joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e040a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8c330e32
ja 0x5e040d
xor ecx, dword [edi + esi*2 + 0x6f265bfc]
pop ebx
outsd dx, dword es:[esi]
xor al, dh
add bl, al
fisub dword [esi + 0x575a439f]
enter 0xffffffffffffaafc, 0x11
je 0x5e0412
ret 0x5bfe

Function at 0x60c140
Capabilities:
Encode data using xor

Disassembly:
add dword [ebx + 0x31563c6d], edx
or al, byte [0xd6a592fb]
loope 0x60c100
shl dword [ebx - 0x28], cl
pop es
sbb eax, dword [ebx - 0x1c2bf95c]
fsubr st(1)
mov ch, 0xe7
add byte [ebp + eax*2 - 0x31070df8], 0xf5
fistp word [esi - 0x6b]
jecxz 0x60c0cc
movsd dword es:[edi], dword [esi]
xor bh, byte [ebx + 0x64]
xor edi, dword [edi - 0x7e79aa2e]
mov ebp, dword [edx + ecx*4 + 0x340ff6ae]
fimul dword [ebp + 0xd]
adc dword [edi - 0x40], 0x3bc3ced9
adc dword [esi], esp
popal
sti
inc esp
jae 0x60c10f
push ebp
xor dword [edi], ebp
out 0x52, eax
cmc
pushal
mov dh, 0x91
shl al, cl
jg 0x60c0a1
xchg ecx, eax
cld
mul esp
add bh, 0x16
xor dword [ebx - 0x5c], edi
popal
inc esi
lodsd eax, dword [esi]
add dword ss:[edx + 0x25], edx
push es
call 0xc42c3e33
xor ch, 0xa4
cdq
add dword [ebx - 0x1b2ba467], 0xffffff80
sbb al, 0xc0
push edi
add byte [ecx + 0x7a], cl
ja 0x60c17a
invalid
jge 0x60c0dc
ret
pop ds
test word [ebx + 0x60], 0xc764
insb byte es:[edi], dx
push edi
pushal
imul ecx, dword [ebx], 0x74
adc ah, byte [ebx + 0x3befe2f3]
inc esi
out dx, eax
loop 0x60c126
cmp eax, dword [esi - 0x11]
add al, 0xd7
mov es, word [esi + 0x3ee89170]
call 0x210d7d83
invalid
invalid
call 0x210d7d83
jne 0x60c143
lodsb al, byte [esi]
and byte [esi + 0x75], ah
sti
pop ss
je 0x60c12c
loop 0x60c0ed
scasd eax, dword es:[edi]
inc eax
mov edi, 0x5f13cfd8
in eax, dx
add byte [eax - 0x66166128], bh
loope 0x60c135
inc edi
jl 0x60c14f
inc ecx
xor word [edi], sp
and cl, byte [edi]
jo 0x60c100
inc ebp
inc ebp
hlt
cmp al, 0xe4
invalid
Function at 0x62bd2a
Capabilities:
Encode data using xor

Disassembly:
and byte [edi - 0x30], ch
rcr dword [eax - 0x5dd40dae], cl
xchg ebp, eax
std
idiv byte [esi - 0x3d17d769]
idiv eax
push ebp
sahf
xlatb
lodsd eax, dword [esi]
push ss
pop esi
sub ah, byte [ebx - 0x39]
adc al, 0x37
push 0x493c1eb8
idiv byte [eax]
leave
or esp, dword [edi]
jo 0x62bd9b
and eax, 0xd00a648b
xlatb
inc ebp
pop ss
int1
idiv ah
fidiv word [edx - 0x64]
jns 0x62bdc7
inc edx
and dword [ecx], esi
inc edi
sub dword [esi - 0x78], esi
mov dl, 0x21
stosb byte es:[edi], al
rcr dl, 0x21
dec ecx
shrd dword [ecx - 0x3d7820e4], ebp, 0xe3
ror dword [ecx + 0x20], 1
dec edi
jmp 0xa686e034
paddusw mm0, mm0
jo 0x62bdcf
adc dword [0x18535957], ebp
xor byte [edi], 0xcb
jl 0x62bda6
pop ecx
or eax, 0xe1295146
mov bl, dh
movsd dword es:[edi], dword [esi]
into
invalid
and bl, cl
fmul dword [esi]
sbb byte [edi], al
std
sbb eax, 0x1aa1fc75
scasd eax, dword es:[edi]
sub eax, 0xc094dee6
xor ecx, dword [ebp + ebx*8 - 0x45764c3d]
fld xword [edi]
add dword [esi - 0x48c1af3b], edx
into
out 0x9f, eax
cdq
push esi
fnstenv [edx - 0x7b1a8b26]
aaa
fcomp qword [ebp + 0x43e8774]
jnp 0x62bdf0
and cl, 0x33
invalid

Function at 0x64e72e
Capabilities:
Authenticate hmac

Disassembly:
inc eax
xor byte [edi], bl
jecxz 0x64e64e
mov ebx, 0xbd974737
inc ebp
popfd
or edx, dword [edx + 0x74]
aas
mov ebp, 0x520b9d45
je 0x64e694
xor ecx, eax
das
push ebp
adc edx, eax
adc edx, eax
in eax, dx
fstp qword [ebp + 0x4bb70041]
loop 0x64e65a
sbb bh, byte [esp + ecx]
test al, 0xb8
out dx, al
inc ebx
fdiv qword [edi - 0x5a]
inc ecx
mov al, 0x88
wait
inc edi
sbb dword [edi - 0x503e2024], 0x83e3e8e6
out 0x49, al
adc dword [ecx + 0x1b], esp
and esi, dword [eax]
add eax, 0x37952075
or bl, byte [edx + 0x50af62ab]
iretd
invalid
jno 0x64e643
adc al, byte [edi - 0x3e]
les edx, [ecx - 0x5d]
sbb al, 0xd1
fmul dword [ebx + edx*8]
cdq
out 0x9b, eax
jmp 0x2a540967
xchg ebp, eax
pop ss
mov al, byte [0x4be0023f]
xor ecx, edi
adc al, dl
jp 0x64e759
cmpsb byte [esi], byte es:[edi]
aam 0x2e
rol dword [eax + 0x7a820f77], 0xa7
jbe 0x64e6b1
inc esp
jecxz 0x64e788
aam 0xe4
mov cl, 0x9e
jne 0x64e771
and ch, bh
adc al, 0xd7
loop 0x64e769
pop ds
mov al, 0x71
sub al, al
mov eax, 0x16df0e30
pop edi
or byte [bx + si], bl
js 0x64e717
mov esi, 0x53d8ffb6
push ds
inc ebx
xchg byte [eax], dh
xchg edx, eax
pushal
in eax, dx
adc esp, dword [esp + edx*8]
and esi, esp
aas
xchg ecx, eax
or bh, byte [esi + 0x31074ac0]
mov esi, 0x31074ac0
adc cl, byte [ecx - 0x7fa89077]
push edx
out dx, eax
rcr ebp, 1
loop 0x64e725
lea ebx, [esi]
cdq
add byte [ebp + 0xa41ee7d], dh
pop esi
mov ah, bh
nop
jl 0x64e74e
and byte [esp + edi*8], bl
mov eax, dword [0x6f266390]
nop
arpl word [esi], sp
outsd dx, dword [esi]
jge 0x64e764
cmp byte [eax + 0x774df755], cl
insd dword es:[edi], dx
cmp ah, cl
invalid
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x65b67a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
jmp 0x6594cb
and dword [ebp - 4], 0
jmp 0x65941d
sub esp, 0xd
lea esp, [esp + 1]
jmp 0x65b708
push esi
jmp 0x65ca2f
pop edi
push di
lea esp, [esp + 2]
jmp 0x65cc56
pop esi
jmp fcn.006593fd
sub esp, 0x14
jmp 0x65c787
mov ecx, ebp
add ecx, 0xfffffffc
mov eax, dword [ecx]
pop ecx
jmp 0x65c7ac
lea esp, [esp + 1]
jmp 0x65b6dd
mov eax, dword [eax + 0x7c]
pushal
mov word [esp + 5], ax
jmp 0x65b6b3
push edx
jmp 0x65b6c3
mov dword [ebp - 0x18], eax
lea esp, [esp + 0x3c]
je 0x6593e7
inc eax
jmp 0x65b69d
pushal
not bh
mov dword [esp + 0x14], esi
popal
jmp 0x65b6fe
lea esp, [esp + 1]
mov esi, dword [eax + 0x78]
add esi, ecx
jmp 0x65b680
jne 0x659413
je 0x6593e7
aam 0x55
lds ebp, [edi + ebx*2 - 0x2108bb68]
sub dword [ebx + reloc.SHELL32.dll_SHGetPathFromIDListA], eax
add edx, 0x20
mov eax, dword [edx]
pop edx
test eax, eax
jmp 0x65b6e8
add eax, ecx
call 0x65b710
dec eax
mov dword [esp], edi
lea esp, [esp + 0x10]
push ebx
jmp 0x65cdf4
lea esp, [esp + 2]
jmp 0x65c77e
push edx
add edi, ecx
sub esp, 0x1c
mov dword [esp + 0xe], ecx
lea esp, [esp + 0x16]
jmp 0x65c72a
mov dword [ebp - 0x10], eax
cmc
setp ah
mov eax, dword [esi + 0x1c]
stc
jmp 0x65c740
push esi
jmp 0x65c7c6
add eax, ecx
lea esp, [esp + 0x24]
dec ebx
jmp 0x65c768
push ecx
jmp 0x65952b
mov dword [ebp - 0x14], eax
js 0x659472
jns 0x659523
mov dh, 0xef
add eax, ebx
lea esp, [esp + 0x14]
cdq
jmp 0x65c7e6
mov esi, ebp
lea esi, [esi - 8]
mov dword [esi], edi
pop esi
jmp 0x65c79d
mov eax, dword [ebp - 0x10]
neg dx
pushal
call fcn.0065c892
retf 0xd949
stc
sub eax, edx
mov edi, eax
lea edx, [esi*4]
jmp 0x65c7d0
mov edi, dword [ebx]
pop ebx
pushal
pop word [esp + 0xe]
lea esp, [esp + 2]
jmp 0x65c75b
push ebx
mov ebx, esi
add ebx, 0x24
jmp 0x65c801
xor esi, esi
jmp 0x65cbc9
lea esp, [esp + 4]
test ebx, ebx
jl 0x65950d
jge 0x65a547
lea esp, [esp + 8]
jmp 0x659488
pop ebx
jmp 0x6594cb
lea ebx, [ebx + ebp]
mov ebx, dword [esi + 0x18]
cmc
push edi
jmp 0x65c927

Function at 0x6d3033
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 2]
call 0x6d301d
Function at 0x10003001
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [0x705070]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1000316b
push 0x40
mov edx, esi
mov ecx, edi
call 0x10005240
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call 0x10005240
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x100030c9
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call 0x10005240
add esi, 0x28
dec edi
jne 0x10003087
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x100030c9
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call 0x10005240
lea esi, [esi + 0x28]
dec ebx
jne 0x100030ae
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10001f85
push dword [ebp - 0x18]
mov ecx, dword [0x706438]
mov edx, edi
call fcn.10001ee1
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10003168
cmp dword [ebx + 0x64], 0
je 0x10003168
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10003110
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x10003114
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x1000313d
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x1000313f
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10003162
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41c642
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push edi
push 0x4379fc
push dword [esp + 0x18]
push dword [0x445068]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41c75b
push esi
push dword [0x445068]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x41c75b
push esi
push dword [0x445068]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41c75b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41c75b
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41c753
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41c74c
push edi
push esi
push eax
call fcn.00424240
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41c745
push ebp
push dword [esp + 0x14]
call fcn.0041c5a6
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x436278]
call esi
test edi, edi
je 0x41c745
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x41c733
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41c733
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x436278]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
jmp 0x41c75d
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x41cf79
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0xfa8]
mov eax, 0x1028
call fcn.00421580
mov eax, dword [0x44277c]
xor eax, ebp
mov dword [ebp + 0xfa4], eax
cmp word [0x454892], 0
je 0x41d02a
push esi
push 6
push dword [0x442724]
mov esi, 0x454892
push esi
call fcn.0040e1f8
push eax
call fcn.0041417a
test eax, eax
jne 0x41d029
push 0x453890
call fcn.0041cba6
push 0x800
push esi
lea eax, [ebp - 0x60]
push eax
call fcn.0041267b
lea eax, [ebp - 0x60]
push eax
call fcn.00426433
pop ecx
lea eax, [eax*2 + 2]
cmp eax, 0x1002
jae 0x41d03f
xor ecx, ecx
push 0x1e
mov word [ebp + eax - 0x60], cx
lea eax, [ebp - 0x80]
push ecx
push eax
call fcn.00422630
add esp, 0xc
mov dword [ebp - 0x7c], 3
push 0x14
pop eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
mov ecx, dword [ebp + 0xfa4]
xor ecx, ebp
call fcn.004210e9
add ebp, 0xfa8
leave
ret
call fcn.004213e9
int3
Function at 0x41fd88
Capabilities:
Hide graphical window

Disassembly:
and dword [0x45388c], 0
push 1
push dword [esp + 8]
mov byte [0x44c46d], 1
mov byte [0x44c46e], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401323
cmp dword [0x463cd4], 0
jne 0x41fdc8
cmp byte [0x44c47b], 0
je 0x41fdd1
cmp dword [0x44c474], 0
jne 0x41fde4
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41ffca
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00421580
mov eax, dword [0x44277c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push esi
call fcn.004123c6
mov esi, eax
test esi, esi
je 0x42002b
movzx ecx, word [esi]
push ecx
jmp 0x420016
add esi, 2
movzx eax, word [esi]
push eax
call fcn.004124e2
test al, al
jne 0x42000f
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004210e9
leave
ret 4
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x7b9008], 0x8088405
inc edx
mov dword [ebx + 0x7b9008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret