joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10144e70
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x101f0014]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x10144f07
cmp dword [esp + 8], 6
jb 0x10144f07
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.101606b4
add esp, 0x118
ret

Function at 0x10144f20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018cba0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x101f0014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10007cf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.10137cc0
mov ecx, eax
call fcn.10137d80
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10007c90
push 0xb
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x40]
push str.crypt32.dll
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10007cf0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.10137cc0
mov ecx, eax
call fcn.10137d80
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10007c90
test ebx, ebx
je 0x1014507d
test esi, esi
je 0x1014507d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10148ae0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b8df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f0014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.100073c0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.100073c0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.100073c0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.100073c0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.100073c0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.100073c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1014a7b0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x101f0014]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x1014a815
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1014a7f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1014a815
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.101606b4
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.101606b4
add esp, 8
ret 4
Function at 0x1014a9c0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018d7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x101f0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x1014aa09
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x1014ab5b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x1014ab26
test eax, eax
je 0x1014ab26
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x1014ab29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x1014aaab
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1014aa9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1014aaab
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x1014aab9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.100073c0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x1014ab26
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x1014aa64
jmp 0x1014ab29
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x1014ab52
test edx, edx
je 0x1014ab4e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x1014aa20
mov al, 1
jmp 0x1014ab5d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1014ab5b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101606b4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1014d150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018dc70
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101f0014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test eax, eax
je 0x1014d237
cmp byte [eax + 0x54], 0
je 0x1014d237
add eax, 0x1c
lea ecx, [ebp - 0x38]
push eax
call fcn.100a8aa0
push 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10125fc0
add esp, 4
mov byte [ebp - 4], 1
lea edi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [esi]
cmovae edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 8
jb 0x1014d1d2
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1014d21c
push 2
push 0
push 0
push esi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.100074a0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100a8af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101606b4
mov esp, ebp
pop ebp
ret 4
Function at 0x10161dd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018f9e6
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x101f0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xa8]
call fcn.100073a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa8]
push eax
call fcn.10161f50
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10161e47
mov byte [ebp - 0xc1], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10007310
mov al, byte [ebp - 0xc1]
jmp 0x10161f33
push 0x101f41c0
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.10128250
add esp, 0xc
mov byte [ebp - 4], 1
push 0x80
push 0
lea ecx, [ebp - 0x90]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xc0]
call fcn.100072a0
push eax
push 0x40
lea edx, [ebp - 0x90]
push edx
push 0x10197420
mov ecx, 0x101f4238
call fcn.100072a0
push eax
mov ecx, 0x101f4220
call fcn.100072a0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x90]
test edx, edx
jne 0x10161ef6
mov byte [ebp - 0xc2], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.10007310
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10007310
mov al, byte [ebp - 0xc2]
jmp 0x10161f33
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp + 8]
call fcn.100072b0
mov byte [ebp - 0xc3], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.10007310
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10007310
mov al, byte [ebp - 0xc3]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101606b4
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
imul eax, dword [ebp + 8], 0xffffff8b
cmpsb byte [esi], byte es:[edi]
enter 0x40c0, 0xffffffffffffffd9
push eax
add ecx, 0x40
push 0x40d235
push ecx
call dword [0xab7080]
mov eax, dword [0x404102ac]
lodsb al, byte [esi]
add al, byte [ecx + 0x40]
rol ah, 0xc
test eax, eax
je 0x401787
adc dword [ecx + 0x66], 0x53
push es
add bh, bh
adc eax, 0x5dc164
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
test dword [esi + 0xb8ec81], 0x78a10000
add al, byte [ecx]
test eax, eax
mov eax, dword [0x3441404c]
je 0x4017bb
push 0x413c40
push eax
call fcn.004057fd
mov sp, ax
je 0x4017b9
xchg esi, eax
dec eax
jmp 0x4017cf
mov esi, dword [ebp]
sbb byte [ecx], al
push edx
push eax
int3
mov dword [0x411808], eax
mov eax, dword [0x3413488]
push ebx
push esi
mov esi, dword [0x40c1e2]
mov word [0x410bb4], di
test eax, eax
push edi
jne 0x40176d
mov edx, dword [0x4118a2]
push edx
push 0x14d498
call esi
adc al, 0x78
add al, byte [ecx]
add esp, 8
or eax, 0xa11574c0
je 0x40180c
inc ecx
add byte [eax + 0x68], dl
inc eax
cmp al, 0x41
add byte [eax - 0x7c], ch
jnp 0x401856
push eax
push 0x413c40
push 0xc2407b84
mov eax, dword [0xcc483d6]
mov eax, dword [0xeed014]
test dword [edx + 0x40d48087], ebx
add byte [ebp + 5], dh
mov eax, 0x40d47c
push eax
push str._be_patient__s
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0xfffffff3
push ecx
call dword [0x1e40c154]
and dword [edx - 0x5e4574f4], 0xffffffd0
inc eax
add byte [ebx + 0x40c15835], cl
add byte [eax + 0x60], ch
sbb eax, 0xb59800d1
salc
ret 0xd6a1
push 0xd11d60
cwde
mov ch, 0xd6
mov dword [0x274137b0], eax
mov eax, dword [0x408bf2]
push 0x20
push eax
call esi
mov ecx, dword [0x4140fd]
mov edx, dword [0x9240d018]
add esp, 0x10
mov dword [0x41337a], eax
outsd dx, dword [esi]
add byte [eax + 0x52], cl
push 0x9f17f8
call fcn.00406010
test eax, eax
je 0x4018a1
push 0x68
push eax
aam 0x40
mov ch, pe_nt_image_headers32
insd dword es:[edi], dx
add eax, 0xc4d5008c
or byte [edi], ah
daa
jl 0x4018a6
add byte cs:[ebp - 0x5eca8a40], al
lodsb al, byte [esi]
or eax, dword [ecx]
test eax, eax
jne 0x4018df
mov eax, dword [0x410bac]
aaa
or eax, 0x410b9c
mov edx, dword [0x4140e9]
cmp byte [eax], al
push 0x40899c
pop es
mov eax, dword [0x41404c]
push ecx
push str.Host:
push edx
push eax
call 0xb940dc90
and dword [ecx], 0x1c
mov dword [0x34419548], eax
loop 0x4018e4
lcall 0xd8b, 0x414048
add byte [edx], 0x41
add byte [ebp - 0x74d98a37], al
or eax, 0xf241404c
mov ecx, dword [0x410280]
test ecx, ecx
jne 0x401914
mov ecx, dword [0xf241404c]
push 0
push 0x28d1ed
push 0x40d444
push str.User_Agent:_ApacheBench_
inc ecx
push ecx
call fcn.00401990
add byte [esi], dl
sbb byte [ebx + 0x414048], ah
mov edi, dword [esp + eax*4 + 0x74]
inc ecx
jo 0x4018a0
leave
jne 0x40193a
mov edx, dword [0xd841404c]
push 0
push str.Accept:___r_n
push eax
push edx
call fcn.0040587e
add esp, 0x10
mov dword [0x41bf48], eax
ror byte [0x2d410260], 0x85
sub dword [edi - 0x2c], edi
inc ecx
adc eax, 0x410268
mov esi, 0xd2d3fc
test edx, edx
jne 0x401958
mov esi, 0x919f49d4
Function at 0x42e400
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
jmp 0x42e41a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42e421
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42e410
mov eax, 1
add ebx, ebx
jne 0x42e433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42e428
jne 0x42e444
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e428
xor ecx, ecx
sub eax, 3
jb 0x42e458
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42e4ca
mov ebp, eax
add ebx, ebx
jne 0x42e463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42e470
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42e494
inc ecx
add ebx, ebx
jne 0x42e480
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42e475
jne 0x42e491
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e475
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42e4b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42e4a5
jmp 0x42e416
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42e4b4
add edi, ecx
jmp 0x42e416
pop esi
mov edi, esi
mov ecx, 0xa88
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42e4d2
cmp byte [edi], 0x12
jne 0x42e4d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42e4d7
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42e54f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x33130]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33210]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e504
mov ecx, edi
jns 0x42e533
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33218]
or eax, eax
je 0x42e549
mov dword [ebx], eax
add ebx, 4
jmp 0x42e521
call dword [esi + 0x33214]
mov ebp, dword [esi + 0x3321c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42e583
sub esp, 0xffffff80
jmp 0x41c35f
Function at 0x44a3c0
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x4cf880
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov word [0x4cfb6c], 0x7f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
and esi, 0xff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
call fcn.0044a380
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 6
mov ebx, eax
setae cl
cmp esi, 6
mov byte [0x4cfb39], cl
jb 0x44a47a
mov edx, dword [0x4cc048]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetThreadPreferredUILanguages
push eax
call edi
test ebx, ebx
mov dword [0x4cf8a0], eax
je 0x44a449
mov eax, dword [0x4cfa2c]
push 0x4cf70c
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [0x4cc048]
push ecx
call esi
push str.SetThreadPreferredUILanguages
push eax
call edi
mov edx, dword [0x4cc048]
mov dword [0x4cf89c], eax
push edx
call esi
push str.GetThreadUILanguage
push eax
call edi
pop edi
pop esi
mov dword [0x4cf898], eax
pop ebx
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x464d61
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0
add byte [esp + 0x24], dh
cmp esi, 0x7fff0018
jae 0x464e20
add byte [esp + 0x20], bh
mov eax, dword [edi - 0x38]
add al, dh
jae 0x464d95
sub esp, 4
inc dword [eax]
add byte [esi + 0x57], dl
call 0x1134e31
add esp, 0x10
jmp 0x464e13
cmp esi, 0
add byte [edi - 0x76], bl
dec esp
and al, 0x28
cld
add byte [edi + edx*2 - 0x75], dh
dec edi
adc al, 0x39
int1
add byte [eax], al
ja 0x464dad
mov ebx, ecx
add dword [edx], 0
jb 0x464de6
lea ecx, [edi + 4]
mov ebp, dword [ecx]
add byte [eax], al
je 0x464dcc
sub esp, 4
popfd
add byte [ecx - 0x18], dl
push ebx
xor byte [ebp], bh
add dword [eax], 0
mov eax, dword [edi + 0x18]
lea eax, [ebx]
cmp eax, 0x1000
jb 0x464dda
add byte [eax], al
cld
sub esp, 0xc
push ebp
stosd dword es:[edi], eax
add byte [edi + 0x7c], ch
add byte [ebx + 0xc710c4], al
add byte [edi], al
add byte [eax], al
mov dword [eax], 0x700
add byte [ecx - 0x3899ff41], cl
inc esp
pop edi
add al, 0
add byte [eax], al
add byte [ebp - 0x72e98a0a], al
sbb eax, dword [eax]
cmp eax, 8
jb 0x464e07
mov ecx, dword [ecx]
add byte [eax], al
adc al, 0
add byte [eax], al
add byte [edi], dh
add dword [eax], eax
add byte [ebp + 0x950ff6], al
test esi, esi
setne byte [eax]
add ah, al
or al, 0x5e
pop edi
pop ebx
cmp dword [eax], eax
sub esp, 0xc
push 0xd9844c
add byte [ebp + ebp*8 - 0x617cff84], dh
add byte [eax + 0x53e58955], dl
push edi
push esi
add byte [eax], al
mov word [eax], es
add byte [eax], al
mov esp, dword [eax + eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax], eax
add byte [ecx + 0x4589e84d], cl
rol dword [eax], 0x75
call 0x8b4e1cd9
pop ebp
add byte [eax], al
inc ebp
mov al, byte [0xe2beb048]
add byte [ebp - 0x5c], al
or al, 0x87
fld dword [eax]
mov dword [eax], eax
add byte [ecx + 0x45c7b065], cl
dec edi
add byte [esi + 0x40], dl
add byte [ebp + 0xe88445], cl
add byte [esi], bh
cmp esi, 0x7f002ffe
ja 0x464eb1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add byte [ecx - 0x45102e31], cl
add byte [edx - 0x80f7656], ch
loop 0x464e68
add byte [eax], al
xlatb
mov ebx, esi
jbe 0x464eb1
rol byte [eax], 0xff
invalid
mov ecx, dword [ebp - 0x10]
mov eax, ebx
inc eax
add byte [eax], al
test eax, eax
js 0x471e15
add eax, eax
cmp eax, 0x1000
add byte [ebp - 0x14], bl
jb 0x464f07
mov ebp, dword [esi]
cmp eax, 0xffffffdd
jae 0x46502a
mov ecx, dword [ebp - 0x10]
add eax, 0x60
add byte [ebp - 0x28], cl
mov dword [ebp - 0x74], 3
mov dword [esp], eax
call fcn.00469079
mov esi, eax
add esi, 0x23
add dword [eax], 0
mov dword [esi - 4], eax
jmp 0x464f1e
add byte [eax], al
invalid
out dx, eax
add ah, ch
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], esi
add byte [eax], al
je 0x464f2a
invalid
invalid
mov dword [ebp - 0x28], ecx
invalid
imul ebp, dword [edx + 0x34], 0x3e
invalid
Function at 0x4ae991
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0
add byte [esp + 0x24], dh
cmp esi, 0x7fff0018
jae 0x4aea50
add byte [esp + 0x20], bh
mov eax, dword [edi - 0x38]
add al, dh
jae 0x4ae9c5
sub esp, 4
inc dword [eax]
add byte [esi + 0x57], dl
call 0x117ea61
add esp, 0x10
jmp 0x4aea43
cmp esi, 0
add byte [edi - 0x76], bl
dec esp
and al, 0x28
cld
add byte [edi + edx*2 - 0x75], dh
dec edi
adc al, 0x39
int1
add byte [eax], al
ja 0x4ae9dd
mov ebx, ecx
add dword [edx], 0
jb 0x4aea16
lea ecx, [edi + 4]
mov ebp, dword [ecx]
add byte [eax], al
je 0x4ae9fc
sub esp, 4
popfd
add byte [ecx - 0x18], dl
push ebx
xor byte [ebp], bh
add dword [eax], 0
mov eax, dword [edi + 0x18]
lea eax, [ebx]
cmp eax, 0x1000
jb 0x4aea0a
add byte [eax], al
cld
sub esp, 0xc
push ebp
stosd dword es:[edi], eax
add byte [edi + 0x7c], ch
add byte [ebx + 0xc710c4], al
add byte [edi], al
add byte [eax], al
mov dword [eax], 0x700
add byte [ecx - 0x3899ff41], cl
inc esp
pop edi
add al, 0
add byte [eax], al
add byte [ebp - 0x72e98a0a], al
sbb eax, dword [eax]
cmp eax, 8
jb 0x4aea37
mov ecx, dword [ecx]
add byte [eax], al
adc al, 0
add byte [eax], al
add byte [edi], dh
add dword [eax], eax
add byte [ebp + 0x950ff6], al
test esi, esi
setne byte [eax]
add ah, al
or al, 0x5e
pop edi
pop ebx
cmp dword [eax], eax
sub esp, 0xc
push 0xd9844c
add byte [ebp + ebp*8 - 0x617cff84], dh
add byte [eax + 0x53e58955], dl
push edi
push esi
add byte [eax], al
mov word [eax], es
add byte [eax], al
mov esp, dword [eax + eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [eax], eax
add byte [ecx + 0x4589e84d], cl
rol dword [eax], 0x75
call 0x8b52b909
pop ebp
add byte [eax], al
inc ebp
mov al, byte [0xe2beb048]
add byte [ebp - 0x5c], al
or al, 0x87
fld dword [eax]
mov dword [eax], eax
add byte [ecx + 0x45c7b065], cl
dec edi
add byte [esi + 0x40], dl
add byte [ebp + 0xe88445], cl
add byte [esi], bh
cmp esi, 0x7f002ffe
ja 0x4aeae1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add byte [ecx - 0x45102e31], cl
add byte [edx - 0x80f7656], ch
loop 0x4aea98
add byte [eax], al
xlatb
mov ebx, esi
jbe 0x4aeae1
rol byte [eax], 0xff
invalid
mov ecx, dword [ebp - 0x10]
mov eax, ebx
inc eax
add byte [eax], al
test eax, eax
js 0x4bba45
add eax, eax
cmp eax, 0x1000
add byte [ebp - 0x14], bl
jb 0x4aeb37
mov ebp, dword [esi]
cmp eax, 0xffffffdd
jae 0x4aec5a
mov ecx, dword [ebp - 0x10]
add eax, 0x60
add byte [ebp - 0x28], cl
mov dword [ebp - 0x74], 3
mov dword [esp], eax
call fcn.004b2ca9
mov esi, eax
add esi, 0x23
add dword [eax], 0
mov dword [esi - 4], eax
jmp 0x4aeb4e
add byte [eax], al
invalid
out dx, eax
add ah, ch
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], esi
add byte [eax], al
je 0x4aeb5a
invalid
invalid
mov dword [ebp - 0x28], ecx
invalid
invalid