joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485834
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485a9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
jne 0x48590e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x48590e
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4858e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4858bf
mov eax, dword [ebp - 4]
add eax, 0x48
mov edx, dword [ebp - 0x18]
call fcn.00404544
jmp 0x4858ca
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040433c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4858ef
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov ecx, 2
mov edx, 1
call fcn.0040486c
mov eax, dword [ebp - 0x228]
mov edx, 0x485ab0
call fcn.00404758
jne 0x4859d2
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetDesktopFolder
test eax, eax
jne 0x485a75
xor eax, eax
push ebp
push 0x4859cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x222]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov ecx, 0x104
call fcn.004054c4
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x4859bd
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00485eb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
push eax
push 0
push 0x466
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485a75
ret
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetDesktopFolder
test eax, eax
jne 0x485a75
xor eax, eax
push ebp
push 0x485a43
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x222]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov ecx, 0x104
call fcn.004054c4
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x485a35
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00485eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485a4a
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485aa2
lea eax, [ebp - 0x22c]
mov edx, 2
call fcn.00404360
lea eax, [ebp - 0xc]
call fcn.00406104
ret
Function at 0x48c0a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c22a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a6fac]
cmp byte [eax], 0
je 0x48c0ff
mov eax, dword [ebp - 4]
mov edx, dword [0x44def4]
call fcn.00403678
test al, al
je 0x48c11a
mov eax, dword [ebp - 4]
call fcn.0045bd80
test al, al
je 0x48c11a
mov eax, dword [ebp - 4]
call fcn.0045b888
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x48c11a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00453024
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00404c04
jmp 0x48c1ff
mov eax, dword [ebp - 4]
mov edx, dword [0x44def4]
call fcn.00403678
test al, al
jne 0x48c17b
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0048bf7c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48c15a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00453024
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00404c04
jmp 0x48c1ff
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00453024
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, 0x38
call fcn.0047d6ac
jmp 0x48c1ff
mov eax, dword [ebp - 4]
call fcn.0045bd80
test al, al
jne 0x48c1ad
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00453024
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00404c04
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048bff4
jmp 0x48c1ff
mov eax, dword [ebp - 4]
call fcn.0045b888
push eax
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, dword [ebp - 8]
call fcn.00404ff4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c90
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c80
push eax
mov eax, dword [ebp - 4]
call fcn.0045b888
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c90
mov edx, eax
dec edx
mov eax, dword [ebp - 8]
call fcn.00404ff4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c231
lea eax, [ebp - 0x20]
call fcn.0040433c
lea eax, [ebp - 0x1c]
call fcn.00404a2c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404360
ret

Function at 0x492e74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.0040460c
mov edx, eax
mov eax, ebp
call fcn.00404998
mov eax, dword [esp]
call fcn.0040460c
mov edi, eax
test edi, edi
jle 0x492ed8
mov ebx, 1
mov eax, ebp
call fcn.00404864
mov edx, dword [esp]
mov dl, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x492ea4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x492ee0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.0040460c
mov edx, eax
mov eax, dword [esp]
call fcn.00404998
mov eax, edi
call fcn.0040460c
mov ebp, eax
test ebp, ebp
jle 0x492f3f
mov ebx, 1
mov eax, dword [esp]
call fcn.00404864
mov dl, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x492f0f
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x499a84
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4aa190
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x499aa6
shr eax, 1
xor eax, 0xedb88320
jmp 0x499aa8
shr eax, 1
dec edx
jne 0x499a94
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x499a8d
mov byte [0x4aa590], 1
pop esi
pop ebx
ret

Function at 0x499ac4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4aa590], 0
jne 0x499adb
call fcn.00499a84
mov eax, edi
dec eax
test eax, eax
jl 0x499b04
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4aa190]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x499ae5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49c024
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x49c055
dec al
je 0x49c091
dec al
je 0x49c0d5
dec al
je 0x49c140
jmp 0x49c1ca
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x49c1ca
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49c065
jmp 0x49c1ca
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49c1ca
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49c0a1
jmp 0x49c1ca
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49c1ca
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x49c103
xor ebp, ebp
jmp 0x49c114
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x49c11d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49c0e5
jmp 0x49c1ca
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49c1ca
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49c198
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00499b0c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49c154
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49fda8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49fe9a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4aa7ff], 0
je 0x49fe62
lea eax, [ebp - 0x14]
mov edx, 0x4aa7ff
call fcn.004045b0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0049fbe8
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4adadc]
mov eax, dword [eax + 0x2f8]
call fcn.0048fa0c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004825a4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.00404cfc
lea eax, [ebp - 8]
call fcn.00404a2c
mov eax, dword [ebp - 4]
call fcn.00404c90
cmp eax, 4
jle 0x49fe62
push 5
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0047dd3c
mov eax, dword [ebp - 0x20]
call fcn.00404c80
push eax
mov eax, dword [ebp - 8]
call fcn.00404c80
push eax
mov eax, dword [ebp - 4]
call fcn.00404c80
push eax
push 0x49fea8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fea1
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404a44
lea eax, [ebp - 0x14]
call fcn.0040433c
lea eax, [ebp - 0x10]
call fcn.00404a2c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a44
ret

Function at 0x49feb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ff9b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4adaec], 1
jne 0x49ff65
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x49feff
xor eax, eax
call fcn.0049fda8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x49ff5b
push 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0048fa0c
mov eax, dword [ebp - 0xc]
call fcn.00404c80
push eax
push 0x49ffa8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0048fa0c
mov eax, dword [ebp - 0x10]
call fcn.00404c80
push eax
push 0x49ffac
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 4]
call fcn.00473138
jmp 0x49ff80
mov byte [0x4adaed], 0
mov eax, dword [ebp - 4]
call fcn.00473138
mov eax, dword [0x4a7264]
mov eax, dword [eax]
call fcn.004766cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ffa2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a44
ret
Function at 0x4a15a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00402740
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a1615
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a161c
mov eax, dword [ebp - 0xc]
call fcn.00402760
ret
Function at 0x7981b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1cf000]
push edi
or ebp, 0xffffffff
jmp 0x7981d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7981d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7981c8
mov eax, 1
add ebx, ebx
jne 0x7981eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7981fc
jne 0x79821b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79821b
dec eax
add ebx, ebx
jne 0x798208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7981e0
add ebx, ebx
jne 0x798217
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x79826d
xor ecx, ecx
sub eax, 3
jb 0x798233
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7982a2
sar eax, 1
mov ebp, eax
jmp 0x79823e
add ebx, ebx
jne 0x79823e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79820c
inc ecx
add ebx, ebx
jne 0x79824c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x79820c
add ebx, ebx
jne 0x798259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x79824e
jne 0x79826a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x79824e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x79828c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x79827e
jmp 0x7981ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x79828c
add edi, ecx
jmp 0x7981ce
pop esi
mov edi, esi
mov ecx, 0xcd58
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7982aa
cmp byte [edi], 0x22
jne 0x7982aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7982af
lea edi, [esi + 0x395000]
mov eax, dword [edi]
or eax, eax
je 0x798327
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x39f3b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x39f4d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7982dc
mov ecx, edi
jns 0x79830b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x39f4dc]
or eax, eax
je 0x798321
mov dword [ebx], eax
add ebx, 4
jmp 0x7982f9
call dword [esi + 0x39f4d8]
mov ebp, dword [esi + 0x39f4e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x79835b
sub esp, 0xffffff80
jmp 0x5b8aa3
Function at 0x41aa5a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4225a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c31c
and dword [ebp - 0x14], 0
cmp dword [0x439bb8], 0
mov dword [ebp - 0x18], eax
jne 0x41ab0d
push 0x403e00
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41abb5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403df4
push ebx
call edi
test eax, eax
je 0x41abb5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403de4
push ebx
mov dword [0x439bb8], eax
call edi
push eax
call esi
push 0x403dd0
push ebx
mov dword [0x439bbc], eax
call edi
push eax
call esi
push 0x403db4
push ebx
mov dword [0x439bc0], eax
call edi
push eax
call esi
mov dword [0x439bc8], eax
test eax, eax
je 0x41ab0d
push 0x403d9c
push ebx
call edi
push eax
call esi
mov dword [0x439bc4], eax
mov eax, dword [0x439bc4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ab66
cmp dword [0x439bc8], ecx
je 0x41ab66
push eax
call esi
push dword [0x439bc8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ab66
test ebx, ebx
je 0x41ab66
call edi
test eax, eax
je 0x41ab5d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41ab5d
test byte [ebp - 8], 1
jne 0x41ab66
or dword [ebp + 0x10], 0x200000
jmp 0x41ab99
mov eax, dword [0x439bbc]
cmp eax, dword [ebp - 0x18]
je 0x41ab99
push eax
call esi
test eax, eax
je 0x41ab99
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ab99
mov eax, dword [0x439bc0]
cmp eax, dword [ebp - 0x18]
je 0x41ab99
push eax
call esi
test eax, eax
je 0x41ab99
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439bb8]
call esi
test eax, eax
je 0x41abb5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41abb7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407104
leave
ret

Function at 0x41e4a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x8e4028], ax
mov word [0x8e402c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x8e4028
mov dword [0x8e4034], 0x320033
mov dword [0x8e403c], 0x6c006c
mov word [0x8e402e], cx
mov dword [0x8e4030], 0x6c0065
mov dword [0x8e4038], 0x64002e
mov word [0x8e402a], dx
mov word [0x8e4040], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x8e4024]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x8e4020], eax
mov eax, dword [0x8e2810]
push edx
push eax
mov byte [0x439be3], 0x65
mov dword [0x439bd9], 0x75747269
mov word [0x439bdd], 0x6c61
mov byte [0x439bd8], 0x56
mov word [0x439be4], 0x7463
mov byte [0x439be6], 0
mov dword [0x439bdf], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x41e5a0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1280
call fcn.0041d980
cmp dword [0x8e4024], 0x37
push esi
jne 0x41e6a1
push 0
lea eax, [esp + 0x284]
push eax
push 0x403ee4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
call esi
xor eax, eax
lea edx, [esp + 8]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_ReadFileScatter]
push 0
lea eax, [esp + 0x684]
push eax
push 0x403ef0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0xa84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x60]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call esi
push 0x403f18
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x38], 0
call fcn.00410220
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
mov edx, dword [0x8e6788]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + ebx]
mov edx, dword [0x8e2810]
mov byte [edx + ebx], cl
pop esi
add esp, 0x1280
ret