joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002809
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1002724c
call fcn.10011854
sub esp, 0x428
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.1001e28c
push 0x100387a8
push str.software_
lea ecx, [ebp + 8]
call fcn.1001cc39
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x100029cd
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push esi
push eax
mov dword [ebp - 0x10], ebx
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x100029cd
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x227]
mov byte [ebp - 0x228], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x32b]
mov byte [ebp - 0x32c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
mov dword [ebp - 0x20], esi
push eax
lea eax, [ebp - 0x228]
push str.SOFTWAREClassesCLSID_sInprocServer32
push eax
mov dword [ebp - 0x1c], 1
call fcn.100119ad
add esp, 0xc
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push eax
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x228]
push 0x100387a8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x1000294a
lea eax, [ebp - 0x434]
push ebx
push eax
push ebx
lea eax, [ebp - 0x32c]
push ebx
push eax
call fcn.10012563
lea eax, [ebp - 0x434]
push eax
call fcn.1001c932
push eax
push dword [ebp + 8]
call fcn.100124b4
add esp, 0x20
test eax, eax
je 0x1000296e
inc dword [ebp - 0x10]
push esi
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.10011a00
add esp, 0xc
lea eax, [ebp - 0x124]
push esi
push eax
push dword [ebp - 0x10]
jmp 0x10002887
push 4
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_s
push eax
call fcn.100119ad
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x228]
push str.Flags
push eax
push SysReAllocString
call edi
test eax, eax
je 0x100029be
mov dword [ebp - 0x14], 1
jmp 0x100029cd
xor eax, eax
cmp dword [ebp - 0x10], 0x400
sete al
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1001dd8a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100029f4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1002727f
call fcn.10011854
sub esp, 0x42c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x24], ebx
mov eax, dword [0x10034f94]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.1001e28c
push 0x100387a8
push str.software_
lea ecx, [ebp + 0xc]
call fcn.1001cc39
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10002bc6
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x128]
push esi
push eax
mov dword [ebp - 0x14], ebx
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x10002bc6
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x22b]
mov byte [ebp - 0x22c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x32f]
mov byte [ebp - 0x330], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], esi
push eax
lea eax, [ebp - 0x22c]
push str.SOFTWAREClassesCLSID_sInprocServer32
push eax
mov dword [ebp - 0x20], 1
call fcn.100119ad
add esp, 0xc
lea eax, [ebp - 0x1c]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x22c]
push 0x100387a8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x10002b45
lea eax, [ebp - 0x438]
push ebx
push eax
push ebx
lea eax, [ebp - 0x330]
push ebx
push eax
call fcn.10012563
lea eax, [ebp - 0x438]
push eax
call fcn.1001c932
push eax
push dword [ebp + 0xc]
call fcn.100124b4
add esp, 0x20
test eax, eax
je 0x10002b69
inc dword [ebp - 0x14]
push esi
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.10011a00
add esp, 0xc
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp - 0x14]
jmp 0x10002a82
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x22c]
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_s
push eax
call fcn.100119ad
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x22c]
push str.Flags
push eax
push SysReAllocString
call edi
test eax, eax
je 0x10002bb7
push str.ERROR
jmp 0x10002bbe
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x10]
call fcn.1001df13
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.1001daff
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1001dd8a
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.1001dd8a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10002eff
Capabilities:
Get common file path

Disassembly:
mov ecx, 0x100387cc
jmp fcn.10002e41

Function at 0x10005395
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor eax, eax
mov edi, ecx
cmp dword [ebp + 8], eax
mov dword [ebp - 8], edi
je 0x10005430
cmp dword [ebp + 0xc], eax
je 0x10005430
push ebx
mov esi, 0x200
push 0x201
mov ebx, esi
call fcn.1001e2ee
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
pop ecx
jne 0x100053d3
mov eax, 0x100387a8
push dword [edi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push dword [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
inc eax
cmp eax, esi
jb 0x1000542a
push dword [ebp - 4]
add ebx, esi
call fcn.1001e317
lea eax, [ebx + 1]
push eax
call fcn.1001e2ee
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
pop ecx
test eax, eax
pop ecx
jne 0x10005412
mov eax, 0x100387a8
mov ecx, dword [ebp - 8]
push dword [ecx + 4]
push ebx
push dword [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
inc eax
cmp eax, ebx
jae 0x100053ee
mov eax, dword [ebp - 4]
pop ebx
jmp 0x10005463
cmp dword [ebp + 0x10], eax
jne 0x10005444
push 1
call fcn.1001e2ee
mov esi, eax
pop ecx
and byte [esi], 0
jmp 0x10005461
push dword [ebp + 0x10]
call fcn.10011400
inc eax
push eax
call fcn.1001e2ee
push dword [ebp + 0x10]
mov esi, eax
push esi
call fcn.10011a60
add esp, 0x10
mov eax, esi
pop edi
pop esi
leave
ret 0xc
Function at 0x10006845
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100276bb
call fcn.10011854
sub esp, 0x124
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], ebx
je 0x1000694f
mov eax, dword [0x10034f94]
push edi
mov dword [ebp - 0x14], eax
mov edi, 0x104
lea eax, [ebp - 0x130]
push edi
push ebx
push eax
mov byte [ebp - 4], 2
call fcn.10011a00
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x14]
push str._sExpand.Dat
push eax
call fcn.1001d2f1
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.10022554
push ebx
push 0x1001
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.100225c9
test eax, eax
je 0x10006936
xor edi, edi
cmp dword [esi + 8], edi
jle 0x1000692e
mov eax, dword [0x10034f94]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 4
add eax, edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x10]
push str._s__s__s__s__s__s_r_n
push eax
call fcn.1001d2f1
add esp, 0x20
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x10]
call fcn.1002273c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.1001dd8a
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 8]
jl 0x100068db
lea ecx, [ebp - 0x2c]
call fcn.100228f9
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10022586
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1001dd8a
pop edi
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.1000177e
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.1000652c
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10006974
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov eax, 0x100276e0
call fcn.10011854
sub esp, 0x124
mov eax, dword [ebp + 8]
or dword [ebp - 0x24], 0xffffffff
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], eax
cmp eax, dword [esi + 8]
jge 0x10006b28
lea edi, [eax + eax*2]
shl edi, 3
xor ebx, ebx
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], ebx
add eax, edi
lea ecx, [eax + 4]
add eax, 8
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1001dfb9
mov eax, dword [esi + 4]
mov dword [ebp - 4], ebx
add eax, edi
lea ecx, [eax + 0x10]
add eax, 8
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001dfb9
mov eax, dword [esi + 4]
mov byte [ebp - 4], 1
add eax, edi
lea ecx, [eax + 0x14]
add eax, 8
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1001dfb9
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10006a04
mov dword [ebp - 0x10], 4
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10006a15
or dword [ebp - 0x10], 2
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10006a26
or dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
jne 0x10006ac6
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push 0xf003f
lea ecx, [ebp + 8]
mov eax, dword [edi + eax]
push eax
push SysReAllocString
call fcn.10006118
test eax, eax
jne 0x10006ab2
mov eax, 0x104
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.10011a00
add esp, 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x1003360c
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp + 8], ebx
je 0x10006a9a
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x130]
push eax
call fcn.10011400
test eax, eax
pop ecx
jbe 0x10006ab2
mov dword [ebp - 0x10], 8
cmp dword [ebp + 8], ebx
je 0x10006ac3
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x10], ebx
ja 0x10006aff
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.1001dd8a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.1001dd8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1001dd8a
inc dword [ebp - 0x14]
add edi, 0x18
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 8]
jl 0x100069a4
jmp 0x10006b28
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
call fcn.1001dd8a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.1001dd8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1001dd8a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1000c5ef
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
je 0x1000c651
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [esi + 0xb8], 0
je 0x1000c621
inc dword [ebp - 0xc]
inc dword [ebp - 0x10]
dec dword [ebp - 8]
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
push 1
sub eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_MoveWindow]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x7c]
call edi
push 0
jmp 0x1000c660
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esi + 0x7c]
call edi
push 5
push dword [esi + 0xac]
call edi
pop edi
pop esi
leave
ret 4

Function at 0x1000e884
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1002865f
call fcn.10011854
sub esp, 0x424
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
mov eax, dword [0x10034f94]
push 1
pop ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov eax, 0x410
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.10011a00
add esp, 0xc
lea ecx, [ebp - 0x10]
push 0xf003f
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call fcn.10006118
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000e928
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], esi
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
push str.Start_Page
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x430]
lea ecx, [ebp - 0x14]
push eax
call fcn.1001df13
cmp dword [ebp - 0x10], esi
je 0x1000e928
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.1001daff
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.1001dd8a
cmp dword [ebp - 0x10], esi
je 0x1000e94c
push dword [ebp - 0x10]
call edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000e95e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push esi
push 0xf003f
lea eax, [ebp - 0x400]
push esi
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1000e995
xor eax, eax
jmp 0x1000e9e5
mov eax, dword [ebp + 0x18]
dec eax
je 0x1000e9b6
sub eax, 3
jne 0x1000e9d7
push dword [ebp + 0x14]
call fcn.10011d96
pop ecx
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 4
push eax
push 4
jmp 0x1000e9c6
push dword [ebp + 0x14]
call fcn.10011400
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000e9da
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x10020f77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10020fb9
call fcn.10025ed7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10020fb9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10020fb0
xor eax, eax
jmp 0x10020fc1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10020fc7
pop edi
pop esi
pop ebx
ret 4
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x408963
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
inc ecx
call fcn.00408988
and eax, ecx
mov eax, eax
xor dword [esi], edi
or eax, eax
inc esi
add eax, ecx
cmp esi, edx
jne fcn.00408963
mov ecx, ecx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x3b67474
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x783f402e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40122e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esp], 0
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp]
jl 0x4012f5
mov ebp, 0x403134
mov ebx, ebp
add ebx, dword [esp]
mov eax, ebx
call fcn.004020d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 4], ebx
mov ebx, dword [esp + 4]
and ebx, ebx
jl 0x401282
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 0x24]
jge 0x401282
mov eax, 1
jmp 0x401284
xor eax, eax
and eax, eax
je 0x4012ec
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 4]
mov eax, edi
cdq
idiv dword [esp + 0x2c]
mov edi, edx
add ebx, edi
mov eax, ebx
call fcn.004020d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0xc], ebx
mov ebp, 0x40304c
mov ebx, ebp
add ebx, dword [esp]
mov eax, ebx
call fcn.004020d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 8], ebx
mov ebx, dword [esp + 8]
xor ebx, dword [esp + 0xc]
mov dword [esp + 8], ebx
push dword [esp + 8]
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.004020e0
jmp 0x4012ec
inc dword [esp]
jno 0x40123e
xor eax, eax
add esp, 0x10
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x68c478fe
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0xcd63a00
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219