joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594194
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59421e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
jne 0x5941f8
call sub.KERNEL32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040d174
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408608]
call fcn.0040d998
call fcn.0040425c
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594225
lea eax, [ebp - 0x110]
call fcn.004048ec
ret

Function at 0x59422c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5942b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.ADVAPI32.dll_GetUserNameA
test eax, eax
jne 0x594290
call sub.KERNEL32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040d174
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408608]
call fcn.0040d998
call fcn.0040425c
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5942bd
lea eax, [ebp - 0x110]
call fcn.004048ec
ret

Function at 0x5942c4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe28
mov edi, eax
lea eax, [esp + 0x48]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
mov eax, edi
call fcn.004048ec
push 0x40
lea eax, [esp + 0xc]
push eax
call sub.WS2_32.dll_gethostname
lea eax, [esp + 8]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [esp], eax
cmp dword [esp], 0
je 0x594331
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
xor ebx, ebx
jmp 0x594321
push dword [esi]
call sub.WS2_32.dll_inet_ntoa
mov edx, edi
call fcn.0040a400
inc ebx
mov eax, dword [esp + 4]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x594312
call sub.WS2_32.dll_WSACleanup
add esp, 0x1d8
pop edi
pop esi
pop ebx
ret
Function at 0x594594
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x594677
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004048ec
xor eax, eax
push ebp
push 0x594652
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404ad4
lea eax, [ebp - 0x10]
mov edx, 0x594690
call fcn.00404bb4
mov eax, dword [ebp - 0x10]
call fcn.00404dac
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
mov eax, dword [ebp - 4]
call fcn.00407f6c
movzx eax, ax
lea ecx, [ebp - 0x14]
mov edx, 4
call fcn.00409918
push dword [ebp - 0x14]
push 0x59469c
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00409918
push dword [ebp - 0x18]
mov eax, esi
mov edx, 3
call fcn.00404c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59465c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59467e
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404910
ret

Function at 0x59495c
Capabilities:
Create process on windows
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
mov eax, dword [ebp - 8]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x594a2c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403388
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00404dac
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404dac
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.SHELL32.dll_ShellExecuteEx
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x594a11
jmp 0x5949ff
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
call fcn.00471bc4
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x594a11
push 0x64
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x5949e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594a33
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404910
ret
Function at 0x4010cc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010de
mov eax, dword [0x40f08b]
shl eax, 2
mov dword [0x40f08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405368
pop edx
call fcn.00404704
call fcn.0040536c
push 0
call fcn.004065e4
pop ecx
push 0x40f034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40f093], eax
push 0
jmp fcn.0040a3b8
Function at 0x402fe4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x403018
mov edx, dword [eax + 8]
test edx, edx
jne 0x403007
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x403014
add edx, esi
cmp ebx, edx
jb 0x403025
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x402ffd
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403060
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x40307a
xor eax, eax
jmp 0x4031fa
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x40308e
xor eax, eax
jmp 0x4031fa
cmp word [ebx + 0x14], 0xe0
jne 0x40309e
cmp word [ebx + 0x18], 0x10b
je 0x4030a5
xor eax, eax
jmp 0x4031fa
mov dword [0x452d74], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00402fe4
add esp, 8
test eax, eax
jne 0x4030d0
xor eax, eax
jmp 0x4031fa
mov edx, dword [0x452d74]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040302c
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x403102
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x4031fa
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x4031cc
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x4031be
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x4031b9
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x4031b0
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4031a5
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4031a5
test cl, cl
je 0x40319a
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4031a5
add eax, 2
add edx, 2
test cl, cl
jne 0x40317e
jne 0x4031a5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x4031fa
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x403164
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x40313c
jmp 0x4031f8
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x4031f0
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x4031ec
cmp dword [eax], 0
je 0x4031ec
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x4031fa
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x4031d3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40330c
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x403329
xor eax, eax
jmp 0x403366
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x403350
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x403366
cmp dword [esp + 4], 4
jne 0x403364
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x403366
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x4033c8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4033e1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4033e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x403408
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f928
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.004033a0
pop ecx
test eax, eax
je 0x403444
push ebx
call fcn.004033e8
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x403482
push ebx
call fcn.0040327c
pop ecx
test eax, eax
jne 0x403479
push ebx
call fcn.004032b4
pop ecx
test eax, eax
je 0x40349f
push ebx
call fcn.004033e8
pop ecx
jmp 0x40349f
push ebx
call fcn.004033c8
pop ecx
test eax, eax
jne 0x403498
push ebx
call fcn.0040336c
pop ecx
test eax, eax
je 0x40349f
push ebx
call fcn.004033e8
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40350b
jmp 0x4034fa
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4034ec
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x4034fa
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4034ce
cmp esi, dword [ebp - 4]
je 0x403530
cmp dword [ebp - 4], 0
je 0x403530
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x40360e
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44facd
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x40360e
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4035ea
xor esi, esi
lea ebx, [ebp - 0x12cc]
jmp 0x4035e0
push 0x104
lea eax, [ebp - 0x13d0]
push eax
mov edx, dword [ebx]
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4035dc
lea ecx, [ebp - 0x13d0]
push ecx
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4035dc
mov dword [ebp - 0xc], 1
jmp 0x4035ea
inc esi
add ebx, 4
mov edx, dword [ebp - 8]
shr edx, 2
cmp esi, edx
jb 0x4035a3
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x40360e
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0fff
dec dword [edi]
pop ds
add al, ch
push es
scasd eax, dword es:[edi]
add byte [eax], al
Function at 0x403668
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x403679
jne 0x403679
jmp fcn.004035fd
cmp esi, 8
jb 0x4036b7
xor ebx, ebx
jmp 0x4036ae
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.004036bc
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x403682
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4036bc
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.0040163c
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x40376f
mov eax, fcn.004012ec
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x40376f
mov eax, fcn.00403918
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x40376f
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x40376f
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403737
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40378c
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.0040163c
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403842
mov eax, fcn.004012ec
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403842
mov eax, fcn.0040378c
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403842
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403842
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x40380a
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403968
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.0040163c
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a1e
mov eax, fcn.004012ec
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a1e
mov eax, fcn.00403918
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403a1e
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403a1e
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x4039e6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40505c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4093e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x409446
call fcn.00409394
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0040570c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0040570c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4094a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4518dc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40957e
cmp dword [0x4518d8], 0
jne 0x40957e
cmp dword [0x451acc], 0
je 0x409538
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00409294
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40951e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00409294
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40951e
lea ebx, [ebp - 0x84]
jmp 0x40951f
inc ebx
call fcn.00409460
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4095b9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4518e0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0040570c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4518e3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4095b9
cmp dword [0x4518d8], 0
je 0x409598
cmp dword [0x4518d8], 0xffffffff
je 0x4095b9
push esi
call dword [0x4518d8]
pop ecx
mov eax, dword [0x4518dc]
test eax, eax
je 0x4095b9
cmp dword [0x4518dc], 0xffffffff
je 0x4095b9
cmp byte [eax], 0
je 0x4095b9
push esi
push eax
call fcn.004093e4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409dfc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4537e4], 0
jne 0x409e7d
cmp dword [0x453804], 0
jne 0x409e2c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x453804], eax
test eax, eax
jne 0x409e2c
push str.GetEnvironmentStrings_failed
call fcn.004095d0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x453804]
jmp 0x409e40
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040570c
pop ecx
mov edi, eax
test eax, eax
jne 0x409e38
lea edi, [ebp + 1]
push edi
call fcn.00404614
pop ecx
mov ebx, eax
mov dword [0x4537e8], ebx
test ebx, ebx
jne 0x409e6a
xor eax, eax
jmp 0x409f40
push edi
mov edx, dword [0x453804]
push edx
push ebx
call fcn.004055f8
add esp, 0xc
jmp 0x409e9d
xor esi, esi
mov ebx, dword [0x4537e4]
jmp 0x409e97
push eax
call fcn.0040570c
pop ecx
test eax, eax
jne 0x409e93
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x409e87
lea ebx, [esi + 4]
push 4
mov dword [0x4537ec], ebx
inc ebx
push ebx
call fcn.00404178
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x409ec0
xor eax, eax
jmp 0x409f40
cmp dword [0x4537e4], 0
jne 0x409ef1
xor esi, esi
mov ebx, dword [0x4537e8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x409ee2
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040570c
pop ecx
mov edi, eax
test eax, eax
jne 0x409ed8
jmp 0x409f22
xor esi, esi
mov ebx, dword [0x4537e4]
mov eax, dword [esp]
mov edi, eax
jmp 0x409f1c
push eax
call fcn.0040570c
pop ecx
test eax, eax
je 0x409f11
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x409f15
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x409f00
mov eax, dword [0x4537e4]
test eax, eax
je 0x409f32
push eax
call fcn.00404624
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4537e4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c6c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x45253c
sub eax, eax
test esi, esi
je 0x40c7a0
sub eax, 1
test ecx, ecx
je 0x40c79e
test esi, 3
je 0x40c6fe
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40c6e3
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x40c785
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40c70c
mov ecx, edx
test ecx, ecx
je 0x40c79e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40c78b
not eax
mov dword [esp + 0x1c], eax
popal
ret