joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061a91
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10080378]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10061ad1
cmp byte [ebx], 0xa
jne 0x10061ad1
or byte [eax + edi + 0x28], 4
jmp 0x10061ad6
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10061bd4
mov al, byte [edx]
cmp al, 0x1a
je 0x10061bb6
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10061b05
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x10061b2a
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10061b34
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10061ae7
jmp 0x10061bd4
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10061bb1
cmp dword [ebp - 0xc], 0
je 0x10061bb1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10080378]
test byte [eax + edi + 0x28], 0x48
je 0x10061b8b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10061b76
mov byte [esi], dl
jmp 0x10061b87
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10080378]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10061bd4
cmp byte [ebp - 1], 0xa
jne 0x10061b9a
cmp esi, ebx
jne 0x10061b9a
mov byte [esi], 0xa
jmp 0x10061bd3
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1005f446
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10061bd4
mov byte [esi], 0xd
jmp 0x10061bd3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10080378]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10061bd0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10061bd4
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10061bdd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x10080378]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10061c20
cmp word [esi], dx
jne 0x10061c20
or byte [edi + eax + 0x28], 4
jmp 0x10061c25
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10061d5e
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10061d3e
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10061c67
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10061c9d
cmp eax, edx
jae 0x10061ca9
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x10061c3f
jmp 0x10061d5e
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10061d3a
cmp dword [ebp - 0x14], 0
je 0x10061d3a
mov eax, dword [ebx*4 + 0x10080378]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x10061d12
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x10061d58
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x10080378]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x10080378]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x10080378]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x10061d5b
pop ebx
cmp word [ebp - 4], bx
jne 0x10061d23
cmp esi, dword [ebp + 0xc]
jne 0x10061d23
mov word [esi], bx
jmp 0x10061d5b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1005f446
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10061d5e
push 0xd
jmp 0x10061d57
mov ecx, dword [ebx*4 + 0x10080378]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10061d55
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10061d5e
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10069934
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10069ad7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10069aac
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10069aac
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10069a5b
jg 0x1006998d
test eax, eax
je 0x10069a51
push 1
push 0x1000
call fcn.1005bc39
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100699b3
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x10069a48
push 0x8000
push ebx
call fcn.1006982e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100699df
jg 0x100699da
cmp ecx, 0x1000
jb 0x100699df
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10060564
add esp, 0x10
cmp eax, 0xffffffff
je 0x10069a24
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100699da
jl 0x10069a0b
test ecx, ecx
jne 0x100699cc
push dword [ebp - 0xc]
push ebx
call fcn.1006982e
push esi
call fcn.10058b27
add esp, 0xc
xor edi, edi
jmp 0x10069abd
cmp byte [edi + 0x24], 0
je 0x10069a3b
cmp dword [edi + 0x20], 5
jne 0x10069a3b
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10069a46
mov edi, dword [edi + 0x18]
jmp 0x10069a48
xor edi, edi
push esi
call fcn.10058b27
pop ecx
jmp 0x10069abd
test ecx, ecx
jg 0x10069a1d
jl 0x10069a5b
test eax, eax
jae 0x10069a1d
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005f446
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10069a7e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10069a1d
jmp 0x10069ab5
push ebx
call fcn.10051ff3
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10069a1d
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x10069abd
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10069aba
mov edi, dword [edi + 0x18]
jmp 0x10069abd
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1005f446
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x6e61e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x289000]
push edi
jmp 0x6e61fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6e6201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6e61f0
mov eax, 1
add ebx, ebx
jne 0x6e6213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6e6224
jne 0x6e6243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6e6243
dec eax
add ebx, ebx
jne 0x6e6230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6e6208
add ebx, ebx
jne 0x6e623f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6e6295
xor ecx, ecx
sub eax, 3
jb 0x6e625b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6e62ca
sar eax, 1
mov ebp, eax
jmp 0x6e6266
add ebx, ebx
jne 0x6e6266
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6e6234
inc ecx
add ebx, ebx
jne 0x6e6274
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6e6234
add ebx, ebx
jne 0x6e6281
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6e6276
jne 0x6e6292
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6e6276
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6e62b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6e62a6
jmp 0x6e61f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6e62b4
add edi, ecx
jmp 0x6e61f6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6e62d2
cmp byte [edi], 0x11
jne 0x6e62d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6e62d7
lea edi, [esi + 0x2df000]
mov eax, dword [edi]
or eax, eax
je 0x6e634f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4e9e58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4e9fd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6e6304
mov ecx, edi
jns 0x6e6333
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4e9fd8]
or eax, eax
je 0x6e6349
mov dword [ebx], eax
add ebx, 4
jmp 0x6e6321
call dword [esi + 0x4e9fe8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6e6380
cmp al, 0xef
ja 0x6e6373
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6e6355
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6e6362
mov ebp, dword [esi + 0x4e9fdc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6e63b4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x588218ec
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x7d072930
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4156cc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x415705
mov edx, 0
mov eax, 0
jmp 0x41573f
push 0x33
call 0x41570c
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret

Function at 0x415743
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x41577c
mov edx, 0
mov eax, 0
jmp 0x4157b4
push 0x33
call 0x415783
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4157ba
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x4157e7
mov eax, 0
jmp 0x41581c
push 0x33
call 0x4157ee
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x41594c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x41596d
jmp 0x415a0e
cmp dword [ebp + 8], 0
jne 0x415977
cmp dword [ebp + 0xc], 0
je 0x4159a1
cmp dword [ebp + 0x10], 0
jne 0x415987
cmp dword [ebp + 0x14], 0
je 0x4159a1
cmp dword [ebp + 0x18], 0
jne 0x415997
cmp dword [ebp + 0x1c], 0
je 0x4159a1
xor eax, eax
jmp 0x4159a6
mov eax, 1
test eax, eax
je 0x4159b3
jmp 0x415a0e
push 0x33
call 0x4159ba
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x18

Function at 0x416069
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x416096
mov eax, 0
jmp 0x4160c9
push 0x33
call 0x41609d
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4160eb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x416118
mov eax, 0
jmp 0x416160
mov dword [ebp - 4], 0
push 0x33
call 0x416126
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41619a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.00415535
and eax, 1
xor eax, 1
test eax, eax
je 0x4161e1
mov edx, 0
mov eax, 0
jmp 0x4162e3
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x33
call 0x416204
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x446470
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x70bc7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0070091b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4464f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.006fe86a
mov eax, dword [eax]
push 0xb15260
push eax
call fcn.006e4a84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00700ba6
test bl, bl
je 0x4464f2
push 0xb15260
lea ecx, [esp + 0xc]
call fcn.00700f36
push 0xb18db4
lea ecx, [esp + 0xc]
call fcn.00700f36
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44652e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00700ba6
jmp 0x4465f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA_1]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4465b2
lea edx, [esp + 0x7c]
push 0xb18db0
push edx
call fcn.006e4a84
add esp, 8
test eax, eax
je 0x4465b2
lea eax, [esp + 0x7c]
push 0xb18dac
push eax
call fcn.006e4a84
add esp, 8
test eax, eax
je 0x4465b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x446542
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00700ba6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x446df0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x446e52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc