joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412138
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], dx
xor bl, bl
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], 8
jb 0x405251
mov eax, dword [eax]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 0xc]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4052ef
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4052da
push 0x419517
push dword [ebp - 0x30]
call fcn.00410c0c
mov esi, eax
add esp, 8
test esi, esi
je 0x4052c3
lea eax, [ebp - 0x30]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4052ba
push esi
lea ecx, [ebp - 0x28]
call fcn.00407290
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
push 0xe
push 0
push str.Acrobat_Reader
lea ecx, [ebp - 0x28]
call fcn.00407c50
cmp eax, 0xffffffff
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test bl, bl
setne al
movzx esi, ax
jmp 0x4052f2
or esi, 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x405303
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410c15
mov esp, ebp
pop ebp
ret
Function at 0x405ce0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
or edi, 0xffffffff
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
test esi, esi
je 0x405dd4
push ebx
push 0x228
lea eax, [ebp - 0x434]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x438], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x405d84
cmp dword [ebp - 0x430], ebx
je 0x405d7e
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405d63
jmp 0x405d84
mov edi, dword [ebp - 0x420]
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
pop ebx
test eax, eax
je 0x405dcd
cmp dword [ebp - 0x430], edi
je 0x405db1
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405d96
jmp 0x405dcd
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR120.dll_wcsncpy]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov esi, str.firefox.exe
push eax
call dword [sym.imp.MSVCR120.dll__wcslwr]
add esp, 4
lea esp, [esp]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x405e16
test cx, cx
je 0x405e12
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x405e16
add eax, 4
add esi, 4
test cx, cx
jne 0x405df0
xor ecx, ecx
jmp 0x405e1b
sbb ecx, ecx
or ecx, 1
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.00410c15
mov esp, ebp
pop ebp
ret
Function at 0x405e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412208
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x27
xor eax, eax
mov dword [ebp - 0x34], 4
push str.SOFTWAREPoliciesAdobeAcrobat_Reader_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x30], 0
xor bl, bl
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004072e0
push 2
push 0x414d70
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00407090
push 0x10
push str.FeatureLockDown
lea ecx, [ebp - 0x28]
call fcn.00407090
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 1
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f24
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push str.bAcroSuppressOpenInReader
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405f1b
cmp dword [ebp - 0x30], 0
mov eax, 1
movzx ebx, bl
cmovne ebx, eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
movzx esi, bl
jb 0x405f38
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410c15
mov esp, ebp
pop ebp
ret
Function at 0x40bb00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0
push 0
push 0x40bc00
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
xor bl, bl
push eax
mov byte [ebp - 1], bl
call sub.USER32.dll_DdeInitializeW
test eax, eax
jne 0x40bbf9
push esi
push edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.USER32.dll_DdeCreateStringHandleW
push 0
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp - 8]
call sub.USER32.dll_DdeCreateStringHandleW
push 0
mov esi, eax
push esi
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x10], esi
call sub.USER32.dll_DdeConnect
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
test edi, edi
jne 0x40bb9d
push dword [ebp - 8]
call sub.USER32.dll_DdeGetLastError
push edi
push esi
push ebx
push dword [ebp - 8]
call sub.USER32.dll_DdeConnect
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp eax, 0xea60
jbe 0x40bb66
test edi, edi
jne 0x40bb9d
push dword [ebp - 8]
call sub.USER32.dll_DdeGetLastError
jmp 0x40bbd5
mov esi, dword [ebp + 0x10]
push 0
push 0x2710
push 0x4050
push 1
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
call sub.USER32.dll_DdeClientTransaction
test eax, eax
push edi
setne byte [ebp - 1]
call sub.USER32.dll_DdeDisconnect
mov esi, dword [ebp - 0x10]
push ebx
push dword [ebp - 8]
call sub.USER32.dll_DdeFreeStringHandle
push esi
push dword [ebp - 8]
call sub.USER32.dll_DdeFreeStringHandle
push dword [ebp - 8]
call sub.USER32.dll_DdeUninitialize
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bc90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412871
mov eax, dword fs:[0]
push eax
sub esp, 0x4f0
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x454], 0
call sub.MSVCR120.dll_memset
mov ecx, dword [0x4194c0]
add esp, 0xc
lea ecx, [ecx + 0x74]
call fcn.0040ec7b
test eax, eax
je 0x40be74
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40be74
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4152e0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40be74
push 1
push 0x40
push 0x20
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4fc]
call fcn.00409e10
mov ecx, dword [0x4194c0]
mov dword [ebp - 4], 0
lea ecx, [ecx + 0x74]
call fcn.0040ecfa
push eax
lea ecx, [ebp - 0x450]
call fcn.00403250
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00403940
add esp, 8
cmp dword [ebp - 0x424], 0x10
lea eax, [ebp - 0x438]
push 0
push dword [ebp - 0x428]
cmovae eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x4fc]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea ecx, [ebp - 0x4f8]
call fcn.0040c330
test eax, eax
jne 0x40bde3
push eax
mov eax, dword [ebp - 0x4fc]
lea ecx, [ebp - 0x4fc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp dword [ebp - 0x424], 0x10
jb 0x40bdfa
push dword [ebp - 0x438]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [ebp - 0x43c], 0x10
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], 0
mov byte [ebp - 0x438], 0
jb 0x40be2c
push dword [ebp - 0x450]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x43c], 0xf
mov dword [ebp - 0x440], 0
mov byte [ebp - 0x450], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0040a010
mov eax, dword [sym.imp.MSVCP120.dll_const_std::ios_base::vftable]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.MSVCP120.dll_private:_static_void___cdecl_std::ios_base::_Ios_base_dtor_class_std::ios_base__]
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x218], ax
jne 0x40be94
xor ecx, ecx
jmp 0x40beaf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bea0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004072e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410c15
mov esp, ebp
pop ebp
ret
Function at 0x40c000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4128a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x40c12d
cmp byte [edi + 0x45], 0
je 0x40c12d
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40c054
xor al, al
jmp 0x40c12f
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x48]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x40c0c1
dec eax
je 0x40c0c5
sub eax, 2
je 0x40c116
xor bl, bl
jmp 0x40c118
mov byte [edi + 0x45], 0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp ebx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ecx
sub esi, eax
je 0x40c0f8
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40c0bd
cmp byte [edi + 0x45], 0
je 0x40c116
test esi, esi
lea esi, [edi + 0x48]
jne 0x40c087
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00403670
jmp 0x40c084
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x40c129
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
jmp 0x40c12f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410c15
mov esp, ebp
pop ebp
ret
Function at 0x40d430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesAdobeAdobe_AcrobatDCFeatureLockDown
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d4a0
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d497
cmp dword [ebp - 8], 4
jne 0x40d497
mov eax, 1
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d517
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4153f0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d50e
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e880
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x41559c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call fcn.0040d4b0
test eax, eax
je 0x40e917
call fcn.0040d430
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e8dc
push str.SetProcessDEPPolicy
push eax
call esi
test eax, eax
je 0x40e8dc
xor ecx, ecx
test ebx, ebx
sete cl
lea ecx, [ecx*2 + 1]
push ecx
call eax
test eax, eax
jne 0x40e917
push str.ntdll.dll
call edi
test eax, eax
je 0x40e917
push str.NtSetInformationProcess
push eax
call esi
mov esi, eax
test esi, esi
je 0x40e917
xor ecx, ecx
lea eax, [ebp - 4]
test ebx, ebx
push 4
setne cl
push eax
push 0x22
lea ecx, [ecx*4 + 9]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
call fcn.0040d8c0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x40d950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
push 2
test eax, eax
jne 0x40e942
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x40d7d0
push 0x64
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x419508], 0x258
mov dword [ebp - 4], eax
jae 0x40e9c3
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea esp, [esp]
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x40e99c
lea eax, [ebp - 0x28]
push eax
call edi
lea eax, [ebp - 0x28]
push eax
call ebx
cmp dword [0x4194c0], 0
je 0x40e9b4
mov dword [0x419508], 0
call fcn.0040b270
cmp dword [0x419508], 0x258
jb 0x40e980
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.00406890
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4010e0
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call fcn.00401480
add esp, 8
test eax, eax
jne 0x40128f
mov eax, dword [0x408470]
test eax, eax
jne 0x401116
mov ecx, dword [0x4084dc]
mov edx, 0x405a90
call fcn.00402ac0
mov dword [0x408470], eax
push ebx
push esi
push edi
push 0x405434
call eax
mov esi, eax
add esp, 4
test esi, esi
je 0x4011e1
mov eax, dword [0x408494]
test eax, eax
jne 0x40114b
mov ecx, dword [0x4084dc]
mov edx, 0x405c08
call fcn.00402ac0
mov dword [0x408494], eax
push 0
push 0
push 0x408018
call eax
mov ebx, dword [str._MessageBox]
mov edi, eax
mov eax, dword [0x408508]
add esp, 0xc
test eax, eax
jne 0x40117f
mov ecx, dword [0x4084dc]
mov edx, 0x405bf0
call fcn.00402ac0
mov dword [0x408508], eax
push edi
push ebx
push esi
call eax
mov eax, dword [0x408494]
add esp, 0xc
test eax, eax
jne 0x4011a5
mov ecx, dword [0x4084dc]
mov edx, 0x405c08
call fcn.00402ac0
mov dword [0x408494], eax
push 0
push 0
push 0x408028
call eax
mov ebx, dword [str._SHGetSpecialFolderPath]
mov edi, eax
mov eax, dword [0x408508]
add esp, 0xc
test eax, eax
jne 0x4011d9
mov ecx, dword [0x4084dc]
mov edx, 0x405bf0
call fcn.00402ac0
mov dword [0x408508], eax
push edi
push ebx
push esi
call eax
add esp, 0xc
call fcn.004012d0
push 0x405298
mov edi, eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x40126a
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 0
call esi
mov ebx, eax
add esp, 4
mov eax, dword [0x4084b4]
test eax, eax
jne 0x401227
mov ecx, dword [0x4084dc]
mov edx, 0x405790
call fcn.00402ac0
mov dword [0x4084b4], eax
push 0x4052a8
push ebx
call eax
add esp, 8
test eax, eax
je 0x40126a
push 0
call esi
mov esi, eax
add esp, 4
mov eax, dword [0x408550]
test eax, eax
jne 0x40125d
mov ecx, dword [0x4084dc]
mov edx, 0x4057a4
call fcn.00402ac0
mov dword [0x408550], eax
push 0
push 0x4052a8
push esi
call eax
add esp, 0xc
mov eax, dword [0x408454]
test eax, eax
jne 0x401288
mov ecx, dword [0x4084dc]
mov edx, 0x405818
call fcn.00402ac0
mov dword [0x408454], eax
call eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x72bb1c97
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2fe75815
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10002210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x101165b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
test ebx, ebx
jne 0x10002256
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008600b
mov esp, ebp
pop ebp
ret
push edi
push 0x100aab8c
push ebx
call fcn.10085fad
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000227e
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008600b
mov esp, ebp
pop ebp
ret
push esi
push 0x10000
call fcn.10085e5d
mov esi, eax
add esp, 4
test esi, esi
jne 0x100022af
push edi
call fcn.10085daa
add esp, 4
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008600b
mov esp, ebp
pop ebp
ret
push sym.cis_cc_3.2.dll_popsha1
push 0x10
lea eax, [ebp - 0x66c]
push 0x100b3004
push eax
call sym.cis_cc_3.2.dll_HMAC_Initialize
push edi
push 0x10000
push 1
push esi
call fcn.10085d20
add esp, 0x20
test eax, eax
je 0x10002303
lea esp, [esp]
push eax
lea ecx, [ebp - 0x66c]
push esi
push ecx
call sym.cis_cc_3.2.dll___HMAC_Update
push edi
push 0x10000
push 1
push esi
call fcn.10085d20
add esp, 0x1c
test eax, eax
jne 0x100022e0
push edi
call fcn.10085a91
add esp, 4
push edi
test eax, eax
je 0x10002333
call fcn.10085daa
push esi
call fcn.10085a2f
add esp, 8
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008600b
mov esp, ebp
pop ebp
ret
call fcn.10085daa
lea edx, [ebp - 0x66c]
push edx
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x18]
push ecx
call sym.cis_cc_3.2.dll_HMAC_Finalize
push esi
call fcn.10085a2f
add esp, 0x14
cmp dword [ebp - 0x670], 0x14
jne 0x1000231f
xor esi, esi
lea edi, [ebp - 0x6c]
jmp 0x10002370
movzx edx, byte [ebp + esi - 0x18]
push edx
push str._02x
push edi
call fcn.10085876
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x14
jl 0x10002370
lea edx, [ebp - 0x16c]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10002397
lea eax, [ebp - 0x16c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100023a8
mov ecx, dword [str..hmac]
mov dx, word [0x100aab80]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x16c]
push 0x100aab8c
push eax
call fcn.10085fad
mov esi, eax
add esp, 8
test esi, esi
je 0x1000231f
push esi
push 0x28
lea ecx, [ebp - 0x40]
push 1
push ecx
call fcn.10085d20
push esi
mov edi, eax
call fcn.10085daa
add esp, 0x14
test edi, edi
jle 0x1000231f
mov eax, 0x28
xor ecx, ecx
lea esp, [esp]
mov edx, dword [ebp + ecx - 0x6c]
cmp edx, dword [ebp + ecx - 0x40]
jne 0x1000231f
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x10002410
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1008600b
mov esp, ebp
pop ebp
ret