax, [esp + 0x30]
mov dword [esp + 4], 0
mov ebx, dword [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [sym.imp.python39.dll__PyRuntime]
mov esi, dword [0x4da13c]
sub esp, 8
mov edi, dword [eax + 0x118]
mov eax, dword [0x4db290]
test eax, eax
je 0x458fa0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00444c10
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp], edi
call fcn.00453e60
sub dword [esi], 1
jne 0x458f3a
mov edx, dword [esi + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call dword [edx + 0x18]
mov eax, dword [esp + 0x1c]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
test bl, bl
je 0x458f94
mov eax, dword [0x4dabd4]
mov esi, 0x4dabd4
test eax, eax
jne 0x458f3a
cmp byte [0x4dade2], 0
jne 0x458f6b
movzx eax, bl
call fcn.00425990
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x4dabe0
call dword [sym.imp.python39.dll_PyUnicode_FromWideChar]
mov dword [esi], eax
test eax, eax
je 0x458fc9
add dword [eax], 1
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4dabd0]
mov esi, 0x4dabd0
jmp 0x458f56
mov eax, dword [0x4db24c]
mov ebp, dword [0x4da134]
test eax, eax
je 0x458fd4
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00444c10
mov dword [0x4db290], eax
jmp 0x458f02
call dword [sym.imp.python39.dll_PyErr_Print]
call sub.msvcrt.dll_abort
mov dword [esp], 0x4b7342
call dword [sym.imp.python39.dll_PyImport_ImportModule]
mov dword [0x4db24c], eax
test eax, eax
je 0x4af4c4
jmp 0x458faf
Function at 0x497830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4dabc5], 0
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
je 0x4978b8
mov dword [esp + 4], 0x4ba84a
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x497930
mov ebx, dword [0x4dab24]
jmp 0x497874
lea ebx, [eax + ecx + 4]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax + 1]
mov ecx, dword [eax]
test edi, edi
jne 0x497870
lea ecx, [eax + 6]
movzx eax, word [eax + 4]
mov edx, ebp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004871a0
mov dword [esp + 8], 0xa
mov dword [esp + 4], 3
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax + 4]
sub esp, 4
mov dword [0x4dab24], eax
add eax, 8
mov ebx, dword [eax - 8]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0
mov dword [0x4dab24], eax
call fcn.00496d80
cmp eax, ebx
jne 0x49799f
mov byte [0x4dabc5], 1
jmp 0x497850
cmp byte [0x4dabc4], 0
jne 0x497868
mov ebx, dword [sym.imp.python39.dll_PyDict_New]
call ebx
mov dword [0x4db394], eax
call ebx
mov dword [0x4db390], eax
call ebx
mov dword [0x4db38c], eax
call ebx
mov dword [0x4db388], eax
call ebx
mov dword [0x4db384], eax
call ebx
mov dword [0x4db380], eax
call ebx
mov dword [0x4db37c], eax
call ebx
mov byte [0x4dabc4], 1
mov dword [0x4db378], eax
mov eax, dword [sym.imp.python39.dll__PyRuntime]
mov eax, dword [eax + 0x118]
mov eax, dword [eax + 8]
add eax, 0x754
mov dword [0x4dab20], eax
jmp 0x497868
mov dword [esp], str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort

Function at 0x49ee9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.004ae85c
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.004ae85c
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
Function at 0x49fa70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x49fa8f
mov eax, 0
jmp 0x49fad3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x49fab2
mov eax, 0
jmp 0x49fad3
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x49face
mov eax, 0
jmp 0x49fad3
mov eax, 1
leave
ret

Function at 0x49fad5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x49fb34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x49fb2c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x49fb2c
mov eax, dword [ebp - 4]
jmp 0x49fb48
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x49fb09
mov eax, 0
leave
ret
Function at 0x428370
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00428300
add esp, 4
test al, al
je 0x428389
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop esi
ret

Function at 0x428490
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], 0
je 0x428510
mov ecx, pe_nt_image_headers32
mov edi, 0x571be8
mov edx, 0x571be8
rep stosd dword es:[edi], eax
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4284c2
mov eax, dword [str.command.ln]
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x428510
lea ecx, [esp + 8]
push 0
push ecx
push 0x200
push 0x571be8
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x428520
Capabilities:
Delete file
Read file on windows

Disassembly:
push ecx
mov eax, dword [str.command.ln]
push esi
push eax
mov dword [esp + 8], 0
call fcn.00428300
add esp, 4
test al, al
jne 0x428543
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
xor eax, eax
push edi
mov ecx, pe_nt_image_headers32
mov edi, 0x571be8
push eax
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov ecx, dword [str.command.ln]
push 3
push eax
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
jne 0x42857e
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
lea edx, [esp + 4]
push 0
push edx
push 0x200
push 0x571be8
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [str.command.ln]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, 0x571be8
pop esi
pop ecx
ret

Function at 0x45cbe0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x47f670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x531d83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esp + 0x64], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea eax, [esp + 0x10]
mov byte [esp + 0x64], 2
push eax
push ebx
push str.localization.txt
push 0x555cb4
push str.global
call 0x452290
mov ecx, dword [str.global_]
mov edx, dword [0x555ca8]
mov ebp, eax
mov dword [esp + 0x30], ecx
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x34], edx
rep stosd dword es:[edi], eax
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x24]
not ecx
dec ecx
push eax
push str.____Localization:_I_see__d_localization_files_n
mov dword [esp + 0x30], ecx
call fcn.0044cf60
mov ecx, dword [esp + 0x2c]
push 0x47f650
push 4
push ecx
push ebp
call 0x51b1ec
mov eax, dword [esp + 0x3c]
add esp, 0x2c
xor edi, edi
cmp eax, ebx
jle 0x47f76a
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + edi*4]
lea edx, [esp + edx + 0x1c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x47f739
lea eax, [esp + 0x1c]
push eax
push str.____Localization:_reading_file__s_n
call fcn.0044cf60
add esp, 8
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call 0x47f7c0
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x47f72d
mov edx, dword [esp + 0x14]
mov eax, 0x555c3c
lea edx, [esp + edx + 0x1c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x47f779
lea eax, [esp + 0x1c]
push eax
push str.____Localization:_reading_file__s_n
call fcn.0044cf60
add esp, 8
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call 0x47f7c0
push ebp
call 0x4526b0
mov ecx, dword [esp + 0x60]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret

Function at 0x482e80
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
test eax, eax
mov dword [0x7fcfc8], eax
je 0x482ec7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x482ec2
mov ecx, dword [0x7fcfc8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x7fcfc8], 0
mov eax, 1
ret
mov eax, dword [0x7fcfc8]
xor edx, edx
test eax, eax
sete dl
mov eax, edx
ret

Function at 0x482ee0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x482f17
cmp dword [esp + 4], 5
jb 0x482f17
cmp dword [esp + 0x10], 2
jne 0x482f17
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x488b60
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x101c
call fcn.0051bfb0
mov ecx, dword [esp + 0x1020]
push ebx
push esi
lea eax, [esp + 0x102c]
push edi
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0051c159
lea eax, [esp + 0x34]
push eax
call 0x488c10
push 0x544de4
call 0x488c10
lea ecx, [esp + 0x3c]
push ecx
call 0x488d40
push 1
push 1
call fcn.00488b60
add esp, 0x20
push 1
call dword [sym.imp.WINMM.DLL_timeEndPeriod]
call 0x47ebe0
mov esi, dword [sym.imp.USER32.DLL_GetMessageA]
mov edi, dword [sym.imp.USER32.DLL_TranslateMessage]
mov ebx, dword [sym.imp.USER32.DLL_DispatchMessageA]
push 0
push 0
lea edx, [esp + 0x14]
push 0
push edx
call esi
test eax, eax
jne 0x481646
call 0x44d420
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
jmp 0x481630
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [0x7fec24], eax
mov eax, dword [0x7fec20]
cmp ecx, eax
je 0x488bda
mov edx, dword [0x7fe7a0]
mov dword [0x7fec20], ecx
test edx, edx
je 0x488bda
mov eax, ecx
sub eax, 0
je 0x488bd1
dec eax
je 0x488bae
dec eax
je 0x488ba4
mov dword [esp + 8], ecx
mov dword [esp + 4], str.Invalid_visLevel__d_sent_to_Sys_ShowConsole_n
jmp 0x4815c0
push 6
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
ret
push 1
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
mov ecx, dword [0x7fe7a4]
push 0xffff
push 0
push 0xb6
push ecx
call dword [sym.imp.USER32.DLL_SendMessageA]
ret
push 0
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
ret

Function at 0x489d20
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x7fec48]
test eax, eax
jne 0x489d65
mov eax, dword [0x7fec4c]
test eax, eax
jne 0x489d65
mov eax, dword [0xcbb62c]
push 0
push eax
push 0x489ae0
push 0xd
call dword [sym.imp.USER32.DLL_SetWindowsHookExA]
test eax, eax
mov dword [0x7fec3c], eax
je 0x489d5b
mov dword [0x7fec48], 1
ret
mov dword [0x7fec4c], 1
ret
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0x401910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401923
push esp
mov dword [ebp - 0x24], 0x401640
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019c2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019a3
pop ebp
ret 0x10
Function at 0x404735
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406928
call fcn.0040545b
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x4048ac
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x4048a5
cmp dword [ebx + edi*4], 0
je 0x404898
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404898
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x404892
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x404892
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00404698
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x404883
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x404883
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x404883
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x404883
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404a3b
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401780
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x40479b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.00405416
ret

Function at 0x404ace
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.00404972
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call fcn.00404735
test al, al
jne 0x404afd
xor eax, eax
inc eax
jmp 0x404b0c
push esi
call fcn.00404935
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10

Function at 0x411073
Capabilities:
Terminate process

Disassembly:
jmp 0x419e00
jmp fcn.0041acf0
cmp ecx, dword [0x424224]
jne 0x419e0a
repz ret
jmp 0x4111e5
Function at 0x608b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x323000
lea edi, [esi - 0x1b2000]
push edi
jmp 0x608b7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x608b81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x608b70
mov eax, 1
add ebx, ebx
jne 0x608b93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x608ba4
jne 0x608bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x608bc3
dec eax
add ebx, ebx
jne 0x608bb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x608b88
add ebx, ebx
jne 0x608bbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x608c15
xor ecx, ecx
sub eax, 3
jb 0x608bdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x608c4a
sar eax, 1
mov ebp, eax
jmp 0x608be6
add ebx, ebx
jne 0x608be6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x608bb4
inc ecx
add ebx, ebx
jne 0x608bf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x608bb4
add ebx, ebx
jne 0x608c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x608bf6
jne 0x608c12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x608bf6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x608c34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x608c26
jmp 0x608b76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x608c34
add edi, ecx
jmp 0x608b76
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x608c52
cmp byte [edi], 0x11
jne 0x608c52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x608c57
lea edi, [esi + 0x201000]
mov eax, dword [edi]
or eax, eax
je 0x608ccf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x337fa0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33811c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x608c84
mov ecx, edi
jns 0x608cb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x338120]
or eax, eax
je 0x608cc9
mov dword [ebx], eax
add ebx, 4
jmp 0x608ca1
call dword [esi + 0x338130]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x608d00
cmp al, 0xef
ja 0x608cf3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x608cd5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x608ce2
mov ebp, dword [esi + 0x338124]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x608d34
sub esp, 0xffffff80
jmp 0x427f4a