joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471830
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x471840
sub esi, ecx
je 0x471857
lea eax, [esi + esi]
push eax
call dword [0x48f040]
jmp 0x471862
push 0x47970e
call dword [0x48f04c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x471875
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
xor ecx, ecx
test esi, esi
je 0x471890
nop dword [eax + eax]
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x471880
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x47190d
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x471901
push 0
lea eax, [esi + esi]
mov dword [esp + 0x18], 0x10
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x48f044]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x471930
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x48f074]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x471a3f
push esi
mov esi, dword [esp + 0x38]
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x24], 0
push 8
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [esp + 0x24], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [esp + 0x25], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [esp + 0x26], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [esp + 0x27], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [esp + 0x28], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [esp + 0x29], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov word [esp + 0x18], 0x208
mov byte [esp + 0x2a], al
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x20], 0x6601
mov dword [esp + 0x24], 8
mov byte [esp + 0x2f], cl
call fcn.004741d0
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x471a51
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047497b
add esp, 0x24
ret
mov ecx, dword [esp + 0x2c]
push dword [esp + 8]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
xor ecx, esp
call fcn.0047497b
add esp, 0x24
ret
Function at 0x474280
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x48f040]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4742a7
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4742f2
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x4742f6
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x474356
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x474315
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x474387
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x484d86
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x484d87
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x474360
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x4743ef
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004743cb
pop esi
leave
ret 8

Function at 0x475944
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x475983
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x475983
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x475983
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x475983
cmp dword [ecx + 0x74], 0xe
jbe 0x475983
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x47c950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
fcmovb st(0), st(6)
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]

Function at 0x47c956
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0047c5b3
mov ebx, 0x883be41c
popfd
jl 0x47ca38
invalid
invalid
Function at 0x47c98b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0047c5b3
mov ebx, 0x883be41c
popfd
jl 0x47ca38
invalid
invalid

Function at 0x47c9ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0047c5b3
mov ebx, 0x883be41c
popfd
jl 0x47ca38
invalid
invalid
Function at 0x47c9dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0047c5c3
push eax
push esi
push dword [ebp + 8]
call fcn.0047c578
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0047c5b3
mov ebx, 0x883be41c
popfd
jl 0x47ca38
invalid
invalid
Function at 0x409460
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
mov ecx, dword [0x951934]
xor eax, eax
mov dword [esp], eax
add ecx, 0x22051
mov dword [esp + 4], eax
mov word [esp + 8], ax
mov dx, word [ecx]
mov word [esp], dx
mov al, byte [ecx + 2]
lea ecx, [esp]
push ecx
mov byte [esp + 6], al
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp ax, 1
je 0x409629
cmp ax, 2
je 0x409629
cmp ax, 3
je 0x409629
cmp ax, 4
je 0x409629
cmp ax, 5
je 0x409629
cmp ax, 6
je 0x409629
cmp ax, 7
je 0x409629
cmp ax, 8
je 0x409629
cmp ax, 9
je 0x409629
cmp ax, 0xa
je 0x409629
cmp ax, 0xb
je 0x409629
cmp ax, 0xc
je 0x409629
cmp ax, 0xd
je 0x409629
cmp ax, 0xe
je 0x409629
cmp ax, 0xf
je 0x409629
cmp ax, 0x11
je 0x409629
cmp ax, 0x12
je 0x409629
cmp ax, 0x13
je 0x409629
cmp ax, 0x14
je 0x409629
cmp ax, 0x15
je 0x409629
cmp ax, 0x17
je 0x409629
cmp ax, 0x19
je 0x409629
cmp ax, 0x1a
je 0x409629
cmp ax, 0x1b
je 0x409629
cmp ax, 0x1d
je 0x409629
cmp ax, 0x21
je 0x409629
cmp ax, 0x22
je 0x409629
cmp ax, 0x23
je 0x409629
cmp ax, 0x24
je 0x409629
cmp ax, 0x25
je 0x409629
cmp ax, 0x26
je 0x409629
cmp ax, 0x27
je 0x409629
cmp ax, 0x28
je 0x409629
cmp ax, 0x29
je 0x409629
cmp ax, 0x2a
je 0x409629
cmp ax, 0x2c
je 0x409629
cmp ax, 0x2d
je 0x409629
cmp ax, 0x51
je 0x409629
cmp ax, 0x52
je 0x409629
cmp ax, 0x53
je 0x409629
cmp ax, 0x54
je 0x409629
cmp ax, 0x55
je 0x409629
cmp ax, 0x56
je 0x409629
cmp ax, 0x57
je 0x409629
cmp ax, 0xc8
jge 0x409629
mov edx, dword [0x951934]
xor ax, ax
mov byte [edx + 0x2204f], 0x31
add esp, 0xc
ret
mov eax, dword [0x951934]
mov byte [eax + 0x2204f], 0x30
xor ax, ax
add esp, 0xc
ret
Function at 0x4111f0
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0xc8
push ebx
push ebp
push esi
push edi
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x10], 0x28
rep stosd dword es:[edi], eax
mov eax, dword [0x951934]
cmp dword [eax + 0x3dc60], 1
jne 0x41122f
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x41123f
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov al, byte [esp + 0x38]
test al, al
jne 0x411278
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x38]
rep stosd dword es:[edi], eax
mov edi, str.Standalone
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x88]
mov dl, byte [esp + 0x38]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x38]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov al, byte [esp + 0x39]
dec ecx
mov byte [esp + 0x89], dl
mov byte [esp + 0x8a], al
mov cl, byte [esp + ecx + 0x37]
mov byte [esp + 0x88], cl
mov cl, byte [esp + 0x3a]
mov byte [esp + 0x8b], cl
mov eax, dword [esp + 0x88]
push eax
mov dword [0x9ef264], eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
add esp, 4
mov dword [esp + 0x14], 0
mov edx, dword [0x951924]
mov ecx, 0x14
xor eax, eax
mov edi, 0x9ecad4
rep stosd dword es:[edi], eax
mov cx, word [edx + 0x66]
lea eax, [edx + 0x66]
push eax
push str._sTUCFILELOCKTFNAME
push 0x9ecad4
mov word [0x9ecad4], cx
call esi
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x9ecad4
call ebp
cmp eax, 0xffffffff
jne 0x4113cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x9ef260], eax
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x12c
mov dword [esp + 0x14], eax
jg 0x4113d1
call ebx
mov edx, eax
mov ecx, 0x14
push edx
xor eax, eax
lea edi, [esp + 0x8c]
lea edx, [esp + 0x8c]
push 0x41722c
push edx
rep stosd dword es:[edi], eax
call esi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x95]
push edx
stosw word es:[edi], ax
mov al, byte [esp + 0x98]
mov byte [esp + 0x29], cl
mov byte [esp + 0x28], al
mov byte [esp + 0x2a], 0x30
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x10
mov dword [0x9ecac4], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4112f0
mov dword [0x9ef254], eax
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc8
ret
Function at 0x413e20
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp], eax
push esi
movsx edx, byte [ecx]
mov dword [esp + 8], eax
push edx
mov word [esp + 0x10], ax
lea eax, [esp + 8]
push str._C:_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 4]
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
mov eax, 1
je 0x413e67
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x406430
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41d66b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404194
call fcn.00408fa4
push 4
mov dword [esp + 0x18], 0
call fcn.0040a763
mov edi, eax
add esp, 4
test edi, edi
je 0x4064a4
push ebx
call fcn.00408d9f
mov dword [edi], eax
call fcn.00408b5e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00408f65
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406498
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00408f8d
pop ebx
jmp 0x4064a6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b25b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4203ec]
jne 0x40b265
repz ret
jmp fcn.0041204c
Function at 0x4177e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4203ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410c67
and dword [ebp - 0x14], 0
cmp dword [0x4b7310], 0
mov dword [ebp - 0x18], eax
jne 0x417897
push 0x403f20
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41793f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f14
push ebx
call edi
test eax, eax
je 0x41793f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403f04
push ebx
mov dword [0x4b7310], eax
call edi
push eax
call esi
push 0x403ef0
push ebx
mov dword [0x4b7314], eax
call edi
push eax
call esi
push 0x403ed4
push ebx
mov dword [0x4b7318], eax
call edi
push eax
call esi
mov dword [0x4b7320], eax
test eax, eax
je 0x417897
push 0x403ebc
push ebx
call edi
push eax
call esi
mov dword [0x4b731c], eax
mov eax, dword [0x4b731c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4178f0
cmp dword [0x4b7320], ecx
je 0x4178f0
push eax
call esi
push dword [0x4b7320]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4178f0
test ebx, ebx
je 0x4178f0
call edi
test eax, eax
je 0x4178e7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4178e7
test byte [ebp - 8], 1
jne 0x4178f0
or dword [ebp + 0x10], 0x200000
jmp 0x417923
mov eax, dword [0x4b7314]
cmp eax, dword [ebp - 0x18]
je 0x417923
push eax
call esi
test eax, eax
je 0x417923
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417923
mov eax, dword [0x4b7318]
cmp eax, dword [ebp - 0x18]
je 0x417923
push eax
call esi
test eax, eax
je 0x417923
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b7310]
call esi
test eax, eax
je 0x41793f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417941
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b25b
leave
ret
Function at 0x419200
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1784
call fcn.004180a0
cmp dword [0x961764], 0x37
jne 0x4192f8
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea ecx, [esp + 0x784]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
lea eax, [esp + 0xf84]
push eax
push 0x40400c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x384]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x160]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0x40403c
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x20], 0
call fcn.0040a580
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov edx, dword [0x963ec8]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x95ff5c]
mov byte [edx + esi], cl
add esp, 0x1784
ret