joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc2b6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4cc2dd
call fcn.004b926d
mov dword [eax], esi
call fcn.004b925a
push 0x16
pop esi
mov dword [eax], esi
call fcn.004bf36d
mov eax, esi
jmp 0x4cc332
test dword [ebp + 0xc], 0xfffffff9
jne 0x4cc2c3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4cc30a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b9280
pop ecx
call fcn.004b925a
mov eax, dword [eax]
jmp 0x4cc332
test al, 0x10
jne 0x4cc330
test al, 1
je 0x4cc330
test byte [ebp + 0xc], 2
je 0x4cc330
call fcn.004b926d
mov dword [eax], 5
call fcn.004b925a
mov dword [eax], 0xd
jmp 0x4cc301
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4d7eb6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x53f1e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004c2d5b
and dword [ebp - 0x14], 0
cmp dword [0x543038], 0
mov dword [ebp - 0x18], eax
jne 0x4d7f69
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4d8011
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x501464
push ebx
call edi
test eax, eax
je 0x4d8011
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x543038], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x54303c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x543040], eax
call edi
push eax
call esi
mov dword [0x543048], eax
test eax, eax
je 0x4d7f69
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x543044], eax
mov eax, dword [0x543044]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4d7fc2
cmp dword [0x543048], ecx
je 0x4d7fc2
push eax
call esi
push dword [0x543048]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4d7fc2
test ebx, ebx
je 0x4d7fc2
call edi
test eax, eax
je 0x4d7fb9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4d7fb9
test byte [ebp - 8], 1
jne 0x4d7fc2
or dword [ebp + 0x10], 0x200000
jmp 0x4d7ff5
mov eax, dword [0x54303c]
cmp eax, dword [ebp - 0x18]
je 0x4d7ff5
push eax
call esi
test eax, eax
je 0x4d7ff5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4d7ff5
mov eax, dword [0x543040]
cmp eax, dword [ebp - 0x18]
je 0x4d7ff5
push eax
call esi
test eax, eax
je 0x4d7ff5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x543038]
call esi
test eax, eax
je 0x4d8011
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4d8013
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1681
leave
ret
Function at 0x401500
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x688
mov ebx, dword [ecx + 8]
mov esi, dword [ecx]
cmp ebx, 0x1a1
je 0x401640
jbe 0x401578
cmp ebx, 0x1a2
je 0x401690
cmp ebx, 0x1a3
jne 0x40171e
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov dword [esp], 9
call sym._MAIN_MessageBoxIDS
mov eax, 1
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp ebx, 1
je 0x4015b0
cmp ebx, 2
jne 0x40171e
mov dword [esp + 4], 2
mov dword [esp], esi
call dword [sym.imp.user32.dll_EndDialog]
sub esp, 8
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea edi, [ebp - 0x418]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edi
mov dword [esp + 4], 0x1a0
mov dword [esp], esi
call dword [sym.imp.user32.dll_GetDlgItemTextA]
sub esp, 0x10
mov dword [esp + 4], 0x1a1
mov dword [esp], esi
call dword [sym.imp.user32.dll_IsDlgButtonChecked]
sub esp, 8
test eax, eax
mov eax, 2
cmovne ebx, eax
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_WinExec]
mov eax, dword [0x407060]
sub esp, 8
test eax, eax
jne 0x401708
mov dword [esp], esi
mov dword [esp + 4], 1
call dword [sym.imp.user32.dll_EndDialog]
mov eax, 1
sub esp, 8
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], esi
mov dword [esp + 4], 0x1a1
call dword [sym.imp.user32.dll_IsDlgButtonChecked]
sub esp, 8
test eax, eax
sete al
mov dword [esp], esi
movzx eax, al
mov dword [esp + 4], 0x1a1
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_CheckDlgButton]
mov eax, 1
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea ebx, [ebp - 0x67a]
mov ecx, str..exe_.pif_.com_.bat
mov edx, 0x14
mov byte [ebp - 0x418], 0
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], ebx
call sym._DIALOG_AddFilterItem
mov edx, 0x13
lea eax, [ebp - 0x680]
mov ecx, 0x408018
call sym._DIALOG_AddFilterItem
lea edx, [ebp - 0x418]
mov eax, ebx
call sym._DIALOG_Browse.constprop.0
test eax, eax
je 0x40159a
lea eax, [ebp - 0x418]
mov dword [esp + 4], 0x1a0
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.user32.dll_SetDlgItemTextA]
sub esp, 0xc
jmp 0x40159a
mov eax, dword [0x407028]
mov dword [esp], eax
call dword [sym.imp.user32.dll_CloseWindow]
sub esp, 4
jmp 0x401611
xor eax, eax
jmp 0x401563
Function at 0x4041c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x400]
push ebx
sub esp, 0x41c
mov eax, dword [0x407050]
mov dword [esp + 0x10], 0x3e8
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.Autostart
mov dword [esp + 4], str.AutoStart
mov dword [esp], str.Settings
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
sub esp, 0x18
call sym._GROUP_FirstGroup
test eax, eax
je 0x404274
mov ebx, eax
jmp 0x404226
mov dword [esp], ebx
call sym._GROUP_NextGroup
mov ebx, eax
test eax, eax
je 0x404274
mov dword [esp], ebx
call sym._GROUP_GroupName
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
sub esp, 8
test eax, eax
jne 0x404218
mov dword [esp], ebx
call sym._PROGRAM_FirstProgram
mov edi, eax
test eax, eax
je 0x404218
mov dword [esp], edi
call sym._PROGRAM_ExecuteProgram
mov dword [esp], edi
call sym._PROGRAM_NextProgram
mov edi, eax
test eax, eax
jne 0x404250
mov dword [esp], ebx
call sym._GROUP_NextGroup
mov ebx, eax
test eax, eax
jne 0x404226
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404280
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x814]
lea esi, [ebp - 0x418]
push ebx
lea ebx, [ebp - 0x800]
sub esp, 0x84c
mov eax, dword [0x407050]
mov dword [esp + 0x10], 0x3e8
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x408250
mov dword [esp + 4], str.Order
mov dword [esp], str.Settings
mov dword [ebp - 0x82c], eax
call eax
sub esp, 0x18
jmp 0x404351
cmp eax, 1
jne 0x4043a2
mov eax, dword [ebp - 0x81c]
mov dword [esp + 4], str.Group_d
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf.constprop.0
mov eax, dword [0x407050]
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x82c]
mov dword [esp + 8], 0x408250
mov dword [esp + 4], edi
mov dword [esp], str.Groups
call eax
sub esp, 0x18
cmp byte [ebp - 0x418], 0
je 0x40434d
mov dword [esp], esi
call sym._GRPFILE_ReadGroupFile
add ebx, dword [ebp - 0x818]
cmp ebx, esi
jae 0x4043a2
lea eax, [ebp - 0x818]
mov dword [esp + 4], str._d_n
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x81c]
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._sscanf
test eax, eax
jne 0x4042e0
mov eax, dword [0x407050]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._MAIN_MessageBoxIDS_s
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405210
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_LocalLock]
mov dword [esp], eax
call esi
mov ebx, eax
mov eax, dword [eax + 0x24]
sub esp, 4
mov dword [esp], eax
call esi
mov edx, dword [ebx + 0x34]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WinExec]
mov eax, dword [0x407060]
sub esp, 8
test eax, eax
jne 0x405260
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [0x407028]
mov dword [esp], eax
call dword [sym.imp.user32.dll_CloseWindow]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x405f80
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop

Function at 0x406090
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40611d
cmp al, 9
je 0x406110
cmp al, 0x20
je 0x406110
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x406178
cmp al, 0x22
je 0x406180
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x40611d
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4060d0
test edi, 1
jne 0x4060d0
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x406110
cmp al, 0x20
je 0x406110
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x406138
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x4060e7
and dword [ebp - 0x6c], 1
jne 0x4060e0
xor edi, 1
jmp 0x4060e7
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x10015450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001545f
pop dword [ebp - 0x48]
mov eax, 0x717c1d48
add eax, 0x9e853717
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd55b121
add dword [ebp - 0x58], 0x40fc942a
mov dword [ebp - 0x54], 0x7183eb10
add dword [ebp - 0x54], 0xc0af6135
mov dword [ebp - 0x50], 0xe383a56d
sub dword [ebp - 0x50], 0x9737613f
mov dword [ebp - 0x4c], 0x7cf66c14
add dword [ebp - 0x4c], 0x830993ec
lea eax, [ebp - 0x58]
push eax
mov eax, 0x100ab08
add eax, 0xf00b558
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf4a251ac
add dword [ebp - 0x58], 0x7fd017aa
mov dword [ebp - 0x54], 0x4d2042f0
sub dword [ebp - 0x54], 0xbb3e17b
mov dword [ebp - 0x50], 0x59c60e67
add dword [ebp - 0x50], 0x9a95e05
mov dword [ebp - 0x4c], 0xf771aedb
sub dword [ebp - 0x4c], 0xf771aedb
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3932a
push 0
call eax
mov ecx, 0xb9b88d70
add ecx, 0x4647c0fe
mov edi, eax
mov ebx, 0x10023600
add ebx, dword [ebp - 0x48]
mov esi, 0x8dbfc36e
add esi, 0x82a5dc42
add dword [ebp - 0x20], esi
mov edx, dword [ebx]
sub edx, esi
mov dword [edi], edx
xor dword [ebp - 0x28], 0x5f4e8504
add edi, 0x72d5c0b1
add edi, 0x8d2a3f53
add ebx, 0xf8e05925
add ebx, 0x71fa6df
loop 0x10015576
add eax, 0x780ecf50
sub eax, 0x780da2c5
mov ebx, eax
add eax, 0xc62e2ba6
add eax, 0x39d1d45f
mov ecx, 0xc7204249
add ecx, 0x48dfbdb7
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4010f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b004]
jne 0x4010fe
repz ret
jmp fcn.004014d0

Function at 0x408cec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404b1f
and dword [ebp - 0x14], 0
cmp dword [0x43dc74], 0
mov dword [ebp - 0x18], eax
jne 0x408d9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e47
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e47
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43dc74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43dc78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43dc7c], eax
call edi
push eax
call esi
mov dword [0x43dc84], eax
test eax, eax
je 0x408d9f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43dc80], eax
mov eax, dword [0x43dc80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408df8
cmp dword [0x43dc84], ecx
je 0x408df8
push eax
call esi
push dword [0x43dc84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408df8
test ebx, ebx
je 0x408df8
call edi
test eax, eax
je 0x408def
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408def
test byte [ebp - 8], 1
jne 0x408df8
or dword [ebp + 0x10], 0x200000
jmp 0x408e2b
mov eax, dword [0x43dc78]
cmp eax, dword [ebp - 0x18]
je 0x408e2b
push eax
call esi
test eax, eax
je 0x408e2b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e2b
mov eax, dword [0x43dc7c]
cmp eax, dword [ebp - 0x18]
je 0x408e2b
push eax
call esi
test eax, eax
je 0x408e2b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43dc74]
call esi
test eax, eax
je 0x408e47
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010f4
leave
ret
Function at 0x4301c0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x43bdb0]
push ebx
mov ebx, dword [0x2be1234]
push edi
mov edi, dword [0x2be36b4]
call fcn.00430130
cmp dword [0x2be36b4], 0x2f
jne 0x43022d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00430160
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010f4
add esp, 0x24
ret
Function at 0x4304b0
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x4304c8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x430511
mov dword [0x2be331c], 0x8e46a6f0
cmp dword [0x2be36b4], 0x3dc
jne 0x43050f
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4304bf
mov dword [ebp - 0x10], 0
jmp 0x430523
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x4305c6
cmp dword [0x2be36b4], 0xa5f
jne 0x43054c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x10], 0x84620b
jne 0x430571
mov eax, dword [0x43cbd0]
mov dword [0x2be36b4], eax
mov ecx, dword [0x2be36b4]
add ecx, 0xa231
mov dword [0x2be36b4], ecx
cmp dword [0x2be36b4], 0x141
jne 0x4305c1
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x43e1a0], 0xec58acac
mov dword [0x43e1a4], 0xffffffff
jmp 0x43051a
call fcn.00430250
jmp dword [0x2be1234]
Function at 0x40457c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437a6c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x40469f
push ecx
lea ecx, [esi + 0x18]
call fcn.00423d9c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4046b6
push ecx
lea ecx, [esi + 0x24]
call fcn.00423cac
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4375bc
Capabilities:
Encode data using xor

Disassembly:
inc ebx
add bh, dl
mov dword [0x638031f5], eax
cmc
xor dword [eax + 0x41e94563], eax
lock adc dword [esi], esp
cmc
xor dword [eax + 0x41e94563], eax
lock adc dword [esi], esp
sbb dword [ebp - 0x28d81eaf], edx
fisttp word [edi - 0x4f219831]
movsb byte es:[edi], byte [esi]
xor byte [edx + 0x20], 0xf3
dec esp
mov ecx, 0x7567c879
jae 0x4375b7
pop es
xor al, 0xa2
invalid

Function at 0x437a6c
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x1f
dec edx
mov esp, 0x81e3622a
sbb al, 0xe3
dec esp
jne 0x437a11
cli
push edi
mov bh, 1
mov ebx, 0xd442b97b
push ebx
pop es
mov cl, byte [ecx]
ret
mov bl, 0x83
xchg edi, eax
ror byte [eax + 0x63], 3
mov byte [0xb8025529], al
adc byte [ebx + 0x3bec8445], dh
arpl word [ebx + 0x50], cx
xor eax, 0x97751922
stc
cmp al, 3
fidivr word ds:[edx]
push esp
sahf
push es
test byte [eax + 0x65], al
jns 0x437a06
cmc
add al, 0x6f
sal dword [ebx + eax*2], 0xa7
call 0xa29e4ed9
insb byte es:[edi], dx
and edx, 0xffffffc4
jge 0x437a37
les edi, [ebp - 0x3b]
inc edi
sar dword [ecx - 0x14], cl
xor al, 0x59
test edi, edx
add dword [edx], ebx
jge 0x437a6f
pop ebp
movsd dword es:[edi], dword [esi]
push edx
inc ebp
stc
mov bl, 0x82
pop ecx
pop es
inc ebp
xchg edx, eax
cmp byte [esi + 0x4d037888], bl
xchg ebp, eax
mov al, byte [0xc647e1a9]
in eax, 0x90
sbb esi, ebp
test al, 0x8c
jmp 0x87a10de5