joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.0043f640
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0x474174
test eax, eax
je 0x420809
cmp word [eax], 0
mov dword [ebp - 0x28], eax
jne 0x420810
mov dword [ebp - 0x28], 0
push esi
push edi
push 0
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], 0
push eax
push 0x420770
push 0
push 0
mov dword [ebp - 0x20], 5
call fcn.004460bd
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x1c]
test esi, esi
je 0x420857
cmp esi, 0xffffffff
je 0x420857
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b62c
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x497d1c]
cmp eax, dword [ecx + 4]
jg 0x4209ae
mov eax, dword [0x497d04]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
push 0x497d1c
call fcn.0043c0e7
add esp, 4
cmp dword [0x497d1c], 0xffffffff
jne 0x420990
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0043f640
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or edx, 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.0040fce0
push 0x497d1c
mov dword [0x497d04], eax
call fcn.0043c09d
add esp, 4
jmp 0x420990

Function at 0x420cd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0x22c
push 0
push eax
call fcn.0043f640
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x420d56
cmp esi, 0xffffffff
je 0x420d56
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x420d56
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax + eax]
cmp dword [ebp - 0x228], edi
je 0x420d7b
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x420d40
xor edi, edi
test esi, esi
je 0x420d68
cmp esi, 0xffffffff
je 0x420d68
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x218]
jmp 0x420d58
Function at 0x421a30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1004
push eax
mov eax, dword [ecx + 4]
push 4
push 0
push dword [ebp + 8]
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 8

Function at 0x421b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 0xc]
mov esi, ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [esi + 4]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421bd3
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esi + 4]
push dword [ebp + 8]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x421bd3
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x421d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421d40
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
mov eax, dword [esi + 4]
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x421de0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
push dword [ebp + 8]
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x425d10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ebx, ecx
test edi, edi
je 0x425d44
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c683
mov esi, eax
add esp, 4
xor eax, eax
mov word [esi], ax
push edi
push esi
push dword [ebx + 0x48]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jns 0x425d58
or edi, 0xffffffff
jmp 0x425d71
mov edx, dword [ebp + 8]
test esi, esi
mov ecx, 0x478d08
cmovne ecx, esi
push ecx
push edi
call fcn.0041f8e0
add esp, 8
mov edi, eax
test esi, esi
je 0x425d7e
push esi
call fcn.0043bf25
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x426450
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b9b6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0x45c2ec
push 1
push 0
push 0x45c31c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4264b8
xor esi, esi
jmp 0x426576
mov eax, dword [ebp - 0x220]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
push ecx
lea edx, [ebp - 0x21c]
mov ecx, edi
call fcn.00426620
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
add esp, 4
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x220]
push edx
push 0x45c30c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x426556
mov eax, dword [ebp - 0x224]
push 1
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
js 0x426556
push ecx
lea edx, [ebp - 0x21c]
mov ecx, esi
call fcn.00426620
add esp, 4
lea eax, [ebp - 0x21c]
push 0
push eax
push 0x1005
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 1
jmp 0x426558
xor esi, esi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x426576
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x42658d
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret

Function at 0x4265b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4265e0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
push ecx
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.00426620
add esp, 4
lea eax, [ebp - 0x20c]
push 0
push eax
push 0x1005
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret

Function at 0x4266e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4266f6
mov eax, 1
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
ret
Function at 0x4268c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, ecx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 9
mov dword [ebp - 0x420], eax
mov edx, 0x4745fc
push esi
push eax
test esi, esi
mov eax, 0x4745dc
cmovne eax, edx
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0041d860
add esp, 0x14
lea eax, [esi + 1]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push 0x4745f0
push 0x104
push eax
call fcn.0041d860
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426970
push 1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
je 0x42696e
push 4
push 0
lea eax, [ebp - 0x41c]
push eax
call edi
jmp 0x426970
xor ebx, ebx
sub esi, 1
mov eax, dword [ebp - 0x420]
mov edx, 0x4745fc
jns 0x4268f3
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret

Function at 0x4269a0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 1
mov esi, 0xa
push esi
push ebx
push str._s._d
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0041d860
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426a02
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
dec esi
test esi, esi
jg 0x4269c2
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
Function at 0x426a20
Capabilities:
Get file size
Read file via mapping
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x47f06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push ecx
push 0
push 3
push ecx
push 1
mov edx, 0x80000000
call fcn.00420640
add esp, 0x14
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
jne 0x426a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.src__s__open_err__x__n
call fcn.0041cfd0
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, edi
mov ebx, eax
call fcn.004269a0
push ecx
push 0x80
push 2
push ecx
push 0
mov edx, 0x40000000
mov ecx, edi
call fcn.00420640
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x426b2d
push ecx
mov ecx, edi
call fcn.004268c0
mov eax, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x426ae8
mov dword [eax], 1
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
jne 0x426b2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x474654
call fcn.0041cfd0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
xor ebx, ebx
jmp 0x426beb
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x426bc3
cmp edi, 0xffffffff
je 0x426bc3
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x426bb1
cmp eax, 0xffffffff
je 0x426bb1
push 0
lea ecx, [ebp - 0x18]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x426bb1
cmp ebx, dword [ebp - 0x18]
jne 0x426bb1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x426baa
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, 1
jmp 0x426bb3
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x426bc5
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x426bc5
xor ebx, ebx
test edi, edi
je 0x426bd9
cmp edi, 0xffffffff
je 0x426bd9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x426bdf
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x426beb
cmp esi, 0xffffffff
je 0x426beb
push esi
call edi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x426bf5
push eax
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426d20
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ba61
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x47f06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], ecx
push 0x208
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.0043f640
add esp, 0xc
lea eax, [ebp - 0x260]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x426db5
xor eax, eax
jmp 0x426f13
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [ebp - 0x280], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x426f57
cmp edi, 0xffffffff
je 0x426f57
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x284], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x426ee1
cmp esi, 0xffffffff
je 0x426ee1
push 0x48
lea eax, [ebp - 0x58]
push 0x3d
push eax
call fcn.0043f640
add esp, 0xc
mov byte [ebp - 0x11], 0xa
mov byte [ebp - 0x58], 0xa
push 0
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x268], edx
lea ebx, [eax - 0x48]
mov dword [ebp - 0x270], ebx
test ebx, ebx
je 0x426ee1
lea eax, [edx + esi]
lea ecx, [esi + 0x47]
mov dword [ebp - 0x274], eax
add ecx, edx
cmp byte [eax], 0xa
mov dword [ebp - 0x26c], ecx
jne 0x426ec1
mov cl, byte [ecx]
cmp cl, 0xa
jne 0x426eb7
mov ecx, eax
lea edx, [ebp - 0x58]
mov ebx, 0x44
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x426ea4
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x426e80
mov eax, dword [ebp - 0x26c]
cmp dword [eax + 1], 0x3a325049
je 0x426f2f
mov edx, dword [ebp - 0x268]
mov eax, 0x47
mov ebx, dword [ebp - 0x270]
jmp 0x426ed1
mov eax, 0x48
cmp cl, 0x3d
jmp 0x426ec9
cmp byte [ecx], 0x3d
mov eax, 0x47
mov ecx, 1
cmove eax, ecx
add edx, eax
mov dword [ebp - 0x268], edx
cmp edx, ebx
jb 0x426e54
xor ebx, ebx
test esi, esi
je 0x426eee
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x264]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x426f0a
cmp edi, 0xffffffff
je 0x426f0a
push edi
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x426f11
push esi
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bdd7
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x274]
mov ebx, dword [ebp - 0x278]
add eax, 0x48
mov ecx, dword [ebp - 0x27c]
sub ebx, eax
add ebx, esi
push ebx
push eax
call fcn.00422a10
cmp eax, ebx
sbb ebx, ebx
neg ebx
jmp 0x426ee3
xor ebx, ebx
jmp 0x426ef4
Function at 0x4285e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0xc], eax
lea ebx, [ecx + 8]
mov eax, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [esp + 0x14], eax
mov eax, esi
mov dword [esp + 0x18], edx
sub eax, ecx
mov dword [esp + 0x1c], ebx
push edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], 4
nop word [eax + eax]
movq xmm0, qword [eax + ebx]
mov eax, dword [ebx + 4]
mov edi, dword [ebx - 8]
mov ecx, dword [ebx]
movq qword [esp + 0x30], xmm0
xor eax, dword [esp + 0x34]
xor ecx, dword [esp + 0x30]
movq xmm0, qword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [ebx - 4]
movq qword [esp + 0x28], xmm0
xor eax, dword [esp + 0x2c]
xor edi, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, edi
mul ecx
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0xc]
mul ecx
mov ecx, eax
mov dword [esp + 0x28], edx
mov eax, edi
mul dword [esp + 0x10]
add eax, esi
mov edi, edx
mov esi, dword [esp + 0x1c]
adc edi, 0
add eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc]
adc edi, 0
mul dword [esp + 0x10]
xor ecx, ecx
or ecx, ebx
mov ebx, dword [esp + 0x20]
add eax, edi
mov edi, dword [esp + 0x14]
adc edx, 0
add eax, dword [esp + 0x28]
adc edx, 0
xor ecx, eax
mov eax, dword [esp + 0x30]
xor eax, edx
mov edx, dword [esp + 0x18]
add edi, ecx
mov dword [esp + 0x14], edi
adc edx, eax
mov eax, dword [esp + 0x3c]
add esi, 0x10
mov dword [esp + 0x18], edx
add ebx, 0x10
mov dword [esp + 0x1c], esi
sub dword [esp + 0x24], 1
mov dword [esp + 0x20], ebx
jne 0x428620
push 0x16566791
mov ecx, edx
xor eax, eax
push 0x9e3779f9
shr ecx, 5
xor eax, edx
xor ecx, edi
push eax
push ecx
call fcn.0043ca00
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
invalid
invalid
Function at 0x402240
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x404094
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
shr eax, 0x10
mov dword [0x40d294], edx
mov dword [0x40d290], ecx
mov dword [0x40d288], eax
shl ecx, 8
add ecx, edx
mov dword [0x40d28c], ecx
call fcn.00404050
test eax, eax
jne 0x4022aa
push 0x1c
call fcn.00402380
add esp, 4
call fcn.00403f60
test eax, eax
jne 0x4022bd
push 0x10
call fcn.00402380
add esp, 4
mov dword [ebp - 4], 0
call fcn.00403d80
call fcn.00403d70
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4102b4], eax
call fcn.004038d0
mov dword [0x40cfe0], eax
test eax, eax
je 0x4022f0
cmp dword [0x4102b4], 0
jne 0x4022fa
push 0xffffffffffffffff
call fcn.004031c0
add esp, 4
call fcn.00403660
call fcn.00403570
call fcn.00403190
mov eax, dword [0x40d2a4]
mov dword [0x40d2a8], eax
push eax
mov eax, dword [0x40d29c]
push eax
mov eax, dword [0x40d298]
push eax
call fcn.0040148d
add esp, 0xc
push eax
call fcn.004031c0
jmp 0x402357
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403200
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.004032c0
cmp dword [0x40d2c4], 1
mov esi, dword [esp + 0x10]
jne 0x403223
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x40d2c0], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x40d2bc], bl
jne 0x40327d
cmp dword [0x40f298], 0
je 0x40326b
mov edi, dword [0x40f294]
sub edi, 4
cmp edi, dword [0x40f298]
jb 0x40326b
mov eax, dword [edi]
test eax, eax
je 0x403260
call eax
sub edi, 4
cmp edi, dword [0x40f298]
jae 0x403258
push 0x40c01c
push 0x40c014
call fcn.004032e0
add esp, 8
push 0x40c024
push 0x40c020
call fcn.004032e0
add esp, 8
test ebx, ebx
je 0x40329c
call fcn.004032d0
pop edi
pop esi
pop ebx
ret
mov dword [0x40d2c4], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4038d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x40d364], ebx
jne 0x40391f
call esi
cmp eax, ebx
mov edi, eax
je 0x4038fd
mov dword [0x40d364], 1
jmp 0x40391f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x403915
mov dword [0x40d364], 2
jmp 0x40391f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x40d364], 1
jne 0x4039ce
test edi, edi
jne 0x403942
call esi
mov edi, eax
test edi, edi
jne 0x403942
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40395c
add esi, 2
cmp word [esi], 0
jne 0x40394a
add esi, 2
cmp word [esi], 0
jne 0x40394a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x4039bd
push ebp
call fcn.00405680
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4039bd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4039ac
push ebx
call fcn.004062c0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x40d364], 2
jne 0x403a52
test ebx, ebx
jne 0x4039f1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x4039f1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x403a06
inc ebp
cmp byte [ebp], 0
jne 0x4039f8
inc ebp
cmp byte [ebp], 0
jne 0x4039f8
sub ebp, ebx
inc ebp
push ebp
call fcn.00405680
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x403a2b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x403f60
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.004043b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x40d5a4], eax
cmp eax, 0xffffffff
jne 0x403f7a
xor eax, eax
pop esi
ret
push 0x74
push 1
call fcn.004051d0
add esp, 8
mov esi, eax
test esi, esi
je 0x403fbc
push esi
mov eax, dword [0x40d5a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x403fbc
push esi
call fcn.00403fc0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret