joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402600
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
dec esi
mov eax, 0xb0
or eax, 0xb8
inc esi
imul edx
or edi, 0x94
mov ebx, 0x3f
and edi, 0xfc
imul esi
dec eax
bswap edi
neg eax
dec ebx
not esi
bswap edx
add eax, 0x23
sbb ebx, 0xe6
and edi, 0xd6
imul ebx
inc eax
or ebx, 0xd1
rol esi, 0x9f
dec esi
rcr eax, 0xaa
neg esi
not edi
neg edx
dec edx
or esi, 0xac
or eax, 0x61
imul edi
or edx, 0x15
bswap edi
rol ebx, 0x54
add ebx, 0x63
not esi
sbb edi, 0x97
neg eax
or ebx, 0x97
neg ebx
ror edx, 0x9d
rcl esi, 0x39
dec edx
imul edi
sub esi, 0xb7
rcl ebx, 0x86
bswap edx
sub esi, 0xd0
not edx
and ebx, 0xda
xor ecx, ecx
xor edi, edi
not esi
or edi, 0x4e
sub eax, 0xbd
imul edx
dec edi
inc edx
neg eax
neg ebx
add edx, 0x8b
mov esi, 0x20
sub edi, 0x79
neg edi
rcl esi, 5
inc edi
rcr edx, 5
ror ebx, 0x34
imul edx
sub edi, 0xf4
rol esi, 0xe9
add esi, 0xd6
inc eax
or esi, 3
not edx
sbb eax, 0x41
imul esi
and ebx, 0x4b
bswap ebx
bswap edi
neg edi
sub esi, 0x7b
ror esi, 0x56
bswap edx
sub ebx, 0x6a
inc ebx
bswap esi
neg eax
not esi
sub edi, 2
rol eax, 0x13
and eax, 0x21
bswap edx
bswap edi
sub eax, 0xc8
sub eax, 0x77
neg ebx
bswap edi
rcr esi, 0xf7
rol edx, 0xfd
rcl eax, 0x1e
rol esi, 0xda
mov ecx, dword [ebp + 0xc]
sbb edx, 0xa8
ror edi, 0xa7
inc esi
neg esi
add ebx, 0xfd
and ebx, 0xd9
mov esi, 0x42
rcl eax, 0xeb
add edi, 0xbb
sub eax, 0xb3
not edi
neg ebx
neg edi
add ebx, 0xff
mov edi, 0x8c
add esi, 0xd7
add edi, 0
imul esi
imul esi
and ebx, 0xb4
imul edi
ror edx, 0x47
rcl edx, 0xfe
mov esi, 0x95
ror esi, 0xb0
and eax, 0x47
neg edi
dec edi
rcl esi, 0x1e
not esi
not edx
sub edx, 0x7c
rcr esi, 0x5d
dec ebx
bswap eax
dec edi
bswap eax
rcr edx, 0x56
add ebx, 0xfa
dec edi
ror eax, 0xfa
dec edx
dec ebx
rol esi, 0xac
mov edx, 0x9e
add eax, 0xfc
neg eax
dec esi
imul eax
bswap edx
mov edi, dword [ebp + 8]
mov eax, ebx
mov eax, esi
mov ebx, ebx
xor esi, eax
xor ebx, eax
xor ebx, eax
mov eax, esi
xor ebx, eax
xor ebx, ebx
xor eax, ebx
mov eax, eax
xor ebx, eax
not byte [edi]
mov eax, eax
xor ebx, ebx
xor esi, esi
xor esi, eax
xor ebx, esi
mov ebx, ebx
mov ebx, ebx
mov eax, esi
xor esi, eax
add byte [edi], 0x87
mov esi, eax
xor ebx, esi
mov esi, esi
mov eax, eax
xor eax, ebx
xor eax, ebx
xor eax, esi
xor eax, ebx
xor esi, ebx
sub byte [edi], 0x53
mov eax, esi
mov eax, esi
xor esi, esi
xor ebx, esi
mov esi, eax
xor ebx, esi
xor ebx, ebx
xor eax, eax
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4027d4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402a30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
not byte [edi]
mov eax, eax
mov eax, ebx
xor ebx, esi
mov eax, esi
xor eax, esi
mov eax, eax
mov eax, eax
mov ebx, esi
mov esi, ebx
add byte [edi], 0x26
mov eax, esi
xor esi, esi
mov eax, esi
xor esi, eax
xor esi, ebx
xor ebx, esi
xor eax, esi
mov ebx, ebx
xor eax, ebx
sub byte [edi], 0x87
mov ebx, ebx
mov ebx, esi
mov ebx, eax
xor esi, eax
mov ebx, ebx
mov eax, ebx
xor ebx, eax
fmul dword [ebx - 0x927743d]
das
fmul dword [ebx - 0x927743d]
das
inc edi
loop 0x4029f7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..pdata
nop
mov ebx, 0x40de38
nop
mov ecx, 0x27154cd8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x16c2f6d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40200b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea esi, [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x100]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 8]
push esi
push 0
mov ecx, esp
push dword [ecx]
push dword [ecx + 4]
push dword [ecx + 8]
push dword [ecx + 0xc]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_WriteFile
add esp, 0x14
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40207a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea esi, [ebp - 4]
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
lea esi, [ebp - 8]
push esi
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x100]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, esp
push dword [ecx]
push dword [ecx + 4]
push dword [ecx + 8]
push dword [ecx + 0xc]
push dword [ecx + 0x10]
call sub.KERNEL32.DLL_ReadFile
add esp, 0x14
pop esi
mov dword [esi], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, 0
je 0x402101
jmp 0x40214e
push 0x40911c
push 0
push str.BR_lenread0_succ
push 0
push 0
call fcn.004011da
push 0x40911c
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call fcn.004011b7
push 0x40911c
push 0
call fcn.004011c6
push 1
mov eax, dword [ebp - 8]
mov ecx, eax
pop eax
cmp eax, ecx
jne 0x402165
jmp 0x40217d
push 0x407122
call sub.KERNEL32.DLL_GetLastError
pop esi
mov dword [esi], eax
mov eax, dword [0x407122]
push eax
call fcn.00401b93
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4021ed
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea esi, [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea esi, [ebp - 4]
push esi
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x100]
push eax
push 0
mov ecx, esp
push dword [ecx]
push dword [ecx + 4]
call sub.KERNEL32.DLL_GetFileSize
add esp, 8
pop esi
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x406810
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41dc3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4045bc
call fcn.004093a4
push 4
mov dword [esp + 0x18], 0
call fcn.0040aa46
mov edi, eax
add esp, 4
test edi, edi
je 0x406884
push ebx
call fcn.0040919f
mov dword [edi], eax
call fcn.00408f5e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409365
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406878
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040938d
pop ebx
jmp 0x406886
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b53e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4213dc]
jne 0x40b548
repz ret
jmp fcn.004114dc
Function at 0x416bd3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f9be
and dword [ebp - 0x14], 0
cmp dword [0x438914], 0
mov dword [ebp - 0x18], eax
jne 0x416c86
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416d2e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x416d2e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x438914], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x438918], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x43891c], eax
call edi
push eax
call esi
mov dword [0x438924], eax
test eax, eax
je 0x416c86
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x438920], eax
mov eax, dword [0x438920]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416cdf
cmp dword [0x438924], ecx
je 0x416cdf
push eax
call esi
push dword [0x438924]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416cdf
test ebx, ebx
je 0x416cdf
call edi
test eax, eax
je 0x416cd6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416cd6
test byte [ebp - 8], 1
jne 0x416cdf
or dword [ebp + 0x10], 0x200000
jmp 0x416d12
mov eax, dword [0x438918]
cmp eax, dword [ebp - 0x18]
je 0x416d12
push eax
call esi
test eax, eax
je 0x416d12
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d12
mov eax, dword [0x43891c]
cmp eax, dword [ebp - 0x18]
je 0x416d12
push eax
call esi
test eax, eax
je 0x416d12
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x438914]
call esi
test eax, eax
je 0x416d2e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416d30
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b53e
leave
ret
Function at 0x401290
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
lea edi, [ebp - 0x36]
mov esi, 0x40c24a
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x3e]
mov esi, str.mssrv32
mov ecx, 8
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push reloc.WS2_32.dll_bind
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
jne 0x40131f
lea eax, [ebp - 8]
push eax
push 2
push 0
lea eax, [ebp - 0x36]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401329
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
push 0
lea eax, [ebp - 0x3e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401329
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401338
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x405155
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], edx
push edi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov edi, dword [ecx]
and edi, 7
cmp dword [ebp - 4], 5
jb 0x40529a
sub dword [ebp - 4], 4
add dword [ebp + 8], 5
push ebx
push esi
mov ecx, dword [ebp - 4]
lea esi, [eax + edx]
lea ebx, [edx + ecx]
cmp esi, ebx
jae 0x40519c
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x40519c
inc esi
jmp 0x40518b
mov ecx, esi
sub ecx, eax
mov eax, esi
sub ecx, edx
sub eax, edx
cmp esi, ebx
jae 0x405286
cmp ecx, 2
jbe 0x4051b7
xor edi, edi
jmp 0x4051e1
shr edi, cl
test edi, edi
je 0x4051e1
cmp edi, 4
ja 0x40527b
cmp edi, 3
je 0x40527b
mov ecx, edi
shr ecx, 1
mov cl, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
je 0x40527b
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x40527b
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, eax
add eax, 5
cmp dword [ebp + 0x10], 0
mov dword [ebp - 8], ecx
je 0x405223
add ebx, ecx
jmp 0x405225
sub ebx, ecx
test edi, edi
je 0x405258
and edi, 6
mov edx, ebx
shl edi, 2
mov ecx, edi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x405253
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x10], 0
je 0x405250
add ebx, dword [ebp - 8]
jmp 0x405253
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor edi, edi
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x405182
or edi, 8
shr edi, 1
inc eax
jmp 0x405182
push 2
pop edx
pop esi
shr edi, cl
cmp edx, ecx
mov edx, dword [ebp + 0xc]
sbb ecx, ecx
pop ebx
not ecx
and ecx, edi
mov dword [edx], ecx
pop edi
leave
ret 0xc

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xf1ecbdc4]
lodsd eax, dword [esi]
cmp dword [ebx - 0xc], ebp
dec esp
xor dl, bh
out 0xe, al
pop eax
inc eax
add ah, byte [ebp - 0x4df569fe]
or dl, al
jo 0x4153ea
cmpsb byte [esi], byte es:[edi]
aad 0x4d
dec ebp
push 0x5cf7f469
sbb dh, byte [edi - 0x7b951fb3]
or al, 0x58
ret 0xb2a4
Function at 0x4030d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
cmp dword [0x8c2080], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 0xc], eax
jne 0x403109
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [0x4a2ef8]
mov ebx, dword [0x4a2efc]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0x9e3779b9
mov dword [ebp - 0x28], ecx
call fcn.004030c0
mov edx, dword [0x4a2f00]
mov eax, dword [0x4a2f04]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x403150
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov ecx, dword [0x8c2080]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x4031b8
push 0
lea ecx, [ebp - 0x42c]
push ecx
push 0x402590
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
xor edx, edx
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], ax
mov ecx, dword [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0x8c2080]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4031d2
mov dword [0x8c161c], 0xedeb2e40
jmp 0x4031e4
cmp ecx, 0x3eb
jne 0x4031e4
mov dword [0x8c0fd0], 0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add edx, esi
mov dword [ebp - 0x14], edx
mov edx, esi
shr edx, cl
mov dword [0x8c1618], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0x8c2080], 0xc
jne 0x403242
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov edx, dword [ebp - 0xc]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, edx
xor ecx, eax
mov dword [ebp - 4], ecx
sub esi, ecx
mov eax, dword [ebp - 0x20]
sub dword [ebp - 8], eax
sub edi, 1
jne 0x403150
cmp dword [0x8c2080], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x4032a9
push 0
push 0x4025c4
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4032c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8c2080]
mov ecx, dword [0x8c0fd4]
shr eax, 3
sub esp, 0x408
test eax, eax
jbe 0x40339a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x8c2080], 0x959
jne 0x403380
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x4025f8
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004030d0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x403300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403690
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a03d8
push eax
mov dword fs:[0], esp
sub esp, 0x448
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x4036cb
lea eax, [ebp - 0x454]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x4036b8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov ebx, dword [ebp - 0x10]
xor esi, esi
call edi
cmp esi, 0x2b259d
jle 0x4036f2
cmp ebx, 0x785074d5
jne 0x4036fb
inc esi
cmp esi, 0x1c1b
jl 0x4036e0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, 0x206d47
jg 0x40372d
inc esi
cmp esi, 0x4f6a4
jl 0x403710
cmp dword [0x8c2080], 0x400
jne 0x403767
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [ebp - 0x30]
call fcn.00403800
push 0
mov dword [ebp - 4], 0
call fcn.00403b34
add esp, 4
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00403820
mov ecx, dword [0x4a313c]
mov edx, dword [0x4a3110]
mov dword [0x8c2080], ecx
mov dword [0x8c2084], edx
call fcn.004033c0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
nop
push 0
call edi
cmp esi, 0x2b259d
jle 0x4037a4
cmp ebx, 0x785074d5
jne 0x4037ad
inc esi
cmp esi, 0x11915
jl 0x403790
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0x8c2080], 0x51f
jne 0x4037d2
lea eax, [ebp - 0x54]
push eax
call esi
sub edi, 1
jne 0x4037c0
mov eax, dword [0x8c0fd4]
mov dword [0x8c1614], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4044a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a20c8]
jne 0x4044aa
repz ret
jmp fcn.00406c0e
Function at 0x40682f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404521
and dword [ebp - 4], 0
cmp dword [0x4a3a10], 0
mov ebx, eax
jne 0x4068e0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406991
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406991
push eax
call fcn.004044af
mov dword [esp], 0x4019ac
push edi
mov dword [0x4a3a10], eax
call esi
push eax
call fcn.004044af
mov dword [esp], 0x401998
push edi
mov dword [0x4a3a14], eax
call esi
push eax
call fcn.004044af
mov dword [esp], 0x40197c
push edi
mov dword [0x4a3a18], eax
call esi
push eax
call fcn.004044af
pop ecx
mov dword [0x4a3a20], eax
test eax, eax
je 0x4068e0
push 0x401964
push edi
call esi
push eax
call fcn.004044af
pop ecx
mov dword [0x4a3a1c], eax
mov eax, dword [0x4a3a1c]
cmp eax, ebx
je 0x406938
cmp dword [0x4a3a20], ebx
je 0x406938
push eax
call fcn.0040452a
push dword [0x4a3a20]
mov esi, eax
call fcn.0040452a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406938
test edi, edi
je 0x406938
call esi
test eax, eax
je 0x40692f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40692f
test byte [ebp - 0xc], 1
jne 0x406938
or dword [ebp + 0x10], 0x200000
jmp 0x406971
mov eax, dword [0x4a3a14]
cmp eax, ebx
je 0x406971
push eax
call fcn.0040452a
pop ecx
test eax, eax
je 0x406971
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406971
mov eax, dword [0x4a3a18]
cmp eax, ebx
je 0x406971
push eax
call fcn.0040452a
pop ecx
test eax, eax
je 0x406971
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a3a10]
call fcn.0040452a
pop ecx
test eax, eax
je 0x406991
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406993
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret