joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40720c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x407250
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00403cec
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x407250
cmp dword [esp + 4], 4
je 0x407255
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x407260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00403cec
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete al
pop ebp
ret

Function at 0x407384
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x4073b1
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403cec
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4073b5
xor eax, eax
jmp 0x4073b7
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4096f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0040b080
test eax, eax
je 0x409717
cmp ebx, dword [eax + 0xf2]
jne 0x409717
xor edx, edx
mov dword [eax + 0xf2], edx
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x409726
push 0
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.00405640
test byte [ebx + 0x35], 8
jne 0x40982a
or byte [ebx + 0x35], 8
test byte [ebx + 0x39], 0x20
je 0x409750
mov eax, dword [ebx + 0xea]
call fcn.00402510
and byte [ebx + 0x39], 0xdf
mov eax, dword [ebx + 0xca]
call fcn.00405604
xor eax, eax
mov dword [ebx + 0xca], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40979c
mov esi, eax
mov eax, dword [ebx + 0xfe]
test eax, eax
je 0x409787
cmp eax, 0xffffffff
je 0x409787
test byte [ebx + 0x34], 4
jne 0x409787
push eax
call sub.user32.dll_DestroyIcon
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x409797
push esi
call sub.user32.dll_DestroyWindow
xor eax, eax
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0xe6]
test eax, eax
je 0x4097ab
call fcn.00402510
xor eax, eax
mov dword [ebx + 0xe6], eax
mov eax, dword [ebx + 0xee]
call fcn.00405604
xor eax, eax
mov dword [ebx + 0xee], eax
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4097d3
push eax
call sub.gdi32.dll_DeleteObject
xor eax, eax
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0xe2]
call fcn.0040388c
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x409813
mov edx, ebx
mov eax, dword [eax + 0x44]
call fcn.004058c8
mov edx, ebx
mov eax, dword [ebx + 0x30]
call fcn.00405730
mov eax, dword [ebx + 0x30]
mov edx, dword [eax + 0xf2]
cmp edx, ebx
jne 0x409813
xor edx, edx
mov dword [eax + 0xf2], edx
mov eax, dword [ebx + 0x44]
call fcn.00405604
mov eax, dword [ebx + 0x40]
call fcn.00405604
mov eax, ebx
call fcn.00405628
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x40a60c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
and dword [ebx + 0x24], 0xefffffff
test dl, dl
je 0x40a621
or dword [ebx + 0x24], 0x10000000
cmp dword [ebx + 0x1c], 0
je 0x40a657
test dl, dl
je 0x40a640
mov eax, ebx
call dword [0x474148]
push 5
mov eax, dword [ebx + 0x1c]
push eax
call sub.user32.dll_ShowWindow
jmp 0x40a657
and byte [ebx + 0x37], 0xfe
push 0
mov eax, dword [ebx + 0x1c]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call dword [0x474148]
pop ebx
ret
Function at 0x40e6b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40e72b
call sub.user32.dll_EmptyClipboard
mov eax, edi
xor edx, edx
call fcn.00403ff4
je 0x40e724
mov eax, edi
call fcn.00403fe8
inc eax
add eax, eax
push eax
push 0x2000
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
test esi, esi
je 0x40e726
push esi
call sub.kernel32.dll_GlobalLock
mov ebx, eax
mov eax, edi
call fcn.00403fe8
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00403fd8
mov edx, ebx
pop ecx
call fcn.00402614
push esi
call sub.kernel32.dll_GlobalUnlock
push esi
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
jmp 0x40e726
mov bl, 1
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40eb28
Capabilities:
Check os version

Disassembly:
push ebx
push esi
cmp byte [0x474334], 0xff
je 0x40eb3b
mov al, byte [0x474334]
pop esi
pop ebx
ret
call sub.kernel32.dll_GetVersion_1
mov esi, eax
mov ebx, esi
mov eax, esi
call fcn.00405010
mov edx, eax
test esi, esi
jl 0x40eb7e
mov al, 4
cmp bl, 6
jb 0x40eb65
cmp dl, 1
jb 0x40eb61
mov al, 9
jmp 0x40eba6
mov al, 8
jmp 0x40eba6
cmp bl, 5
jb 0x40eba6
cmp dl, 1
jb 0x40eb7a
mov al, 6
cmp dl, 2
jb 0x40eba6
mov al, 7
jmp 0x40eba6
mov al, 5
jmp 0x40eba6
mov al, 1
cmp bl, 4
ja 0x40eb8f
cmp bl, 4
jne 0x40eb9f
cmp dl, 0xa
jb 0x40eb9f
mov al, 2
cmp bl, 4
jne 0x40eba6
cmp dl, 0x5a
jb 0x40eba6
mov al, 3
jmp 0x40eba6
cmp bl, 3
ja 0x40eba6
xor eax, eax
mov byte [0x474334], al
pop esi
pop ebx
ret
Function at 0x40f51c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cdc
mov eax, dword [ebp - 8]
call fcn.00403cdc
xor eax, eax
push ebp
push 0x40f669
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x40f5aa
mov edx, dword [ebp - 4]
mov eax, 0x40f684
call fcn.00403dd4
test eax, eax
jle 0x40f5aa
mov edx, dword [ebp - 4]
mov eax, 0x40f684
call fcn.00403dd4
mov esi, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403aec
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00403d4c
lea eax, [ebp - 4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403d4c
test bl, bl
je 0x40f5b5
mov esi, 5
jmp 0x40f5b7
xor esi, esi
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x40f5d6
lea eax, [ebp - 0xc]
mov edx, 0x40f68c
call fcn.00403f10
mov eax, dword [ebp - 0xc]
call fcn.00403fd8
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00403fc8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00403fc8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402738
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x10]
call fcn.00403fd8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
call fcn.00403fd8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x40f63f
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcessId
mov ebx, eax
jmp 0x40f641
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f670
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403ec8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004038b0
ret

Function at 0x4159f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040388c
cmp dword [ebx], 0
mov byte [ebp - 0x105], 0
lea eax, [ebp - 0x105]
push eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x415a3d
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403ac0
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x415c5c
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
call sub.kernel32.dll_GetVersion_1
mov esi, eax
mov ebx, esi
mov eax, esi
call fcn.00405010
mov byte [esp], al
test esi, esi
jl 0x415d37
mov eax, edi
mov edx, 0x415d98
call fcn.004038e0
cmp bl, 8
jb 0x415c9f
mov eax, edi
mov edx, 0x415da4
call fcn.004038e0
jmp 0x415d89
cmp bl, 6
jb 0x415cfa
cmp byte [esp], 3
jb 0x415cbb
mov eax, edi
mov edx, 0x415db4
call fcn.004038e0
jmp 0x415d89
cmp byte [esp], 2
jb 0x415cd2
mov eax, edi
mov edx, 0x415dc4
call fcn.004038e0
jmp 0x415d89
cmp byte [esp], 1
jb 0x415ce9
mov eax, edi
mov edx, 0x415dd4
call fcn.004038e0
jmp 0x415d89
mov eax, edi
mov edx, 0x415de4
call fcn.004038e0
jmp 0x415d89
cmp bl, 5
jb 0x415d89
cmp byte [esp], 1
jb 0x415d29
mov eax, edi
mov edx, 0x415df4
call fcn.004038e0
cmp byte [esp], 2
jb 0x415d89
mov eax, edi
mov edx, 0x415e00
call fcn.004038e0
jmp 0x415d89
mov eax, edi
mov edx, 0x415e14
call fcn.004038e0
jmp 0x415d89
mov eax, edi
mov edx, 0x415e28
call fcn.004038e0
cmp bl, 4
ja 0x415d53
cmp bl, 4
jne 0x415d78
cmp byte [esp], 0xa
jb 0x415d78
mov eax, edi
mov edx, 0x415e38
call fcn.004038e0
cmp bl, 4
jne 0x415d89
cmp byte [esp], 0x5a
jb 0x415d89
mov eax, edi
mov edx, 0x415e48
call fcn.004038e0
jmp 0x415d89
cmp bl, 3
ja 0x415d89
mov eax, edi
mov edx, 0x415e58
call fcn.004038e0
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x415e90
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov byte [esp], 0
push 0x400
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00403cec
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, esi
mov edx, esp
mov ecx, 0x400
call fcn.00403ac0
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x437da0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor edx, edx
test dl, dl
mov ecx, eax
dec ecx
sub ecx, 2
jb 0x437db4
sub ecx, 3
jb 0x437db8
jmp 0x437dc7
mov ebx, eax
jmp 0x437dbb
lea ebx, [eax + 1]
push ebx
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl dl
mov eax, edx
pop ebx
ret

Function at 0x43aa5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43ad09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea eax, [ebx + 0x38]
call fcn.0040388c
mov byte [ebx + 0x3c], 0
mov byte [ebx + 0x3d], 0
mov byte [ebx + 0x3e], 0
mov byte [ebx + 0x3f], 0
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x41], 0
cmp si, 0x41
jb 0x43aaaf
cmp si, 0x5a
jbe 0x43aacd
cmp si, 0x30
jb 0x43aabb
cmp si, 0x39
jbe 0x43aacd
cmp si, 8
je 0x43aacd
cmp si, 0xd
je 0x43aacd
cmp si, 0x20
jne 0x43aae4
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403a74
mov ecx, dword [ebp - 4]
lea eax, [ebx + 0x38]
xor edx, edx
call fcn.00403b38
test si, si
jne 0x43aaf1
lea eax, [ebx + 0x38]
call fcn.0040388c
movzx eax, si
cmp eax, 0xba
jg 0x43abac
je case.0x43ab11.58
add eax, 0xffffffc6
cmp eax, 0x24
ja case.0x43ab11.59
jmp dword [eax*4 + 0x43ab18]
cmp eax, 0xdb
jg 0x43abd4
je case.0x43ab11.91
sub eax, 0xbc
je case.0x43ab11.60
sub eax, 2
je case.0x43ab11.62
dec eax
je case.0x43ab11.63
dec eax
je case.0x43ab11.64
jmp case.0x43ab11.59
sub eax, 0xdc
je case.0x43ab11.92
dec eax
je case.0x43ab11.93
dec eax
je case.0x43ab11.94
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad20
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad2c
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad38
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad44
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad50
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad5c
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad68
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad74
call fcn.004038e0
xor esi, esi
jmp case.0x43ab11.59
lea eax, [ebx + 0x38]
mov edx, 0x43ad80
call fcn.004038e0
xor esi, esi
mov eax, esi
and eax, 0xff
xor edx, edx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], edx
push 0x14
call sub.user32.dll_GetKeyState
test al, 1
setne al
mov byte [ebx + 0x3d], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setl al
mov byte [ebx + 0x3e], al
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
setl al
mov byte [ebx + 0x3f], al
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
setl al
mov byte [ebx + 0x40], al
push 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x43acee
push 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x43acee
xor eax, eax
jmp 0x43acf0
mov al, 1
mov byte [ebx + 0x41], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ad10
lea eax, [ebp - 4]
call fcn.0040388c
ret
Function at 0x43ad84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ae87
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
lea eax, [esi + 0x38]
call fcn.0040388c
mov byte [esi + 0x3c], 0
mov byte [esi + 0x3d], 0
mov byte [esi + 0x3e], 0
mov byte [esi + 0x3f], 0
mov byte [esi + 0x40], 0
mov byte [esi + 0x41], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00403a74
mov ecx, dword [ebp - 4]
lea eax, [esi + 0x38]
xor edx, edx
call fcn.00403b38
xor eax, eax
mov al, bl
xor edx, edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
mov byte [esi + 0x3d], 0
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setl al
mov byte [esi + 0x3e], al
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
setl al
mov byte [esi + 0x3f], al
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
setl al
mov byte [esi + 0x40], al
push 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x43ae3e
push 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x43ae3e
xor eax, eax
jmp 0x43ae40
mov al, 1
mov byte [esi + 0x41], al
cmp byte [esi + 0x3f], 0
je 0x43ae71
cmp byte [esi + 0x40], 0
je 0x43ae71
push 0xa2
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ae71
push 0xa5
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ae71
mov byte [esi + 0x3f], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ae8e
lea eax, [ebp - 4]
call fcn.0040388c
ret
Function at 0x443524
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x443594
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040388c
cmp dword [ebp - 4], 0
xor ebx, ebx
test ebx, ebx
lea ecx, [ebp - 8]
xor edx, edx
mov eax, esi
call fcn.00470874
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4435ac
call fcn.00403b38
mov eax, dword [ebp - 4]
call fcn.00403cec
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44359b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004038b0
ret

Function at 0x447580
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x447664
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x117], 0
push 0
lea eax, [ebp - 0x117]
push eax
push 0x109
push 0x73
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x117]
mov ecx, 0x10f
call fcn.00403ac0
mov eax, dword [ebp - 0x11c]
call fcn.00473124
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x117]
mov ecx, 0x10f
call fcn.00403ac0
cmp dword [ebp - 0x120], 0
je 0x447627
mov eax, 0x447678
call fcn.00473124
mov byte [ebp - 0x117], 0
push 3
lea eax, [ebp - 0x117]
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
mov dword [ebp - 4], 1
and ebx, 0xffffff
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
call sub.user32.dll_SetSysColors
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44766b
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.004038b0
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0xc36ea4
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36ea4
ret
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x204
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x1f8
lea eax, [esp + 0x12]
push ebx
push eax
mov word [esp + 0x18], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
xor eax, eax
push ebx
mov ecx, 0x7e
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push 0x1f6
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 1
lea edx, [esp + 0xe]
lea eax, [ecx - 1]
cmp eax, 0x19
jl 0x401074
cmp eax, 0x23
jle 0x4010b3
cmp eax, 0x37
jl 0x40107e
cmp eax, 0x41
jle 0x4010b3
cmp eax, 0x56
jl 0x401088
cmp eax, 0x60
jle 0x4010b3
cmp eax, 0x7f
jl 0x401094
cmp eax, 0x89
jle 0x4010b3
cmp eax, 0xc1
jl 0x4010a2
cmp eax, 0xcb
jle 0x4010b3
lea eax, [ecx - 0xef]
cmp eax, 0xa
jbe 0x4010b3
movzx eax, word [edx - 2]
add ebx, eax
cmp ecx, 0x19
jl 0x4010bd
cmp ecx, 0x23
jle 0x401103
cmp ecx, 0x37
jl 0x4010c7
cmp ecx, 0x41
jle 0x401103
cmp ecx, 0x56
jl 0x4010d1
cmp ecx, 0x60
jle 0x401103
cmp ecx, 0x7f
jl 0x4010de
cmp ecx, 0x89
jle 0x401103
cmp ecx, 0xc1
jl 0x4010ee
cmp ecx, 0xcb
jle 0x401103
cmp ecx, 0xee
jl 0x4010fe
cmp ecx, 0xf8
jle 0x401103
movzx eax, word [edx]
add ebx, eax
lea eax, [ecx + 1]
cmp eax, 0x19
jl 0x401110
cmp eax, 0x23
jle 0x401152
cmp eax, 0x37
jl 0x40111a
cmp eax, 0x41
jle 0x401152
cmp eax, 0x56
jl 0x401124
cmp eax, 0x60
jle 0x401152
cmp eax, 0x7f
jl 0x401130
cmp eax, 0x89
jle 0x401152
cmp eax, 0xc1
jl 0x40113e
cmp eax, 0xcb
jle 0x401152
cmp eax, 0xee
jl 0x40114c
cmp eax, 0xf8
jle 0x401152
movzx eax, word [edx + 2]
add ebx, eax
lea eax, [ecx + 2]
cmp eax, 0x19
jl 0x40115f
cmp eax, 0x23
jle 0x4011a1
cmp eax, 0x37
jl 0x401169
cmp eax, 0x41
jle 0x4011a1
cmp eax, 0x56
jl 0x401173
cmp eax, 0x60
jle 0x4011a1
cmp eax, 0x7f
jl 0x40117f
cmp eax, 0x89
jle 0x4011a1
cmp eax, 0xc1
jl 0x40118d
cmp eax, 0xcb
jle 0x4011a1
cmp eax, 0xee
jl 0x40119b
cmp eax, 0xf8
jle 0x4011a1
movzx eax, word [edx + 4]
add ebx, eax
lea eax, [ecx + 3]
cmp eax, 0x19
jl 0x4011ae
cmp eax, 0x23
jle 0x4011f0
cmp eax, 0x37
jl 0x4011b8
cmp eax, 0x41
jle 0x4011f0
cmp eax, 0x56
jl 0x4011c2
cmp eax, 0x60
jle 0x4011f0
cmp eax, 0x7f
jl 0x4011ce
cmp eax, 0x89
jle 0x4011f0
cmp eax, 0xc1
jl 0x4011dc
cmp eax, 0xcb
jle 0x4011f0
cmp eax, 0xee
jl 0x4011ea
cmp eax, 0xf8
jle 0x4011f0
movzx eax, word [edx + 6]
add ebx, eax
lea eax, [ecx + 4]
cmp eax, 0x19
jl 0x4011fd
cmp eax, 0x23
jle 0x40123f
cmp eax, 0x37
jl 0x401207
cmp eax, 0x41
jle 0x40123f
cmp eax, 0x56
jl 0x401211
cmp eax, 0x60
jle 0x40123f
cmp eax, 0x7f
jl 0x40121d
cmp eax, 0x89
jle 0x40123f
cmp eax, 0xc1
jl 0x40122b
cmp eax, 0xcb
jle 0x40123f
cmp eax, 0xee
jl 0x401239
cmp eax, 0xf8
jle 0x40123f
movzx eax, word [edx + 8]
add ebx, eax
add ecx, 6
lea eax, [ecx - 1]
add edx, 0xc
cmp eax, 0xfb
jle 0x401067
mov ecx, dword [esp + 0x208]
mov eax, ebx
sub eax, 0x3dcc
neg eax
pop edi
sbb eax, eax
pop ebx
xor ecx, esp
call fcn.00405260
add esp, 0x204
ret
Function at 0x404a70
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x4086b4]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x208
push 8
push eax
call edi
mov ecx, dword [0x4086b4]
push 0x190
push 8
push ecx
mov esi, eax
call edi
push 0x102
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esp + 0x14], eax
lea esp, [esp]
lea edx, [esp + 0x18]
push edx
push 0x102
push edi
push esi
call ebx
push edi
call ebp
cmp eax, 2
jne 0x404add
mov ecx, edi
call fcn.00404b20
mov eax, dword [esp + 0x14]
push 0x102
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x404ac0
mov ecx, dword [0x4086b4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
push ecx
call esi
mov edx, dword [0x4086b4]
push edi
push 0
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret