joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ad64f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 3
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x18], 1
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x100ca3c8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100ad6ac
jmp 0x100ad7ff
push dword [ebp + 8]
push 0x100ca418
push 0x103
lea eax, [ebp - 0x128]
push eax
call fcn.10007d4e
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100ad6f1
jmp 0x100ad7f6
mov dword [ebp - 0x18], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100ca428
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100ad729
jmp 0x100ad7ed
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x103
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.10072040
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100ca438
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100ad774
jmp 0x100ad7ed
cmp dword [ebp - 0x10], 1
jne 0x100ad7a4
push 0x100ca3c4
call fcn.1006f320
pop ecx
push eax
push 0x100ca448
lea eax, [ebp - 0x128]
push eax
call fcn.1007123f
add esp, 0xc
test eax, eax
jne 0x100ad7a4
and dword [ebp - 8], 0
jmp 0x100ad7ed
cmp dword [ebp - 0x10], 1
jne 0x100ad7d7
push 0x100ca44c
call fcn.1006f320
pop ecx
push eax
push 0x100ca450
lea eax, [ebp - 0x128]
push eax
call fcn.1007123f
add esp, 0xc
test eax, eax
je 0x100ad7d7
mov dword [ebp - 8], 2
jmp 0x100ad7ed
cmp dword [ebp - 0x10], 2
jne 0x100ad7e6
mov dword [ebp - 8], 1
jmp 0x100ad7ed
mov dword [ebp - 8], 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006f3c1
leave
ret
Function at 0x100adbcd
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100adbfd
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100adc1b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100adbf6
mov dword [ebp - 0x1c], 0xe3779b90
and dword [ebp - 8], 0
jmp 0x100adc2f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100adc8a
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x61c88647
mov dword [ebp - 0x1c], eax
jmp 0x100adc28
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret
Function at 0x100adca9
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100adcd9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100adcf7
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100adcd2
and dword [ebp - 0x1c], 0
and dword [ebp - 8], 0
jmp 0x100add08
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100add5f
mov eax, dword [ebp - 0x1c]
sub eax, 0x61c88647
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x100add01
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret

Function at 0x100aec15
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x5c
push 0
push dword [ebp + 8]
call fcn.10072040
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x58], 0
pop ebp
ret
Function at 0x100b1383
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5879
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x2c]
call fcn.100016b1
and dword [ebp - 4], 0
mov byte [ebp - 0x2d], 0
push 0x208
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.10072040
add esp, 0xc
push 1
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, 0x23
push eax
lea eax, [ebp - 0x23c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100b149d
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x258]
call fcn.100016da
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2c]
call fcn.10001773
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.10001748
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100b145f
push 0x100ca46c
lea ecx, [ebp - 0x2c]
call fcn.10004cd6
jmp 0x100b146c
push 0x100ca494
lea ecx, [ebp - 0x2c]
call fcn.10004cd6
lea eax, [ebp - 0x2c]
push eax
call fcn.100b0001
pop ecx
movzx eax, al
test eax, eax
jne 0x100b148c
lea eax, [ebp - 0x2c]
push eax
call fcn.100b0f38
pop ecx
mov byte [ebp - 0x2d], al
jmp 0x100b1490
mov byte [ebp - 0x2d], 1
push 0x100ca4b8
lea ecx, [ebp - 0x2c]
call fcn.10004cd6
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10001710
mov eax, dword [ebp - 0x25c]
or eax, 1
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10001748
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006f3c1
leave
ret
Function at 0x100b14de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b58a9
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 0x31], 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100b1383
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x30]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100b157b
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.100b1383
pop ecx
pop ecx
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x50]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50]
call fcn.10001748
cmp dword [ebp - 0x10], 0xffffffff
je 0x100b15ac
push 0
lea eax, [ebp - 0x54]
push eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b15a3
cmp dword [ebp - 0x54], 0x10
jne 0x100b15a3
mov byte [ebp - 0x31], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x55], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10001748
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006f3c1
leave
ret 4
Function at 0x100b15da
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b58d6
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov byte [ebp - 0x31], 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100b1383
pop ecx
pop ecx
and dword [ebp - 4], 0
or dword [ebp - 0x10], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x30]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100b16ce
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.100b1383
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
call fcn.100aec65
pop ecx
movzx eax, al
test eax, eax
jne 0x100b16a5
lea eax, [ebp - 0x50]
push eax
call fcn.100aec65
pop ecx
movzx eax, al
test eax, eax
je 0x100b16a5
push 0
lea ecx, [ebp - 0x30]
call fcn.10004d5d
push eax
lea ecx, [ebp - 0x50]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100b16a5
lea ecx, [ebp - 0x50]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x50]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50]
call fcn.10001748
cmp dword [ebp - 0x10], 0xffffffff
je 0x100b171c
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x10
jb 0x100b1713
cmp dword [ebp - 0x54], 0xffffffff
je 0x100b1713
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b1713
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x54]
jne 0x100b1713
mov byte [ebp - 0x31], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x59], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10001748
mov al, byte [ebp - 0x59]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006f3c1
leave
ret 4
Function at 0x100b1da5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x100fd7e0]
and eax, 1
jne 0x100b1deb
mov eax, dword [0x100fd7e0]
or eax, 1
mov dword [0x100fd7e0], eax
mov ecx, 0x100fd7dc
call fcn.10003b59
push 0x100bb61f
call fcn.1006f92b
pop ecx
mov ecx, 0x100fd7dc
call fcn.1002fdd6
movzx eax, al
test eax, eax
je 0x100b1e3e
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10072040
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x100fd7dc
call fcn.10003c10
push 0x100fd7dc
mov ecx, dword [ebp + 8]
call fcn.10003b73
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f3c1
leave
ret

Function at 0x100b1e69
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x100fd7e8]
and eax, 1
jne 0x100b1eaf
mov eax, dword [0x100fd7e8]
or eax, 1
mov dword [0x100fd7e8], eax
mov ecx, 0x100fd7e4
call fcn.10003b59
push 0x100bb610
call fcn.1006f92b
pop ecx
mov ecx, 0x100fd7e4
call fcn.1002fdd6
movzx eax, al
test eax, eax
je 0x100b1f02
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10072040
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x100fd7e4
call fcn.10003c10
push 0x100fd7e4
mov ecx, dword [ebp + 8]
call fcn.10003b73
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f3c1
leave
ret
Function at 0x100b2328
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10001898
movzx eax, al
test eax, eax
jne 0x100b2357
push 4
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
leave
ret 4
Function at 0x10250284
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esp + 0x30], ebx
pushfd
push 0x7e7dcae1
pushfd
lea esp, [esp + 0x18]
jbe 0x10263603
push 0xfdd39e8f
jmp fcn.1005ad15

Function at 0x1025a1f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1026d7ed
lea esp, [esp + 8]
je 0x1025b62e
pushfd
jmp 0x10255621
jmp 0x1026d6a2
push edi
pushal
mov word [esp + 0x97a], 0x77
pushfd
jmp 0x102461b1
inc dword [esp + 0x18]
push dword [esp]
pushal
cmp dword [esp + 0x3c], 0xe
mov byte [esp], 0xee
lea esp, [esp + 0x28]
jb 0x1025f6bf
call fcn.1025a8b6
mov word [esp + 0x9cc], si
lea esp, [esp + 0x78]
jl 0x1026150f
pushal
pushal
push dword [esp]
mov word [esp + 0x99a], 0x77
jmp 0x10258a04

Function at 0x10263f88
Capabilities:
Enumerate processes

Disassembly:
call fcn.1025bf42
mov word [esp + 0x844], 0x44
call fcn.1024e35c
call fcn.10264741
Function at 0x41b64b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41b68a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b68a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b68a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41b68a
cmp dword [ecx + 0x74], 0xe
jbe 0x41b68a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x422deb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x422e88
push ebx
push esi
call fcn.00422db4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00422d48
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x422e35
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x422e87
push edi
push eax
call fcn.00421880
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x422e55
call fcn.004218ce
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x422e86
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00422d48
add esp, 0x20
test eax, eax
jne 0x422e74
push edi
call fcn.004218ce
jmp 0x422e7c
push ebx
call fcn.004218ce
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x424097
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c9a0
push 0x42c998
push str.FlsAlloc
push 0x1f
call fcn.00423f56
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4240cb
push dword [ebp + 8]
mov ecx, esi
call dword [0x42a144]
call esi
jmp 0x4240d1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x424115
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c9b0
push 0x42c9a8
push str.FlsGetValue
push 0x21
call fcn.00423f56
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42414c
push dword [ebp + 8]
mov ecx, esi
call dword [0x42a144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x424154
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c9b8
push 0x42c9b0
push str.FlsSetValue
push 0x22
call fcn.00423f56
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42418e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42a144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x429460
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42948d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42948d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x424bfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004248ad

Function at 0x424c07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424a37
Function at 0x4268d4
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x28
lahf
pop ss
hlt
pop esi
sar dword [edx], cl
jecxz 0x426838
cdq
insd dword es:[edi], dx
loope 0x42689d
xor eax, 0xa8c687c4
invalid
pop ss
js 0x426913
ret
mov ch, 0xfa
sal esp, 1
sub al, dh
in eax, 0xb5
in eax, dx
xchg ecx, eax
fsubp st(2)
and esi, dword [ebx + 0x5cc2e08a]
mov dh, 0xf9
outsd dx, dword [esi]
aas
mov word [ebx + 0x3c], ss
or esp, ebx
inc edi
int3
jo 0x4268a1
push ebx
adc al, 0xd8
invalid
invalid
invalid

Function at 0x43a590
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
mov al, 0xc4
add bh, bl
add eax, 0x204bd45f
lahf
insd dword es:[edi], dx
out dx, eax
and dword [edx - 0xd8ba089], ebp
and byte [edx], bh
or al, 0x77
test dh, 0x9b
or eax, 0x2e9345d8
push es
push 3
mov esp, 0x8e4b75bd
mov al, byte [0xbd55217f]
fidivr dword [ecx]
cmpsd dword [esi], dword es:[edi]
adc eax, 0x456a92f5
push cs
xor bl, bh
or ecx, dword [ebx]
dec ebp
pop ds
imul ecx, dword [edx], 0xffffff91
mov al, byte [0x6b19a970]
scasd eax, dword es:[edi]
sar ebp, 0xac
inc edx
dec esi
pop ds
fistp qword [ebp - 0x6575783c]
mov edi, 0xc2a0d9f
in eax, 0x1e
mov esi, 0x76c1d04b
out 0xfa, al
rdtsc
aam 0x61
mov al, 0x65
fmul dword [ecx - 0x202280aa]
xor dword [edi - 0x71], ecx
jnp 0x43a5c5
dec edi
push edx
cmp dl, al
inc edi
pop eax
add esi, esi
and byte [esi + 0xeb20977], dh
push edx
xor bh, cl
mov ebx, 0xb2d2b0a2
outsd dx, dword [esi]
pop esp
sahf
in al, dx
sbb esp, ebx
mov eax, dword [0x1f2d2184]
bound esp, qword [edi + ecx]
lcall 0x7a6e, 0xa25ffa3c
mov bh, 0x41
aas
aaa
into
add byte [ebp - 0x42], 0x4f
mov dword [0xb3bf9b2f], eax
fldcw word [ecx - 0x57426b2a]
fcomp qword es:[ecx]
adc dword [ecx + 0x5d1413a1], 0xffffffaa
xchg ecx, eax
test al, 0xed
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
xor bh, dl
inc ebx
invalid

Function at 0x43ad0a
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x3f1d5c5c
dec esi
push ds
or cl, cl
pop ebp
cmp esi, dword [ebx]
or dword [0x3a60c90f], 0xffffffc3
invalid
invalid
inc eax