joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4655d8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404d24
xor eax, eax
push ebp
push 0x4656cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046283c
test al, al
je 0x4656a0
xor edx, edx
push ebp
push 0x465642
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00462fac
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.00409488
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46564c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00462da0
test al, al
jne 0x46567a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
push eax
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3200], 0
je 0x4656b6
cmp dword [ebp + 8], 0x20
je 0x4656b6
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404d34
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4656b6
mov eax, dword [ebp - 4]
add eax, 0x4d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3208]
call fcn.004048c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4656d3
lea eax, [ebp - 0xc]
call fcn.00404874
ret

Function at 0x465b6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x465b98
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x476314]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x465b72
pop esi
pop ebx
ret

Function at 0x465d60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x4784c4
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x4762c4]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x4762c4]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x465e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x465ea9
call fcn.00465e60
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.00465d60
inc dword [esi]
dec ebx
jne 0x465e92
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x465eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x465ee4
call fcn.00465e60
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.00465d60
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x465ec3
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x465f0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00404d24
xor eax, eax
push ebp
push 0x465fbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x465fa5
mov eax, dword [ebp + 8]
call fcn.00465dc4
test eax, eax
jne 0x465fa5
xor ebx, ebx
call fcn.00465e60
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.00465d60
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x465f48
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x465f93
mov eax, dword [ebp - 4]
call fcn.004076d0
call fcn.004076d4
cmp bl, al
sete al
mov ebx, eax
jmp 0x465fa5
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465fc2
lea eax, [ebp + 8]
call fcn.00404874
ret

Function at 0x467124
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d24
xor eax, eax
push ebp
push 0x467175
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404d34
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x467159
test al, 0x10
jne 0x46715d
xor ebx, ebx
jmp 0x46715f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46717c
lea eax, [ebp - 4]
call fcn.00404874
ret

Function at 0x46726c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x467294
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404ae4
jmp 0x46729d
mov eax, ebx
xor edx, edx
call fcn.00404ec0
add esp, 0x104
pop ebx
ret
Function at 0x4679f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x467a09
add esp, 0xfffffff0
call fcn.00403e2c
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.00404d24
mov eax, dword [ebp + 0xc]
call fcn.00404d24
xor eax, eax
push ebp
push 0x467b00
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x467aa9
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.00462ea0
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.004048c8
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.004048c8
mov byte [ebx + 0x50], 1
jmp 0x467ac0
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.004048c8
lea eax, [ebx + 0x54]
call fcn.00404874
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.004663cc
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467b07
lea eax, [ebp - 8]
call fcn.00404874
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404898
ret
Function at 0x4707b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
call fcn.00404d24
mov eax, dword [ebp - 0x14]
call fcn.00404d24
xor eax, eax
push ebp
push 0x4709a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x470802
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3d], 0
je 0x47082c
mov eax, 0x90
call fcn.0040272c
mov ebx, eax
push 0x90
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404a6c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c], 0
je 0x470909
mov ecx, dword [0x476378]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4514d4]
call fcn.00453f68
mov dword [ebp - 0xc], eax
mov dl, 4
mov eax, dword [ebp - 0xc]
call fcn.00455d8c
mov edx, 0x1c2
mov eax, dword [ebp - 0xc]
call fcn.0043b85c
mov edx, 0x50
mov eax, dword [ebp - 0xc]
call fcn.0043b880
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0045572c
mov dl, 3
mov eax, dword [ebp - 0xc]
call fcn.00455a28
mov dl, byte [0x4709b0]
mov eax, dword [ebp - 0xc]
call fcn.00455700
mov edx, 0x4709bc
mov eax, dword [ebp - 0xc]
call fcn.0043c0d0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0x294], edx
mov dword [eax + 0x290], 0x470234
mov eax, dword [ebp - 4]
mov byte [eax + 0x46], 1
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x42fe58]
call fcn.00432244
mov ebx, eax
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, 0x14
mov eax, dword [ebx + 0x68]
call fcn.0041e2f8
mov edx, 0x4709d4
mov eax, dword [ebx + 0x68]
call fcn.0041e280
mov edx, 0x4709e8
mov eax, ebx
call fcn.0043c0d0
mov eax, dword [ebp - 0xc]
call fcn.004582c0
mov eax, dword [ebp - 0x10]
call fcn.00404b34
test eax, eax
jle 0x470934
mov eax, dword [ebp - 0x10]
call fcn.00404b34
mov edx, dword [ebp - 0x10]
cmp byte [edx + eax - 1], 0x5c
je 0x470934
lea eax, [ebp - 0x10]
mov edx, 0x470a04
call fcn.00404b3c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
push ebp
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404b80
mov eax, dword [ebp - 0x18]
call fcn.00470248
pop ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x46], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c], 0
je 0x470973
mov eax, dword [ebp - 4]
mov byte [eax + 0x46], 0
mov eax, dword [ebp - 0xc]
call fcn.00458118
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
call fcn.00470224
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4709ab
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404898
lea eax, [ebp - 8]
call fcn.00404874
ret
Function at 0x471678
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d24
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4717e6
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.0047111c
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.0047113c
jmp 0x4717b2
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404ae4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409854
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408960
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408960
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404c80
je 0x471792
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404ae4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408960
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408960
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404c80
jne 0x4717a9
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0047115c
test eax, eax
jne 0x4716f3
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4717ed
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404898
lea eax, [ebp - 4]
call fcn.00404874
ret

Function at 0x4717f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x88], eax
xor eax, eax
push ebp
push 0x4718fd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x4718df
cmp eax, 0x81
jbe 0x471874
lea edx, [ebp - 0x88]
mov eax, 0xe
call fcn.0040c338
mov ecx, dword [ebp - 0x88]
mov dl, 1
mov eax, dword [0x407ce8]
call fcn.0040cb40
call fcn.00404294
lea esi, [ebp - 0x81]
jmp 0x4718da
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4718d7
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x94]
mov edx, esi
call fcn.00404a6c
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00408960
mov eax, dword [ebp - 0x90]
mov ecx, 1
mov edx, 1
call fcn.00404d94
mov eax, dword [ebp - 0x8c]
mov edx, 0x471914
call fcn.00404c80
jne 0x4718d7
mov bl, 1
jmp 0x4718df
add esi, 4
cmp byte [esi], 0
jne 0x47187c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471904
lea eax, [ebp - 0x94]
mov edx, 4
call fcn.00404898
ret
Function at 0x471918
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x88], eax
xor eax, eax
push ebp
push 0x471a1d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x4719ff
cmp eax, 0x81
jbe 0x471994
lea edx, [ebp - 0x88]
mov eax, 0xe
call fcn.0040c338
mov ecx, dword [ebp - 0x88]
mov dl, 1
mov eax, dword [0x407ce8]
call fcn.0040cb40
call fcn.00404294
lea esi, [ebp - 0x81]
jmp 0x4719fa
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4719f7
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x94]
mov edx, esi
call fcn.00404a6c
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00408960
mov eax, dword [ebp - 0x90]
mov ecx, 1
mov edx, 1
call fcn.00404d94
mov eax, dword [ebp - 0x8c]
mov edx, 0x471a34
call fcn.00404c80
jne 0x4719f7
mov bl, 1
jmp 0x4719ff
add esi, 4
cmp byte [esi], 0
jne 0x47199c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471a24
lea eax, [ebp - 0x94]
mov edx, 4
call fcn.00404898
ret

Function at 0x471a38
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
xor eax, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
xor eax, eax
push ebp
push 0x471b1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4764e0]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00459840
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x471afc
cmp eax, 0x81
jbe 0x471ab1
lea edx, [ebp - 0x88]
mov eax, 0xe
call fcn.0040c338
mov ecx, dword [ebp - 0x88]
mov dl, 1
mov eax, dword [0x407ce8]
call fcn.0040cb40
call fcn.00404294
lea ebx, [ebp - 0x81]
jmp 0x471ae9
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x471ae6
lea eax, [ebp - 0x8c]
mov edx, ebx
call fcn.00404a6c
mov edx, dword [ebp - 0x8c]
mov ecx, 0x471b30
mov eax, dword [0x49076c]
call fcn.004707b8
add ebx, 4
cmp byte [ebx], 0
jne 0x471ab9
mov eax, dword [0x4764e0]
mov eax, dword [eax]
xor edx, edx
call fcn.00459840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471b21
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.00404898
ret
Function at 0x401090
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4032ec], eax
mov eax, dword [ebp + 4]
mov dword [0x40313a], eax
xor eax, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x4010bb
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40313a]
mov dword [ebp - 0x48], eax
mov eax, 0x4021c7
mov dword [ebp - 0x54], eax
mov ecx, 0x4031e6
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40313a]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403338], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403338]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x401179
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x40116b
mov esp, ebp
ret

Function at 0x427432
Capabilities:
Encode data using xor

Disassembly:
pop ebp
clc
pushal
lea edi, [ebp + 0x42]
mov si, 0x256
cld
mov cl, byte [edi]
xor cl, 0x59
rol cl, 0xc4
xor cl, 0x18
mov byte [edi], cl
inc edi
dec si
jne 0x42743d
jmp 0x427495
fmul st(0)
fdivr dword [esi + 0x7d0c6bc0]
invalid
Function at 0x401e60
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401ed0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401120
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x9f6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x9f638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xa1f074
push ecx
mov edi, eax
call fcn.00a0a198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9f63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00a0a02e
push esi
call fcn.00a09fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x9f9850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x9f98ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xa24720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9f98ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00a0a1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x9f98ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xa24720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9f992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00a0b082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x9f9957
mov word [eax], si
add eax, 2
push eax
call fcn.00a0b030
add esp, 4
jmp 0x9f9959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x9f98ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x9f98b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x9f9ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x9fa080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x9fa0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xa1f458
push ecx
call fcn.00a0a1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00a0a1e1
add esp, 0x10
jmp 0x9fa0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00a0a20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00a09dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.009fa050
mov eax, dword [0xa24728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x9fa13b
push esi
call fcn.009f9fb0
add esp, 4
mov dword [0xa24728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x9fa14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.009f9ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x9fd440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x9fd4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x9fd48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x9fd471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x9fd47e
add edx, ecx
cmp ebx, edx
jb 0x9fd48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x9fd467
xor ecx, ecx
jmp 0x9fd4a2
test eax, eax
jne 0x9fd492
xor ecx, ecx
jmp 0x9fd4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.009fd3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret