joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416dd0
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [ecx + 4]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov dword [esp + 0x14], edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x18], edi
mov edi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x20], edi
bswap edx
bswap eax
mov esi, 0xc6ef3720
mov dword [esp + 0x10], ecx
mov edi, 0x20
lea esp, [esp]
mov ebx, dword [esp + 0x20]
xor ebx, edx
add ebx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 5
xor ecx, esi
add ebx, ecx
mov ebp, edx
shl ebp, 4
add ebp, ebx
mov ebx, dword [esp + 0x14]
sub eax, ebp
xor ebx, eax
add ebx, dword [esp + 0x18]
mov ecx, eax
shr ecx, 5
xor ecx, esi
mov ebp, eax
shl ebp, 4
add ebx, ecx
add ebp, ebx
sub edx, ebp
add esi, 0x61c88647
sub edi, 1
jne 0x416e10
mov ecx, dword [esp + 0x24]
pop edi
pop esi
bswap edx
bswap eax
pop ebp
mov dword [ecx], edx
mov dword [ecx + 4], eax
pop ebx
add esp, 0xc
ret 8

Function at 0x416e70
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov dword [esp + 0x20], edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
xor esi, esi
mov dword [esp + 0x14], edi
bswap eax
bswap edx
mov dword [esp + 0x18], ecx
lea edi, [esi + 0x20]
jmp 0x416eb0
mov ebx, dword [esp + 0x20]
xor ebx, edx
add ebx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 5
sub esi, 0x61c88647
xor ecx, esi
add ebx, ecx
mov ebp, edx
shl ebp, 4
add ebp, ebx
mov ebx, dword [esp + 0x14]
add eax, ebp
xor ebx, eax
add ebx, dword [esp + 0x18]
mov ecx, eax
shr ecx, 5
xor ecx, esi
mov ebp, eax
shl ebp, 4
add ebx, ecx
add ebp, ebx
add edx, ebp
sub edi, 1
jne 0x416eb0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
bswap eax
bswap edx
pop ebp
mov dword [ecx], eax
mov dword [ecx + 4], edx
pop ebx
add esp, 0xc
ret 8
Function at 0x416f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x20], eax
mov al, 0xd1
push esi
mov esi, ecx
mov byte [esp + 0x19], al
mov byte [esp + 0x21], al
mov eax, dword [esi]
mov edx, dword [eax]
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x16], 0xc
mov byte [esp + 0x17], 0xa1
mov byte [esp + 0x18], 0xc0
mov byte [esp + 0x1a], 0xce
mov byte [esp + 0x1b], 0x5a
mov byte [esp + 0x1c], 0xb1
mov byte [esp + 0x1d], 0xbf
mov byte [esp + 0x1e], 0x11
mov byte [esp + 0x1f], 0x37
mov byte [esp + 0x20], 0x26
mov byte [esp + 0x22], 0xae
mov byte [esp + 0x23], 0xfb
mov byte [esp + 4], 0x8f
mov byte [esp + 5], 0xa3
mov byte [esp + 6], 5
mov byte [esp + 7], 0x99
mov byte [esp + 8], 0xb3
mov byte [esp + 9], 0x66
mov byte [esp + 0xa], 0x15
mov byte [esp + 0xb], 0xaa
mov byte [esp + 0xc], 0x2a
mov byte [esp + 0xd], 0x5e
mov byte [esp + 0xe], 0xf0
mov byte [esp + 0xf], 0x88
mov byte [esp + 0x10], 0xdf
mov byte [esp + 0x11], 0xed
mov byte [esp + 0x12], 0x81
mov byte [esp + 0x13], 0x8a
call edx
cmp eax, 8
je 0x416fde
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004690b5
add esp, 0x24
ret
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push 0
push 0x10
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call edx
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
lea ecx, [esp + 4]
push ecx
mov edx, ecx
push edx
mov ecx, esi
call eax
mov eax, 8
xor ecx, ecx
jmp 0x417010
mov edx, dword [esp + ecx + 4]
cmp edx, dword [esp + ecx + 0xc]
jne 0x416fcc
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x417010
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
mov al, 1
call fcn.004690b5
add esp, 0x24
ret
Function at 0x417f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [eax + 4]
push esi
push edi
mov esi, ecx
bswap ebx
bswap ebp
xor edi, edi
push edi
mov ecx, ebp
call fcn.00417eb0
xor ebx, eax
lea eax, [edi + 1]
push eax
mov ecx, ebx
call fcn.00417eb0
add edi, 2
xor ebp, eax
cmp edi, 0x10
jl 0x417f55
mov eax, dword [esp + 0x18]
pop edi
bswap ebp
pop esi
mov dword [eax], ebp
bswap ebx
pop ebp
mov dword [eax + 4], ebx
pop ebx
ret 8

Function at 0x417f90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [eax + 4]
push esi
push edi
mov esi, ecx
bswap ebx
bswap ebp
mov edi, 0xf
push edi
mov ecx, ebp
call fcn.00417eb0
xor ebx, eax
lea eax, [edi - 1]
push eax
mov ecx, ebx
call fcn.00417eb0
sub edi, 2
xor ebp, eax
test edi, edi
jg 0x417fa8
mov eax, dword [esp + 0x18]
pop edi
bswap ebp
pop esi
mov dword [eax], ebp
bswap ebx
pop ebp
mov dword [eax + 4], ebx
pop ebx
ret 8

Function at 0x418250
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x418960
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x418a06
cmp eax, 0x40
jbe 0x418990
lea eax, [esi + 0x40]
push eax
push esi
call fcn.004187d0
add esp, 8
mov dword [esi + 0x9c], 0x14
mov eax, dword [esi + 0x9c]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, esi
push 0
push eax
call fcn.00468ca0
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x4189b0
lea eax, [esi + 0x40]
push eax
push 0x40
push esi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
call fcn.00418750
add esp, 0xc
mov dword [esi + 0x9c], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x418a20
mov edx, dword [esp + 8]
add esi, 0x40
push esi
push eax
push edx
call fcn.00418750
add esp, 0xc
pop esi
ret

Function at 0x418a30
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov eax, 0x18
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x2c]
cmp dword [edi + 0x9c], 0xffffffff
je 0x418a65
push edi
push 0
push 0
call fcn.00418960
add esp, 0xc
push esi
lea esi, [edi + 0x40]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004187d0
add esp, 8
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x418a80
push esi
push 0x40
push edi
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.00418750
push esi
lea ecx, [esp + 0x1c]
push 0x14
push ecx
call fcn.00418750
lea edx, [esp + 0x24]
push esi
push edx
call fcn.004187d0
mov eax, dword [esp + 0x4c]
add esp, 0x20
pop esi
test eax, eax
jbe 0x418af9
push eax
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.00468d50
add esp, 0xc
mov ecx, dword [esp + 0x1c]
pop edi
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x18
ret
Function at 0x418b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x224
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push 0xa0
lea ecx, [esp + 0xc4]
push 0
push ecx
mov dword [esp + 0x28], eax
call fcn.00468ca0
mov eax, dword [ebp + 0xc]
lea edx, [esp + 0xcc]
push edx
push eax
push esi
call fcn.004188e0
mov edx, dword [ebp + 0x14]
mov ecx, 0x28
lea esi, [esp + 0xd8]
lea edi, [esp + 0x178]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x178]
push ecx
push edx
push ebx
call fcn.00418960
mov eax, dword [ebp + 0x20]
lea ecx, [eax - 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 4
add esp, 0x24
add edx, 1
mov dword [esp + 0x18], edx
je 0x418d2b
lea edx, [esp + 0x204]
mov dword [esp + 0x10], 0
mov ebx, 1
mov dword [esp + 0xc], edx
jmp 0x418bd0
xor eax, eax
mov ecx, 0x28
lea esi, [esp + 0x160]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], eax
mov ecx, ebx
shr ecx, 0x10
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x219], cl
mov ecx, dword [ebp + 0x18]
mov edx, ebx
shr edx, 8
mov byte [esp + 0x218], al
mov byte [esp + 0x21a], dl
mov byte [esp + 0x21b], bl
mov eax, 4
test ecx, ecx
jbe 0x418cf0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x220]
push edx
call fcn.00418960
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x228]
push 0x14
push ecx
call fcn.00418a30
add esp, 0x18
xor eax, eax
jmp 0x418c80
movzx edx, byte [esp + eax + 0x218]
xor byte [esp + eax + 0x204], dl
movzx ecx, byte [esp + eax + 0x219]
movzx edx, byte [esp + eax + 0x21a]
xor byte [esp + eax + 0x205], cl
xor byte [esp + eax + 0x206], dl
movzx ecx, byte [esp + eax + 0x21b]
movzx edx, byte [esp + eax + 0x21c]
xor byte [esp + eax + 0x207], cl
xor byte [esp + eax + 0x208], dl
add eax, 5
cmp eax, 0x14
jb 0x418c80
sub dword [esp + 0x14], 1
mov ecx, 0x28
lea esi, [esp + 0xc0]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
jne 0x418c46
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [ebp + 0x20]
jae 0x418d10
mov edx, dword [esp + 0xc]
mov dl, byte [edx + eax]
mov esi, dword [esp + 0x1c]
mov byte [eax + esi], dl
inc ecx
inc eax
cmp ecx, 0x14
jb 0x418cf6
mov eax, 0x14
add dword [esp + 0x10], eax
sub dword [esp + 0xc], eax
inc ebx
lea eax, [ebx - 1]
cmp eax, dword [esp + 0x18]
jb 0x418bd0
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004690b5
mov esp, ebp
pop ebp
ret
Function at 0x419980
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebp
push esi
xor ebp, ebp
push ebp
push ebp
push 0x1001
push 0x400
call ebx
mov esi, eax
test esi, esi
je 0x4199e3
lea eax, [esi + esi]
push edi
push eax
call fcn.004691cd
mov edi, eax
add esp, 4
test edi, edi
je 0x4199dc
push esi
push edi
push 0x1001
push 0x400
call ebx
push 0x4e06f0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4199d3
lea ebp, [eax + 1]
push edi
call fcn.004690f0
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x41a5a0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x838
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x834], eax
push esi
push edi
mov edi, dword [esp + 0x844]
push 0x109a0
call fcn.004691cd
mov esi, eax
add esp, 4
test esi, esi
je 0x41a6e2
push 0x400
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x3c]
push 0x5c
push ecx
call fcn.004690c4
xor edx, edx
push str.te225log.txt
mov word [eax + 2], dx
lea eax, [esp + 0x48]
push 0x400
push eax
call fcn.004696da
add esp, 0x14
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx edx, word [esp + 8]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 0xe]
push edi
push edx
movzx edx, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x20]
push edx
push eax
push ecx
push str.__02i:_02i:_02i__02i._02i._04i__t_s
push esi
mov edx, 0x84d0
call fcn.00463e10
add esp, 0x24
push 0
push 0x80
push 4
push 0
push 3
push 4
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41a6d9
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a6b0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x2c]
push ecx
lea edx, [eax + eax]
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004690f0
add esp, 4
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
xor ecx, esp
call fcn.004690b5
add esp, 0x838
ret
Function at 0x41a9f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x18
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], 0
test al, 3
je 0x41aa33
mov byte [ebx], 0
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004690b5
add esp, 0x18
ret
push ebp
mov ebp, dword [esp + 0x24]
shr eax, 2
push edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
mov edi, ebx
sub ebp, eax
push esi
mov al, 0x3e
xor edx, edx
lea ecx, [ecx]
lea esi, [esp + edx + 0x18]
mov cl, byte [esi + ebp]
cmp cl, 0x41
mov byte [esi], cl
jl 0x41aa6c
cmp cl, 0x5a
jg 0x41aa6c
sub cl, 0x41
mov byte [esp + edx + 0x10], cl
jmp 0x41aab2
cmp cl, 0x61
jl 0x41aa7f
cmp cl, 0x7a
jg 0x41aa7f
sub cl, 0x47
mov byte [esp + edx + 0x10], cl
jmp 0x41aab2
cmp cl, 0x30
jl 0x41aa92
cmp cl, 0x39
jg 0x41aa92
add cl, 4
mov byte [esp + edx + 0x10], cl
jmp 0x41aab2
cmp cl, 0x2b
jne 0x41aa9d
mov byte [esp + edx + 0x10], al
jmp 0x41aab2
cmp cl, 0x2f
jne 0x41aaa9
mov byte [esp + edx + 0x10], 0x3f
jmp 0x41aab2
cmp cl, 0x3d
jne 0x41ab1e
mov byte [esp + edx + 0x10], cl
inc edx
cmp edx, 4
jl 0x41aa50
mov eax, dword [esp + 0x10]
mov dl, al
mov cl, ah
sar cl, 4
add dl, dl
and cl, 3
add dl, dl
mov al, ah
add cl, dl
shl al, 4
cmp byte [esp + 0x1a], 0x3d
mov byte [edi], cl
je 0x41ab78
mov cl, byte [esp + 0x12]
mov dl, cl
sar dl, 2
and dl, 0xf
xor dl, al
cmp byte [esp + 0x1b], 0x3d
mov byte [edi + 1], dl
je 0x41ab52
mov eax, dword [esp + 0x1c]
shl cl, 6
add cl, byte [esp + 0x13]
inc eax
mov byte [edi + 2], cl
add edi, 3
add ebp, 4
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x20]
jae 0x41ab36
mov ebx, dword [esp + 0x14]
jmp 0x41aa49
pop esi
pop edi
pop ebp
mov byte [ebx], 0
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004690b5
add esp, 0x18
ret
pop esi
mov eax, edi
sub eax, dword [esp + 0x10]
mov byte [edi], 0
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004690b5
add esp, 0x18
ret
shl cl, 6
pop esi
mov eax, edi
sub eax, dword [esp + 0x10]
mov byte [edi + 2], cl
mov byte [edi + 3], 0
pop edi
pop ebp
add eax, 2
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004690b5
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
mov byte [edi + 1], al
pop esi
mov eax, edi
mov byte [edi + 2], 0
pop edi
sub eax, ebx
pop ebp
pop ebx
xor ecx, esp
inc eax
call fcn.004690b5
add esp, 0x18
ret
Function at 0x41ac00
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x28
call fcn.00468d20
push ebp
push edi
lea eax, [esp + 0xc]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [esp + 0x20]
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x41ac63
mov eax, 0x4e1128
cmp dword [0x584064], edi
jne 0x41ac3e
mov eax, str.Error_getting_PC_info__E1_.
push 0x30
push 0x4e01e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.GetModuleHandle_Error_n
call fcn.0041a5a0
add esp, 4
pop edi
xor eax, eax
pop ebp
add esp, 0x28
ret
push ebx
push esi
push str.GetLogicalProcessorInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x41ac86
push str.WARNING__GetLogicalProcessorInformation_is_not_supported_by_your_OS._Its_time_to_upgrade_:___n
call fcn.0041a5a0
jmp 0x41ad80
push 0x1000
mov dword [esp + 0x14], 0x1000
call fcn.004691cd
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41acda
mov eax, 0x4e0f80
cmp dword [0x584064], edi
jne 0x41acb3
mov eax, str.Error_getting_PC_info__E2_.
push 0x30
push 0x4e01e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.Error_allocationg_memory_for_logical_processors_info_n
call fcn.0041a5a0
add esp, 4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x28
ret
lea ecx, [esp + 0x10]
push ecx
push ebx
call esi
test eax, eax
jne 0x41ad25
mov eax, 0x4e0e78
cmp dword [0x584064], edi
jne 0x41acf8
mov eax, str.Error_getting_PC_info__E3_.
push 0x30
push 0x4e01e0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.Error_getting_logical_processors_info_n
call fcn.0041a5a0
push ebx
call fcn.004690f0
add esp, 8
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x28
ret
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x41ad7a
mov ecx, ebx
nop
cmp dword [ecx + 4], 0
jne 0x41ad6e
xor edx, edx
mov eax, dword [ecx]
test al, 1
je 0x41ad3f
inc edi
shr eax, 1
mov dword [ecx], eax
je 0x41ad6e
test al, 1
je 0x41ad4a
inc edi
shr eax, 1
mov dword [ecx], eax
je 0x41ad6e
test al, 1
je 0x41ad55
inc edi
shr eax, 1
mov dword [ecx], eax
je 0x41ad6e
test al, 1
je 0x41ad60
inc edi
shr eax, 1
mov dword [ecx], eax
je 0x41ad6e
add edx, 4
cmp edx, 0x20
jb 0x41ad38
add esi, 0x18
add ecx, 0x18
cmp esi, dword [esp + 0x10]
jb 0x41ad30
push ebx
call fcn.004690f0
add esp, 4
cmp byte [0x594ad0], 0
jne 0x41adaf
push edi
push ebp
push str.Hard_CPUs:__d__LOG_CPUs:__d_n
push 0x400
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x18
test edi, edi
jne 0x41ade0
cmp byte [0x594ad0], 0
mov edi, ebp
jne 0x41ade0
push ebp
push 0x4e0d84
push 0x400
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
pop esi
pop ebx
mov eax, edi
pop edi
mov byte [0x594ad0], 1
pop ebp
add esp, 0x28
ret
Function at 0x41ae00
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 4
call fcn.00468d20
push esi
push 0xfffe
call fcn.004691cd
mov esi, eax
add esp, 4
test esi, esi
jne 0x41ae30
push str.Error_allocating_buffer_for_passfilename_during_reading_pass_file_n
call fcn.0041a700
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
push 0x7fff
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41afa3
cmp eax, 0x7fff
je 0x41afa3
push 0x5c
push esi
call fcn.004690c4
add esp, 8
test eax, eax
jne 0x41ae78
push esi
call fcn.004690f0
push str.error_composing_passfilename_n
call fcn.0041a700
add esp, 8
xor eax, eax
pop esi
pop ecx
ret
push ebx
push edi
push 0x4e1250
xor ecx, ecx
push 0x7fff
push esi
mov word [eax], cx
call fcn.004696da
push 0x4e1248
push 0x7fff
push esi
call fcn.004696da
push str.pass
push 0x7fff
push esi
call fcn.004696da
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x24
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push esi
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x41af1d
push str..txt
push 0x7fff
push esi
call fcn.004696da
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push esi
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x41af1d
push str.Cant_open_pass_file_n
call fcn.0041a700
push esi
call fcn.004690f0
add esp, 8
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
push esi
call fcn.004690f0
add esp, 4
lea edx, [esp + 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0xc], 0
mov esi, eax
je 0x41af42
push str.pass_file_too_big_n
jmp 0x41af69
cmp esi, 2
jae 0x41af4e
push str.pass_file_too_small_n
jmp 0x41af69
lea eax, [esi + 1]
push eax
call fcn.004691cd
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x41af7f
push str.Error_allocating_buffer_for_pass_file_during_reading_n
call fcn.0041a700
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
push 0
lea edx, [esp + 0x10]
push edx
mov byte [eax + esi], 0
mov eax, dword [ecx]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ecx
ret
push esi
call fcn.004690f0
push str.passfilename_too_long_n
call fcn.0041a700
add esp, 8
xor eax, eax
pop esi
pop ecx
ret
Function at 0x41f280
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov eax, 4
call fcn.00468d20
push str.TE225Decryptor_1.11.5_x32
push 0x4e1ad0
push 0x400
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.Commandline:__s_n
push 0x400
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
push 0xfffe
push 0
push 0x584aa0
mov byte [0x594aa9], 0
call fcn.00468ca0
push 0x200
push 0
push 0x584898
call fcn.00468ca0
add esp, 0x2c
lea eax, [esp]
push eax
push 0
push 0
push 0x41d7d0
push 0
push 0
mov dword [0x584a98], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 8]
mov edx, dword [0x594aac]
mov dword [0x584070], eax
mov dword [ecx], edx
mov eax, 1
pop ecx
ret
Function at 0x421430
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xf4
call fcn.00468d20
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0x104]
push ebx
push ebp
push esi
mov esi, eax
and esi, 0xf
sub eax, esi
push edi
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0xc0
push ecx
call fcn.004cdf40
mov edi, dword [esp + 0x124]
mov ebx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push 0
push edi
lea edx, [esp + 0x24]
push edx
push ebp
push ebx
push eax
call fcn.004cd630
add esp, 0x24
test esi, esi
je 0x4214de
mov edx, dword [esp + 0x114]
lea ecx, [esp + 0x10]
push ecx
push 0xc0
push edx
call fcn.004cdf30
lea eax, [esp + 0x1c]
push eax
push edi
push edi
call fcn.004cbf40
add esp, 0x18
xor ecx, ecx
test esi, esi
jbe 0x4214de
lea eax, [ebx + ebp]
mov ebp, dword [esp + 0x108]
sub ebp, ebx
lea esp, [esp]
mov dl, byte [eax + ebp]
xor dl, byte [ecx + edi]
inc ecx
mov byte [eax], dl
inc eax
cmp ecx, esi
jb 0x4214d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret

Function at 0x4214f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x90]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xa4]
mov esi, eax
push edi
mov edi, dword [esp + 0xb0]
lea ecx, [esp + 0x18]
and esi, 7
push ecx
sub eax, esi
push ebp
mov dword [esp + 0x1c], eax
call fcn.0047a240
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push edi
lea edx, [esp + 0x28]
push edx
push eax
push ebx
push ecx
call fcn.004cf420
add esp, 0x20
test esi, esi
je 0x4215a5
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.0047a240
push 1
lea eax, [esp + 0x24]
push eax
push edi
push edi
call fcn.00479b40
add esp, 0x18
xor ecx, ecx
test esi, esi
jbe 0x4215a5
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
lea eax, [ebx + edx]
sub ebp, ebx
mov dl, byte [eax + ebp]
xor dl, byte [edi + ecx]
inc ecx
mov byte [eax], dl
inc eax
cmp ecx, esi
jb 0x421597
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x8c
ret

Function at 0x421630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100
call fcn.00468d20
mov eax, dword [esp + 0x10c]
push ebx
mov ebx, dword [esp + 0x114]
push ebp
push esi
mov esi, eax
push edi
push 0
and esi, 7
sub eax, esi
push ebx
mov ebp, eax
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.0047ad30
mov edi, dword [esp + 0x134]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
push 0
push edi
lea ecx, [esp + 0x28]
push ecx
push ebp
push edx
push eax
call fcn.0047a850
add esp, 0x28
test esi, esi
je 0x4216de
push 0
push ebx
lea ecx, [esp + 0x18]
push 0x10
push ecx
call fcn.0047ad30
push 1
lea edx, [esp + 0x24]
push edx
push edi
push edi
call fcn.0047a4e0
add esp, 0x20
xor ecx, ecx
test esi, esi
jbe 0x4216de
mov edx, dword [esp + 0x118]
lea eax, [edx + ebp]
mov ebp, dword [esp + 0x114]
sub ebp, edx
lea esp, [esp]
mov dl, byte [eax + ebp]
xor dl, byte [ecx + edi]
inc ecx
mov byte [eax], dl
inc eax
cmp ecx, esi
jb 0x4216d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret