joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1271f21
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
inc ebp
xor esi, ebx
jmp 0x137018b
inc ecx
push esp
dec ebp
xor ebx, eax
inc ecx
not edi
inc ecx
movsx eax, bp
dec edx
mov dword [esp + ebp - 0xd6], eax
dec edi
mov dword [ecx + ebp - 0xde], eax
inc esi
mov esi, dword [esi + ebp*2 - 0x1c8]
inc ecx
sar esp, cl
inc ebp
sub ah, ch
dec edx
lea esi, [esi + ebp - 0xea]
inc ecx
sal edx, cl
jne 0x1267f5a
mov byte [esi], al
jmp 0x136d5fc
je 0x179d8b4
inc edx
jmp 0x1736376
shr al, 0xe1
inc edx
xchg dword [esp + ebp - 0xc7], ecx
inc edi
lea esi, [edx + esi - 0x4b238b7a]
inc ecx
xor esi, 0x90005304
inc sp
xadd ebx, ebp
inc ecx
neg esi
inc ecx
inc esi
jmp 0x17785b1
cmp edx, 0x104
jmp 0x179d8ae
mov eax, 0x21856782
rcr cl, 0x2a
cmc
mov cl, dl
xchg esi, esi
movzx esi, bp
rol eax, cl
sal si, 0x8b
lea esi, [ebp + edx - 0x10c]
cmc
add al, dl
xor al, byte [edi + esi]
jmp 0x1271f5c
inc si
xadd dword [esp + edx - 0x70bffff4], ebp
inc ebx
dec esi
mov dword [esp + ebp*8 + 0x20], ebx
inc esi
xor dword [esp + edx - 0x70bfffe0], esi
dec edx
or dword [esp + edx - 0x70bffff3], ecx
inc edx
shr byte [esp + edx - 0x70bfffe7], 0xe5
dec esi
mov ebx, dword [esp + edx - 0x70bfffe0]
pop edx
dec ebp
arpl si, si
dec ecx
add edi, esi
dec edx
mov dword [esp + edx - 0x70c00000], edi
ret 0x18
jb 0x1741018
mov eax, dword fs:[0x30]
sar bx, cl
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
adc ebx, esp
cmp sp, ax
mov eax, dword [eax + 0x10]
adc bh, 0xb3
rcl ebx, 0xad
mov dword [ebp - 4], eax
sbb ebx, ecx
mov ebx, ecx
test esi, esp
cmp ecx, eax
je 0x122e6be
lea ebx, [ebx]
movsx esi, dx
bswap di

Function at 0x132807d
Capabilities:
Encode data using xor

Disassembly:
inc ecx
dec esi
inc ecx
not esi
pop eax
inc edx
inc dword [esp + eax + 4]
inc ecx
ror esi, 1
inc ecx
mov esp, 0xf48de703
call fcn.0134040e
dec esp
mov dword [esp + ebp - 0x3a25ff9f], ebx
call 0x1731a94
inc ecx
mov eax, 0xc93e9182
inc ecx
push eax
inc ecx
sal esi, cl
dec edx
lea eax, [eax*4 - 0x125fda7d]
inc ebp
mov dword [ecx], esi
dec eax
lea ebx, [eax + eax*8 - 0x75dcb0ff]
inc ecx
xor al, 0x18
dec eax
sbb esi, 4
sub byte [esp + 9], bl
inc esp
mov esi, dword [esi]
inc ebp
xor esi, ebx
inc ebp
xor eax, eax
je 0x128a1e1

Function at 0x1330d41
Capabilities:
Encode data using xor

Disassembly:
and al, ah
mov dword [ebp + eax*2 - 0x2c000000], edx
ror al, 0x64
lea esi, [esi + eax*2 - 0x2c000004]
lea ecx, [eax - 0x11688e50]
lea edx, [ecx*4 - 0x7ad624f4]
mov eax, dword [esi + eax - 0x16000000]
call fcn.0175dc01
lea edx, [edx + ebp*2 + 0x36a788bb]
call fcn.0179217c
mov edx, 0x5e2bfa82
mov edx, dword [ebp + edx - 0x5e2bfa82]
mov eax, 0x7b0950a2
neg al
mov cl, byte [ebp + eax - 0x7b09505a]
lea ebp, [ebp + eax - 0x7b09505c]
shr eax, 3
shl eax, 0x59
shl edx, cl
jmp 0x12431d2
Function at 0x1346000
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
add edi, eax
movsx eax, word [esp + edx - 0x4ef066a4]
movzx eax, byte [esi + ecx*2 - 0x397ebc41]
xchg cl, dl
lea edx, [edx*4 - 0x5b6c8e4a]
dec dx
xor al, bl
jmp fcn.0121a664
pop edx
lea edx, [ecx + ecx*4 - 0x40cc83e3]
sub eax, 0xb19919a7
rol dx, 0xa9
bswap eax
push ecx
lea eax, [eax + edx + 0x5e939af1]
mov dword [esp + ecx - 0x1cbf5e1a], 0x683187b7
bswap eax
jb 0x133512c
cwde
mov al, 0x98
xchg ah, bh
invalid
Function at 0x136cb9c
Capabilities:
Encode data using base64

Disassembly:
neg ebp
dec eax
dec eax
dec esp
lea esi, [ebx*8 - 0x15d98c78]
dec esi
mov dword [esp + edi*2 - 0x7a606758], ebx
jp 0x178f995
inc ecx
add eax, 0xc23f483b
inc edx
xor dword [esp + edi - 0x3d3033ac], ebp
inc ecx
pop ebx
dec eax
arpl bp, bp
movzx edx, ax
dec edi
lea ebp, [edi + eax + 0x2a24b92c]
dec eax
add edi, ebp
inc ecx
add edx, 0x260a4e3e
inc edi
mov ebp, dword [edi + ecx - 0x3d3033ac]
dec eax
shl edx, 0x6a
sar bx, 0x45
dec ebx
lea ecx, [esi + eax*4 + 0x68b1b239]
inc edi
mov esi, dword [edi + ecx - 0x3d3033a8]
jb 0x125845d

Function at 0x137fbb6
Capabilities:
Encode data using xor

Disassembly:
inc di
mov esp, dword [ecx + ebp - 0x3eb9249f]
dec eax
bswap eax
inc ebx
mov cl, byte [ecx + ebp - 0x3eb9249d]
dec edi
lea ecx, [ecx + ebp - 0x3eb9249d]
inc bp
shrd edx, esp, cl
movzx ecx, ax
call fcn.0137c7bc
cmp edx, edi
pop ds
imul ebx, dword [eax + 0x37f010f8], 0x3b
add esi, esi
and ah, dh
das
cmp eax, dword [ebx]
neg byte [eax]
sbb al, 0x27
cmp eax, dword [ebx]
div byte [eax]
and byte [edi], cl
cmp eax, dword [ebx]
imul al
and al, 0x33
cmp eax, dword [ebx]
idiv byte [esi + 0xc]
cmc
inc esi
out 0xa6, al
in eax, dx
mov ebp, 0x14ba8d52
and ebx, dword [eax + 0x1f]
test al, 0x89
xor al, 0x72
out 0xdf, al
xchg edi, eax
invalid
Function at 0x173f99f
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor ebx, ebx
dec ecx
neg eax
not ebx
push eax
sub ebx, 0x9c02a2b5
xor ebx, 0x64a11e97
dec edx
sar dword [esp + eax*8 + 0x1c0e0], 0x2e
dec esp
lea edi, [eax + edx*2 - 0x405e5d5d]
inc ecx
push eax
lea ebx, [ebx + eax + 0x1887e6d9]
dec esp
adc dword [esp + eax - 0x729bbfac], ebx
inc esi
movsx esi, word [esp + eax*2 + 0x703b]
inc edx
xor dword [esp + eax + 0x3824], ebx
inc sp
xor edi, dword [esp + eax - 0x729bbfb0]
inc ecx
push eax
dec esi
mov ebx, dword [esp + eax + 0x382c]
dec eax
arpl bx, bx
inc ecx
setg bh
jg 0x172b88b
pop ecx
add ecx, 0x3d4e68
jmp ecx
dec eax
mov dword [esp + eax - 0x729bbfa4], edx
dec eax
adc edi, ebx
rol edx, 0x3a
inc esp
dec ebx
inc ecx
mov ebx, 0xf525561c
xor dword [esp + ebx*4 - 0x591fe288], eax
dec ecx
shr eax, cl
pop ebp
call fcn.01773a39
mov eax, 0x729bbfb4
inc ebp
mov eax, dword [ebp + eax - 0x729bbfb4]
inc ebp
mov dword [ecx + eax - 0x729bbfb0], eax
dec eax
lea edx, [eax + eax*4 + 0x580f7998]
mov ebx, dword [esi + eax - 0x729bbfb8]
dec eax
lea esi, [esi + eax - 0x729bbfb8]
inc esp
movsx eax, dx
jmp 0x133f489

Function at 0x175304f
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
mov ebx, dword [esp + eax*2 - 0x77f18d62]
dec eax
mov dword [esp + eax - 0x3bf8c6a9], 0x36944280
dec ebp
add esi, edi
inc esp
adc byte [esp + eax - 0x3bf8c6b0], dl
dec eax
arpl dx, dx
jle 0x136b0af
rol dword [esp + eax*2 - 0x77f18d6a], 0x75
dec eax
adc edi, edx
dec eax
mov dword [esp + eax - 0x3bf8c6b9], edi
ret 0x10

Function at 0x175e9dc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x21505183
call fcn.01750d14
shl dword [eax + 0x7e], 1
pop ecx
inc ebx
daa
sti
pop ss

Function at 0x1774571
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc bp
mov esi, dword [ecx + eax*2 - 0x12d14]
shl eax, 0x98
dec edx
mov dword [esp + edi - 0x42aa968e], eax
dec edi
lea ecx, [ecx + edi - 0x42aa9684]
inc esp
movsx eax, ax
inc di
mov dword [edi + edx - 0x42aa968e], esi
inc ecx
mov ecx, edi
dec ecx
lea esi, [edi + esi - 0x42aa9692]
movzx edx, word [esp + ecx - 0x42aa968d]
rol cx, cl
inc ebp
mov esi, dword [eax + esi]
inc ebp
xor esi, ebx
dec edx
lea ebp, [edi*2 + 0x5239fd20]
dec edx
dec dword [esp + eax]
call fcn.0174ea23
dec eax
sub esi, 4
mov eax, 0x48a913a
call fcn.01731d0b

Function at 0x177f590
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.01795c67
mov edx, 0x9a26ff12
mov ecx, edx
shr edx, cl
mov dx, word [edx + ebp - 0x2689]
movsx eax, cl
call fcn.0124c74f

Function at 0x177f5c9
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
xor edx, 0xf1885828
xor ebx, edx
call fcn.01283d29
mov edx, dword [esp]
add ax, cx
movsx ecx, byte [esp]
sar dword [esp], cl
setae cl
mov word [ebp], ax
pop edx
jmp edi
add ax, ax
lea edx, [edx + eax*2 + 0x3ff0eaa7]
mov dword [esp + eax*8 - 0x350e7a00], ecx
ror edx, 1
shl ecx, 0xee
ja 0x1376dde
shr dword [ecx + 0x6f], 1
jno 0x177f640
dec ecx
iretd
shl byte [edx], cl
invalid
Function at 0x1780e04
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc ecx
pop esp
inc ebp
movzx esp, al
inc ecx
sub edx, 0xd7afd284
xor word [esp + ecx*2 + 6], 0x1eae
dec esp
mov dword [esp + ecx*4 + 0x10], ebx
inc esp
xor dword [esp + ecx + 0x10], edx
pop eax
dec esp
mov ebx, dword [esp + ecx + 8]
inc ecx
pop eax
call fcn.017526bb
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x41a1e8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a1ec]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0x2d2de0c], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x854]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ecx, dword [0x41a1f0]
mov edx, dword [0x41a1f4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x2d2de0c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d2de08]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x2d2de0c], 0x3eb
mov dword [0x2d2de08], eax
mov eax, dword [0x2d2dd5c]
cmove eax, dword [ebp - 8]
mov dword [0x2d2dd5c], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], edx
and dword [ebp - 8], 0
mov dword [0x2d2de04], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x2d2de0c], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x401359
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x2d2de0c], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139c
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jne 0x40127f
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb37
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406d87
mov dword [ebp - 0x14], eax
cmp dword [0x4344e8], esi
jne 0x40bc2a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40bbb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40bd0a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40bd0a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40bd0a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4344e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4344ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4344f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4344f8], eax
test eax, eax
je 0x40bc27
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4344f4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40bc4f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40bc42
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40bc64
push 4
pop eax
jmp 0x40bd0c
cmp dword [ebp - 0x14], esi
je 0x40bc64
push dword [0x4344e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40bc49
mov eax, dword [0x4344f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40bcc2
cmp dword [0x4344f8], edi
je 0x40bcc2
push eax
call ebx
push dword [0x4344f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40bcc2
test eax, eax
je 0x40bcc2
call ecx
test eax, eax
je 0x40bcb7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40bcb7
test byte [ebp - 8], 1
jne 0x40bcc2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40bcf2
mov eax, dword [0x4344ec]
cmp eax, edi
je 0x40bcef
push eax
call ebx
test eax, eax
je 0x40bcef
call eax
mov esi, eax
test esi, esi
je 0x40bcef
mov eax, dword [0x4344f0]
cmp eax, edi
je 0x40bcef
push eax
call ebx
test eax, eax
je 0x40bcef
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4344e8]
call ebx
test eax, eax
je 0x40bd0a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40bd0c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040397d
mov esp, ebp
pop ebp
ret
Function at 0x409568
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x41e23f
call fcn.0041d6dc
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], esi
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
call fcn.0040c010
add esp, 0xc
mov dword [ebp - 0x424], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], edi
test edi, edi
jne 0x4095f1
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], eax
test edi, edi
jne 0x4095f1
call fcn.00401c76
mov esi, eax
jmp 0x4096f4
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x409614
call fcn.00401c76
jmp 0x4096e7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x40960a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x409647
mov esi, 0x8007000e
jmp 0x4096e9
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x409717
jb 0x409662
cmp eax, 0xffffffff
ja 0x409717
cmp eax, 0x400
jbe 0x409677
push eax
lea ecx, [ebp - 0x424]
call fcn.00407f38
jmp 0x409699
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x409699
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
je 0x40963d
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40960a
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.00409413
mov esi, eax
test edi, edi
je 0x4096f4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40970d
lea ecx, [ebp - 0x424]
call fcn.00407f23
mov eax, esi
call fcn.0041d629
ret 0x10
push 0x80070216
call fcn.004021d4
int3

Function at 0x416575
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161ee

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x77236b18
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x12193801
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x573e6911
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x9d5897
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov edx, dword [0x86f9a4]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
cmp edx, 0x594
jne 0x401245
push 0
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x86f9a4]
mov eax, dword [0x4191e8]
lea ecx, [ebp - 0xc]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x20], eax
mov eax, dword [0x4191ec]
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp edx, 0x14
jne 0x401285
push 0
lea eax, [ebp - 0x454]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov ecx, dword [0x4191f0]
mov edx, dword [0x4191f4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x86f9a4], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x86f9a0]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x86f9a4], 0x3eb
mov dword [0x86f9a0], eax
mov eax, dword [0x86f8f8]
cmove eax, dword [ebp - 8]
mov dword [0x86f8f8], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], edx
and dword [ebp - 8], 0
mov dword [0x86f99c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x86f9a4], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x40137b
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x86f9a4], 0xb03
mov dword [ebp - 4], ecx
jne 0x4013bc
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jne 0x4012a1
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret