joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e1e
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
not ebx
test esi, esi
je 0x407ee2
mov edx, dword [0x42f100]
push edi
mov edi, dword [0x42f104]
mov ecx, 0x80000000
dec esi
test edi, edi
jne 0x407e62
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x42f100]
mov ecx, 0x80000000
mov eax, edx
not eax
mov edi, 0x2b2
and eax, edi
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov eax, edx
not eax
and eax, edi
neg eax
sbb eax, eax
neg eax
add edx, edx
or edx, eax
mov eax, edx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
movzx eax, byte [ebp]
movzx ecx, bl
mov edi, 0xfe8001ab
xor ecx, eax
push 8
mov dword [0x42f100], edx
mov dword [0x42f104], edi
inc ebp
pop eax
test cl, 1
je 0x407ec8
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x407eca
shr ecx, 1
dec eax
test eax, eax
jg 0x407eb9
shr ebx, 8
xor ebx, ecx
mov ecx, 0x80000000
test esi, esi
jne 0x407e4b
pop edi
pop esi
not ebx
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x407eea
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x432778]
or eax, dword [0x43277c]
push ebx
push ebp
push esi
push edi
jne 0x407f38
xor esi, esi
mov eax, esi
push 8
cdq
pop edi
mov ecx, eax
shrd eax, edx, 1
and ecx, 1
shr edx, 1
or ecx, 0
je 0x407f1e
xor eax, 0xd7870f42
xor edx, 0xc96c5795
dec edi
jne 0x407f03
mov dword [esi*8 + 0x431f80], eax
mov dword [esi*8 + 0x431f84], edx
inc esi
cmp esi, 0x100
jl 0x407efd
mov esi, dword [0x42f104]
or esi, 0xa5
mov eax, 0x3d1
cmp esi, eax
cmove esi, eax
mov eax, dword [0x42f100]
mov ecx, eax
not ecx
and ecx, 0x2b2
lea edx, [eax + eax]
neg ecx
sbb ecx, ecx
neg ecx
or edx, ecx
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, edx
not eax
mov ecx, 0x2b2
and eax, ecx
neg eax
sbb eax, eax
neg eax
add edx, edx
or edx, eax
mov eax, edx
not eax
and eax, ecx
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
shl esi, 0xf
or edx, eax
or esi, 0x1d58001
not ebx
not edi
mov dword [0x42f100], edx
mov dword [0x42f104], esi
test ebp, ebp
je 0x407fe9
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x407fe9
movzx eax, byte [ebp]
xor eax, ebx
shrd ebx, edi, 8
and eax, 0xff
shr edi, 8
xor ebx, dword [eax*8 + 0x431f80]
xor edi, dword [eax*8 + 0x431f84]
inc ebp
dec ecx
jne 0x407fc5
not edi
mov edx, edi
pop edi
pop esi
not ebx
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x409e2f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x42f1a4]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
shr edi, 2
shr esi, 2
test eax, eax
jne 0x409e64
push 0x1c0
mov eax, 0x430690
push eax
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x42f1a4]
or eax, 0xfc
mov dword [0x42f1a4], eax
mov eax, dword [ebp + 8]
mov edx, 0xc0c0c0c0
lea ecx, [eax + esi*4]
mov eax, dword [ebp + 0x14]
test esi, esi
je 0x409e8a
add eax, 0xb16b00b0
xor eax, edx
dec esi
jne 0x409e80
test edi, edi
je 0x409e9d
xor dword [ecx], eax
add eax, 0xb16b00b0
xor eax, edx
lea ecx, [ecx + 4]
dec edi
jne 0x409e8e
pop edi
pop esi
pop ebp
ret
Function at 0x40da50
Capabilities:
Get common file path

Disassembly:
push 0x318
push 0x42cd38
call fcn.00414d40
or dword [ebp - 0x1c], 0xffffffff
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
mov edi, 0x2b2
and ecx, edi
neg ecx
sbb ecx, ecx
neg ecx
lea edx, [eax + eax]
or edx, ecx
mov eax, edx
not eax
and eax, edi
neg eax
sbb eax, eax
mov esi, 0x80000000
and eax, esi
add eax, esi
shr edx, 1
or edx, eax
mov eax, edx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, esi
add eax, esi
shr edx, 1
or edx, eax
mov dword [0x42f1c0], edx
mov dword [0x42f1c4], 0x8021
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0040c5bc
pop ecx
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x40dae5
cmp byte [0x4327b0], 0
je 0x40dc6a
mov edx, dword [0x42f1c4]
test edx, edx
jne 0x40db09
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x42f1c4]
mov ecx, dword [0x42f1c0]
mov eax, ecx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, esi
add eax, esi
shr ecx, 1
or ecx, eax
inc edx
mov eax, 0x11b
cmove edx, eax
mov dword [0x42f1c4], edx
mov eax, ecx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, esi
add eax, esi
shr ecx, 1
or ecx, eax
mov dword [0x42f1c0], ecx
mov byte [ebp - 0x328], bl
mov esi, 0x103
push esi
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.00414400
add esp, 0xc
mov ecx, dword [0x43069c]
lea eax, [ecx + 0x460]
push eax
xor edi, edi
inc edi
push edi
call fcn.004049a8
cmp dword [eax], ebx
je 0x40dbda
mov ecx, dword [0x43069c]
lea eax, [ecx + 0x380]
push eax
push edi
call fcn.004049a8
cmp dword [eax], ebx
je 0x40dbaf
mov ecx, dword [0x43069c]
lea eax, [ecx + 0x380]
push eax
push edi
call fcn.004049a8
push ebx
call dword [eax]
mov esi, eax
jmp 0x40dbb1
mov esi, ebx
mov ecx, dword [0x43069c]
lea eax, [ecx + 0x460]
push eax
push edi
call fcn.004049a8
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push esi
call dword [eax]
mov esi, 0x103
jmp 0x40dbdc
mov eax, ebx
test eax, eax
je 0x40dc6a
mov byte [ebp - 0x120], bl
push esi
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.00414400
mov byte [ebp - 0x224], bl
push esi
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.00414400
add esp, 0x18
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40dc6a
cmp eax, 0xf2
ja 0x40dc6a
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x4308d4
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40dc6a
push 0x4308d8
lea eax, [ebp - 0x224]
push eax
call fcn.00417610
lea eax, [ebp - 0x328]
push eax
call fcn.0040bf1c
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.00414d7b
ret
Function at 0x40e224
Capabilities:
Terminate process

Disassembly:
mov eax, 0x422647
call fcn.00414d1c
push ebx
push esi
push edi
mov esi, 0x40b9a3
push esi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov edx, dword [0x42f1c4]
or edx, 0x67
push 0
mov dword [0x42f1c4], edx
pop edi
jne 0x40e273
push 0x20f
mov eax, 0x426258
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x42f1c4]
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
mov ebx, 0x2b2
and ecx, ebx
neg ecx
sbb ecx, ecx
neg ecx
lea esi, [eax + eax]
or esi, ecx
or edx, 0x3c
mov dword [0x42f1c0], esi
mov dword [0x42f1c4], edx
jne 0x40e2b2
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x42f1c4]
mov esi, dword [0x42f1c0]
mov eax, esi
not eax
and eax, ebx
shl edx, 0x1b
or edx, 1
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr esi, 1
or esi, eax
mov eax, 0x3a1
cmp edx, eax
cmove edx, eax
mov dword [0x42f1c0], esi
mov dword [0x42f1c4], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00417095
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004065e7
push 0x484
call fcn.00401585
add esp, 0x14
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x40e323
push edi
push 0x2000003
mov ecx, eax
call fcn.004013c0
jmp 0x40e325
mov eax, edi
or dword [ebp - 4], 0xffffffff
mov dword [0x43069c], eax
test eax, eax
jne 0x40e346
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
push 0x42625c
push dword [0x430698]
call fcn.00417700
pop ecx
pop ecx
test eax, eax
je 0x40e361
push 0xfffffffffffffffe
pop eax
jmp 0x40e335
push dword [ebp + 0x10]
call fcn.0040da50
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40f946
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0xc
push 0x42d4a0
call fcn.00414d40
mov dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x40f986
cmp eax, 0x4000
jg 0x40f986
mov eax, 1
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
jmp 0x40f992
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
mov edx, dword [0x42f1fc]
mov eax, 0x37f
xor edx, eax
mov dword [0x42f1fc], edx
or edx, eax
mov dword [0x42f1fc], edx
mov ecx, dword [0x42f1f8]
mov eax, ecx
not eax
mov esi, 0x2b2
and eax, esi
neg eax
sbb eax, eax
mov edi, 0x80000000
and eax, edi
add eax, edi
shr ecx, 1
mov dword [0x42f1f8], ecx
or ecx, eax
mov dword [0x42f1f8], ecx
mov eax, ecx
not eax
and eax, esi
neg eax
sbb eax, eax
neg eax
add ecx, ecx
mov dword [0x42f1f8], ecx
or ecx, eax
mov dword [0x42f1f8], ecx
mov eax, ecx
not eax
and eax, esi
neg eax
sbb eax, eax
neg eax
add ecx, ecx
mov dword [0x42f1f8], ecx
or ecx, eax
mov dword [0x42f1f8], ecx
lea eax, [esi + 0x40]
xor edx, eax
mov dword [0x42f1fc], edx
or edx, eax
mov dword [0x42f1fc], edx
or edx, 6
mov dword [0x42f1fc], edx
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid
Function at 0x4102f7
Capabilities:
Delete directory

Disassembly:
mov eax, dword [0x42f1f8]
mov edx, dword [0x42f1fc]
push ebx
mov ecx, eax
not ecx
mov ebx, 0x2b2
and ecx, ebx
neg ecx
sbb ecx, ecx
push esi
neg ecx
lea esi, [eax + eax]
or esi, ecx
mov dword [0x42f1f8], esi
test edx, edx
jne 0x410337
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x42f1f8]
mov edx, dword [0x42f1fc]
mov eax, 0x123
cmp edx, eax
cmove edx, eax
mov eax, esi
not eax
and eax, ebx
neg eax
sbb eax, eax
neg eax
lea ecx, [esi + esi]
or ecx, eax
mov eax, ecx
not eax
and eax, ebx
neg eax
sbb eax, eax
neg eax
add ecx, ecx
or ecx, eax
or edx, 0xdc
mov dword [0x42f1f8], ecx
mov dword [0x42f1fc], edx
jne 0x41038a
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x42f1f8]
mov edx, dword [0x42f1fc]
mov eax, ecx
not eax
and eax, ebx
neg eax
sbb eax, eax
mov esi, 0x80000000
and eax, esi
add eax, esi
mov esi, dword [0x4327dc]
shr ecx, 1
or ecx, eax
inc edx
mov eax, 0x261
cmove edx, eax
or edx, 0x28b
mov dword [0x42f1f8], ecx
mov dword [0x42f1fc], edx
jmp 0x4103da
cmp dword [esi + 0x14], 0x10
jb 0x4103ce
mov eax, dword [esi]
jmp 0x4103d0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esi, 0x18
cmp esi, dword [0x4327e0]
jne 0x4103c4
pop esi
pop ebx
ret
Function at 0x412e06
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x42202c
call fcn.00414d1c
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0x10
jb 0x412e22
mov eax, dword [esi]
jmp 0x412e24
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x412ebf
push dword [0x42f228]
cmp dword [0x42f22c], 0x10
mov eax, 0x42f218
cmovae eax, dword [0x42f218]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00411a9e
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x412e96
push ebx
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004065a8
and dword [ebp - 4], 0
push edi
push eax
call fcn.00412e06
mov bl, al
pop ecx
neg bl
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040150a
inc bl
pop ebx
je 0x412e96
xor al, al
jmp 0x412ece
cmp dword [esi + 0x14], 0x10
jb 0x412ea0
mov eax, dword [esi]
jmp 0x412ea2
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x412e92
push esi
mov ecx, 0x4327c8
call fcn.00412f0f
mov byte [edi], 0
jmp 0x412ecc
test eax, 0x410
je 0x412e92
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4132d7
Capabilities:
Delete directory

Disassembly:
mov eax, 0x42202c
call fcn.00414d1c
sub esp, 0x18
cmp dword [0x4327d8], 0
je 0x413374
push ebx
push esi
push edi
mov esi, 0x426370
mov ebx, 0x312
mov edi, 0x4327c8
mov eax, dword [0x42f1fc]
test eax, eax
jne 0x41331c
push 0x5e
push esi
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x42f1fc]
inc eax
mov ecx, 0x24b
cmove eax, ecx
cmp eax, ebx
cmove eax, ebx
mov ecx, edi
mov dword [0x42f1fc], eax
call fcn.00410209
push eax
lea ecx, [ebp - 0x24]
call fcn.0040a83f
and dword [ebp - 4], 0
mov ecx, edi
call fcn.00412edc
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040150a
cmp dword [0x4327d8], 0
jne 0x413303
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x41fbc7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42f5f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.0041394e]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00417ec7
mov dword [ebp - 0x14], eax
cmp dword [0x433650], edi
jne 0x41fcb8
push 0x800
push edi
push 0x428588
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41fc45
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41fd98
push 0x428588
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41fd98
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd98
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x433650], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x433654], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x433658], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x433660], eax
test eax, eax
je 0x41fcb5
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43365c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41fcdd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41fcd0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41fcf2
push 4
pop eax
jmp 0x41fd9a
cmp dword [ebp - 0x14], edi
je 0x41fcf2
push dword [0x433650]
call dword [fcn.00413952]
push 3
jmp 0x41fcd7
mov eax, dword [0x43365c]
mov ebx, dword [fcn.00413952]
cmp eax, esi
je 0x41fd50
cmp dword [0x433660], esi
je 0x41fd50
push eax
call ebx
push dword [0x433660]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41fd50
test eax, eax
je 0x41fd50
call ecx
test eax, eax
je 0x41fd45
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41fd45
test byte [ebp - 8], 1
jne 0x41fd50
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41fd80
mov eax, dword [0x433654]
cmp eax, esi
je 0x41fd7d
push eax
call ebx
test eax, eax
je 0x41fd7d
call eax
mov edi, eax
test edi, edi
je 0x41fd7d
mov eax, dword [0x433658]
cmp eax, esi
je 0x41fd7d
push eax
call ebx
test eax, eax
je 0x41fd7d
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x433650]
call ebx
test eax, eax
je 0x41fd98
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41fd9a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417c3c
leave
ret
Function at 0x40816b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417400]
jne 0x408175
repz ret
jmp fcn.0040df0a

Function at 0x40af91
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406490
and dword [ebp - 0x14], 0
cmp dword [0x448f94], 0
mov dword [ebp - 0x18], eax
jne 0x40b044
push 0x402228
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b0ec
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40221c
push ebx
call edi
test eax, eax
je 0x40b0ec
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40220c
push ebx
mov dword [0x448f94], eax
call edi
push eax
call esi
push 0x4021f8
push ebx
mov dword [0x448f98], eax
call edi
push eax
call esi
push 0x4021dc
push ebx
mov dword [0x448f9c], eax
call edi
push eax
call esi
mov dword [0x448fa4], eax
test eax, eax
je 0x40b044
push 0x4021c4
push ebx
call edi
push eax
call esi
mov dword [0x448fa0], eax
mov eax, dword [0x448fa0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b09d
cmp dword [0x448fa4], ecx
je 0x40b09d
push eax
call esi
push dword [0x448fa4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b09d
test ebx, ebx
je 0x40b09d
call edi
test eax, eax
je 0x40b094
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b094
test byte [ebp - 8], 1
jne 0x40b09d
or dword [ebp + 0x10], 0x200000
jmp 0x40b0d0
mov eax, dword [0x448f98]
cmp eax, dword [ebp - 0x18]
je 0x40b0d0
push eax
call esi
test eax, eax
je 0x40b0d0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b0d0
mov eax, dword [0x448f9c]
cmp eax, dword [ebp - 0x18]
je 0x40b0d0
push eax
call esi
test eax, eax
je 0x40b0d0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x448f94]
call esi
test eax, eax
je 0x40b0ec
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b0ee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040816b
leave
ret
Function at 0x414a10
Capabilities:
Access the windows event log
Connect pipe
Delete directory
Delete file
Get common file path
Get uefi variable
Read pipe
Write pipe

Disassembly:
mov eax, 0x1004
call fcn.0040ede0
cmp dword [0x2b72af4], 0x37
jne 0x414adc
push 0x4035a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
lea eax, [esp + 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403564
push 0x40358c
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0x403620
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
lea eax, [esp + 0x408]
push eax
push 0x40363c
push 0x403668
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea ecx, [esp + 0xc08]
push ecx
push 0x4036b4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov edx, dword [0x2b72f08]
mov ecx, dword [0x2b725d8]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0x1004
ret
Function at 0x415130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x2b72af4]
sub esp, 0x884
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ebp, 0x2443831
cmp eax, 0x47
jne 0x4151b6
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0x403970
mov dword [esp + 0x6c], 0
call esi
xor eax, eax
push eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea eax, [esp + 0x94]
push eax
push 0x4039b0
xor edx, edx
lea ecx, [esp + 0x5c]
push ecx
push edx
push edx
mov word [esp + 0x68], dx
call edi
dec ebp
mov eax, dword [0x448648]
mov dword [0x2b72af4], eax
jne 0x415155
mov dword [esp + 0x20], 0x764d11c7
mov dword [esp + 0x4c], 0x26b44f20
mov dword [esp + 0x24], 0x1f33c7de
mov dword [esp + 0x10], 0x2e56cff9
mov dword [esp + 0x28], 0x6cde8df8
mov dword [esp + 0x14], 0x796abd53
mov dword [esp + 0x34], 0x3ce56ad4
mov dword [esp + 0x1c], 0x581868fc
mov dword [esp + 0x18], 0xc596c70
mov dword [esp + 0x3c], 0x6d5e9115
mov dword [esp + 0x30], 0x22f372d9
mov dword [esp + 0x40], 0x2ad541d0
mov dword [esp + 0x38], 0x7a5f7c43
mov dword [esp + 0x2c], 0x28d520e
mov dword [esp + 0x48], 0x73f3bc07
mov dword [esp + 0x44], 0x51f578e1
add dword [esp + 0x4c], 0x73e38130
mov eax, 0x3a9c3a87
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], 0x6b053f58
add dword [esp + 0x20], 0x2818faf9
add dword [esp + 0x4c], 0x3ab2fc3
sub dword [esp + 0x20], 0x30ad2d47
sub dword [esp + 0x20], 0x4442fc9b
sub dword [esp + 0x28], 0x2285667
add dword [esp + 0x4c], 0x262c99c6
sub dword [esp + 0x14], 0x4dc74448
mov eax, 0x53cf4e1b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x1b067f32
mov eax, 0x67698c83
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x28], 0x7674af1e
mov eax, 0x173863dd
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, 0x3d786fdd
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x38471b91
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x45f07edf
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x18], 0x6fea1ecd
sub dword [esp + 0x34], 0x32f1f16e
add dword [esp + 0x34], 0x6e380599
sub dword [esp + 0x18], 0x3ca08c1e
add dword [esp + 0x30], 0x154e8e1
add dword [esp + 0x14], 0x53bb032d
sub dword [esp + 0x14], 0x11166d6c
sub dword [esp + 0x18], 0x2a6a1594
add dword [esp + 0x14], 0x4fb1fe05
mov eax, 0x4b3ce8e6
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], 0x1bc84bb6
sub dword [esp + 0x30], 0x687c0c2b
add dword [esp + 0x48], 0x36e578c2
sub dword [esp + 0x10], 0x7b5e58ec
mov eax, 0x38d0a1fb
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x40], 0x15793cf4
mov edx, dword [0x44863c]
mov dword [0x2b72f08], edx
call fcn.00414d70
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret 0x10