joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x903b
call 0x4694d5
add byte [edx], bh
inc esp
cmp edi, dword [edx]
cmp eax, 0x83413f40
les eax, [ecx + eax*4]
loopne 0x4694dc
xor byte [ecx], al
add byte [eax + 0x57], bl
add dword [eax], eax
pop eax
push edi
call 0x4694ee
add byte [edi + 0x46], cl
dec eax
inc eax
inc ebx
inc edx
inc edi
dec edx
add esp, 4
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push edi
add esp, 4
add edx, 0x12fd5
or edx, 0x11924
add edx, 0xbe05
pop edx
push edi
add edi, 0x171a8
or edi, 0x118b1
sub edi, 0x5bb9
xor edi, 0x30d7
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edi
or edi, 0x1098c
jmp 0x4695b1
pop edi
push esi
push ebx
add esp, 4
call 0x4695c7
add byte [edi + 0x33], cl
inc ebx
inc edx
dec ebp
cmp dh, byte [esi + 0x4c48336]
add esi, 0x6a22
add esi, 0x47ba
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push eax
push eax
add esp, 4
and eax, 0x9fc0
and eax, 0x12a3a
or eax, 0x26c4
pop eax
push edi
and edi, 0x7d72
xor edi, 0x50fe
sub edi, 0xb3b8
or edi, 0x14b04
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ebx
and ebx, 0x9db8
add ebx, 0xf027
xor ebx, 0x1da0
pop ebx
push edx
and edx, 0xa86f
add byte [eax], al
add byte [eax], al
or edx, 0xbd43
call 0x4696c5
add byte [esi + esi + 0x47], al
dec esi
cmp eax, 0xc483464d
add al, 0x5a
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push ebx
sub ebx, 0x11c0e
call 0x469713
add byte [ecx], bh
inc eax
dec esp
cmp cl, byte [ebx + esi - 0x7d]
les eax, [ecx + eax*4]
retf
Function at 0x469740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edi
add esp, 4
sub edi, 0x10a8d
pop edi
push edi
xor edi, 0x15a5d
add edi, 0x2ce1
pop edi
push eax
push edi
add esp, 4
jmp 0x469764
jmp 0x46976b
xor eax, 0x668a
pop eax
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x4697a2
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x469a93
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x4697ca
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x469a93
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x4697fc
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x469a93
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x469821
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], edx
jmp 0x469a93
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x304]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1900], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1904], eax
mov ecx, dword [ebp - 0x724]
mov edx, dword [ebp - 0x304]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1908], edx
mov dword [ebp - 0x728], 0
jmp 0x46987b

Function at 0x481800
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x670440]
xor eax, esp
mov dword [esp + 0x44], eax
push 0x38
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x40
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.005b9800
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 8]
xor ecx, esp
mov edx, dword [esp + 0xc]
call fcn.00502d42
mov esp, ebp
pop ebp
ret
Function at 0x4c2610
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x80c
mov eax, dword [0x670440]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x814]
push ebp
push esi
mov dword [esp + 0xc], ebx
mov esi, dword [ebx + 0x124]
mov ebp, dword [ebx + 0x18]
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x1eb8]
sub eax, dword [esi + 0x1eb4]
add eax, 2
push eax
lea eax, [esi + 0x1cb4]
push eax
push 0x3c
push ebx
call fcn.004c2040
mov eax, dword [esi + 0x1eb4]
add esp, 0x10
mov cl, byte [eax]
inc eax
mov dword [esi + 0x1eb4], eax
cmp cl, 0x18
je 0x4c27e8
cmp cl, 0x23
je 0x4c27c5
cmp cl, 0x27
jne 0x4c2870
push edi
push 0
push 0x27
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [esp + 0x2c]
push 0x800
push eax
call fcn.004b7370
mov esi, dword [esi + 0x1cb0]
add esp, 0x1c
mov edi, 4
test esi, esi
je 0x4c2745
mov edx, dword [esi]
mov ecx, edx
lea ebx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c26d0
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edi
cmp eax, 0x7fa
jae 0x4c2736
push 0x2c
push edx
call fcn.005b96d0
mov ebx, 0x800
lea ebp, [esp + 0x20]
mov edx, eax
add esp, 8
sub ebx, edi
add ebp, edi
test edx, edx
jne 0x4c2717
push dword [esi]
push eax
push str._c_s
push ebx
push ebp
call fcn.004b7370
add esp, 0x14
jmp 0x4c2734
mov ecx, dword [esi]
lea eax, [edx + 1]
push eax
push 1
push ecx
sub edx, ecx
push edx
push 0
push str._c_.s_c_s
push ebx
push ebp
call fcn.004b7370
add esp, 0x20
add edi, eax
mov esi, dword [esi + 4]
test esi, esi
jne 0x4c26c4
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, edi
push str._c_c
push eax
lea eax, [esp + 0x28]
add eax, edi
push eax
call fcn.004b7370
add esp, 0x14
lea eax, [edi + 2]
push 0
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebp + 0x128]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c279b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004a6210
add esp, 0xc
push edi
lea eax, [esp + 0x1e]
push eax
push 0x3e
push ebx
call fcn.004c2040
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.00502d42
add esp, 0x80c
ret
lea edx, [esi + 0x1c28]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c27d0
push 0xf0
push 0xff
push edx
push 0
push 0x23
jmp 0x4c2809
lea edx, [esi + 0x1c08]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c27f3
push 0xf0
push 0xff
push edx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
sub ecx, esi
lea eax, [esp + 0x34]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.004b7370
add esp, 0x28
lea eax, [esp + 0x14]
push 0
push esi
push eax
push dword [ebp + 0x128]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c285c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004a6210
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [esp + 0x1a]
push eax
push 0x3e
push ebx
call fcn.004c2040
add esp, 0x10
mov ecx, dword [esp + 0x814]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502d42
add esp, 0x80c
ret
Function at 0x4d03d0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x4c
mov eax, dword [0x670440]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
cmp edi, 4
jb 0x4d054c
inc ebp
sub edi, 2
push str.0123456789abcdefABCDEF:.
push ebp
call fcn.005c8a30
add esp, 8
cmp edi, eax
je 0x4d04ce
mov edi, eax
add eax, ebp
mov dword [esp + 0x14], eax
cmp byte [eax], 0x25
jne 0x4d054c
push 2
lea esi, [eax + 1]
xor ebx, ebx
push 0x5f9414
push esi
call fcn.005c75c0
add esp, 0xc
test eax, eax
jne 0x4d044f
mov cl, byte [esi + 2]
lea eax, [esi + 2]
test cl, cl
je 0x4d044f
cmp cl, 0x5d
cmovne esi, eax
mov al, byte [esi]
test al, al
je 0x4d054c
lea ecx, [esp + 0x18]
sub ecx, esi
nop
cmp al, 0x5d
je 0x4d0475
cmp ebx, 0xf
jge 0x4d0475
mov byte [ecx + esi], al
inc ebx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4d0460
test ebx, ebx
je 0x4d054c
cmp byte [esi], 0x5d
jne 0x4d054c
cmp ebx, 0x10
jae 0x4d0564
lea eax, [esp + 0x18]
mov byte [esp + ebx + 0x18], 0
push eax
call dword [0x67000c]
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x4d04c5
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00502d42
add esp, 0x4c
ret
mov eax, dword [esp + 0x14]
mov word [eax], 0x5d
lea eax, [esp + 0x18]
mov byte [edi + ebp], 0
push eax
push ebp
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x4d054c
push 0x2e
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
push eax
push 0x17
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x4d0533
lea edx, [esp + 0x28]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4d0503
sub edx, ecx
cmp edx, edi
jae 0x4d0533
lea ecx, [esp + 0x28]
mov esi, ebp
mov eax, ecx
sub esi, eax
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x4d0520
mov byte [edx + ebp + 1], al
mov edi, edx
mov byte [edi + ebp], 0x5d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00502d42
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
mov eax, 0x16
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502d42
add esp, 0x4c
ret
call fcn.00503331
int3
Function at 0x4e57c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x4e580c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x4e57d1
pop ebx
pop edi
pop esi
ret
Function at 0x4eb80e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4eb835
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4eb838
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004eb7ea
pop esi
leave
ret 8

Function at 0x4ec460
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov edx, esi
sub edx, eax
push edi
mov edi, edx
and edi, 0xffffffe0
je 0x4ec4b9
mov ecx, dword [0x6704a8]
shr ecx, 5
test cl, 1
je 0x4ec4b9
movsx ecx, byte [ebp + 0x10]
add edi, eax
vmovd xmm1, ecx
vpxor xmm0, xmm0, xmm0
vpshufb xmm0, xmm1, xmm0
vinsertf128 ymm1, ymm0, xmm0, 1
lea ecx, [ecx]
vpcmpeqb ymm0, ymm1, ymmword [eax]
vpmovmskb ecx, ymm0
test ecx, ecx
jne 0x4ec50f
add eax, 0x20
cmp eax, edi
jne 0x4ec4a0
and edx, 0x1f
vzeroupper
and edx, 0xfffffff0
je 0x4ec4f8
mov ecx, dword [0x6704a8]
shr ecx, 1
test cl, 1
je 0x4ec4f8
movsx ecx, byte [ebp + 0x10]
add edx, eax
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [eax]
pcmpeqb xmm0, xmm1
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x4ec51e
add eax, 0x10
cmp eax, edx
jne 0x4ec4e2
cmp eax, esi
je 0x4ec509
mov cl, byte [ebp + 0x10]
nop
cmp byte [eax], cl
je 0x4ec509
inc eax
cmp eax, esi
jne 0x4ec500
pop edi
pop esi
pop ebp
ret 0xc
vzeroupper
tzcnt ecx, ecx
pop edi
add eax, ecx
pop esi
pop ebp
ret 0xc
bsf ecx, ecx
pop edi
add eax, ecx
pop esi
pop ebp
ret 0xc

Function at 0x5027ee
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.005ce9ae
mov eax, dword [eax + 0x14]
test eax, eax
je 0x502831
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x502831
sub eax, 1
je 0x50282c
sub eax, 1
je 0x502828
xor eax, eax
leave
ret
push 3
jmp 0x502833
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x5041e7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x504226
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x504226
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x504226
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x504226
cmp dword [ecx + 0x74], 0xe
jbe 0x504226
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x509d90
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x509da8
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x509dad
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x509e85
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
cmp esi, 3
jb 0x509e19
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x509e65
shl eax, 0x10
cmp esi, 2
jne 0x509e29
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x509e4c
mov al, 0x3d
jmp 0x509e55
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 2], al
mov cl, 0x3d
mov eax, dword [esp + 0x14]
add eax, 3
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x509dc3
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x5150b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00503b50
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x515157
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x515140
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.00515180
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x5150f3
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x515163
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.00515180
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x5e3776
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x670440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x5e37b9
call fcn.005c6a7d
mov dword [eax], 0xf
call fcn.005c6a90
mov dword [eax], 0xd
call fcn.005be8c2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00502d42
leave
ret
test eax, eax
jne 0x5e37c0
inc eax
jmp 0x5e37ad
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x5e37ab
xor eax, eax
cmp ecx, 1
setne al
jmp 0x5e37ad

Function at 0x5e55f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5e561d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5e561d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402eb0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a1ec]
jne 0x402eba
repz ret
jmp fcn.00405817

Function at 0x40c64c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a1ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406daa
and dword [ebp - 0x14], 0
cmp dword [0x41c2e8], 0
mov dword [ebp - 0x18], eax
jne 0x40c6ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c7a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40c7a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41c2e8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41c2ec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41c2f0], eax
call edi
push eax
call esi
mov dword [0x41c2f8], eax
test eax, eax
je 0x40c6ff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41c2f4], eax
mov eax, dword [0x41c2f4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c758
cmp dword [0x41c2f8], ecx
je 0x40c758
push eax
call esi
push dword [0x41c2f8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c758
test ebx, ebx
je 0x40c758
call edi
test eax, eax
je 0x40c74f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c74f
test byte [ebp - 8], 1
jne 0x40c758
or dword [ebp + 0x10], 0x200000
jmp 0x40c78b
mov eax, dword [0x41c2ec]
cmp eax, dword [ebp - 0x18]
je 0x40c78b
push eax
call esi
test eax, eax
je 0x40c78b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c78b
mov eax, dword [0x41c2f0]
cmp eax, dword [ebp - 0x18]
je 0x40c78b
push eax
call esi
test eax, eax
je 0x40c78b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41c2e8]
call esi
test eax, eax
je 0x40c7a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c7a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402eb0
leave
ret

Function at 0x40d803
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41a1ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
mov edi, dword [0x41c740]
cmp dword [ebp + 8], esi
jle 0x40d850
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.0040d7df
xor byte [edi + esi], al
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
inc esi
cmp esi, dword [ebp + 8]
jl 0x40d825
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402eb0
leave
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b008]
jne 0x40100a
repz ret
jmp fcn.00401dd8

Function at 0x405eea
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403abe
and dword [ebp - 4], 0
cmp dword [0x41d25c], 0
mov ebx, eax
jne 0x405f9b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40604c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40604c
push eax
call fcn.00403a4c
mov dword [esp], 0x4189a4
push edi
mov dword [0x41d25c], eax
call esi
push eax
call fcn.00403a4c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d260], eax
call esi
push eax
call fcn.00403a4c
mov dword [esp], 0x418974
push edi
mov dword [0x41d264], eax
call esi
push eax
call fcn.00403a4c
pop ecx
mov dword [0x41d26c], eax
test eax, eax
je 0x405f9b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403a4c
pop ecx
mov dword [0x41d268], eax
mov eax, dword [0x41d268]
cmp eax, ebx
je 0x405ff3
cmp dword [0x41d26c], ebx
je 0x405ff3
push eax
call fcn.00403ac7
push dword [0x41d26c]
mov esi, eax
call fcn.00403ac7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405ff3
test edi, edi
je 0x405ff3
call esi
test eax, eax
je 0x405fea
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405fea
test byte [ebp - 0xc], 1
jne 0x405ff3
or dword [ebp + 0x10], 0x200000
jmp 0x40602c
mov eax, dword [0x41d260]
cmp eax, ebx
je 0x40602c
push eax
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40602c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40602c
mov eax, dword [0x41d264]
cmp eax, ebx
je 0x40602c
push eax
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40602c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d25c]
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40604c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40604e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret