joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x510489
push eax
call fcn.00518140
mov eax, dword [edi + 0x14]
add esp, 4
cmp dword [eax + 0x44], 0
je 0x510489
push eax
call fcn.00517330
add esp, 4
mov esi, dword [edi + 0x18]
test esi, esi
je 0x5104b2
push esi
call fcn.00518140
add esp, 4
cmp dword [esi + 0x44], 0
je 0x5104a8
push esi
call fcn.00517330
add esp, 4
mov esi, dword [esi + 0x80]
test esi, esi
jne 0x510490
cmp dword [edi + 0x20], 0
mov esi, dword [edi + 0x3c]
je 0x5104d1
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_readonly_database.
push 0x238d
call fcn.00448c10
add esp, 0x10
cmp dword [edi + 0x1c], 0
je 0x5104f3
cmp dword [edi + 0x40], 0
jne 0x5104f3
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.00448c10
add esp, 0x10
lea eax, [edi + 0x48]
push eax
push dword [edi + 8]
push dword [edi + 0xc]
call fcn.004a9c80
add esp, 0xc
test eax, eax
jne 0x51051d
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.00448c10
add esp, 0x10
mov ebp, dword [edi + 0x38]
test esi, esi
je 0x5105c3
cmp dword [esi + 4], 0
je 0x5105c3
movzx eax, word [edi + 0x2e]
push ebx
push eax
push 0
push eax
call fcn.00470460
add esp, 4
push eax
call fcn.004dc1a0
add esp, 0xc
mov ebx, eax
nop
mov eax, dword [esi]
mov dword [ebx], eax
cmp dword [edi + 0x28], 0
je 0x510560
movzx ecx, word [edi + 0x30]
jmp 0x510562
xor ecx, ecx
mov eax, ebp
xor edx, edx
call fcn.004db060
push edx
push eax
movzx eax, word [edi + 0x2e]
push eax
push ebx
push dword [edi + 8]
call fcn.00446db0
movzx ecx, word [edi + 0x2e]
add esp, 0x14
cmp eax, ecx
je 0x51059c
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.00448c10
add esp, 0x10
mov dword [edi + 0x78], 1
mov ebp, dword [esi]
mov dword [esi + 4], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x5105b9
cmp dword [esi + 4], 0
jne 0x510550
push ebx
call fcn.00470430
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x510950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
cmp dword [esi + 0x20], 0
mov ebx, dword [esi + 8]
mov dword [esp + 0x10], ebx
je 0x51097e
push 0
push 0
push str.hb_cdxIndexGetAvailPage_on_readonly_database.
push 0x238d
call fcn.00448c10
add esp, 0x10
cmp dword [esi + 0x1c], 0
je 0x5109a0
cmp dword [esi + 0x40], 0
jne 0x5109a0
push 0
push 0
push str.hb_cdxIndexGetAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.00448c10
add esp, 0x10
mov edi, dword [esi + 0x38]
test edi, edi
je 0x510a3a
cmp edi, 0xffffffff
je 0x510a3a
mov ebp, dword [esp + 0x20]
test ebp, ebp
jne 0x510a42
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5109e5
mov ecx, dword [eax]
mov dword [esi + 0x38], ecx
mov ecx, dword [eax + 8]
push eax
mov dword [esi + 0x3c], ecx
call fcn.00470430
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esi + 0x28], 0
je 0x5109f1
movzx ecx, word [esi + 0x30]
jmp 0x5109f3
xor ecx, ecx
mov eax, edi
xor edx, edx
call fcn.004db060
push edx
push eax
push 4
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00446910
add esp, 0x14
cmp eax, 4
je 0x510a29
push 0
push 0
push str.hb_cdxIndexGetAvailPage:_Read_index_page_failed.
push 0x3f2
call fcn.00448c10
add esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x38], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x510a48
movzx eax, word [esi + 0x2c]
jmp 0x510a4c
movzx eax, word [esi + 0x2e]
mov edi, dword [esi + 0x34]
xor ebx, ebx
movzx eax, ax
mov edx, edi
mov dword [esp + 0x14], eax
cmp edi, 0xffffffff
jne 0x510a86
cmp dword [esi + 0x28], ebx
je 0x510a6a
movzx edi, word [esi + 0x30]
jmp 0x510a6c
xor edi, edi
push dword [esp + 0x10]
call fcn.004469e0
add esp, 4
mov ecx, edi
call fcn.004db080
mov edi, eax
mov edx, eax
mov dword [esi + 0x34], edi
movzx eax, word [esi + 0x2e]
mov dword [esp + 0x1c], eax
nop
cmp dword [esi + 0x28], 0
je 0x510a9a
xor ecx, ecx
jmp 0x510a9e
movzx ecx, word [esi + 0x30]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x14]
add edx, eax
mov eax, dword [esp + 0x1c]
add ebx, eax
cmp ebx, ecx
jb 0x510a90
mov dword [esi + 0x34], edx
test ebp, ebp
je 0x510b5c
cmp ecx, eax
cmovae eax, ecx
push eax
push 0
push eax
mov dword [esp + 0x28], eax
call fcn.00470460
add esp, 4
push eax
call fcn.004dc1a0
lea ecx, [esi + 0x48]
mov ebp, eax
push ecx
push dword [esi + 8]
push dword [esi + 0xc]
call fcn.004a9c80
add esp, 0x18
test eax, eax
jne 0x510b07
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.00448c10
add esp, 0x10
cmp dword [esi + 0x28], 0
je 0x510b13
movzx ecx, word [esi + 0x30]
jmp 0x510b15
xor ecx, ecx
mov eax, edi
xor edx, edx
call fcn.004db060
mov ebx, dword [esp + 0x1c]
push edx
push eax
push ebx
push ebp
push dword [esp + 0x20]
call fcn.00446db0
add esp, 0x14
cmp eax, ebx
je 0x510b4c
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.00448c10
add esp, 0x10
push ebp
mov dword [esi + 0x78], 1
call fcn.00470430
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x514250
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
test byte [esi + 0x20], 2
mov eax, dword [esi + 0x40]
mov ebx, dword [esi + 0x10]
movzx eax, word [eax + 0x16]
mov dword [esp + 0x1c], eax
lea ebp, [eax + 8]
jne 0x514288
push 0
push 0
push str.hb_cdxPageLeafDelKey:_page_is_not_a_leaf.
push 0x23f1
call fcn.00448c10
add esp, 0x10
test ebx, ebx
js 0x514291
cmp ebx, dword [esi + 0xc]
jl 0x5142a7
push 0
push 0
push str.hb_cdxPageLeafDelKey:_wrong_iKey_index.
push 0x23f1
call fcn.00448c10
add esp, 0x10
mov edi, dword [esi + 0x34]
test edi, edi
jne 0x5142c9
mov eax, dword [esi + 0xc]
imul eax, ebp
push eax
call fcn.00470460
mov edi, eax
push edi
push esi
call fcn.005140b0
add esp, 0xc
mov dword [esi + 0x34], edi
lea ecx, [ebx + 1]
imul ecx, ebp
mov dword [esp + 0x18], ecx
movzx eax, word [ecx + edi - 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x40]
movzx edx, word [eax + 0x16]
movzx eax, word [ecx + edi - 2]
movzx ecx, byte [esi + 0x1f]
sub ecx, eax
mov eax, dword [esi + 0xc]
sub ecx, dword [esp + 0x14]
dec eax
add ecx, edx
mov dword [esp + 0x10], ecx
cmp ebx, eax
jge 0x514396
lea eax, [ebx + 2]
xor ecx, ecx
imul eax, ebp
sub eax, 4
mov dword [esp + 0x28], eax
movzx eax, word [edi + eax]
sub dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
test ebx, ebx
jle 0x514383
mov esi, dword [esp + 0x18]
lea eax, [ebx - 1]
mov ecx, dword [esp + 0x14]
imul eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
add eax, edi
movzx eax, word [eax + esi + 6]
mov esi, dword [esp + 0x30]
sub edx, eax
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
cmp ecx, edx
jle 0x51435b
mov ecx, edx
jmp 0x514383
jge 0x514383
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
lea edx, [edi + esi]
mov edi, dword [esp + 0x1c]
add edx, ecx
sub eax, esi
mov esi, eax
mov al, byte [edx]
cmp al, byte [esi + edx]
jne 0x51437f
inc ecx
inc edx
cmp ecx, edi
jl 0x514372
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x34]
mov edx, dword [esp + 0x28]
add dword [esp + 0x10], ecx
mov word [edx + eax], cx
mov ecx, dword [esp + 0x10]
mov edi, dword [esi + 0xc]
add word [esi + 0x32], cx
dec edi
movzx eax, word [esi + 0x32]
mov dword [esi + 0xc], edi
cmp edi, ebx
jle 0x5143cd
mov eax, dword [esp + 0x18]
sub edi, ebx
add eax, dword [esi + 0x34]
imul edi, ebp
imul ebp, ebx
push edi
add ebp, dword [esi + 0x34]
push eax
push ebp
call fcn.004dbc20
mov edi, dword [esi + 0xc]
add esp, 0xc
movzx eax, word [esi + 0x32]
xor edx, edx
movzx ebp, ax
cmp ebx, edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 1
setge dl
test edi, edi
jne 0x5143ee
or edx, 4
jmp 0x5143f6
test bp, bp
jns 0x5143f6
or edx, 2
movzx ecx, byte [esi + 0x1f]
mov eax, edx
pop edi
or eax, 8
cmp bp, cx
pop esi
pop ebp
cmovl eax, edx
pop ebx
add esp, 0x1c
ret
Function at 0x54cef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
test edx, edx
jne 0x54cf01
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
not eax
cmp esi, 8
jb 0x54cfbd
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
sub edi, 1
jne 0x54cf16
pop edi
test esi, esi
je 0x54cfdb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x768db0]
sub esi, 1
jne 0x54cfc1
not eax
pop esi
ret

Function at 0x54f3c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x54f3ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x54f3ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x34e85f19
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
mov ecx, 0x452f4ec9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x12c35760
Capabilities:
Encode data using xor

Disassembly:
jmp 0x12c3576a
pushal
call 0x12c35770
pop ebp
sub ebp, 0x10
sub ebp, 0x2c35760
mov al, byte [esp + 0x28]
cmp al, 1
je 0x12c35794
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x12c3579d
mov eax, 0x2c35760
add eax, ebp
add eax, 0x63
mov ecx, 0x5c0
mov edx, 0x1dc911c4
xor byte [eax], dl
inc eax
dec ecx
jne 0x12c357b4
jmp 0x12c357c7
dec edi
or dword [edi + 0x4d], ecx
clc
invalid
Function at 0x415f00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov eax, 0x66666667
push 0
push 0x18
push 0
movzx esi, word [edi + 4]
lea ecx, [esi - 1]
imul ecx
sar edx, 3
mov ebp, edx
shr ebp, 0x1f
inc ebp
add ebp, edx
lea eax, [ebp*4]
add eax, ebp
shl eax, 2
mov ebx, eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
sub ebx, esi
add eax, 4
mov dword [esp + 0x2c], ebx
push eax
mov dword [esp + 0x20], eax
call fcn.00414af0
movzx eax, word [edi + 4]
add esp, 0x10
cmp ebx, eax
ja 0x416087
push dword [esp + 0x18]
call fcn.00444a76
mov ebx, eax
xor esi, esi
xor eax, eax
mov dword [esp + 0x20], ebx
push eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x30], al
movzx eax, word [edi + 4]
push eax
push dword [edi + 8]
push ebx
call fcn.00414a10
mov eax, dword [esp + 0x34]
add esp, 0x14
test eax, eax
je 0x415fab
push esi
push eax
movzx eax, word [edi + 4]
push dword [edi + 8]
add eax, ebx
push eax
call fcn.00414a10
add esp, 0x10
xor edi, edi
cmp dword [esp + 0x18], esi
jbe 0x416066
xor ecx, ecx
lea esp, [esp]
mov eax, 0xcccccccd
xor bl, bl
mul ecx
shr edx, 2
lea eax, [edx + edx*4]
mov edx, dword [esp + 0x10]
sub ecx, eax
jne 0x415fe6
mov eax, dword [esp + 0x14]
dec eax
cmp eax, 0x15
ja 0x415fe6
mov byte [edx + esi], 0x2d
inc esi
xor ecx, ecx
test ebp, ebp
je 0x415fff
mov edx, dword [esp + 0x1c]
lea eax, [ecx + edx]
inc ecx
xor bl, byte [eax + edi]
cmp ecx, ebp
jb 0x415ff0
mov edx, dword [esp + 0x10]
movzx ecx, byte [esp + 0x28]
and ecx, 0x80000003
jns 0x416011
dec ecx
or ecx, 0xfffffffc
inc ecx
mov al, bl
ror al, cl
movzx ecx, al
mov byte [esp + 0x28], al
mov eax, ecx
shr eax, 3
xor eax, ecx
and eax, 0x8000001f
jns 0x41602f
dec eax
or eax, 0xffffffe0
inc eax
cmp al, 8
jae 0x416037
add al, 0x32
jmp 0x416049
cmp al, 0x10
jae 0x41603f
add al, 0x39
jmp 0x416049
cmp al, 0x15
jae 0x416047
add al, 0x3a
jmp 0x416049
add al, 0x3b
mov ecx, dword [esp + 0x14]
add edi, ebp
mov byte [edx + esi], al
inc ecx
inc esi
mov dword [esp + 0x14], ecx
cmp edi, dword [esp + 0x18]
jb 0x415fc0
mov ebx, dword [esp + 0x1c]
push ebx
call fcn.00444a71
add esp, 4
test esi, esi
je 0x41607d
mov eax, dword [esp + 0x2c]
mov dword [eax], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret

Function at 0x4161d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41624e
cmp byte [esi], 0xbc
push edi
jne 0x416207
cmp byte [esi + 1], 0xbd
jne 0x416207
lea eax, [esi + 2]
push 0
push eax
call fcn.00414e80
push 0
push esi
mov edi, eax
call fcn.00414ee0
add esp, 0x10
mov byte [eax + edi - 4], 0
mov eax, edi
pop edi
pop esi
ret
xor edi, edi
push edi
push esi
call fcn.00414ee0
inc eax
push eax
call fcn.00444a76
mov edx, eax
add esp, 0xc
mov al, byte [esi]
xor al, 0x23
mov byte [edx], al
cmp byte [esi], 0
je 0x416245
mov ecx, edx
sub ecx, esi
jmp 0x416230
mov al, byte [esi + 1]
lea esi, [esi + 1]
dec al
inc edi
xor al, byte [ecx + esi - 1]
mov byte [ecx + esi], al
cmp byte [esi], 0
jne 0x416230
mov byte [edi + edx], 0
mov eax, edx
pop edi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x419d80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5923b4]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [esp + 0x418]
push esi
mov esi, dword [esp + 0x418]
push edi
xor edi, edi
test esi, esi
je 0x419e78
push 0x400
lea eax, [esp + 0x15]
mov byte [esp + 0x14], 0
push edi
push eax
call fcn.0042a640
push ebx
push esi
call fcn.00414ee0
add esp, 0x14
mov dword [esp + 0xc], eax
cmp eax, 2
jbe 0x419e56
cmp byte [esi], 0x7c
jne 0x419e56
cmp byte [esi + eax - 1], 0x7c
jne 0x419e56
push ebp
lea eax, [esi + 1]
push ebx
push eax
call fcn.00414e80
mov ebp, eax
mov eax, dword [esp + 0x18]
push 0x575e4c
push ebp
mov byte [eax + ebp - 2], 0
call fcn.004323a4
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
je 0x419e44
push eax
push 0x400
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0043263a
add esp, 0x10
test eax, eax
je 0x419e38
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00414e80
add esp, 8
mov edi, eax
push dword [esp + 0x10]
call fcn.00432051
add esp, 4
test ebp, ebp
je 0x419e51
push ebp
call fcn.00444a71
add esp, 4
pop ebp
test edi, edi
jne 0x419e78
push ebx
push esi
call fcn.00414e80
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00424604
add esp, 0x40c
ret
mov ecx, dword [esp + 0x414]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00424604
add esp, 0x40c
ret
Function at 0x41a990
Capabilities:
Reference wmi statements

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
push esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00420360
mov edi, eax
add esp, 4
test edi, edi
jne 0x41a9d2
test esi, esi
je 0x41aaef
mov eax, dword [esi + 8]
test eax, eax
je 0x41aaef
push 0x59
push str.Failed_to_create_WMI_object
jmp 0x41aae6
push esi
push str.SELECT__FROM_Win32_NetworkAdapter
push edi
call fcn.00420640
add esp, 0xc
test eax, eax
jne 0x41aad4
lea esp, [esp]
push esi
push edi
call fcn.004205f0
add esp, 8
test eax, eax
je 0x41aaef
lea eax, [esp + 0x10]
push eax
push str.PNPDeviceID
push edi
call fcn.00420630
add esp, 0xc
test eax, eax
jne 0x41aaa6
push esi
push 6
push str.VMBUS_
push dword [esp + 0x1c]
call fcn.00415040
add esp, 0x10
test eax, eax
jne 0x41aaa6
lea eax, [esp + 0xc]
push eax
push str.Guid
push edi
call fcn.00420630
add esp, 0xc
test eax, eax
jne 0x41aa92
push dword [esp + 0xc]
call fcn.0041a8d0
add esp, 4
test eax, eax
je 0x41aa92
mov ebx, 1
test esi, esi
je 0x41aa92
mov eax, dword [esi + 8]
test eax, eax
je 0x41aa7c
push 0x6b
push str.Azure_detected_on_the_following_NIC:
push 9
push dword [esi]
call eax
add esp, 0x10
mov eax, dword [esi + 8]
test eax, eax
je 0x41aa92
push 0x6c
push dword [esp + 0x10]
push 9
push dword [esi]
call eax
add esp, 0x10
push dword [esp + 0xc]
call fcn.00444a71
add esp, 4
mov dword [esp + 0xc], 0
push dword [esp + 0x10]
call fcn.00444a71
add esp, 4
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x41a9f0
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
test esi, esi
je 0x41aaef
mov eax, dword [esi + 8]
test eax, eax
je 0x41aaef
push 0x78
push str.Error:_Cmn_Wmi_query_failed
push 9
push dword [esi]
call eax
add esp, 0x10
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x41b940
Capabilities:
Reference wmi statements

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, 1
push edi
push esi
mov dword [esp + 0x10], 0
call fcn.00420360
mov edi, eax
add esp, 4
test edi, edi
jne 0x41b99a
test esi, esi
je 0x41bb56
mov eax, dword [esi + 8]
test eax, eax
je 0x41bb56
push 0xcf
push str.Failed_to_create_WMI_object
push 9
push dword [esi]
call eax
add esp, 0x10
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
push str.SELECT_Name_FROM_Win32_PROCESSOR
push edi
call fcn.00420640
add esp, 0xc
test eax, eax
jne 0x41ba26
push esi
push edi
call fcn.004205f0
add esp, 8
test eax, eax
je 0x41ba10
jmp 0x41b9c0
lea eax, [esp + 0xc]
push eax
push str.Name
push edi
call fcn.00420630
add esp, 0xc
test eax, eax
jne 0x41b9ed
push esi
push str.QEMU_Virtual_CPU
push dword [esp + 0x14]
call fcn.004152b0
add esp, 0xc
test eax, eax
jne 0x41ba0e
push dword [esp + 0xc]
call fcn.00444a71
push esi
push edi
mov dword [esp + 0x18], 0
call fcn.004205f0
add esp, 0xc
test eax, eax
jne 0x41b9c0
jmp 0x41ba10
xor ebx, ebx
push dword [esp + 0xc]
call fcn.00444a71
add esp, 4
test ebx, ebx
je 0x41bb56
jmp 0x41ba44
test esi, esi
je 0x41ba44
mov eax, dword [esi + 8]
test eax, eax
je 0x41ba44
push 0xe6
push str.Error:_Cmn_Wmi_query_failed
push 9
push dword [esi]
call eax
add esp, 0x10
push esi
push str.SELECT__FROM_Win32_DiskDrive
push edi
call fcn.00420640
add esp, 0xc
test eax, eax
jne 0x41bb38
push esi
push edi
call fcn.004205f0
add esp, 8
test eax, eax
je 0x41bb1c
lea ecx, [ecx]
lea eax, [esp + 0xc]
push eax
push str.Caption
push edi
call fcn.00420630
add esp, 0xc
test eax, eax
jne 0x41ba9d
push esi
push str.QEMU
push dword [esp + 0x14]
call fcn.004152b0
add esp, 0xc
test eax, eax
jne 0x41bb1a
push dword [esp + 0xc]
call fcn.00444a71
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push str.Model
push edi
call fcn.00420630
add esp, 0x10
test eax, eax
jne 0x41badb
push esi
push str.QEMU
push dword [esp + 0x14]
call fcn.004152b0
add esp, 0xc
test eax, eax
jne 0x41bb1a
push dword [esp + 0xc]
call fcn.00444a71
push esi
push edi
mov dword [esp + 0x18], 0
call fcn.004205f0
add esp, 0xc
test eax, eax
jne 0x41ba70
push dword [esp + 0xc]
call fcn.00444a71
add esp, 4
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
xor ebx, ebx
push dword [esp + 0xc]
call fcn.00444a71
add esp, 4
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
test esi, esi
je 0x41bb56
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41bb56
push 0x112
push str.Error:_Cmn_Wmi_query_failed
push 9
push dword [esi]
call ecx
add esp, 0x10
push edi
call fcn.00420580
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret