joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7c0b
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4c7c34
call fcn.004c9321
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x4c7c57
push eax
push dword [esi + 4]
call fcn.004c7b96
push esi
push eax
mov ecx, 0x549d68
call fcn.004c7861
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x4c83fe
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x4ec63e
call fcn.004d19d2
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004c83c0
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00469270
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x4c8464
push eax
push dword [esi + 8]
call fcn.004c7b96
push dword [esi + 0xc]
mov ecx, 0x549d68
push eax
call fcn.004c7861
mov eax, esi
call fcn.004d1a71
ret 0x18

Function at 0x4cde2d
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x4cde36
xor eax, eax
jmp 0x4cde9f
cmp dword [esp + 8], 0
jne 0x4cde42
call fcn.004bb5cf
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.004d4f3e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4cde7d
push dword [esi + 0x10]
call fcn.004d4c44
test eax, eax
pop ecx
jne 0x4cde7d
mov esi, dword [esi + 0xc]
call fcn.004d1c0b
push esi
push dword [eax]
push 1
call fcn.004cc9e2
push dword [esi + 0x10]
call fcn.004d4c73
test eax, eax
pop ecx
je 0x4cde9c
push dword [esi + 0x10]
call fcn.004d4b98
push eax
call fcn.004018f0
pop ecx
pop ecx
jmp 0x4cde6b
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4cdea8
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4cdeb2
call fcn.004bb5cf
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.004d50b8
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x4cdedf
mov esi, dword [esi + 0xc]
call fcn.004d1c0b
push esi
push dword [eax]
push 1
call fcn.004cc9e2
pop esi
ret 8

Function at 0x4cf0b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x536ed4]
jne 0x4cf0c2
repz ret
jmp fcn.004d8c05
Function at 0x4d4ca2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4d4cdf
cmp dword [ebp + 0x14], edi
je 0x4d4cdf
cmp ecx, edi
jne 0x4d4ce6
call fcn.004d1bf8
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004d142f
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4d4cfa
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4d4d1b
cmp ebx, 0xffffffff
je 0x4d4d0a
push ebx
push edi
push ecx
call fcn.004d1c40
add esp, 0xc
cmp esi, edi
je 0x4d4cc7
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4d4cc7
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4d4d37
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4d4d3e
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4d4e2f
test word [esi + 0xc], 0x10c
je 0x4d4d92
mov eax, dword [esi + 4]
test eax, eax
je 0x4d4d92
jl 0x4d4e90
cmp ebx, eax
mov edi, ebx
jb 0x4d4d63
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4d4e37
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004cf18d
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4d4e27
cmp ebx, dword [ebp - 0xc]
jb 0x4d4dff
cmp dword [ebp - 0xc], 0
je 0x4d4dbc
mov ecx, DirectSoundCreate
xor edx, edx
cmp ebx, ecx
jbe 0x4d4db1
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4d4db8
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4d4dc7
mov eax, DirectSoundCreate
cmp ebx, eax
ja 0x4d4dc7
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4d4e63
push eax
push dword [ebp - 8]
push esi
call fcn.004d49e5
pop ecx
push eax
call fcn.004e1277
add esp, 0xc
test eax, eax
je 0x4d4ea2
cmp eax, 0xffffffff
je 0x4d4e90
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4d4e27
push esi
call fcn.004e0b96
cmp eax, 0xffffffff
pop ecx
je 0x4d4e94
cmp dword [ebp - 4], 0
je 0x4d4e63
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4d4d46
mov eax, dword [ebp + 0x14]
jmp 0x4d4ce1
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4d4e4e
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004d1c40
add esp, 0xc
call fcn.004d1bf8
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4d4cd7
cmp dword [ebp + 0xc], 0xffffffff
je 0x4d4e79
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004d1c40
add esp, 0xc
call fcn.004d1bf8
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4d4cd7
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4d4ce1
or dword [esi + 0xc], 0x10
jmp 0x4d4e94
Function at 0x4d5556
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x537070]
je 0x4d5571
inc edi
cmp edi, 0x17
jb 0x4d5562
cmp edi, 0x17
jae 0x4d56f1
push ebp
push 3
call fcn.004e194a
cmp eax, 1
pop ecx
je 0x4d56bd
push 3
call fcn.004e194a
test eax, eax
pop ecx
jne 0x4d55a5
cmp dword [0x536e40], 1
je 0x4d56bd
cmp ebx, 0xfc
je 0x4d56f0
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x54a0d8
push ebp
call fcn.004d10c0
add esp, 0xc
test eax, eax
je 0x4d55db
push esi
push esi
push esi
push esi
push esi
call fcn.004d1311
add esp, 0x14
push 0x104
mov esi, 0x54a0f1
push esi
push 0
mov byte [0x54a1f5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4d561f
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004d10c0
add esp, 0xc
test eax, eax
je 0x4d561f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004d1311
add esp, 0x14
push esi
call fcn.004d9590
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4d5664
push esi
call fcn.004d9590
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x54a3ec
push 0x4ff6cc
sub ecx, eax
push ecx
push eax
call fcn.004e1897
add esp, 0x14
test eax, eax
je 0x4d5664
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004d1311
add esp, 0x14
jmp 0x4d5666
xor esi, esi
push 0x4ff6c8
push ebx
push ebp
call fcn.004e1826
add esp, 0xc
test eax, eax
je 0x4d5686
push esi
push esi
push esi
push esi
push esi
call fcn.004d1311
add esp, 0x14
push dword [edi*8 + 0x537074]
push ebx
push ebp
call fcn.004e1826
add esp, 0xc
test eax, eax
je 0x4d56a8
push esi
push esi
push esi
push esi
push esi
call fcn.004d1311
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004e1669
add esp, 0xc
jmp 0x4d56f0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4d56f0
cmp ebp, 0xffffffff
je 0x4d56f0
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x537074]
push dword [esi]
call fcn.004d9590
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4e1669
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004d6107
xor ebx, ebx
cmp dword [0x54abec], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4e173f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4e181f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4e181f
push eax
call fcn.004d6099
mov dword [esp], 0x4ffae0
push edi
mov dword [0x54abec], eax
call esi
push eax
call fcn.004d6099
mov dword [esp], 0x4ffacc
push edi
mov dword [0x54abf0], eax
call esi
push eax
call fcn.004d6099
mov dword [0x54abf4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004d361c
test eax, eax
pop ecx
pop ecx
je 0x4e170d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004d1311
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4e173f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004d6099
cmp eax, ebx
pop ecx
mov dword [0x54abfc], eax
je 0x4e173f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004d6099
pop ecx
mov dword [0x54abf8], eax
mov eax, dword [0x54abf8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4e17c4
cmp dword [0x54abfc], ecx
je 0x4e17c4
push eax
call fcn.004d6110
push dword [0x54abfc]
mov esi, eax
call fcn.004d6110
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4e17c4
cmp edi, ebx
je 0x4e17c4
call esi
cmp eax, ebx
je 0x4e1791
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4e1791
test byte [ebp - 0x18], 1
jne 0x4e17c4
lea eax, [ebp - 0x10]
push eax
call fcn.004d3653
test eax, eax
pop ecx
je 0x4e17ac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004d1311
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4e17bb
or dword [ebp + 0x10], 0x200000
jmp 0x4e17ff
or dword [ebp + 0x10], 0x40000
jmp 0x4e17ff
mov eax, dword [0x54abf0]
cmp eax, dword [ebp - 8]
je 0x4e17ff
push eax
call fcn.004d6110
cmp eax, ebx
pop ecx
je 0x4e17ff
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4e17ff
mov eax, dword [0x54abf4]
cmp eax, dword [ebp - 8]
je 0x4e17ff
push eax
call fcn.004d6110
cmp eax, ebx
pop ecx
je 0x4e17ff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x54abec]
call fcn.004d6110
cmp eax, ebx
pop ecx
je 0x4e181f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4e1821
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e8822
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x536ed4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004e8761
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004d1c40
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4e8871
cmp dword [ebp - 0x1c], 5
jb 0x4e8889
jmp 0x4e8885
cmp dword [ebp - 0x10], 1
jne 0x4e8889
cmp dword [ebp - 0x1c], 4
ja 0x4e8885
jne 0x4e8889
cmp dword [ebp - 0x18], 0
jbe 0x4e8889
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x500c80
call fcn.004e85f7
test eax, eax
jge 0x4e88aa
mov byte [0x54be00], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004cf0b8
add ebp, 0x78
leave
ret
Function at 0x855aa0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42266e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42bb54]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x426ae4
lea eax, [esi + 0x64]
mov dword [esp + 0x20], 4
call fcn.00854f10
cmp dword [0x42fb38], 0
mov dword [esp + 0x10], 0
je 0x855b6e
mov ecx, dword [0x42669c]
mov edx, dword [fcn.004266a0]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x4266a4]
mov dword [eax + 4], edx
mov edx, dword [0x4266a8]
push 4
mov dword [eax + 8], ecx
push 2
push 0
lea ecx, [esp + 0x2c]
mov dword [eax + 0xc], edx
call fcn.00856720
add esp, 0x1c
cmp dword [0x42fb38], 0
je 0x855b6e
mov ecx, dword [0x42669c]
mov edx, dword [fcn.004266a0]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x4266a4]
mov dword [eax + 4], edx
mov edx, dword [0x4266a8]
push 0
mov dword [eax + 8], ecx
push 2
push 2
xor ecx, ecx
mov dword [eax + 0xc], edx
call fcn.00856720
add esp, 0x1c
mov edi, dword [esi + 0x53c]
test edi, edi
je 0x855ba7
mov eax, dword [edi]
test eax, eax
mov ebx, dword [fcn.00423264]
je 0x855b87
push eax
call ebx
mov eax, dword [edi + 0x204]
test eax, eax
je 0x855b94
push eax
call ebx
push edi
call fcn.00856dab
add esp, 4
mov dword [esi + 0x53c], 0
mov edi, dword [esi + 0x58]
test edi, edi
je 0x855bc5
mov ebx, edi
call fcn.00853f60
push edi
call fcn.00856dab
add esp, 4
mov dword [esi + 0x58], 0
cmp dword [esi + 0x548], 0
mov dword [esi + 0x58], 0
je 0x855be4
mov eax, dword [esi + 0x544]
push eax
lea ecx, [esi + 0x64]
call fcn.00854b60
mov byte [esp + 0x20], 3
mov eax, dword [esi + 0x558]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x855c0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x20], 2
mov eax, dword [esi + 0x540]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x855c32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push fcn.00401980
push pe_nt_image_headers32
lea eax, [esi + 0x138]
push 4
push eax
mov byte [esp + 0x30], 1
call fcn.00862090
lea eax, [esi + 0x64]
push eax
mov byte [esp + 0x24], 0
call fcn.008542a0
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.0085b35f
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x536bf7
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3f667f74
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0xa60ba8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa60bb2
pushal
call 0xa60bb8
pop ebp
sub ebp, 0x10
sub ebp, 0x660ba8
jmp 0xa60bce
mov eax, 0x660ba8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x9418a81a
mov eax, 0xba000005
sbb ch, byte [eax + 0x10309418]
xor byte [eax], dl
inc eax
dec ecx
jne 0xa60be5
jmp 0xa60bf8
xchg ecx, eax
xlatb
xchg ecx, eax
xchg ebx, eax
sbb bl, byte es:[edx]
sbb bl, byte [ebx + 0x1a1ae2db]
sbb bl, byte [ecx]
xlatb
mov byte [0x1a1a1a1c], al
mov al, byte [0x1a1a1a32]
in eax, dx
clc
sbb edx, edx
xchg ecx, eax
wait
push ss
sbb bl, byte [edx]
sbb bl, byte [ecx]
fisttp word [edx + 0x4a]
jb 0xa60be8
jg 0xa60c38
sbb dh, byte [edx - 0x2d]
mov edi, 0x361b1a4d
jb 0xa60bdc
movsb byte es:[edi], byte [esi]
loop 0xa60c31
push edx
pop ds
pop ds
sbb bl, byte [edx]
sbb dh, bl
xor bl, byte [edx]
sbb bl, byte [edx]
dec edi
xchg ecx, eax
not byte [ecx + 0x1a1a129f]
sbb dl, byte [ecx + 0x1a1a168f]
sbb dl, byte [ecx + 0x1a1a0a97]
sbb bl, bl
sbb byte [ebx], ch
sbb byte [ecx + 0x15531ed8], bl
lahf
out dx, al
in eax, 0xe5
in eax, 0x47
in eax, 0xe5
inc edi
fcom dword [esi]
sbb dl, byte [ecx + 0x1a1e3e96]
sbb bl, byte [edx]
jb 0xa60c33
jg 0xa60c83
sbb dh, byte [edx - 0x2d]
mov edi, 0x361b1a4d
dec ebx
pop ds
sbb bl, byte [edx]
sbb dh, bl
sub dword [eax], ebx
sbb bl, byte [edx]
dec edi
dec esi
inc edi
in eax, 0x6f
push ss
in eax, 0x6f
adc dh, dl
jl 0xa60ca9
sbb bl, byte [edx]
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
adc bl, byte [edx]
sbb bl, byte [edx]
sub ebx, edx
sub eax, ecx
cdq
pop ds
push edx
adc eax, 0x1a1a549e
sbb dl, byte [0x1a1a5292]
sbb bl, byte [edx]
jl 0xa60c3e
sbb bh, byte [ecx + edx*4 + 6]
push es
and ebx, dword [edx - 0x61ea0d1f]
add byte [edx], bl
sbb bl, byte [edx]
lcall 0x1a0b, 0x9e15f3e1
sbb bl, byte [edx]
jl 0xa60c5e
loope 0xa60caa
aas
adc eax, 0x1a1a0f9e
sbb bl, byte [ebx - 0xd]
salc
in eax, 0xe5
in eax, 0x33
push esi
and ebx, dword [ebx]
cdq
fistp dword [edi]
cdq
push ds
repe cmpsd dword [esi], dword es:[edi]
in eax, 0xe5
in eax, 0x33
dec esi
and ebx, dword [eax]
cdq
fistp dword [ecx + ebx*4]
invalid
Function at 0x4043e4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x42d348]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x28], eax
mov eax, dword [0x42d34c]
push esi
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], 0x9e3779b9
call fcn.004043dd
mov eax, dword [0x42d350]
add dword [ebp - 4], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x42d354]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x282779c]
cmp eax, 0xfa9
jne 0x404465
mov dword [0x2827798], 0xedeb2e40
cmp eax, 0x3eb
jne 0x404473
and dword [0x2827224], 0
mov edx, dword [ebp - 4]
add edx, ebx
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov dword [0x2827794], 0xf4ea3dee
xor eax, edx
xor eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
sub edi, eax
mov eax, edi
shr eax, 5
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x28]
xor esi, edx
cmp dword [0x282779c], 0xb03
jne 0x4044d8
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
xor eax, esi
sub ebx, eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 4], eax
dec dword [ebp - 0x14]
jne 0x404439
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
leave
ret 4

Function at 0x4044fd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x282779c]
mov ecx, dword [0x2827228]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4045cf
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x282779c], 0x959
jne 0x4045bd
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403ef0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x403f3c
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0x403f68
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push 0x403fa0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call fcn.004043e4
add edi, 8
dec ebx
jne 0x404525
pop edi
pop ebx
pop esi
leave
ret