joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4310f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
push 0
push eax
push 2
lea eax, [ebp - 4]
mov edi, ecx
push eax
push edi
mov esi, edx
call ebx
test eax, eax
je 0x43118a
cmp dword [ebp - 8], 2
jb 0x43118a
movsx eax, word [ebp - 4]
mov dword [esi], eax
sub eax, 0
je 0x43115f
sub eax, 1
je 0x43118a
sub eax, 1
jne 0x43118a
push eax
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 0x18]
push eax
push edi
call ebx
test eax, eax
je 0x43118a
cmp dword [ebp - 8], 8
jb 0x43118a
movsd xmm0, qword [ebp - 0x18]
mov eax, 1
movsd qword [esi + 8], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
test eax, eax
je 0x43118a
cmp dword [ebp - 8], 4
jb 0x43118a
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442910
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [0x4a25dc]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0x440
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x40], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x442a25
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x442a13
call fcn.00425a90
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
and ebx, 2
je 0x4429b2
push 0
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x4429b2
push 0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4429f0
cmp dword [ebp + 8], 0x103
jne 0x4429f0
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.00401480
push 0x4ff
push 0xc8
push 0
push 0
push 0
call edi
jmp 0x4429b8
test bx, bx
je 0x442a0e
mov edi, dword [ebp - 4]
push 5
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x442a0e
push 5
push eax
call esi
call fcn.00425b90
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44aa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x54]
mov dword [esi + 0x104], ecx
sub ecx, dword [esi + 0x58]
add eax, ecx
mov dword [esi + 0x108], edx
sub edx, dword [esi + 0x5c]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x64]
add eax, edx
mov dword [esi + 0x118], ecx
mov dword [esi + 0x124], eax
mov ecx, esi
mov eax, dword [esi + 0xdc]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0xe8]
mov dword [esi + 0x11c], edx
mov edx, 1
mov dword [esi + 0x110], eax
pop esi
pop ebp
jmp fcn.0044aae0
Function at 0x4563c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 1], 0
xor edi, edi
lea ecx, [ebp - 0x10]
push edi
push ecx
push 1
lea ecx, [ebp - 1]
mov eax, edx
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x456449
cmp byte [ebp - 1], 0
je 0x456444
push dword [ebx + 0x2ac]
mov edx, dword [ebx + 0x44]
mov ecx, ebx
push edi
call fcn.00455880
mov ecx, dword [ebx + 0x2a4]
add esp, 8
test ecx, ecx
je 0x456449
call fcn.004013f0
mov ecx, dword [ebx + 0x2a4]
xor edx, edx
mov esi, eax
call fcn.00404e60
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.004311a0
mov ecx, esi
mov edi, eax
call fcn.004013f0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4579e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x4a25dc]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [ebp - 4], edx
test ebx, ebx
jne 0x457a00
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
cmp edx, 0x100
jne 0x457a4b
cmp dword [ebp + 8], 9
jne 0x457aa6
cmp dword [ebx + 0x518], ecx
jle 0x457aa6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
test ax, ax
js 0x457a36
call fcn.00433b00
jmp 0x457a3b
call fcn.00433cc0
test eax, eax
je 0x457aa1
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 5
jne 0x457aa6
mov eax, dword [ebx + 0x18]
test byte [eax + 0x14], 0x10
je 0x457aa6
cmp byte [ebx + 0x4c8], cl
je 0x457aa6
mov esi, dword [ebx + 0x1278]
xor edi, edi
cmp dword [ebx + 0x3c], ecx
jle 0x457aa6
nop
mov eax, dword [esi]
test eax, eax
jne 0x457a80
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x457a76
test byte [eax + 0x7c], 4
jne 0x457a98
test dword [eax + 0x78], 0x2b0
je 0x457a98
push eax
mov eax, dword [eax + 0x8c]
call eax
inc edi
add esi, 8
cmp edi, dword [ebx + 0x3c]
jl 0x457a70
mov edx, dword [ebp - 4]
xor ecx, ecx
movsx eax, word [ebx + 0x1d8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x457ae3
xor esi, esi
test eax, eax
jle 0x457ae3
lea edi, [ebx + 0x1dc]
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
push edx
push dword [ebp - 8]
push ebx
call eax
movsx ecx, ax
test cl, 0x5c
jne 0x457ae3
mov edx, dword [ebp - 4]
inc esi
add edi, 4
cmp esi, dword [ebp - 0xc]
jl 0x457ac0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 4], eax
test eax, eax
je 0x457b17
push 0
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push esi
push edi
push 0x304
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 0
push dword [0x4a25b0]
call ebx
mov esi, eax
test esi, esi
je 0x457b67
nop dword [eax + eax]
push 0x100
push 0
push 0
push esi
call edi
push 2
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x457b50
mov eax, dword [0x4a25d4]
cmp dword [eax + 0x1fc], 0
jne 0x457bbe
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x20]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x457bbe
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x457ba0
push dword [0x4a25ac]
call dword [sym.imp.MMFS2.dll_Ordinal_35]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x457be1
push 5
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x458760
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a0014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x4a25d4]
push edi
mov ax, word [esi + 0x14]
mov word [esi + 0x1f8], ax
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
setne al
mov byte [esi + 0x3d1], al
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x4587fb
push 1
push dword [0x4a25b0]
call edi
push dword [0x4a25b4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4587d4
push 1
push dword [0x4a25b4]
call edi
mov ax, word [esi + 0x14]
mov ecx, 0x180
and ax, cx
mov ecx, 0x100
cmp ax, cx
jne 0x4587f6
call fcn.004595a0
mov byte [esi + 0x3d1], 1
call fcn.00457750
mov dword [esi + 0x20c], 0
lea eax, [esi + 0x208]
mov dword [esi + 0x210], 0
mov dword [esi + 0x214], 0
mov dword [esi + 0x218], 0
mov dword [esi + 0x21c], 0
mov dword [esi + 0x220], 0
mov dword [esi + 0x224], 0
mov dword [esi + 0x228], 0
mov dword [esi + 0x22c], 0
mov dword [esi + 0x230], 0
push eax
mov dword [eax], 0x2c
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x458892
push 1
push dword [0x4a25b0]
call edi
mov ax, word [esi + 0x14]
mov ecx, 0xfefe
and ax, cx
mov ecx, 0x82
or ax, cx
test byte [esi + 0x1f8], 0x10
mov word [esi + 0x14], ax
jne 0x45893a
mov ecx, dword [0x4a25d8]
test ecx, ecx
je 0x458916
movsx eax, word [esi + 0x1c]
cmp dword [ecx], eax
jl 0x458916
movsx eax, word [esi + 0x1e]
cmp dword [ecx + 4], eax
jl 0x458916
push 2
push dword [0x4a25b0]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
test eax, eax
je 0x458916
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x458916
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
movsx eax, word [esi + 0x1c]
cmp eax, ecx
jne 0x458916
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
movsx eax, word [esi + 0x1e]
cmp eax, ecx
je 0x45893a
or word [esi + 0x14], 0x14
push dword [0x4a25ac]
call dword [sym.imp.MMFS2.dll_Ordinal_16]
movzx eax, ax
or eax, 2
push eax
push dword [0x4a25ac]
call dword [sym.imp.MMFS2.dll_Ordinal_17]
call fcn.00457890
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x45896f
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 0xffffffff
je 0x45896f
push 8
push 0x401
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_CheckMenuItem]
call fcn.004597e0
call fcn.00457750
call fcn.00457370
push 3
push dword [0x4a25b0]
call edi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push dword [0x4a25b4]
call esi
push 1
push 0
push dword [0x4a25b0]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x4a25e8], 1
pop esi
call fcn.00462d8d
mov esp, ebp
pop ebp
ret
Function at 0x4598a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
test esi, esi
je 0x459978
mov eax, dword [ebp + 8]
nop dword [eax]
cmp ax, word [esi + 2]
jne 0x459912
test byte [esi], 0x10
je 0x4598d1
test ebx, ebx
jne 0x4598d5
jmp 0x459912
test ebx, ebx
jne 0x459912
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test byte [esi], 8
cwde
je 0x4598e9
test eax, eax
jns 0x45990f
jmp 0x4598ed
test eax, eax
js 0x45990f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [esi]
cwde
test cl, 4
je 0x459903
test eax, eax
jns 0x45990b
jmp 0x459907
test eax, eax
js 0x45990b
movzx edi, word [esi + 4]
test edi, edi
jne 0x45991c
mov eax, dword [ebp + 8]
cmp byte [esi], 0
jl 0x459978
add esi, 8
jmp 0x4598c0
test cl, 0x40
je 0x45994f
cmp edi, 0x7d0
jl 0x459957
mov esi, dword [ebp - 4]
push 0
movzx eax, di
or eax, 0x10000
push eax
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x7d0
jl 0x459929
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
je 0x459978
push 0
push edi
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 0xffffffff
je 0x459978
test al, 1
je 0x45992c
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4599e0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4a0014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
xor eax, eax
mov word [edi], ax
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x459a2f
push 0x3f
lea edx, [ebp - 0x84]
mov ecx, 0x65
call fcn.00458550
lea eax, [esi - 0x60]
push eax
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x459a74
lea eax, [esi - 0x70]
cmp eax, 0x17
ja 0x459a4c
lea eax, [esi - 0x6f]
push eax
push 0x491904
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x459a74
xor ecx, ecx
nop
cmp dword [ecx*8 + 0x48eac0], esi
je 0x459a61
inc ecx
cmp ecx, 0x14
jl 0x459a50
jmp 0x459a74
mov ecx, dword [ecx*8 + 0x48eac4]
mov edx, edi
push 0x3f
call fcn.00458550
add esp, 4
cmp word [edi], 0
jne 0x459a8c
push 2
xor eax, eax
push esi
mov word [edi + 2], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [edi], ax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00462d8d
mov esp, ebp
pop ebp
ret
Function at 0x459db0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4a0014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x108], edx
push 0x78
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
mov ecx, dword [ebp - 0x108]
movsx eax, word [ecx + 0x12]
cmp esi, eax
jne 0x459e16
movsx edx, word [ecx + esi*2]
lea ecx, [ebp - 0x104]
call fcn.004599e0
lea eax, [ebp - 0x104]
push eax
lea eax, [esi + 0x6e]
push eax
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 1
lea eax, [esi + 0x6e]
push eax
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc esi
cmp esi, 8
jl 0x459de4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462d8d
mov esp, ebp
pop ebp
ret
Function at 0x45e0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4a0014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm1, xmmword [0x491c30]
xor al, al
push ebx
push esi
mov byte [ebp - 0x412], al
lea esi, [ebp - 0x3fc]
push edi
mov edi, dword [ebp + 8]
mov al, 0x36
mov dword [ebp - 0x420], edx
mov ah, 1
mov dword [ebp - 0x424], ecx
mov edx, 8
mov dword [ebp - 0x41c], edi
mov byte [ebp - 0x411], al
mov dword [ebp - 0x410], 0
mov dword [ebp - 0xc], 0
lea ecx, [edx - 8]
movd xmm0, ecx
lea esi, [esi + 0x40]
pshufd xmm0, xmm0, 0
lea ecx, [edx - 4]
paddd xmm0, xmm1
movups xmmword [esi - 0x50], xmm0
movd xmm0, ecx
lea ecx, [edx + 4]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [esi - 0x40], xmm0
movd xmm0, edx
add edx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [esi - 0x30], xmm0
movd xmm0, ecx
lea ecx, [edx - 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [esi - 0x20], xmm0
cmp ecx, 0x100
jl 0x45e120
xor esi, esi
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x418], edx
nop word [eax + eax]
mov cl, al
shr al, 1
shl cl, 7
add al, cl
test ah, ah
je 0x45e1c5
movzx edx, byte [esi + edi]
mov cl, al
and cl, 1
add cl, 2
movzx ecx, cl
imul edx, ecx
mov ch, byte [ebp - 0x411]
add ch, dl
mov edx, dword [ebp - 0x418]
mov byte [ebp - 0x411], ch
jmp 0x45e1cb
mov ch, byte [ebp - 0x411]
mov cl, byte [esi + edi]
xor cl, al
jne 0x45e1eb
test ah, ah
je 0x45e1e1
cmp ch, byte [esi + edi + 1]
sete byte [ebp - 0x412]
mov cl, byte [edi]
mov al, 0x1b
xor ah, ah
xor esi, esi
xor cl, al
mov edx, dword [ebp + edx*4 - 0x40c]
inc esi
mov edi, dword [ebp - 0x418]
add bl, dl
add bl, cl
movzx ebx, bl
mov ecx, dword [ebp + ebx*4 - 0x40c]
mov dword [ebp + edi*4 - 0x40c], ecx
mov dword [ebp + ebx*4 - 0x40c], edx
mov edx, edi
mov edi, dword [ebp - 0x41c]
inc edx
mov dword [ebp - 0x418], edx
cmp edx, 0x100
jl 0x45e190
cmp byte [ebp - 0x412], 0
je 0x45e2a8
mov edi, dword [ebp - 0x420]
xor esi, esi
mov edx, dword [ebp - 0x410]
mov ebx, dword [ebp - 0xc]
test edi, edi
jle 0x45e292
nop
inc dl
movzx edx, dl
mov ecx, dword [ebp + edx*4 - 0x40c]
mov al, cl
add al, bl
movzx ebx, al
mov eax, dword [ebp + ebx*4 - 0x40c]
mov dword [ebp + edx*4 - 0x40c], eax
mov dword [ebp + ebx*4 - 0x40c], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 0x424]
mov al, byte [ebp + eax*4 - 0x40c]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x45e250
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462d8d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462d8d
mov esp, ebp
pop ebp
ret
Function at 0x45f1b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x45f1bb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0045f1d0
Function at 0x467fbc
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00467e33
Function at 0x4012a0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x8c8678], 0x594
mov dword [ebp - 8], eax
jne 0x4012d3
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, dword [0x4a9298]
mov edx, dword [0x4a929c]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
call fcn.00401290
mov eax, dword [0x4a92a0]
mov ecx, dword [0x4a92a4]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], 0x20
nop
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x8c8678]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401364
push ebx
lea edx, [ebp - 0x834]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov eax, dword [ebp - 4]
mov ecx, dword [0x8c8678]
add eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x40137e
mov dword [0x8c7c14], 0xedeb2e40
jmp 0x40138c
cmp ecx, 0x3eb
jne 0x40138c
mov dword [0x8c75c4], ebx
mov ecx, dword [ebp - 0x18]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov esi, edi
shr esi, cl
mov dword [0x8c7c10], 0xf4ea3dee
add esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
cmp dword [0x8c8678], 0x9e6
jne 0x4013c2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommMask]
xor esi, dword [ebp - 4]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov edx, dword [ebp - 8]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
shr esi, cl
add esi, dword [ebp - 0x28]
cmp dword [0x8c8678], 0x121
jne 0x401421
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
xor eax, esi
mov dword [ebp - 4], eax
sub edi, eax
lea eax, [ebp - 0x18]
call fcn.00401280
sub dword [ebp - 0x1c], 1
jne 0x401310
cmp dword [0x8c8678], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x401469
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
mov ecx, dword [ebp - 8]
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 8]
pop edi
mov dword [esi + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401480
Capabilities:
Set file attributes
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8c8678]
mov ecx, dword [0x8c75c8]
shr eax, 3
sub esp, 8
test eax, eax
jbe 0x40150a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x8c8678], 0x959
jne 0x4014f4
push 0
push 0
call esi
push str.ritabusorehovawefakavonamukalo
push 0
push 0
call edi
push 0
push 0
push str.cokejihe
push str.legas
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 4]
push eax
call fcn.004012a0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4014b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401600
Capabilities:
Extract resource via kernel32 functions
Get hostname

Disassembly:
push ecx
push 0x4aa448
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a2f78
push eax
mov dword fs:[0], esp
sub esp, 0xd84
cmp dword [0x8c8678], 0x5b1
push ebx
push esi
push edi
jne 0x4016d5
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea esi, [ebp - 0x34]
call fcn.00401c60
push 0
mov dword [ebp - 4], 0
call fcn.00403c5f
add esp, 4
push 0
push 0
call fcn.00403901
add esp, 8
jmp 0x4015f0
mov eax, dword [0x4a94b0]
mov dword [0x8c867c], eax
mov eax, dword [0x8c8678]
add eax, 0x1134b
push eax
push 0
mov dword [0x8c8678], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x8c75c8], eax
call fcn.00401530
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
lea esp, [esp]
cmp esi, 0x2710
jge 0x401723
lea ecx, [ebp - 0x590]
push ecx
push 0
call edi
inc esi
cmp esi, 0x18ea14c
jl 0x401710
xor esi, esi
cmp dword [0x8c8678], esi
jbe 0x401792
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ebx, dword [sym.imp.GDI32.dll_SetColorAdjustment]
mov edx, dword [0x8c867c]
mov al, byte [edx + esi + 0x1134b]
mov ecx, dword [0x8c75c8]
mov byte [ecx + esi], al
cmp dword [0x8c8678], 0xa8
jne 0x401789
push 0
lea edx, [ebp - 0x10]
push edx
call edi
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc esi
cmp esi, dword [0x8c8678]
jb 0x401742
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
mov ecx, dword [0x8c8678]
add ecx, esi
cmp ecx, 0xe
jne 0x4017cc
push 0
push 0
push str.yuwazacehawi
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, 0x39621
jl 0x4017a0
call fcn.00401480
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call edi
cmp esi, 0x26
jne 0x4017ee
call fcn.00401510
inc esi
cmp esi, 0x6753f
jl 0x4017e2
mov esi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov ebx, dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x8c8678], 0x86
jne 0x40184c
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xd90]
push eax
push str.fabuz
call esi
push 0
push str.siviwoginabolapofu
push str.bojomecayaviyo
call edi
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub dword [ebp - 0x10], 1
jne 0x401810
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret