joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be90
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40bea8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40bec6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40bf24
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40bf0b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40bf14
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40bf1e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40bf00
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40be8a
invalid
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40bf71
dec eax
je 0x40bf68
sub eax, 3
je 0x40bf5f
mov dword [ebp - 4], 0x40
jmp 0x40bf8e
mov dword [ebp - 4], 4
jmp 0x40bf74
mov dword [ebp - 4], 0x20
jmp 0x40bf74
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40bfc0
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40bf40
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040b7d1
mov dl, 0xee
mov eax, dword [0x1475ff27]
push 1
push esi
call edi
mov eax, esi
jmp 0x40bfcc
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40edbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [esp + 0x10]
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0xc]
shr esi, 2
mov edx, dword [ebp + 8]
mov ecx, esi
dec esi
test ecx, ecx
jle 0x40edff
movzx edi, byte [edx]
inc edx
movzx ecx, byte [edx]
shl ecx, 8
inc edx
or edi, ecx
movzx ecx, byte [edx]
shl ecx, 0x10
inc edx
or edi, ecx
movzx ecx, byte [edx]
shl ecx, 0x18
inc edx
or edi, ecx
mov ecx, esi
xor eax, edi
dec esi
test ecx, ecx
jg 0x40edd7
xor esi, esi
mov ecx, dword [ebp + 0xc]
and ecx, 3
cmp ecx, 1
je 0x40ee26
cmp ecx, 2
je 0x40ee1d
cmp ecx, 3
jne 0x40ee2b
movzx esi, byte [edx]
shl esi, 0x10
inc edx
movzx ecx, byte [edx]
shl ecx, 8
inc edx
or esi, ecx
movzx ecx, byte [edx]
or esi, ecx
xor eax, esi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x401fb2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401fbc
repz ret
jmp fcn.00407aa3

Function at 0x40d9d3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404af4
and dword [ebp - 4], 0
cmp dword [0x414c94], 0
mov ebx, eax
jne 0x40da84
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40db35
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40db35
push eax
call fcn.00404a82
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x414c94], eax
call esi
push eax
call fcn.00404a82
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x414c98], eax
call esi
push eax
call fcn.00404a82
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x414c9c], eax
call esi
push eax
call fcn.00404a82
pop ecx
mov dword [0x414ca4], eax
test eax, eax
je 0x40da84
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404a82
pop ecx
mov dword [0x414ca0], eax
mov eax, dword [0x414ca0]
cmp eax, ebx
je 0x40dadc
cmp dword [0x414ca4], ebx
je 0x40dadc
push eax
call fcn.00404afd
push dword [0x414ca4]
mov esi, eax
call fcn.00404afd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40dadc
test edi, edi
je 0x40dadc
call esi
test eax, eax
je 0x40dad3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40dad3
test byte [ebp - 0xc], 1
jne 0x40dadc
or dword [ebp + 0x10], 0x200000
jmp 0x40db15
mov eax, dword [0x414c98]
cmp eax, ebx
je 0x40db15
push eax
call fcn.00404afd
pop ecx
test eax, eax
je 0x40db15
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40db15
mov eax, dword [0x414c9c]
cmp eax, ebx
je 0x40db15
push eax
call fcn.00404afd
pop ecx
test eax, eax
je 0x40db15
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x414c94]
call fcn.00404afd
pop ecx
test eax, eax
je 0x40db35
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40db37
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ae1a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6b000]
push edi
or ebp, 0xffffffff
jmp 0x4ae1c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ae1c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae1b8
mov eax, 1
add ebx, ebx
jne 0x4ae1db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ae1d0
jne 0x4ae1ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ae1d0
xor ecx, ecx
sub eax, 3
jb 0x4ae200
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ae272
mov ebp, eax
add ebx, ebx
jne 0x4ae20b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4ae218
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4ae23c
inc ecx
add ebx, ebx
jne 0x4ae228
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ae21d
jne 0x4ae239
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ae21d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ae25c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ae24d
jmp 0x4ae1be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ae25c
add edi, ecx
jmp 0x4ae1be
pop esi
mov edi, esi
mov ecx, 0x7e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ae27a
cmp byte [edi], 1
jne 0x4ae27a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ae27f
lea edi, [esi + 0xac000]
mov eax, dword [edi]
or eax, eax
je 0x4ae2ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc56cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc5768]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ae2ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc5770]
or eax, eax
je 0x4ae2e8
mov dword [ebx], eax
add ebx, 4
jmp 0x4ae2c9
call dword [esi + 0xc576c]
mov ebp, dword [esi + 0xc5774]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ae322
sub esp, 0xffffff80
jmp 0x405000
Function at 0x43be11
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43be3f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43be5d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043bd7b
jmp 0x43be5d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43be5d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043bd7b
test edi, edi
mov eax, edi
jne 0x43be47
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x465aec]
test ecx, ecx
je 0x43bf10
jmp 0x43be10
ret 8

Function at 0x414e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x414e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414e70
mov eax, 1
add ebx, ebx
jne 0x414e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414e88
jne 0x414ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414e88
xor ecx, ecx
sub eax, 3
jb 0x414eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414f2a
mov ebp, eax
add ebx, ebx
jne 0x414ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414ef4
inc ecx
add ebx, ebx
jne 0x414ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414ed5
jne 0x414ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414f05
jmp 0x414e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414f14
add edi, ecx
jmp 0x414e76
pop esi
mov edi, esi
mov ecx, 0x5a7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414f32
cmp byte [edi], 5
jne 0x414f32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414f37
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414fa6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1551c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414f64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15520]
or eax, eax
je 0x414fa0
mov dword [ebx], eax
add ebx, 4
jmp 0x414f81
call dword [esi + 0x15530]
mov ebp, dword [esi + 0x15524]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414fda
sub esp, 0xffffff80
jmp 0x40a764
Function at 0x4145e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
jmp 0x4145fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4145f0
mov eax, 1
add ebx, ebx
jne 0x414613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414608
jne 0x414624
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414608
xor ecx, ecx
sub eax, 3
jb 0x414638
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4146aa
mov ebp, eax
add ebx, ebx
jne 0x414643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414674
inc ecx
add ebx, ebx
jne 0x414660
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414655
jne 0x414671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414655
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414694
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414685
jmp 0x4145f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414694
add edi, ecx
jmp 0x4145f6
pop esi
mov edi, esi
mov ecx, 0x40e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4146b2
cmp byte [edi], 6
jne 0x4146b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4146b7
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414726
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x143a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14480]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4146e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14488]
or eax, eax
je 0x414720
mov dword [ebx], eax
add ebx, 4
jmp 0x414701
call dword [esi + 0x14484]
mov ebp, dword [esi + 0x1448c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41475a
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x831079
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xe5e251b
call fcn.00831000

Function at 0x831083
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x805ca789
call fcn.00831000

Function at 0x83108d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x472d46a0
call fcn.00831000

Function at 0x831097
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x82acb12c
call fcn.00831000
push 0xf991917
call fcn.00831000

Function at 0x8310ab
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x258d2b1b
call fcn.00831000

Function at 0x8310b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x47514dc3
call fcn.00831000

Function at 0x8310bf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffabd70c
call fcn.00831000

Function at 0x8310c9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xc1740c6
call fcn.00831000

Function at 0x8310d3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x349c3225
call fcn.00831000

Function at 0x8310dd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x16ac1e03
call fcn.00831000
nop
Function at 0x8310e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x258]
mov esi, str._a_Oa
push ebx
xor ebx, ebx
sub esp, 0x25c
rep movsd dword es:[edi], dword [esi]
mov esi, 7
mov eax, dword [0x859084]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x7a7bf209
or eax, 0xaf4b5c21
mov dword [0x859084], eax
call edi
sub esi, dword [ebp + ebx*4 - 0x258]
inc ebx
imul eax, dword [0x859084], 0xea6d4fa
mov dword [0x859084], eax
cmp ebx, 5
jne 0x83110d
and eax, 0x4dd82cac
xor ebx, ebx
sub eax, 0x4d804d4a
mov dword [0x859084], eax
mov dword [esp + 4], eax
mov dword [esp], str.Maximum_Segment_Descriptors_Exceeded
call fcn.008420d0
mov dword [esp + 4], ebx
mov dword [esp], 2
mov eax, dword [0x845064]
call dword [eax + 0x34]
add esi, eax
push edx
mov ebx, eax
push edx
jne 0x8311e8
mov edx, 0x859580
mov ecx, 0x120
movzx eax, byte [edx]
inc edx
test al, al
je 0x8311cd
add ecx, eax
cmp ecx, 0x939
jbe 0x83118b
call fcn.0083f90c
imul eax, dword [0x859084], 0xa5f7f6e1
mov dword [0x859084], eax
mov dword [esp + 0xc], str.Maximum_Segment_Descriptors_Exceeded
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_maximum_named_pipe_instance_count_has_been_reached.
mov dword [esp], eax
call fcn.008439c0
mov eax, dword [0x859084]
or eax, 0xab3049c5
sub eax, 0x36c9deef
mov dword [0x859084], eax
xor eax, eax
jmp 0x83132c
mov dword [ebp - 0x244], 0x22c
lea esi, [ebp - 0x244]
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [0x845064]
call dword [eax + 0x38]
push ecx
push ecx
test eax, eax
jne 0x8312ac
mov eax, dword [0x859084]
mov dword [esp + 0xc], str.Maximum_Segment_Descriptors_Exceeded
mov dword [esp + 4], str.Maximum_Segment_Descriptors_Exceeded
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.008439c0
mov eax, dword [0x859084]
lea esi, [eax - 0x7f0d7e4e]
call fcn.00843958
and esi, 0xf67f3736
add esi, 0x7eb61c9b
mov dword [0x859084], esi
mov dword [esp + 4], str.Floating_point_overflow.
mov dword [esp], str.Floating_point_overflow.
call fcn.00841940
mov eax, dword [0x859084]
and eax, 0x6823736e
imul eax, eax, 0xf71c810f
or eax, 0xaaf153fb
mov dword [0x859084], eax
call dword [sym.imp.USER32.dll_AnyPopup]
add eax, 0x7f613dfd
mov dword [0x859084], eax
jmp 0x83131f
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [0x845064]
call dword [eax + 0x3c]
push edx
push edx
test eax, eax
je 0x83131f
mov eax, dword [0x859084]
add eax, 0x7799d82e
and eax, 0xc4880573
imul eax, eax, 0x4fa7f78f
and eax, 0x908726fe
sub eax, 0x2777b149
xor eax, 0xdd488a64
mov dword [0x859084], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.0083ed04
test eax, eax
jne 0x831297
call edi
mov eax, dword [0x859084]
or eax, 0x5af1ac9e
imul eax, eax, 0xd94ab07c
or eax, 0x5af1ac9e
imul eax, eax, 0xd94ab07c
mov dword [0x859084], eax
mov dword [esp], ebx
call fcn.00831065
mov eax, 1
jmp 0x83132c
mov dword [esp], ebx
call fcn.00831065
jmp 0x8311e1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x836258
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x858df0]
mov dword [esp], str.Disconnecting_the_console_session_is_not_supported.
add eax, 0x2f8464ed
imul eax, eax, 0xa0cdae77
mov dword [0x858df0], eax
call fcn.00843f48
add dword [0x858df0], 0x76364173
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 1
leave
sete al
movzx eax, al
ret

Function at 0x83667c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x28]
mov esi, 0x845024
push ebx
sub esp, 0x4c
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 3
xor eax, eax
cmp byte [eax + 0x859144], 0
je 0x8366bf
inc eax
cmp eax, 0x1b56
jne 0x83669d
mov eax, dword [0x858dac]
and eax, 0x8aface94
mov dword [0x858f68], eax
jmp 0x8366c6
cmp eax, 0x2d3
jle 0x8366cb
call fcn.00842374
imul eax, dword [0x858dac], 0x2a592a0
mov ebx, dword [ebp + esi*4 - 0x28]
inc esi
add ebx, edi
mov dword [0x858f68], eax
or eax, 0x2d368212
mov edi, ebx
mov dword [0x858dac], eax
cmp esi, 4
jne 0x83669b
cmp byte [0x859144], 0
je 0x836724
mov dword [esp + 4], str.KeepActivationContextsAlive
mov dword [esp], str.The_specified_interrupt_vector_was_already_connected.
call fcn.00841940
mov eax, dword [0x858f68]
and eax, 0xac168e0c
mov dword [0x858dac], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov eax, dword [0x858ca4]
mov edx, eax
and eax, 0x140424c8
and edx, 0x54a764ee
mov dword [0x858f68], eax
mov dword [0x858dac], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp + 4], str.The_requested_print_file_has_been_canceled.
mov dword [esp], str.AslFileMappingGetImageTypeEx_failed___x_
call fcn.00841940
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov dword [esp], 0xffffffff
call fcn.00831083
mov ebx, eax
test eax, eax
jne 0x836817
mov dword [ebp - 0x34], 0x1b
xor esi, esi
mov edi, 0x36
mov dword [ebp - 0x30], 0x3a
mov dword [ebp - 0x2c], 0xffffff75
xor eax, eax
cmp byte [eax + str.The_specified_pack_already_has_a_quorum_of_healthy_disks.], 0
je 0x8367ca
inc eax
cmp eax, 0xffb
jne 0x8367af
sub dword [0x858ca4], 0x460eb65e
mov eax, dword [0x858ca4]
mov dword [esp + 4], str.The_remote_user_session_has_been_deleted.
mov dword [esp], str.ThreadPool:_attempt_to_terminate_a_worker_thread_via_handle__p
add eax, 0x485b805a
mov dword [0x858ca4], eax
and eax, 0x8a1f20f
mov dword [0x858f68], eax
call fcn.00841940
add edi, dword [ebp + esi*4 - 0x34]
inc esi
cmp esi, 3
jne 0x8367ad
cmp edi, dword [ebp - 0x38]
je 0x836819
sub dword [0x858dac], 0x1e0cdcca
mov ebx, 1
jmp 0x836819
xor ebx, ebx
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x83ddf8
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x200
mov ebx, dword [ebp + 0x10]
mov eax, ecx
mov byte [ebp + ecx - 0x10c], cl
cdq
idiv dword [ebp + 0x14]
mov al, byte [ebx + edx]
mov byte [ebp + ecx - 0x20c], al
inc ecx
cmp ecx, 0x100
jne 0x83de09
xor ebx, ebx
xor edx, edx
mov esi, 0x100
movzx eax, byte [ebp + ebx - 0x10c]
mov ecx, eax
add eax, edx
movzx edx, byte [ebp + ebx - 0x20c]
add eax, edx
cdq
idiv esi
mov al, byte [ebp + edx - 0x10c]
mov byte [ebp + edx - 0x10c], cl
mov byte [ebp + ebx - 0x10c], al
inc ebx
cmp ebx, 0x100
jne 0x83de32
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov edi, 0x100
cmp esi, dword [ebp + 0xc]
jge 0x83decc
lea eax, [ebx + 1]
cdq
idiv edi
movzx eax, byte [ebp + edx - 0x10c]
mov ebx, edx
add eax, ecx
cdq
idiv edi
mov al, byte [ebp + edx - 0x10c]
mov ecx, edx
mov dl, byte [ebp + ebx - 0x10c]
mov byte [ebp + ecx - 0x10c], dl
mov edx, dword [ebp + 8]
mov byte [ebp + ebx - 0x10c], al
add al, byte [ebp + ecx - 0x10c]
movzx eax, al
mov al, byte [ebp + eax - 0x10c]
xor al, byte [edx + esi]
mov edx, dword [ebp + 0x18]
mov byte [edx + esi], al
inc esi
jmp 0x83de74
add esp, 0x200
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x83eec0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.Mongolian_Baiti
mov ecx, 0x415
mov ebp, esp
sub esp, 0x18
movsx eax, byte [edx]
inc edx
test al, al
je 0x83eee2
add ecx, eax
cmp ecx, 0x1815
jbe 0x83eed0
mov eax, str.The_display_adapter_is_not_linked_to_any_other_adapters.
mov cl, byte [eax]
lea edx, [ecx - 0x30]
cmp dl, 9
ja 0x83eef4
inc eax
jmp 0x83eee7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, str.Breakpoint
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x83ef0b
inc edx
jmp 0x83eeff
mov eax, dword [ebp + 8]
or eax, 0x4208b51f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
leave
ret