joyce8/EMBER2024-capa huggingface dataset:
Function at 0x652802ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x652ed7b0]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x65280335
push ebx
call fcn.65280283
test eax, eax
pop ecx
jne 0x65280307
call fcn.6527ba8f
mov dword [eax], 0xf
call fcn.6527ba86
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.65285043
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x65280347
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x652802f7
inc eax
cmp eax, 0x104
ja 0x652802f7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x6528037f
cmp eax, dword [ebp + 0x10]
jg 0x65280362
mov eax, dword [ebp + 0x10]
push eax
call fcn.6527ce66
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x65280394
call fcn.6527ba86
mov dword [eax], 0xc
jmp 0x652802f7
cmp eax, dword [ebp + 0x10]
jle 0x65280394
call fcn.6527ba86
mov dword [eax], 0x22
jmp 0x652802f7
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.65285650
pop ecx
pop ecx
jmp 0x652802f9
Function at 0x65284ad3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x652ed7b0]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x652ed720]
je 0x65284b00
inc eax
cmp eax, 0x12
jb 0x65284af1
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x652ed720]
jne 0x65284c34
mov eax, dword [0x652fb3bc]
cmp eax, 1
je 0x65284c0f
cmp eax, edx
jne 0x65284b30
cmp dword [0x652fb3c0], 1
je 0x65284c0f
cmp ecx, 0xfc
je 0x65284c34
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x65284b69
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.65285650
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.65282ac0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x65284bab
lea eax, [ebp - 0x10c]
push eax
call fcn.65282ac0
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x6529d7c8
push edi
call fcn.6527b7d0
add esp, 0x10
push edi
call fcn.65282ac0
push dword [esi + 0x652ed724]
mov ebx, eax
call fcn.65282ac0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.6527c5f0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.65285650
push edi
push ebx
call fcn.65285660
push 0x6529d7a8
push ebx
call fcn.65285660
push dword [esi + 0x652ed724]
push ebx
call fcn.65285660
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.652876f9
add esp, 0x2c
jmp 0x65284c34
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x652ed724]
push dword [esi]
call fcn.65282ac0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.65285043
pop edi
pop esi
pop ebx
leave
ret
Function at 0x65284e3c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.6527c5f0
mov eax, dword [0x652ed7b0]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.65283d98
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x65284f66
push 2
push esi
push dword [ebp + 8]
call fcn.65283d98
add esp, 0xc
cmp eax, ebx
je 0x65284f66
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x65284f09
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.652838e0
push 0x8000
push dword [ebp + 8]
call fcn.65287efb
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x65284ec2
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.6527ee12
add esp, 0xc
cmp eax, 0xffffffff
je 0x65284ee2
sub edi, eax
test edi, edi
jg 0x65284eba
jmp 0x65284efa
call fcn.6527ba8f
cmp dword [eax], 5
jne 0x65284ef7
call fcn.6527ba86
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.65287efb
pop ecx
pop ecx
jmp 0x65284f51
jge 0x65284f51
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.65283d98
push dword [ebp + 8]
call fcn.6527e964
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x65284f51
call fcn.6527ba86
mov dword [eax], 0xd
call fcn.6527ba8f
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.65283d98
add esp, 0xc
mov eax, esi
pop edi
jmp 0x65284f68
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.65285043
leave
ret
Function at 0x65286a40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.6527c5f0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x65286ad5
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x652fb3e8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x65286ad5
cmp eax, 1
je 0x65286aed
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x65286ad5
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x65286aaa
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x65286ad1
xor eax, eax
inc eax
jmp 0x65286b09
cmp esi, ebx
jae 0x65286ad9
xor eax, eax
jmp 0x65286b09
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x652fb3e8]
jmp 0x65286aef
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x652876f9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x652fb740], ebx
push esi
push edi
jne 0x65287779
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x652877b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6529dab0
push edi
call esi
test eax, eax
mov dword [0x652fb740], eax
je 0x652877b4
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x652fb744], eax
call esi
cmp dword [0x652fb3e8], 2
mov dword [0x652fb748], eax
jne 0x65287779
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x652fb750], eax
je 0x65287779
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x652fb74c], eax
mov eax, dword [0x652fb74c]
test eax, eax
je 0x652877be
call eax
test eax, eax
je 0x652877a5
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x652fb750]
test eax, eax
je 0x652877a5
test byte [ebp - 8], 1
jne 0x652877be
cmp dword [0x652fb3f4], 4
jb 0x652877b8
or byte [ebp + 0x12], 0x20
jmp 0x652877dd
xor eax, eax
jmp 0x652877ed
or byte [ebp + 0x12], 4
jmp 0x652877dd
mov eax, dword [0x652fb744]
test eax, eax
je 0x652877dd
call eax
mov ebx, eax
test ebx, ebx
je 0x652877dd
mov eax, dword [0x652fb748]
test eax, eax
je 0x652877dd
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x652fb740]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x65288551
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x652885bc
push 0x3d
push dword [ebp + 8]
call fcn.6527cbce
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x652885bc
cmp dword [ebp + 8], esi
je 0x652885bc
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x652fb408]
cmp eax, dword [0x652fb40c]
jne 0x652885a2
mov edi, eax
call fcn.652884f0
mov dword [0x652fb408], eax
cmp eax, ebx
jne 0x652885fb
cmp dword [ebp + 0xc], ebx
je 0x652885c4
cmp dword [0x652fb410], ebx
je 0x652885c4
call fcn.65285796
test eax, eax
je 0x652885fb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x652886ff
push 4
call fcn.6527ce66
cmp eax, ebx
pop ecx
mov dword [0x652fb408], eax
je 0x652885bc
mov dword [eax], ebx
cmp dword [0x652fb410], ebx
jne 0x652885fb
push 4
call fcn.6527ce66
cmp eax, ebx
pop ecx
mov dword [0x652fb410], eax
je 0x652885bc
mov dword [eax], ebx
mov ebx, dword [0x652fb408]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.652884a3
mov edi, eax
test edi, edi
pop ecx
jl 0x65288654
cmp dword [ebx], 0
je 0x65288654
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.6527ce78
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x6528863c
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x6528868a
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x65288633
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.6527cee9
test eax, eax
pop ecx
pop ecx
je 0x6528868a
jmp 0x65288685
cmp dword [ebp - 4], 0
jne 0x652886f8
test edi, edi
jge 0x65288664
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.6527cee9
test eax, eax
pop ecx
pop ecx
je 0x652885bc
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x652fb408], eax
cmp dword [ebp + 0xc], 0
je 0x652886e1
push dword [ebp + 8]
call fcn.65282ac0
inc eax
inc eax
push eax
call fcn.6527ce66
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x652886e1
push dword [ebp + 8]
push esi
call fcn.65285650
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x652886da
or dword [ebp - 8], 0xffffffff
push esi
call fcn.6527ce78
pop ecx
cmp dword [ebp - 4], 0
je 0x652886f0
push dword [ebp + 8]
call fcn.6527ce78
pop ecx
mov eax, dword [ebp - 8]
jmp 0x652885bf
push esi
call fcn.6527ce78
pop ecx
xor eax, eax
jmp 0x652885bf
Function at 0x652894a0
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, cl
test ecx, ecx
jle 0x652894ea
push esi
add eax, 2
push edi
lea esp, [esp]
movzx esi, byte [eax - 1]
movzx edx, byte [eax + 1]
mov edi, dword [esi*4 + 0x652f04b0]
movzx esi, byte [eax - 2]
mov edx, dword [edx*4 + 0x652f0cb0]
xor edx, edi
mov edi, dword [esi*4 + 0x652f00b0]
movzx esi, byte [eax]
xor edx, edi
xor edx, dword [esi*4 + 0x652f08b0]
mov dword [eax - 2], edx
add eax, 4
dec ecx
jne 0x652894b0
pop edi
pop esi
ret
Function at 0x65289ed0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push esi
mov esi, dword [esp + 0x24]
mov ebx, dword [esi]
push edi
xor edx, dword [esi + 4]
mov edi, dword [esp + 0x20]
xor ecx, ebx
mov ebx, dword [esi + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 8]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
xor ecx, edx
mov edx, dword [eax + 0xc]
push esi
lea eax, [esp + 0x10]
push eax
xor edx, ebx
push edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call fcn.65289750
mov eax, dword [esp + 0x38]
shr eax, 4
add esp, 0xc
dec eax
test eax, eax
jle 0x65289f6c
mov ebx, eax
jmp 0x65289f30
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
xor edx, ecx
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x10], edx
mov edx, dword [esi + 4]
xor eax, edx
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 8]
xor ecx, eax
mov dword [esi + 0x18], ecx
mov ecx, dword [esi + 0xc]
xor edx, ecx
mov dword [esi + 0x1c], edx
add esi, 0x10
push esi
push esi
push edi
call fcn.65289750
add esp, 0xc
dec ebx
jne 0x65289f30
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x65289f80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
push esi
lea esi, [ecx + eax - 0x10]
shr eax, 4
dec eax
test eax, eax
push edi
jle 0x65289fdb
mov edi, eax
lea ecx, [ecx]
push esi
push esi
push ebx
call fcn.65289b10
mov edx, dword [esi - 0x10]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
xor eax, edx
mov edx, dword [esi + 8]
mov dword [esi], eax
mov eax, dword [esi - 0xc]
xor ecx, eax
mov eax, dword [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [esi - 8]
xor edx, ecx
mov dword [esi + 8], edx
mov edx, dword [esi - 4]
xor eax, edx
mov dword [esi + 0xc], eax
add esp, 0xc
sub esi, 0x10
dec edi
jne 0x65289fa0
push esi
push esi
push ebx
call fcn.65289b10
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
xor ebx, ecx
mov dword [esi], ebx
mov edx, dword [eax + 4]
xor edi, edx
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ecx, dword [eax + 8]
xor edx, ecx
mov dword [esi + 8], edx
mov edx, dword [eax + 0xc]
mov eax, dword [esi + 0xc]
add esp, 0xc
xor eax, edx
pop edi
mov dword [esi + 0xc], eax
pop esi
mov eax, 1
pop ebx
ret
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x4266a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4266b4
pop dword [ebp - 0x24]
mov eax, 0x4266b4
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xfa5e87e6
add dword [ebp - 0x34], 0x53f3bd65
mov dword [ebp - 0x30], 0x64300049
add dword [ebp - 0x30], 0xce034bfc
mov dword [ebp - 0x2c], 0x85c46aa6
add dword [ebp - 0x2c], 0xc687d988
mov dword [ebp - 0x28], 0xd3a81efb
sub dword [ebp - 0x28], 0xd3a81efb
lea eax, [ebp - 0x34]
push eax
mov eax, 0xe3f3cafd
add eax, 0x1c4ff72f
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xb8d10079
sub dword [ebp - 0x34], 0x445e9723
mov dword [ebp - 0x30], 0x70902325
add dword [ebp - 0x30], 0xd0dc3e50
mov dword [ebp - 0x2c], 0x37b6d963
sub dword [ebp - 0x2c], 0xd4476cf7
mov dword [ebp - 0x28], 0x58d8cd9e
sub dword [ebp - 0x28], 0x58d8cd9e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x6f4de9a0
sub eax, 0x6f0a26b0
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x44c9d
push 0
call eax
mov ecx, 0x6ade959d
sub ecx, 0x6ade521b
mov edi, eax
mov esi, 0x475600
add esi, dword [ebp - 0x24]
mov ebx, 0xeb160105
sub dword [ebp - 0x1c], 0xdeac5f8
mov edx, dword [esi]
mov dword [ebp - 0x14], 0x4757ecab
sub edx, ebx
add dword [ebp - 0x14], 0xbd3c4856
mov dword [edi], edx
xor dword [ebp - 0x14], esi
add edi, 4
add esi, 4
loop 0x4267c5
add eax, 0x100db
xor ebx, ebx
add ebx, eax
add eax, 0x651c394d
sub eax, 0x651c3948
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x41aafa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4225a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c3bc
and dword [ebp - 0x14], 0
cmp dword [0x439938], 0
mov dword [ebp - 0x18], eax
jne 0x41abad
push 0x403df0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ac55
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403de4
push ebx
call edi
test eax, eax
je 0x41ac55
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403dd4
push ebx
mov dword [0x439938], eax
call edi
push eax
call esi
push 0x403dc0
push ebx
mov dword [0x43993c], eax
call edi
push eax
call esi
push 0x403da4
push ebx
mov dword [0x439940], eax
call edi
push eax
call esi
mov dword [0x439948], eax
test eax, eax
je 0x41abad
push 0x403d8c
push ebx
call edi
push eax
call esi
mov dword [0x439944], eax
mov eax, dword [0x439944]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ac06
cmp dword [0x439948], ecx
je 0x41ac06
push eax
call esi
push dword [0x439948]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ac06
test ebx, ebx
je 0x41ac06
call edi
test eax, eax
je 0x41abfd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41abfd
test byte [ebp - 8], 1
jne 0x41ac06
or dword [ebp + 0x10], 0x200000
jmp 0x41ac39
mov eax, dword [0x43993c]
cmp eax, dword [ebp - 0x18]
je 0x41ac39
push eax
call esi
test eax, eax
je 0x41ac39
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ac39
mov eax, dword [0x439940]
cmp eax, dword [ebp - 0x18]
je 0x41ac39
push eax
call esi
test eax, eax
je 0x41ac39
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439938]
call esi
test eax, eax
je 0x41ac55
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ac57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004071a4
leave
ret

Function at 0x41e4f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x8e3da8], ax
mov word [0x8e3dac], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x8e3da8
mov dword [0x8e3db4], 0x320033
mov dword [0x8e3dbc], 0x6c006c
mov word [0x8e3dae], cx
mov dword [0x8e3db0], 0x6c0065
mov dword [0x8e3db8], 0x64002e
mov word [0x8e3daa], dx
mov word [0x8e3dc0], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x8e3da4]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x8e3da0], eax
mov eax, dword [0x8e2590]
push edx
push eax
mov byte [0x439963], 0x65
mov dword [0x439959], 0x75747269
mov word [0x43995d], 0x6c61
mov byte [0x439958], 0x56
mov word [0x439964], 0x7463
mov byte [0x439966], 0
mov dword [0x43995f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x41e5f0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1280
call fcn.0041da20
cmp dword [0x8e3da4], 0x37
push esi
jne 0x41e6f1
push 0
lea eax, [esp + 0x284]
push eax
push 0x403ed4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
call esi
xor eax, eax
lea edx, [esp + 8]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_ReadFileScatter]
push 0
lea eax, [esp + 0x684]
push eax
push 0x403ee0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0xa84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x60]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call esi
push 0x403f08
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x38], 0
call fcn.004102c0
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
mov edx, dword [0x8e6508]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + ebx]
mov edx, dword [0x8e2590]
mov byte [edx + ebx], cl
pop esi
add esp, 0x1280
ret