joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402140
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x4021a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405090]
test esi, esi
jle 0x40228d
mov edi, dword [0x405094]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4021d4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402286
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x4021c0
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x4022ca
lea ebx, [esi + esi*2]
mov esi, dword [0x405094]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405094]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4022aa
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40227f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40227f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405094]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x402294
add dword [0x405090], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x4021de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405094]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402790
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405448
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405440]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4027e5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4027de
test esi, esi
je 0x4027de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4027c0
mov dword [esp], 0x405448
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402a00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402a38
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x402a2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402a3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402a20
xor eax, eax
pop ebx
pop esi
ret
Function at 0x2d815dfb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x110
mov eax, 0x2d8db980
call fcn.2d805c11
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
and dword [ebp - 0x114], 0
push eax
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2d815e33
xor al, al
jmp 0x2d815ea9
lea eax, [ebp - 0x118]
mov dword [ebp - 0x11c], 1
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x118], 0x100
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push str.Version
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test eax, eax
jne 0x2d815e9b
and dword [ebp - 4], eax
lea eax, [ebp - 0x110]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
or dword [ebp - 4], 0xffffffff
pop ecx
push eax
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.2d816526
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2d8074bc
ret
Function at 0x2d8bc0cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x2d8bc0db
pop dword [ebp - 0x14]
mov eax, 0x3945b4c7
sub eax, 0xbb9f3ec
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa7b72b44
add dword [ebp - 0x24], 0xa69b1a07
mov dword [ebp - 0x20], 0x3f6e0907
add dword [ebp - 0x20], 0xf2c5433e
mov dword [ebp - 0x1c], 0xe9a15ada
sub dword [ebp - 0x1c], 0x9d5516ac
mov dword [ebp - 0x18], 0x67d0527f
add dword [ebp - 0x18], 0x982fad81
lea eax, [ebp - 0x24]
push eax
mov eax, 0xea589c32
add eax, 0x43367476
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa844ef19
sub dword [ebp - 0x24], 0x33d285c3
mov dword [ebp - 0x20], 0xac660395
add dword [ebp - 0x20], 0x95065de0
mov dword [ebp - 0x1c], 0xe89de709
sub dword [ebp - 0x1c], 0x852e7a9d
mov dword [ebp - 0x18], 0xc0a9a38c
sub dword [ebp - 0x18], 0xc0a9a38c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8d70565d
add eax, 0xa01eba43
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x6a856
push 0
call eax
mov ecx, 0xe1630f3c
sub ecx, 0xe162c1fa
xor ebx, ebx
add ebx, eax
mov edi, 0x6333c1ae
add edi, 0xca666a52
add edi, dword [ebp - 0x14]
mov edx, 0xc86171c5
add edx, 0x242d8fda
sub dword [ebp - 4], 0x1a98c6b3
mov esi, dword [edi]
sub dword [ebp - 4], edi
xor esi, edx
add dword [ebp - 0x10], eax
mov dword [ebx], esi
sub dword [ebp - 0x10], edx
add ebx, 0xa101914b
sub ebx, 0xa1019147
add edi, 4
loop 0x2d8bc1ff
add eax, 0x127db
mov ebx, eax
add eax, 0x81021643
sub eax, 0x8102163e
mov ecx, 0xbd3e0da3
add ecx, 0x7041f25d
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10003001
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [0x715070]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1000316b
push 0x40
mov edx, esi
mov ecx, edi
call 0x10005240
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call 0x10005240
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x100030c9
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call 0x10005240
add esi, 0x28
dec edi
jne 0x10003087
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x100030c9
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call 0x10005240
lea esi, [esi + 0x28]
dec ebx
jne 0x100030ae
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10001f85
push dword [ebp - 0x18]
mov ecx, dword [0x716438]
mov edx, edi
call fcn.10001ee1
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10003168
cmp dword [ebx + 0x64], 0
je 0x10003168
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10003110
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x10003114
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x1000313d
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, eax
xor eax, eax
jmp 0x1000313f
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10003162
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.10001eb3
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x52328a
Capabilities:
Encode data using xor

Disassembly:
inc esi
mov byte [0x845b937a], al
lds esi, [ebx - 0x5cecb2a9]
adc dword [eax - 0x2a], esp
sbb bl, ah
jmp 0x523239
mov dword [eax], 0x31c40f3
push edi
jo 0x523291
adc bl, byte [ebp + 0x58f31012]
loopne 0x5232ea
adc al, 0x7f
fld dword [ebx - 0x42]
invalid
lodsb al, byte [si]
dec esi
push ss
cmpsd dword [esi], dword es:[edi]
cwde
xchg ebx, eax
xchg ecx, eax
sal byte [esi], 1
test dword [edx], 0xaca0615b
pop ebx
popal
mov al, byte [0xa99615ac]
and ebp, ecx
pop ss
push ebx
shl ebp, 0xc6
mov eax, 0x63c4cc81
inc ecx
lcall 0x3d90, 0x3a6c95a7
loopne 0x523233
xchg bh, ah
push es
push ebx
push edi
mov al, byte [0x5740c316]
out 0x5a, eax
lodsb al, byte [esi]
xor dl, bl
sbb byte [eax], 1
xor ah, byte [ecx]
cmc
js 0x523263
or esi, dword [ebx - 0x3d5edae5]
leave
xchg ecx, eax
adc esp, dword [ebp - 0x3d]
cmp ah, byte [ebx + 0xcd7ecc7]
invalid
or al, 0xf0
ret 0xe309
add bh, byte [edi + 0x6604a5e4]
lodsb al, byte [esi]
leave
xchg dword [esi + 0x2f22a093], eax
adc eax, 0x33f9b0f0
call 0xd6655385
mov fs, word [esi - 0x16df5f0d]
mov bl, 0x3a
sbb edi, dword [0x92e27018]
test eax, 0xb0a0da60
jl 0x5232b7
fisub dword [eax + 0x5ba07cb0]
pop ebx
test dword [esi], esi
inc ebp
push ss
mov esp, 0xb6501f46
jecxz 0x523364
nop
out 0xcb, al
and eax, 0x668506c0
mov al, 0xdd
jne 0x5232da
test dword [esi - 0x50], esp
fnsave dword [ebp - 0x55]
jno 0x523329
xchg esi, eax
leave
jle 0x523312
sub dl, byte [ebp + esi*2 + 0x188026b5]
inc eax
inc ebp
int 0xf0
stosd dword es:[edi], eax
pop eax
sbb byte [edi + eax*8], ah
cdq
arpl word [ebx - 0x6c], dx
pop eax
mov ch, 0xf1
pop esi
add byte [eax + 0x22da5ef0], ch
inc ebp
movsd dword es:[edi], dword [esi]
invalid
lea ebp, [ecx + edx + 0x2107533c]
pop ss
test eax, 0x2d87c569
add ecx, dword [edi - 0x7fbed163]
shr dword [eax], cl
out 0xf, eax
loopne 0x5233ba
rcl byte [eax]
mov ch, 0xe1
arpl word [esi], bp
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
push esi
add eax, 0x25901300
mov ebp, 0x3396a23d
iret
inc ebx
sub dh, byte [eax - 0x13]
imul ebp, dword [edx], 0xffffffe3
salc
xchg esi, eax
inc edi
push ebx
mov dh, 0x47
xlatb
sub al, byte [esi - 0x3f]
aad 0x72
xlatb
push ebx
bound esp, qword [edx]
call 0x5d84c9b
xchg edi, eax
pop ecx
leave
xor eax, 0x57413028
jns 0x5233d1
stosd dword es:[edi], eax
hlt
Function at 0x53dce8
Capabilities:
Check for software breakpoints

Disassembly:
push es
adc al, 4
cmp al, 0x27
arpl word [ebx], bx
jns 0x95478348
xchg ebx, eax
call 0xc36196f
mul dword [ebx - 0x5c]
shl byte [ebp - 0x70c49acd], cl
push edx
add bl, byte [ebp + 0x5c]
jecxz 0x53dd63
mov byte [0x50733f7d], al
invalid
and al, 0xbd
push ds
or edi, edx
std
cmpsb byte [esi], byte es:[edi]
int 0x85
and dword [ebx], eax
push edx
inc esi
push ss
movsb byte es:[edi], byte [esi]
sal dword [eax - 0xcdab4c8], 1
xchg edx, eax
popal
out 0x4e, al
dec ebx
and eax, 0xe66192f3
dec esi
aam 0xdc
int 0x95
insb byte es:[edi], dx
test dword [esi], esi
mov dl, 0xcd
aas
jae 0x53ddc2
sub byte [eax], bh
hlt
dec ecx
daa
xchg ebx, eax
adc ebp, dword [edx - 0x72b3427d]
pushfd
lahf
and al, 0x57
fsetpm
int 0x75
mov ebp, 0xc9139d82
imul edx, dword [esi - 0x3a], 0xc88d92ef
push esp
xchg dword [edi - 0xbcd3a33], esp
jmp 0x53dd75

Function at 0x5bafb3
Capabilities:
Encode data using xor

Disassembly:
xchg byte [0xf4b73e1], al
push 0xffffffffffffff9a
mov bh, 3
in al, dx
imul ebx, dword [edx], 0xffffffb6
add al, 0x8e
invalid

Function at 0x612c5f
Capabilities:
Check for software breakpoints

Disassembly:
in al, 5
adc dword [ebp - 0x54472763], edi
push ebx
add dword [ecx - 0x5f], eax
mov es, word [ebx + 0x2fc7cfba]
je 0x612c8e
adc al, 0xff
retf 0x864f
fsubp st(2)
dec ebx
je 0x612ca1
inc esi
xor eax, 0x3231775
xchg ah, bh
out dx, al
xor byte [ecx + 0x6a], al
mov ebp, 0x6c18648d
call edx
sbb byte fs:[edi + edi*8 - 0x2e], ch
insb byte es:[edi], dx
aam 0xdc
add dh, byte [ebx + 0x35]
clc
or al, 0xfd
and eax, 0x605f1b53
mov esp, 0x96d48e82
mov al, byte [0x8e7f0ceb]
outsd dx, dword [esi]
add ebx, edi
cmp byte [esi + 0x79], 0xcc
aam 0x37
out 0x9c, eax
adc al, 0xc7
daa
mov dl, 0x16
ficomp word [edi - 0x56]
and eax, 0x3dc40665
lahf
xchg esi, eax
pop ecx
push dword [ecx]
mov esp, 0x79c776d0
imul ebx, dword [ebp + esi*2 - 0x71], 0x49
lodsb al, byte [esi]
sbb cl, bh
push es
arpl word [esi], ax
sti
movsd dword es:[edi], dword [esi]
push ds
sub edi, ebp
sub dword [edx - 0x21dee21c], 0x40545599
test al, 0xc
invalid
Function at 0x4051d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44393c]
jne 0x4051de
repz ret
jmp fcn.00408fc2

Function at 0x40ba5c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406ba0
and dword [ebp - 4], 0
cmp dword [0x445250], 0
mov ebx, eax
jne 0x40bb0d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bbbe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40bbbe
push eax
call fcn.00406b2e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x445250], eax
call esi
push eax
call fcn.00406b2e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x445254], eax
call esi
push eax
call fcn.00406b2e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x445258], eax
call esi
push eax
call fcn.00406b2e
pop ecx
mov dword [0x445260], eax
test eax, eax
je 0x40bb0d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406b2e
pop ecx
mov dword [0x44525c], eax
mov eax, dword [0x44525c]
cmp eax, ebx
je 0x40bb65
cmp dword [0x445260], ebx
je 0x40bb65
push eax
call fcn.00406ba9
push dword [0x445260]
mov esi, eax
call fcn.00406ba9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bb65
test edi, edi
je 0x40bb65
call esi
test eax, eax
je 0x40bb5c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bb5c
test byte [ebp - 0xc], 1
jne 0x40bb65
or dword [ebp + 0x10], 0x200000
jmp 0x40bb9e
mov eax, dword [0x445254]
cmp eax, ebx
je 0x40bb9e
push eax
call fcn.00406ba9
pop ecx
test eax, eax
je 0x40bb9e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bb9e
mov eax, dword [0x445258]
cmp eax, ebx
je 0x40bb9e
push eax
call fcn.00406ba9
pop ecx
test eax, eax
je 0x40bb9e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445250]
call fcn.00406ba9
pop ecx
test eax, eax
je 0x40bbbe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bbc0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
or ebx, 0x34
add edi, 0x32
and edi, 0xd2
dec edx
rcr eax, 0xa8
sbb edi, 0x80
add edx, 0x82
or edi, 0x59
inc edx
bswap edi
bswap edi
and edi, 0x9e
imul edx
not edi
not edi
bswap edx
sub edx, 0xf4
rcl esi, 0x54
dec edi
bswap eax
neg edx
rol eax, 0x9c
bswap edx
not edi
not edi
rcr ebx, 0x5e
not ebx
rcr eax, 0xbe
sub esi, 0x1b
bswap esi
not eax
sub ebx, 0x70
dec edx
mov eax, 0xd4
inc ebx
sub eax, 0x75
and edx, 6
inc esi
bswap esi
dec esi
sub ebx, 0xa8
sbb eax, 0x7e
inc edx
not eax
add eax, 0xf2
inc edx
imul eax
rcl ebx, 0xcf
and ebx, 0x97
mov ebx, 0xb8
xor ecx, ecx
xor edi, edi
and ebx, 0xd7
not edx
mov edi, 0xe8
sub ebx, 0x36
neg eax
bswap edi
sbb edi, 0x9d
rcr ebx, 0x3b
not eax
inc edi
not edx
rol esi, 0x1a
neg edx
add eax, 0x49
imul esi
sub edi, 0xeb
bswap ebx
rol ebx, 0xd0
not ebx
neg esi
rol edi, 0x39
bswap esi
or esi, 0x8d
not eax
rcl ebx, 0x3c
bswap ebx
and ebx, 0x7e
rol esi, 4
rol esi, 0xa7
neg eax
mov eax, 0xc0
imul edx
ror eax, 0xff
and edi, 0xeb
sub ebx, 0xf1
inc esi
dec edx
neg eax
inc ebx
not esi
not edx
sub edi, 0xa2
dec eax
not eax
sbb edi, 0x2a
sub ebx, 0x42
and edi, 0x18
inc esi
mov esi, 0x27
dec edx
mov ecx, dword [ebp + 0xc]
neg ebx
or edi, 0x84
rol esi, 0xf0
and ebx, 0x90
not eax
dec eax
rcl edx, 0x9d
rcr eax, 0xe4
sbb esi, 0x21
ror edi, 0x25
rcl eax, 0x7c
inc edi
inc eax
neg esi
rcl ebx, 0xff
add eax, 0xc9
neg ebx
rcr eax, 0x6c
bswap eax
rcl esi, 0xbd
bswap edi
imul edi
not edx
or edx, 0x33
sbb esi, 0x21
ror eax, 0xb6
rcl eax, 8
imul esi
inc esi
and esi, 0xbb
add ebx, 0x19
add ebx, 0x24
add edx, 0x9d
or eax, 0x25
bswap edi
rcr edi, 0x64
not edi
imul ebx
rol edi, 0xd4
dec esi
rcr esi, 0x59
rcl eax, 0x66
dec eax
imul edi
bswap ebx
dec esi
and edx, 0x91
inc esi
dec edx
bswap esi
mov edi, dword [ebp + 8]
xor esi, ebx
xor esi, ebx
mov ebx, eax
not byte [edi]
mov esi, esi
mov esi, esi
xor esi, ebx
mov esi, eax
xor esi, eax
xor ebx, ebx
xor esi, ebx
mov ebx, esi
xor ebx, esi
add byte [edi], 0x26
mov ebx, esi
xor eax, ebx
xor esi, ebx
mov eax, esi
xor eax, ebx
xor esi, ebx
mov ebx, ebx
xor ebx, esi
xor eax, ebx
sub byte [edi], 0x86
mov ebx, eax
xor eax, eax
mov eax, esi
mov ebx, ebx
xor ebx, esi
mov esi, esi
mov ebx, esi
xor esi, esi
xor ebx, eax
imul byte [edi]
inc edi
loop 0x4103ba
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x435890
Capabilities:
Copy file
Get thread local storage value
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b0
cmp dword [0x4e1be4], 0x516
jne 0x4358b5
push 0
lea eax, [ebp - 0x9b0]
push eax
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push ebx
mov ebx, dword [ebp + 0xc]
push esi
shr ebx, 3
xor esi, esi
test ebx, ebx
je 0x435904
push edi
mov edi, dword [ebp + 8]
cmp dword [0x4e1be4], 0x29
jne 0x4358e8
push 0
push 0
push 0
push 0
push 0x4013c0
push 0x4013f0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
cmp dword [0x4e1be4], 0x1c
je 0x43590c
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call fcn.00435730
inc esi
add edi, 8
cmp esi, ebx
jb 0x4358c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x401438
push 0
lea edx, [ebp - 0x9b0]
push edx
push 0x4014a8
push 0x401564
push 0x401598
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea ecx, [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x435990
Capabilities:
Copy file
Set current directory
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
cmp dword [0x4e1be4], 0x37
jne 0x435afd
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0x4015f4
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
push 0
push 0x4015fc
push 0
push 0x401638
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0x20]
mov word [ebp - 0x10], dx
push ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
push edx
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
push 0x401688
push 0x4016d4
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea edx, [ebp - 0xa18]
push edx
push 0x4016e8
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x401730
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x40177c
push 0x401798
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0x4017c8
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov ecx, dword [0x4e1be8]
mov eax, dword [ebp + 8]
mov dl, byte [ecx + eax + 0x12336]
mov ecx, dword [0x4de1e4]
mov byte [ecx + eax], dl
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x4e1be8]
mov eax, dword [ebp + 8]
mov cl, byte [edx + eax + 0x12336]
mov edx, dword [0x4de1e4]
mov byte [edx + eax], cl
mov esp, ebp
pop ebp
ret 4