joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ee6ce70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
lea ebx, [edi - 2]
test ebx, ebx
jle 0x6ee6cefc
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
movzx ecx, byte [edi + esi]
shr ecx, 2
movzx ecx, byte [ecx + 0x6ee8d850]
mov byte [eax], cl
movzx edx, byte [edi + esi]
movzx ecx, byte [edi + esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x6ee8d850]
mov byte [eax + 1], cl
movzx edx, byte [edi + esi + 1]
movzx ecx, byte [edi + esi + 2]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + 0x6ee8d850]
mov byte [eax + 2], cl
movzx ecx, byte [edi + esi + 2]
add esi, 3
and ecx, 0x3f
movzx ecx, byte [ecx + 0x6ee8d850]
mov byte [eax + 3], cl
add eax, 4
cmp esi, ebx
jl 0x6ee6ce90
mov edi, dword [ebp + 0x10]
cmp esi, edi
jge 0x6ee6cf5c
mov ebx, dword [ebp + 0xc]
movzx ecx, byte [esi + ebx]
shr ecx, 2
mov cl, byte [ecx + 0x6ee8d850]
mov byte [eax], cl
lea ecx, [edi - 1]
movzx edx, byte [esi + ebx]
and edx, 3
shl edx, 4
cmp esi, ecx
jne 0x6ee6cf30
mov cl, byte [edx + 0x6ee8d850]
mov dl, 0x3d
mov byte [eax + 1], cl
jmp 0x6ee6cf52
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
or ecx, edx
mov cl, byte [ecx + 0x6ee8d850]
mov byte [eax + 1], cl
movzx ecx, byte [esi + ebx + 1]
and ecx, 0xf
mov dl, byte [ecx*4 + 0x6ee8d850]
mov byte [eax + 2], dl
mov byte [eax + 3], 0x3d
add eax, 4
pop edi
mov byte [eax], 0
sub eax, dword [ebp + 8]
pop esi
inc eax
pop ebx
pop ebp
ret 0xc

Function at 0x6ee6ec80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x6ee6ec9f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x10]
call ecx
add esp, 0xc
pop ebp
ret 0xc
mov dword [ebp + 8], 0
pop ebp
jmp sym.libaprutil_1.dll__apr_memcache_hash_default_12

Function at 0x6ee6ecb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x6ee6ecdd
push edi
mov edi, dword [ebp + 0xc]
movsx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6ee8db50]
cmp edx, esi
jb 0x6ee6ecc4
pop edi
not eax
pop esi
pop ebp
ret 0xc

Function at 0x6ee6ecf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x6ee6ed1d
push edi
mov edi, dword [ebp + 0xc]
movsx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6ee8db50]
cmp edx, esi
jb 0x6ee6ed04
pop edi
not eax
shr eax, 0x10
and eax, 0x7fff
pop esi
pop ebp
ret 0xc
Function at 0x6ee71460
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x6ee714a8
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x6ee714a3
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x6ee7148d
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x6ee71495
cmp edx, ebx
jne 0x6ee715e3
test dword [esi + 1], ecx
add byte [eax], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x6ee71464
add eax, dword [eax + 4]
jmp 0x6ee71451
mov dword [ebp + 0xc], ebx
jmp 0x6ee714b3
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x6ee714cb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x6ee714e9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x6ee71547
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x6ee7152e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x6ee71537
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x6ee71541
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x6ee71523
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x6ee714ad
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x6ee71594
dec eax
je 0x6ee7158b
sub eax, 3
je 0x6ee71582
mov dword [ebp - 4], 0x40
jmp 0x6ee715b1
mov dword [ebp - 4], 4
jmp 0x6ee71597
mov dword [ebp - 4], 0x20
jmp 0x6ee71597
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x6ee715e3
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x6ee71563
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.6ee70df4
cmp eax, 0xff01527e
jne 0x6ee715ee
push 1
push esi
call edi
mov eax, esi
jmp 0x6ee715ef
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6ee71630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
invalid

Function at 0x6ee71640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
Function at 0x6ee72fa0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
daa
mov eax, es
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]

Function at 0x6ee72fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x1c], 0x18
je 0x6ee72fb8
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
invalid
xor ebx, esi
invalid

Function at 0x6ee741a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x6ee741bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x10]
call ecx
add esp, 0xc
pop ebp
ret 0xc
mov dword [ebp + 8], 0
pop ebp
jmp sym.libaprutil_1.dll__apr_redis_hash_default_12

Function at 0x6ee741d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x6ee741fd
push edi
mov edi, dword [ebp + 0xc]
movsx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6ee8e378]
cmp edx, esi
jb 0x6ee741e4
pop edi
not eax
pop esi
pop ebp
ret 0xc

Function at 0x6ee74210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x6ee7423d
push edi
mov edi, dword [ebp + 0xc]
movsx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6ee8e378]
cmp edx, esi
jb 0x6ee74224
pop edi
not eax
shr eax, 0x10
and eax, 0x7fff
pop esi
pop ebp
ret 0xc

Function at 0x6ee779a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.EXPAT_ENTROPY_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x6ee77a0c
mov ecx, 0x6ee8f0d4
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x6ee779e0
test dl, dl
je 0x6ee779dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x6ee779e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x6ee779c0
xor eax, eax
jmp 0x6ee779e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x6ee77a0c
push 4
push dword [ebp + 0xc]
push 8
push dword [ebp + 8]
push str.Entropy:__s_____0x_0lx___lu_bytes__n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.6ee7b900
add esp, 0x18
mov eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x6ee7e1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jle 0x6ee7e2a1
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [eax + 8]
mov ebx, dword [eax]
mov ecx, dword [eax + 0xc]
add ebx, edx
mov edi, dword [eax + 4]
mov esi, ecx
adc edi, ecx
mov eax, dword [ebp + 8]
shld ecx, edx, 0xd
shr esi, 0x13
shl edx, 0xd
mov dword [ebp - 4], esi
xor esi, esi
or dword [ebp - 4], edx
or esi, ecx
xor dword [ebp - 4], ebx
xor esi, edi
mov edx, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 0x18], esi
mov esi, edx
add esi, dword [eax + 0x10]
mov dword [ebp - 8], edi
adc ebx, dword [eax + 0x14]
xor edi, edi
mov dword [ebp - 0xc], ebx
mov ebx, ecx
shld ecx, edx, 0x10
shr ebx, 0x10
shl edx, 0x10
or edi, ecx
xor edi, dword [ebp - 0xc]
or ebx, edx
mov ecx, dword [ebp - 8]
xor ebx, esi
mov dword [ebp - 0x14], esi
mov edx, edi
xor esi, esi
or esi, dword [ebp - 0x10]
add ecx, ebx
mov dword [eax], ecx
adc esi, edi
mov dword [ebp - 8], ecx
shld edi, ebx, 0x15
xor ecx, ecx
shr edx, 0xb
or ecx, edi
shl ebx, 0x15
mov edi, dword [ebp - 4]
or edx, ebx
xor edx, dword [ebp - 8]
xor ecx, esi
add edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x18], edx
mov edx, ebx
mov dword [eax + 4], esi
mov esi, ebx
adc esi, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 4]
shld ebx, eax, 0x11
shr edx, 0xf
shl eax, 0x11
or ecx, ebx
or edx, eax
xor ecx, esi
mov eax, dword [ebp + 8]
xor edx, edi
mov dword [eax + 0xc], ecx
xor ecx, ecx
or ecx, edi
mov dword [eax + 8], edx
sub dword [ebp + 0xc], 1
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], ecx
jne 0x6ee7e1c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6ee7e2b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1ec], 0
jne 0x6ee7e34c
push ebx
push esi
push str.ADVAPI32.DLL
xor ebx, ebx
call fcn.6ee8bef0
mov esi, eax
add esp, 4
test esi, esi
je 0x6ee7e315
push str.SystemFunction036
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x6ee7e300
push 4
lea ecx, [ebp + 8]
push ecx
call eax
mov ecx, 1
cmp al, cl
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x6ee7e315
push dword [ebp + 8]
push str.RtlGenRandom
jmp 0x6ee7e33c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
mov dword [ebp + 8], eax
imul eax, eax, 0x7fffffff
push eax
push str.fallback_4_
call fcn.6ee779a0
add esp, 8
mov dword [edi + 0x1ec], eax
pop esi
pop ebx
cmp byte [edi + 0xe8], 0
je 0x6ee7e368
push str.xmlhttp:__www.w3.org_XML_1998_namespace
push edi
call fcn.6ee7dc20
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x6ee8bef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x6ee91314
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
test eax, eax
jne 0x6ee8bf10
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push str.LoadLibraryExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x6ee91330
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbspbrk]
add esp, 8
test eax, eax
je 0x6ee8bf5d
test ebx, ebx
je 0x6ee8bf4d
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x6ee8bf86
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x6ee8bf86
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x6ee8c030
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6ee8bfa2
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x6ee8c026
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6ee8c026
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6ee8bfd3
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6ee8bff0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x6ee8c000
mov eax, dword [ebp - 8]
test eax, eax
je 0x6ee8c01d
push 8
push 0
push ebx
call eax
jmp 0x6ee8c024
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7c3c3ad4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x35fe03bc
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x43fef0]
and dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [0x43fef4]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
call fcn.00401022
mov eax, dword [0x43fef8]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x43fefc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [0x245d8cc]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x40109f
mov dword [0x245d8c8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ad
and dword [0x245d354], 0
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x245d8cc], 0xc
mov dword [0x245d8c4], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010fd
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
lea eax, [ebp - 0x828]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x1c]
add ecx, edi
xor eax, ecx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401076
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40113b
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x245d8cc]
mov ecx, dword [0x245d358]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4011f6
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x245d8cc], 0x959
jne 0x4011e5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401163
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4014a2
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x245d8cc], 0x400
push edi
jne 0x4014ff
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
call fcn.00401639
push esi
push esi
call fcn.0040176f
push esi
call fcn.00401d81
push esi
push esi
call fcn.00401bcc
push esi
call fcn.00401e17
push esi
push esi
call fcn.00401673
add esp, 0x24
xor edi, edi
cmp edi, 0x16cda
jge 0x401517
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5bee
jg 0x40153c
inc edi
cmp edi, 0x30053
jl 0x401501
mov eax, dword [0x44033c]
mov dword [0x245d8cc], eax
call fcn.004011f9
mov edi, 0x3078f
cmp dword [0x245d8cc], 0x51f
jne 0x40156a
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x401550
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x405e1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f678]
jne 0x405e25
repz ret
jmp fcn.00407c5a
Function at 0x407460
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f678]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404a33
and dword [ebp - 0x14], 0
cmp dword [0x44ae90], 0
mov dword [ebp - 0x18], eax
jne 0x407513
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4075bb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4075bb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44ae90], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44ae94], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44ae98], eax
call edi
push eax
call esi
mov dword [0x44aea0], eax
test eax, eax
je 0x407513
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44ae9c], eax
mov eax, dword [0x44ae9c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40756c
cmp dword [0x44aea0], ecx
je 0x40756c
push eax
call esi
push dword [0x44aea0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40756c
test ebx, ebx
je 0x40756c
call edi
test eax, eax
je 0x407563
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407563
test byte [ebp - 8], 1
jne 0x40756c
or dword [ebp + 0x10], 0x200000
jmp 0x40759f
mov eax, dword [0x44ae94]
cmp eax, dword [ebp - 0x18]
je 0x40759f
push eax
call esi
test eax, eax
je 0x40759f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40759f
mov eax, dword [0x44ae98]
cmp eax, dword [ebp - 0x18]
je 0x40759f
push eax
call esi
test eax, eax
je 0x40759f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44ae90]
call esi
test eax, eax
je 0x4075bb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4075bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405e1b
leave
ret
Function at 0x4035cf
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
sar eax, 2
push esi
test eax, eax
je 0x403655
xor esi, esi
mov al, byte [esi + 0x4e6fc0]
mov edx, str.Own_head
xor al, 0x73
sub al, 0x6c
xor al, 0x74
mov byte [esi + 0x4e6fc0], al
call fcn.004051f4
push eax
call fcn.004053b4
mov al, byte [esi + 0x4e6fc0]
mov edx, str.Earth
add al, 0x4e
xor al, 0xdc
pop ecx
mov byte [esi + 0x4e6fc0], al
call fcn.004051f4
push eax
call fcn.004053b4
mov al, byte [esi + 0x4e6fc0]
xor al, 0xac
mov dword [esp], 0x492e4c
sub al, 0x65
xor al, 0x22
sub al, 0x73
mov byte [esi + 0x4e6fc0], al
call fcn.004581cb
xor byte [esi + 0x4e6fc0], al
inc esi
pop ecx
cmp esi, 0x4ac
jb 0x4035e2
lea ecx, [esp + 0xc]
call fcn.004048c2
pop esi
pop ecx
ret 0x14

Function at 0x40b2f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40b318
jl 0x40b30f
test edi, edi
jne 0x40b318
xor eax, eax
xor edx, edx
jmp 0x40b3d9
cmp dword [ebx + 0x38], 0
je 0x40b32d
push eax
push edi
push dword [ebp + 8]
call fcn.0040b3df
jmp 0x40b3d9
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40b374
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40b374
cmp eax, edi
jb 0x40b34e
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0042f7c0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40b37a
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40b3ce
mov ecx, ebx
call fcn.0040a9cd
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40b3b9
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004594f9
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40b3ce
jmp 0x40b38c
test edx, edx
je 0x40b3ce
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004594f9
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x41d0f1
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x41d114
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x41d102
mov eax, ecx
pop esi
pop ebp
ret