joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d8d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x43d8f1
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x43d8ea
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x43d905
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043d29c
test bl, bl
jne 0x43d9d8
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x51fc58
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43d93c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43d950
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043d7b0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x43d982
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x43d931
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43d9a5
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x43d9b6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43d9ca
jmp 0x43da93
cmp bl, 1
jne 0x43da93
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x51fcb2
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43d9f8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43da0c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043d7b0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x43da3e
sub ebx, 6
inc dword [ebp - 8]
jne 0x43d9ed
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x43da65
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x43da76
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x43da8a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043d320
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x43dfb0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x43e0ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
mov eax, 0x43e0c4
call fcn.0043e0cc
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404800
mov eax, dword [ebp - 8]
call fcn.004049f8
mov esi, eax
xor edx, edx
push ebp
push 0x43e08b
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x43e02a
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e095
mov eax, edi
call fcn.004049f8
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x43e05a
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e095
push esi
push 0xffffffffffffffff
push 0
call fcn.00406804
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x43e077
cmp eax, 5
jne 0x43e081
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e095
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e0b2
lea eax, [ebp - 8]
call fcn.00404538
ret

Function at 0x43e0cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43e146
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404538
mov eax, dword [ebp - 4]
call fcn.004047f8
mov esi, eax
test esi, esi
jle 0x43e130
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404720
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404800
inc dword [ebp - 8]
dec esi
jne 0x43e109
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e14d
lea eax, [ebp - 0xc]
call fcn.00404538
ret

Function at 0x43e224
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43e297
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404538
mov dword [ebp - 8], 0x1e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404b84
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004049f8
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x43e281
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e29e
lea eax, [ebp - 4]
call fcn.00404538
ret
Function at 0x43e2a4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd50
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404538
xor ecx, ecx
push ebp
push 0x43e381
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x290]
mov edx, esi
call fcn.00408798
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43e372
mov edx, dword [eax + 0xc]
test edx, edx
je 0x43e372
mov esi, dword [edx]
test esi, esi
je 0x43e372
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 0x29c], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x298], eax
mov byte [ebp - 0x294], 0
lea edx, [ebp - 0x2b0]
mov ecx, 3
mov eax, 0x43e39c
call fcn.00408d0c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e38b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e56c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
mov ebx, eax
mov edx, ebx
mov eax, 0x43e60c
call fcn.0043e0cc
xor edx, edx
push ebp
push 0x43e5f0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x43e5e1
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404730
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e5fa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43efdc
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f0d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004047f8
cmp eax, 2
jl 0x43f0bb
mov eax, ebx
call fcn.00408564
test al, al
je 0x43f0bb
lea ecx, [ebp - 8]
mov edx, 0x43f0f0
mov eax, ebx
call fcn.0043ef54
xor eax, eax
push ebp
push 0x43f0b1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004049f8
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43f0a7
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00408624
mov eax, dword [ebp - 0xc]
call fcn.004047f8
mov edi, eax
inc edi
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
call fcn.00404a50
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f0bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f0dd
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040455c
ret

Function at 0x43f200
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f2d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004047f8
cmp eax, 2
jl 0x43f2c0
xor eax, eax
push ebp
push 0x43f2b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, ebx
call fcn.004049f8
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x43f2ac
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00408624
mov eax, dword [ebp - 8]
call fcn.004047f8
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
call fcn.00404a50
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
call fcn.004049f8
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f2dd
lea eax, [ebp - 8]
call fcn.00404538
ret

Function at 0x43f3e4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.00404538
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x43f412
mov edx, ebx
lea eax, [esp + 4]
call fcn.00408868
add esp, 0x18
pop ebx
ret
Function at 0x43fcc4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43fd5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404538
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00406af8
test eax, eax
je 0x43fd41
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004047a8
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040c8dc
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.0040458c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fd61
lea eax, [ebp - 0x110]
call fcn.00404538
ret

Function at 0x43fd68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43fdfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 0x29
call fcn.0043fcc4
mov eax, dword [ebx]
call fcn.00408564
test al, al
jne 0x43fdc8
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jbe 0x43fdc8
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004047a8
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c8dc
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.0040458c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fe02
lea eax, [ebp - 0x10c]
call fcn.00404538
ret

Function at 0x43fe08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43fe9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 0x24
call fcn.0043fcc4
mov eax, dword [ebx]
call fcn.00408564
test al, al
jne 0x43fe68
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x43fe68
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004047a8
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c8dc
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.0040458c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fea2
lea eax, [ebp - 0x10c]
call fcn.00404538
ret

Function at 0x43fea8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ff20
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004047a8
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c8dc
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.0040458c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ff27
lea eax, [ebp - 0x10c]
call fcn.00404538
ret
Function at 0x440084
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x44008c
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4401e7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, 0x4401fc
call fcn.0043e0cc
mov eax, dword [ebp - 0x14]
call fcn.004049f8
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x4400df
mov dword [ebp - 4], 0xaacd2aec
lea edx, [ebp - 0x10]
mov eax, 0x440208
call fcn.0043e0cc
lea edx, [ebp - 0x18]
mov eax, 0x440214
call fcn.0043e0cc
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, 0x58
xor edx, edx
div ecx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.00408124
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
shr eax, 4
movzx eax, ax
mov edx, 4
call fcn.004080fc
push dword [ebp - 0x20]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shr eax, 4
call fcn.00406aa4
movzx eax, ax
lea ecx, [ebp - 0x24]
mov edx, 4
call fcn.004080fc
push dword [ebp - 0x24]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shr eax, 5
call fcn.00406aa4
movzx eax, ax
lea ecx, [ebp - 0x28]
mov edx, 4
call fcn.004080fc
push dword [ebp - 0x28]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shl eax, 6
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x2c]
mov eax, 8
call fcn.00408124
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 4]
shr eax, 5
movzx eax, ax
mov edx, 4
call fcn.004080fc
push dword [ebp - 0x30]
lea edx, [ebp - 0x34]
mov eax, 0x440220
call fcn.0043e0cc
push dword [ebp - 0x34]
mov eax, ebx
mov edx, 0xc
call fcn.004048b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4401ee
lea eax, [ebp - 0x34]
mov edx, 0xa
call fcn.0040455c
ret

Function at 0x4402ec
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.00403040
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00403040
mov dword [esp], 0x44
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x20
push 0
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x4403e0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4404d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edi
call fcn.00404538
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004049f8
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x44044d
lea eax, [ebp - 0x14]
call fcn.0043fc3c
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0040458c
jmp 0x4404b4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4403bc]
call fcn.004058e8
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jb 0x440488
inc eax
xor ecx, ecx
mov ebx, dword [ebp - 0x10]
add ebx, ecx
push ebx
mov bl, byte [edx]
xor bl, 0xff
pop edi
mov byte [edi], bl
inc edx
inc ecx
dec eax
jne 0x440475
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4404df
lea eax, [ebp - 0x14]
call fcn.00404538
lea eax, [ebp - 0x10]
mov edx, dword [0x4403bc]
call fcn.004058f4
ret

Function at 0x444954
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4449d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404538
mov eax, dword [ebp - 4]
call fcn.004047f8
mov esi, eax
test esi, esi
jle 0x4449bb
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404720
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404800
inc dword [ebp - 0xc]
dec esi
jne 0x444994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4449d8
lea eax, [ebp - 0x10]
call fcn.00404538
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x14cf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.014cf1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80