joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407bf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d2b0
push 0x409cc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x412bb0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x412bac], ecx
shl ecx, 8
add ecx, edx
mov dword [0x412ba8], ecx
shr eax, 0x10
mov dword [0x412ba4], eax
call fcn.00409b90
test eax, eax
jne 0x407c5a
push 0x1c
call fcn.00407dc0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00409990
call fcn.00409980
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x414488], eax
call fcn.00409340
mov dword [0x412be4], eax
test eax, eax
je 0x407c8d
mov eax, dword [0x414488]
test eax, eax
jne 0x407c97
push 0xffffffffffffffff
call fcn.00407970
add esp, 4
call fcn.00409090
call fcn.00408fa0
call fcn.00407940
mov esi, dword [0x414488]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x407d76
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x407cde
test al, al
je 0x407cde
and eax, 0xff
push eax
call fcn.00408f40
add esp, 4
test eax, eax
je 0x407cb8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x407cb8
cmp byte [esi], 0x22
jne 0x407ce7
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x407cf7
cmp al, 0x20
ja 0x407cf7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x407ce7
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x407d18
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x407d1d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00407970
jmp 0x407d5b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x407ce7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x407d76

Function at 0x407dc0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x412bec], 1
jne 0x407dce
call fcn.00409da0
mov eax, dword [esp + 4]
push eax
call fcn.00409de0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409340
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x412d00]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x409382
call edi
mov esi, eax
test esi, esi
je 0x40936c
mov eax, 1
jmp 0x40937d
call ebp
mov ebx, eax
test ebx, ebx
je 0x40948f
mov eax, 2
mov dword [0x412d00], eax
cmp eax, 1
jne 0x409422
test esi, esi
jne 0x40939b
call edi
mov esi, eax
test esi, esi
je 0x40948f
cmp word [esi], 0
mov eax, esi
je 0x4093b5
add eax, 2
cmp word [eax], 0
jne 0x4093a3
add eax, 2
cmp word [eax], 0
jne 0x4093a3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x409414
push edi
call fcn.0040a9a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x409414
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x409406
push ebx
call fcn.0040aa50
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x40948f
test ebx, ebx
jne 0x409433
call ebp
mov ebx, eax
test ebx, ebx
je 0x40948f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x40944b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40943b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40943b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.0040a9a0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40946d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x401df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push esi
mov esi, eax
xor eax, eax
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp eax, ecx
ja 0x401e1d
jb 0x401e15
cmp esi, edx
jae 0x401e1d
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
jmp 0x401e23
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
ja 0x401e31
cmp dword [ebp - 0x10], eax
jbe 0x401eb8
mov eax, dword [ebx]
or eax, dword [ebx + 4]
jne 0x401e4f
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x16]
mov esi, dword [ebp + 8]
push ecx
call fcn.00401ef0
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx]
cmp esi, eax
jb 0x401e67
ja 0x401e62
cmp edi, dword [ebp - 0x10]
jbe 0x401e67
mov edi, dword [ebp - 0x10]
mov esi, eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
push edx
push edi
lea ecx, [eax + 0x277a800]
push 1
push ecx
call fcn.00419559
add esp, 0x10
xor ecx, ecx
cmp eax, edi
jne 0x401ec1
cmp ecx, esi
jne 0x401ec1
add dword [ebp - 0x18], edi
mov eax, dword [ebp - 0xc]
adc dword [ebp - 0x14], esi
add dword [ebp - 4], edi
sub dword [ebx], edi
sbb dword [ebx + 4], esi
sub dword [ebx + 8], edi
sbb dword [ebx + 0xc], esi
sub dword [ebp - 0x10], edi
sbb eax, esi
mov dword [ebp - 0xc], eax
test eax, eax
ja 0x401e31
jb 0x401eb8
cmp dword [ebp - 0x10], ecx
ja 0x401e31
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push edi
push str.Error_when_trying_to_read__llu_bytes_of_data_in_sparse_read_n
push 0x85b
push str.sparse_read
push 1
call fcn.00401210
add esp, 0x18
push 1
call fcn.004017c0
int3

Function at 0x401ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4353f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xc
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00419559
add esp, 0x10
cmp eax, 0xc
je 0x401f36
push str.Didnt_get_proper_amount_of_bytes_for_chunk_header_n
push 0x8b2
push str.read_chunk_header
push 1
call fcn.00401210
add esp, 0x10
push 1
call fcn.004017c0
movzx edi, di
cmp edi, 0xc
jbe 0x401f4f
push 1
lea ecx, [edi - 0xc]
push 0
push ecx
push esi
call fcn.00418c8a
add esp, 0x10
mov edx, 0xcac3
cmp word [ebp - 0x10], dx
jne 0x401f96
lea ebx, [ebx]
push esi
push 0xc
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00419559
add esp, 0x10
cmp eax, 0xc
jne 0x401fad
cmp edi, eax
jbe 0x401f8b
push 1
lea ecx, [edi - 0xc]
push 0
push ecx
push esi
call fcn.00418c8a
add esp, 0x10
mov edx, 0xcac3
cmp word [ebp - 0x10], dx
je 0x401f60
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp + 8]
xor ecx, ebp
xor edx, edx
call fcn.00417675
mov esp, ebp
pop ebp
ret
push str.Didnt_get_proper_amount_of_bytes_for_chunk_header_n
push 0x8c3
jmp 0x401f20
Function at 0x401fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x1c]
push esi
push edi
push ebx
push 0x1c
lea ecx, [ebp - 0x28]
push 1
push ecx
mov dword [ebp - 4], eax
call fcn.00419559
add esp, 0x10
cmp eax, 0x1c
je 0x402004
push str.Didnt_properly_read_the_sparse_header__n
push 0x880
push str.read_sparse_header
push 1
call fcn.00401210
add esp, 0x10
push 1
call fcn.004017c0
movzx eax, word [ebp - 0x20]
cmp eax, 0x1c
jbe 0x40201e
push 1
add eax, 0xffffffe4
push 0
push eax
push ebx
call fcn.00418c8a
add esp, 0x10
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
push edx
push eax
mov ecx, 7
lea esi, [ebp - 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00418c8a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov di, word [eax + 0xa]
push ecx
mov esi, ebx
call fcn.00401ef0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402a40
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0x4000
call fcn.00418846
mov dword [esi + 0xd50], eax
mov eax, dword [esi + 0x938]
imul eax, dword [esi + 0x914]
add esp, 4
xor ecx, ecx
add eax, dword [esi + 0x948]
push 0
adc ecx, dword [esi + 0x94c]
push ecx
push eax
push edi
call fcn.00418c8a
push edi
push 0x200
lea edx, [esi + 0x950]
push 1
push edx
call fcn.00419559
add esp, 0x20
cmp eax, 0x200
je 0x402ab7
push str.ERROR___couldnt_properly_read_out_the_protective_MBR_n
push 0x9aa
push str.ReadFFUGPT
push 1
call fcn.00401210
add esp, 0x10
push 1
call fcn.004017c0
push edi
push 4
lea eax, [esi + 0xb50]
push 1
push eax
call fcn.00419559
add esp, 0x10
cmp eax, 4
je 0x402adc
push str.ERROR___couldnt_properly_read_out_the_Gpt_Header_n
push 0x9b1
jmp 0x402aa1
mov ecx, dword [esi + 0xd50]
push edi
push 0x4000
push 1
push ecx
call fcn.00419559
add esp, 0x10
cmp eax, 0x4000
je 0x402b06
push str.ERROR___couldnt_properly_read_gpt_entries_n
push 0x9b8
jmp 0x402aa1
pop ecx
ret
Function at 0x40ab60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x100000
jbe 0x40ab7d
mov esi, 0x100000
cmp byte [0x2389cd9], 0
push esi
je 0x40abc8
push str._n_nINTERACTIVE_Press_any_key_to_attempt_to_READ__d_bytes__q_to_quit_interactive_:
call fcn.0041917f
add esp, 8
call fcn.0041a1b2
push 2
push edi
push edi
mov bl, al
call fcn.00418966
push eax
call fcn.00418c8a
add esp, 0x10
cmp bl, 0x71
jne 0x40abb9
mov byte [0x2389cd9], 0
push 0x42e2b8
call fcn.0041917f
add esp, 4
jmp 0x40abe7
mov eax, dword [0x2389cc4]
push eax
push str.CharsInBuffer_d_Trying_to_read_from_USB__ld_bytes
push 0x145e
push str.ReadPort
push 5
call fcn.00401210
add esp, 0x18
xor ebx, ebx
cmp dword [0x436414], ebx
jl 0x40ac6f
jg 0x40abfb
cmp dword [0x436410], ebx
jbe 0x40ac6f
mov edx, dword [ebp + 8]
mov eax, dword [0x2389ca4]
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x40ac1c
add dword [ebp + 8], eax
sub esi, eax
test eax, eax
jne 0x40ac5d
cmp dword [0x436414], eax
jl 0x40ac43
jg 0x40ac38
cmp dword [0x436410], 0x3e8
jbe 0x40ac43
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
adc ebx, 0
cmp ebx, dword [0x436414]
jl 0x40abfb
jg 0x40ac6f
cmp edi, dword [0x436410]
jb 0x40abfb
jmp 0x40ac6f
cmp ebx, dword [0x436414]
jl 0x40ac94
jg 0x40ac6f
cmp edi, dword [0x436410]
jb 0x40ac94
push 0x23f6ee0
push str.Could_not_read_from__s__Windows_API_ReadFile_failed__Your_device_is_probably_not_on_this_port_n_n
push 0x1498
push str.ReadPort
push 1
call fcn.00401210
add esp, 0x14
push 1
call fcn.004017c0
push eax
push str.CHANNEL_DATA___ld_bytes______TARGET_to_HOST
push 0x149c
push str.ReadPort
push 5
call fcn.00401210
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415ca0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4353f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x2389ce2], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x415d07
lea eax, [ebp - 0x40]
push eax
push 0x23f76e0
call fcn.004183fc
add esp, 8
test eax, eax
jne 0x415d07
push 0x23f76e0
push str._s_already_exists_and___forceoverwrite_not_set._Leaving_file_as_is.
push 0x2aed
push str.MyCopyFile
push 4
call fcn.00401210
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417675
mov esp, ebp
pop ebp
ret
push 0x800
mov edx, 0x42d888
mov ecx, esi
call fcn.00410ed0
add esp, 4
mov esi, eax
push 0x800
mov edx, 0x42c9e4
mov ecx, 0x23f76e0
mov dword [ebp - 0x48], esi
call fcn.00410ed0
add esp, 4
push str._BEGIN_COPY
mov dword [ebp - 0x44], eax
call fcn.0041917f
add esp, 4
push esi
push 0x100000
push 1
push 0x253a740
xor ebx, ebx
call fcn.00419559
push 0x42d9a0
mov esi, eax
xor edi, edi
call fcn.0041917f
mov ecx, esi
add esp, 0x14
or ecx, edi
je 0x415dc0
mov edx, dword [ebp - 0x44]
push edx
push esi
push 1
push 0x253a740
call fcn.004197d9
mov ebx, eax
add esp, 0x10
xor eax, eax
cmp ebx, esi
jne 0x415dc0
cmp eax, edi
jne 0x415dc0
mov eax, dword [ebp - 0x48]
push eax
push 0x100000
push 1
push 0x253a740
xor ebx, ebx
call fcn.00419559
push 0x42d9a0
mov esi, eax
xor edi, edi
call fcn.0041917f
mov ecx, esi
add esp, 0x14
or ecx, edi
jne 0x415d72
mov edx, dword [ebp - 0x48]
push edx
call fcn.00419df4
mov eax, dword [ebp - 0x44]
add esp, 4
push eax
call fcn.00419df4
add esp, 4
cmp ebx, esi
jne 0x415de2
xor eax, eax
cmp eax, edi
je 0x415df6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417675
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00417675
mov esp, ebp
pop ebp
ret
Function at 0x417350
Capabilities:
Hash data using sha256

Disassembly:
test ebx, ebx
je 0x417384
push esi
push edi
push 0x8c
push 0
push ebx
call fcn.0041c990
add esp, 0xc
lea edi, [ebx + 8]
mov ecx, 8
mov esi, 0x42af98
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop esi
ret

Function at 0x417675
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4353f4]
jne 0x41767f
repz ret
jmp fcn.0041a34b

Function at 0x41c7b5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41c7dc
call fcn.00419011
mov dword [eax], esi
call fcn.00418ffe
push 0x16
pop esi
mov dword [eax], esi
call fcn.0041b095
mov eax, esi
jmp 0x41c831
test dword [ebp + 0xc], 0xfffffff9
jne 0x41c7c2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c809
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00419024
pop ecx
call fcn.00418ffe
mov eax, dword [eax]
jmp 0x41c831
test al, 0x10
jne 0x41c82f
test al, 1
je 0x41c82f
test byte [ebp + 0xc], 2
je 0x41c82f
call fcn.00419011
mov dword [eax], 5
call fcn.00418ffe
mov dword [eax], 0xd
jmp 0x41c800
xor eax, eax
pop esi
pop ebp
ret
Function at 0x424474
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4353f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041bcbc
and dword [ebp - 0x14], 0
cmp dword [0x44838c], 0
mov dword [ebp - 0x18], eax
jne 0x424527
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4245cf
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4245cf
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44838c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x448390], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x448394], eax
call edi
push eax
call esi
mov dword [0x44839c], eax
test eax, eax
je 0x424527
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x448398], eax
mov eax, dword [0x448398]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x424580
cmp dword [0x44839c], ecx
je 0x424580
push eax
call esi
push dword [0x44839c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x424580
test ebx, ebx
je 0x424580
call edi
test eax, eax
je 0x424577
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x424577
test byte [ebp - 8], 1
jne 0x424580
or dword [ebp + 0x10], 0x200000
jmp 0x4245b3
mov eax, dword [0x448390]
cmp eax, dword [ebp - 0x18]
je 0x4245b3
push eax
call esi
test eax, eax
je 0x4245b3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4245b3
mov eax, dword [0x448394]
cmp eax, dword [ebp - 0x18]
je 0x4245b3
push eax
call esi
test eax, eax
je 0x4245b3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44838c]
call esi
test eax, eax
je 0x4245cf
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4245d1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417675
leave
ret
Function at 0x401172
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4034cb
mov ecx, dword [esp + 8]
xor eax, eax
mov edx, ecx
dec ecx
test edx, edx
je 0x403503
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
movzx edx, ax
shr edx, 8
xor edx, edi
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x4148bc]
xor ax, bx
inc ecx
dec esi
jne 0x4034e2
pop edi
pop esi
pop ebx
ret
Function at 0x402089
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020c8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020c8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020c8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020c8
cmp dword [ecx + 0x74], 0xe
jbe 0x4020c8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407f86
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415618
push 0x415610
push str.FlsAlloc
push 0x1f
call fcn.00407e45
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407fba
push dword [ebp + 8]
mov ecx, esi
call dword [0x414138]
call esi
jmp 0x407fc0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408004
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415628
push 0x415620
push str.FlsGetValue
push 0x21
call fcn.00407e45
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40803b
push dword [ebp + 8]
mov ecx, esi
call dword [0x414138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408043
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415630
push 0x415628
push str.FlsSetValue
push 0x22
call fcn.00407e45
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40807d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414138]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b5ca
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b667
push ebx
push esi
call fcn.0040b593
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b527
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b614
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b666
push edi
push eax
call fcn.00408735
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b634
call fcn.00407cd8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b665
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b527
add esp, 0x20
test eax, eax
jne 0x40b653
push edi
call fcn.00407cd8
jmp 0x40b65b
push ebx
call fcn.00407cd8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41374d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41374d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 4]
push eax
push 0x1002fba8
push 0
push 2
push str.AiLdaAmdHwId
push str.SOFTWAREAMDEEU
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], pe_nt_image_headers32
mov dword [ebp - 4], 0x200
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 8], 0x200
call esi
test eax, eax
jne 0x10001562
mov ecx, 0x1002e250
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001487
sub ecx, edx
lea eax, [ebp - 4]
push eax
sar ecx, 1
lea eax, [ecx*2 + 0x1002e250]
push eax
push 0
push 2
push str.AiLdaAmdSequenceNumber
push str.SOFTWAREAMDEEU
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10001562
lea eax, [ebp - 0xc]
push eax
push 0x1002faa8
push 0
push 2
push str.DriverDesc
push 0x1002e250
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10001562
lea eax, [ebp - 8]
push eax
push 0x1002fea8
push 0
push 2
push str.AiLdaIntelHwId
push str.SOFTWAREAMDEEU
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10001562
mov ecx, str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE10318_
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001510
sub ecx, edx
lea eax, [ebp - 8]
push eax
sar ecx, 1
lea eax, [ecx*2 + str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE10318_]
push eax
push 0
push 2
push str.AiLdaIntelSequenceNumber
push str.SOFTWAREAMDEEU
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10001562
lea eax, [ebp - 0x10]
push eax
push 0x1002fda8
push 0
push 2
push str.DriverDesc
push str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE10318_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001580
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100015c6
call fcn.10001260
mov dword [0x1002fa84], eax
test eax, eax
je 0x100015dd
call fcn.10001430
test eax, eax
jne 0x100015b6
push eax
push eax
push eax
push 0x10001020
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x100015d8
mov dword [0x1002fa84], 0
xor eax, eax
pop ebp
ret 0xc
test eax, eax
jne 0x100015d8
mov eax, dword [0x1002fa84]
test eax, eax
je 0x100015dd
call fcn.10001180
mov eax, dword [0x1002fa84]
pop ebp
ret 0xc