joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483950
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
cmp ebx, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
jne 0x483990
cmp ebp, ebx
jne 0x483990
mov eax, dword [esp + 0x334]
call fcn.00483930
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x4839ab
mov esi, edi
call fcn.00485110
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
je 0x4839df
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
cmp ebp, 0xffffffff
mov dword [esp + 0x228], eax
je 0x483a26
test ecx, ecx
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
jbe 0x483a0e
cmp dword [esp + eax*4 + 0x24], ebp
je 0x483a0e
add eax, 1
cmp eax, ecx
jb 0x483a01
cmp eax, ecx
jne 0x483a20
cmp ecx, 0x40
jae 0x483a20
mov dword [esp + eax*4 + 0x24], ebp
add dword [esp + 0x20], 1
cmp ebp, edx
jbe 0x483a26
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea eax, [esp + 0x18]
lea ebp, [edx + 1]
sub ebx, 1
and ebx, eax
lea esp, [esp]
xor eax, eax
cmp edi, eax
jle 0x483a71
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov ecx, esi
sub ecx, eax
imul ecx, ecx, 0x3e8
mov dword [esp + 0x1c], ecx
jmp 0x483a7b
jne 0x483a7b
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x130]
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x483ae5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x483aae
cmp eax, 0x2714
jne 0x483ae9
test edi, edi
jle 0x483a40
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
call fcn.00485110
push edx
push eax
call fcn.00485140
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x483a40
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x483af7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x483b06
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x483b3d
lea ecx, [esp + 0x124]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x483b2b
mov esi, 1
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x483b3d
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x483b70
lea eax, [esp + 0x228]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x483b5e
or esi, 2
lea ecx, [esp + 0x20]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x483b70
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x4845a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [eax], 0
call fcn.00485110
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0xd0]
push ecx
mov ecx, dword [esi + 0xcc]
push ecx
push edx
push eax
call fcn.00485140
mov ebx, dword [esp + 0x40]
add esp, 0x10
cmp eax, ebx
jg 0x484655
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
lea ebx, [ebx]
mov edx, ebx
sub edx, eax
mov eax, dword [esp + 0x20]
push edx
push 0xffffffffffffffff
push eax
call fcn.00483950
add esp, 0xc
test eax, eax
jle 0x484655
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
push edx
call fcn.0047d880
add esp, 0x10
test eax, eax
jne 0x484658
mov eax, dword [esp + 0x14]
cmp edi, eax
je 0x484660
test eax, eax
je 0x484655
add dword [esp + 0x10], eax
sub edi, eax
add ebp, eax
call fcn.00485110
mov ecx, dword [esi + 0xd0]
push ecx
mov ecx, dword [esi + 0xcc]
push ecx
push edx
push eax
call fcn.00485140
add esp, 0x10
cmp eax, ebx
jle 0x4845f0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
add eax, edx
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x485da0
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x485daf
jmp dword [ecx*4 + 0x485e04]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x485f90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4d7160]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0049379c
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x485ff5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x485ff5
lea edx, [esp]
push edx
call dword [0x4d700c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004921f3
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004921f3
add esp, 0x108
ret
jmp 0x485f90
Function at 0x486010
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4d7160]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0049379c
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x485ff5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x485ff5
lea edx, [esp]
push edx
call dword [0x4d700c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004921f3
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004921f3
add esp, 0x108
ret
jmp 0x485f90

Function at 0x48992e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4d7160]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0048986d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0048c8d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x48997d
cmp dword [ebp - 0x1c], 5
jb 0x489995
jmp 0x489991
cmp dword [ebp - 0x10], 1
jne 0x489995
cmp dword [ebp - 0x1c], 4
ja 0x489991
jne 0x489995
cmp dword [ebp - 0x18], 0
jbe 0x489995
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4b3458
call fcn.004094d3
test eax, eax
jge 0x4899b6
mov byte [0x4dcff4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004921f3
add ebp, 0x78
leave
ret

Function at 0x489c35
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4dc090], 0
push esi
jne 0x489ba8
call fcn.00489ad3
test eax, eax
je 0x489beb
mov eax, dword [0x4dc090]
cmp eax, 1
jne 0x489bc9
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x489beb
pop esi
ret
push eax
call dword [0x4dc098]
test eax, eax
jne 0x489c33
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x489bef
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4dc090]
call dword [0x4dc098]
mov edi, eax
test edi, edi
je 0x489c16
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x489c32
lea edi, [esi + 0xff0]
push esi
push dword [0x4dc090]
call dword [0x4dc094]
add esi, 0x10
cmp esi, edi
jb 0x489c1c
mov eax, esi
pop edi
pop esi
ret
jmp 0x489b95
Function at 0x48c60e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x48c64b
cmp dword [ebp + 0x14], edi
je 0x48c64b
cmp ecx, edi
jne 0x48c652
call fcn.00493210
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0048c23a
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x48c666
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x48c687
cmp ebx, 0xffffffff
je 0x48c676
push ebx
push edi
push ecx
call fcn.0048c8d0
add esp, 0xc
cmp esi, edi
je 0x48c633
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x48c633
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x48c6a3
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x48c6aa
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x48c79b
test word [esi + 0xc], 0x10c
je 0x48c6fe
mov eax, dword [esi + 4]
test eax, eax
je 0x48c6fe
jl 0x48c7fc
cmp ebx, eax
mov edi, ebx
jb 0x48c6cf
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x48c7a3
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0048baf8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x48c793
cmp ebx, dword [ebp - 0xc]
jb 0x48c76b
cmp dword [ebp - 0xc], 0
je 0x48c728
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x48c71d
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x48c724
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x48c733
mov eax, SysReAllocString
cmp ebx, eax
ja 0x48c733
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x48c7cf
push eax
push dword [ebp - 8]
push esi
call fcn.0048eb8d
pop ecx
push eax
call fcn.00499e62
add esp, 0xc
test eax, eax
je 0x48c80e
cmp eax, 0xffffffff
je 0x48c7fc
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x48c793
push esi
call fcn.00499781
cmp eax, 0xffffffff
pop ecx
je 0x48c800
cmp dword [ebp - 4], 0
je 0x48c7cf
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x48c6b2
mov eax, dword [ebp + 0x14]
jmp 0x48c64d
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x48c7ba
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0048c8d0
add esp, 0xc
call fcn.00493210
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x48c643
cmp dword [ebp + 0xc], 0xffffffff
je 0x48c7e5
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0048c8d0
add esp, 0xc
call fcn.00493210
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x48c643
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x48c64d
or dword [esi + 0xc], 0x10
jmp 0x48c800
Function at 0x48faa3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x48fad0
call fcn.00493223
mov dword [eax], esi
call fcn.00493210
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0048c23a
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x48faac
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48faff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00493236
pop ecx
call fcn.00493210
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x48fb26
test al, 1
je 0x48fb26
test byte [esp + 0xc], 2
je 0x48fb26
call fcn.00493223
mov dword [eax], 5
call fcn.00493210
mov dword [eax], 0xd
jmp 0x48faf6
xor eax, eax
pop esi
ret

Function at 0x4921f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d7160]
jne 0x4921fd
repz ret
jmp fcn.004a2b27

Function at 0x49707f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4d7cb8]
je 0x49709a
inc edi
cmp edi, 0x17
jb 0x49708b
cmp edi, 0x17
jae 0x49721a
push ebp
push 3
call fcn.004a4627
cmp eax, 1
pop ecx
je 0x4971e6
push 3
call fcn.004a4627
test eax, eax
pop ecx
jne 0x4970ce
cmp dword [0x4d715c], 1
je 0x4971e6
cmp ebx, 0xfc
je 0x497219
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4dc190
push ebp
call fcn.0048fc71
add esp, 0xc
test eax, eax
je 0x497104
push esi
push esi
push esi
push esi
push esi
call fcn.0048c13e
add esp, 0x14
push 0x104
mov esi, 0x4dc1a9
push esi
push 0
mov byte [0x4dc2ad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x497148
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048fc71
add esp, 0xc
test eax, eax
je 0x497148
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048c13e
add esp, 0x14
push esi
call fcn.00489cd0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x49718d
push esi
call fcn.00489cd0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4dc4a4
push 0x4b493c
sub ecx, eax
push ecx
push eax
call fcn.004a18ae
add esp, 0x14
test eax, eax
je 0x49718d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0048c13e
add esp, 0x14
jmp 0x49718f
xor esi, esi
push 0x4b4938
push ebx
push ebp
call fcn.004a183d
add esp, 0xc
test eax, eax
je 0x4971af
push esi
push esi
push esi
push esi
push esi
call fcn.0048c13e
add esp, 0x14
push dword [edi*8 + 0x4d7cbc]
push ebx
push ebp
call fcn.004a183d
add esp, 0xc
test eax, eax
je 0x4971d1
push esi
push esi
push esi
push esi
push esi
call fcn.0048c13e
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004a446a
add esp, 0xc
jmp 0x497219
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x497219
cmp ebp, 0xffffffff
je 0x497219
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4d7cbc]
push dword [esi]
call fcn.00489cd0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a446a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00496b00
xor ebx, ebx
cmp dword [0x4dcc44], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4a4540
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4a4620
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a4620
push eax
call fcn.00496a92
mov dword [esp], 0x4b5520
push edi
mov dword [0x4dcc44], eax
call esi
push eax
call fcn.00496a92
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4dcc48], eax
call esi
push eax
call fcn.00496a92
mov dword [0x4dcc4c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00491d32
test eax, eax
pop ecx
pop ecx
je 0x4a450e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048c13e
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4a4540
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00496a92
cmp eax, ebx
pop ecx
mov dword [0x4dcc54], eax
je 0x4a4540
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00496a92
pop ecx
mov dword [0x4dcc50], eax
mov eax, dword [0x4dcc50]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4a45c5
cmp dword [0x4dcc54], ecx
je 0x4a45c5
push eax
call fcn.00496b09
push dword [0x4dcc54]
mov esi, eax
call fcn.00496b09
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4a45c5
cmp edi, ebx
je 0x4a45c5
call esi
cmp eax, ebx
je 0x4a4592
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a4592
test byte [ebp - 0x18], 1
jne 0x4a45c5
lea eax, [ebp - 0x10]
push eax
call fcn.00491d69
test eax, eax
pop ecx
je 0x4a45ad
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048c13e
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4a45bc
or dword [ebp + 0x10], 0x200000
jmp 0x4a4600
or dword [ebp + 0x10], 0x40000
jmp 0x4a4600
mov eax, dword [0x4dcc48]
cmp eax, dword [ebp - 8]
je 0x4a4600
push eax
call fcn.00496b09
cmp eax, ebx
pop ecx
je 0x4a4600
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a4600
mov eax, dword [0x4dcc4c]
cmp eax, dword [ebp - 8]
je 0x4a4600
push eax
call fcn.00496b09
cmp eax, ebx
pop ecx
je 0x4a4600
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4dcc44]
call fcn.00496b09
cmp eax, ebx
pop ecx
je 0x4a4620
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a4622
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [str.SY]
and dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [0x43aef4]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
call fcn.00401022
mov eax, dword [0x43aef8]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x43aefc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [0x24588cc]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x40109f
mov dword [0x24588c8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ad
and dword [0x2458354], 0
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x24588cc], 0xc
mov dword [0x24588c4], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010fd
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
lea eax, [ebp - 0x828]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x1c]
add ecx, edi
xor eax, ecx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401076
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40113b
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x24588cc]
mov ecx, dword [0x2458358]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4011f6
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x24588cc], 0x959
jne 0x4011e5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401163
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4014a2
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x24588cc], 0x400
push edi
jne 0x4014ff
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
call fcn.00401639
push esi
push esi
call fcn.0040176f
push esi
call fcn.00401d81
push esi
push esi
call fcn.00401bcc
push esi
call fcn.00401e17
push esi
push esi
call fcn.00401673
add esp, 0x24
xor edi, edi
cmp edi, 0x16d2a
jge 0x401517
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x40153c
inc edi
cmp edi, 0x3011b
jl 0x401501
mov eax, dword [0x43b33c]
mov dword [0x24588cc], eax
call fcn.004011f9
mov edi, 0x3078f
cmp dword [0x24588cc], 0x51f
jne 0x40156a
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x401550
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x405e1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a678]
jne 0x405e25
repz ret
jmp fcn.00407c5a
Function at 0x1000aa10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x1000aa1b
jmp dword [eax*4 + 0x1000aa88]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x1000a760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x10049a54], 0
je case.default.0x1000aa1b
xor edx, edx
xor ecx, ecx
call fcn.1003b1d0
push dword [0x10049a50]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x10049a50], 0
mov dword [0x10049a54], 0
mov eax, 1
pop ebp
ret 0xc