joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489a9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, esi
xor dword [eax], 0x41dfac36
inc ebx
add eax, 4
cmp ebx, 4
jb 0x489aaa
mov edx, edi
mov eax, dword [esi + 0x10]
shl edx, 3
add dword [esi + 0x10], edx
shr eax, 3
mov ecx, dword [esi + 0x10]
and eax, 0x3f
cmp ecx, edx
jae 0x489ad4
inc dword [esi + 0x14]
mov edx, edi
mov ebx, 0x40
shr edx, 0x1d
sub ebx, eax
add dword [esi + 0x14], edx
cmp ebx, edi
ja 0x489b25
push ebx
add eax, esi
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.0048a727
add esp, 0xc
lea eax, [esi + 0x18]
push eax
push esi
call fcn.00489bbd
add esp, 8
jmp 0x489b1a
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push esi
call fcn.00489bbd
add esp, 8
add ebx, 0x40
lea ecx, [ebx + 0x3f]
cmp edi, ecx
ja 0x489b08
xor eax, eax
jmp 0x489b27
xor ebx, ebx
sub edi, ebx
add esi, eax
push edi
mov edx, dword [ebp + 0xc]
add edx, ebx
add esi, 0x18
push edx
push esi
call fcn.0048a727
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48a76a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x52
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0x43
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0x36
mov eax, dword [ebp + 0xc]
mov byte [eax + 3], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], 0xb8
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [0x4ad898]
mov dword [eax + 8], edx
mov ecx, dword [ebp + 0xc]
xor dword [ecx + 8], 0x339effab
mov ebx, 1
mov eax, dword [ebp + 0xc]
add eax, 8
mov edx, dword [eax]
inc ebx
mov dword [eax + 4], edx
mov ecx, dword [0x4ad89c]
xor ecx, 0x339effab
add dword [eax + 4], ecx
add eax, 4
cmp ebx, 0x2b
jle 0x48a7c6
xor eax, eax
mov edi, eax
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
cmp dword [ebp - 8], 0x2c
jle 0x48a7fb
mov eax, dword [ebp - 8]
jmp 0x48a800
mov eax, 0x2c
lea edx, [eax + eax*2]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jg 0x48a87a
push 3
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ebx*4 + 8]
add esi, edi
push esi
call fcn.0048aadd
mov edx, dword [ebp + 0xc]
mov esi, eax
add esp, 8
mov dword [edx + ebx*4 + 8], eax
lea edx, [edi + esi]
push edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
add edx, esi
add edi, edx
push edi
call fcn.0048aadd
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edi, eax
add esp, 8
mov dword [ecx + edx*4], eax
lea eax, [ebx + 1]
cdq
mov ecx, 0x2c
idiv ecx
mov eax, dword [ebp - 0xc]
mov ebx, edx
inc eax
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jle 0x48a815
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a9ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0x10], 0xf
je 0x48a9c7
mov eax, 1
jmp 0x48aad6
cmp dword [ebp + 0x10], 0
je 0x48aad4
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
add dword [ebp + 0xc], 4
sub dword [ebp + 0x10], 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
sub edi, dword [ecx + 0xb4]
sub ebx, dword [eax + 0xb0]
mov dword [ebp - 0x10], 0x14
mov edx, dword [ebp + 8]
lea ecx, [edx + 0xac]
mov dword [ebp - 0x14], ecx
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov edi, esi
mov esi, eax
push 5
mov eax, dword [ebp - 0xc]
add eax, eax
inc eax
imul dword [ebp - 0xc]
push eax
call fcn.0048aadd
mov edx, esi
add esp, 8
add edx, edx
mov dword [ebp - 8], eax
inc edx
push 5
imul edx, esi
push edx
call fcn.0048aadd
add esp, 8
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
sub edi, dword [ecx]
push edi
call fcn.0048ab00
add esp, 8
xor eax, dword [ebp - 8]
mov edi, eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x14]
sub ebx, dword [eax - 4]
push ebx
call fcn.0048ab00
xor eax, dword [ebp - 4]
dec dword [ebp - 0x10]
add dword [ebp - 0x14], 0xfffffff8
add esp, 8
mov ebx, eax
cmp dword [ebp - 0x10], 0
jg 0x48aa21
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
sub dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
sub esi, dword [eax + 8]
mov dword [edx], ebx
add dword [ebp + 0x14], 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], esi
add dword [ebp + 0x14], 4
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
add dword [ebp + 0x14], 4
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
add dword [ebp + 0x14], 4
cmp dword [ebp + 0x10], 0
jne 0x48a9d1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov byte [esp], 0x4f
mov byte [esp + 2], 0x4c
mov byte [esp + 4], 0x44
mov byte [esp + 6], 0x47
mov byte [esp + 8], 0x45
mov byte [esp + 0xa], 0x45
mov byte [esp + 1], 0x4c
mov byte [esp + 3], 0x59
mov byte [esp + 5], 0x42
mov byte [esp + 7], 0x2e
mov byte [esp + 9], 0x58
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xe], 0x50
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x12], 0x53
mov byte [esp + 0x14], 0x45
mov byte [esp + 0x16], 0x45
mov byte [esp + 0xd], 0x45
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x11], 0x44
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x15], 0x58
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x1a], 0x32
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x20], 0x45
mov byte [esp + 0x22], 0x45
mov byte [esp + 0x19], 0x33
mov byte [esp + 0x1b], 0x44
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x21], 0x58
mov byte [esp + 0x23], 0
push 0
push 2
call fcn.004862ce
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48f687
xor eax, eax
jmp 0x48f79f
mov dword [esp + 0x24], 0x128
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.0048637c
add esp, 8
test eax, eax
jne 0x48f6af
push ebx
call fcn.0048605b
pop ecx
xor eax, eax
jmp 0x48f79f
call fcn.004861be
cmp eax, dword [esp + 0x2c]
jne 0x48f6be
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00486402
add esp, 8
test eax, eax
jne 0x48f6af
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.0048637c
add esp, 8
test eax, eax
jne 0x48f6f0
push ebx
call fcn.0048605b
pop ecx
xor eax, eax
jmp 0x48f79f
cmp esi, dword [esp + 0x2c]
jne 0x48f77d
lea edx, [esp + 0x48]
push edx
call fcn.00485a0d
pop ecx
lea ecx, [esp + 0x48]
push ecx
call fcn.004859ea
pop ecx
push esp
call fcn.00485a0d
pop ecx
lea eax, [esp + 0xc]
push eax
call fcn.00485a0d
pop ecx
lea edx, [esp + 0x18]
push edx
call fcn.00485a0d
pop ecx
push 0xc
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x50]
push eax
call fcn.004859a1
add esp, 0xc
mov edi, eax
push 0xc
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.004859a1
add esp, 0xc
mov ebp, eax
push 0xd
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.004859a1
add esp, 0xc
test edi, edi
je 0x48f779
test ebp, ebp
je 0x48f779
test eax, eax
jne 0x48f77d
xor eax, eax
jmp 0x48f79f
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00486402
add esp, 8
test eax, eax
jne 0x48f6f0
push ebx
call fcn.0048605b
pop ecx
mov eax, 1
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48f8cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x48f8e4
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x48f8f8
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret
Function at 0x496376
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff18
push ebx
push esi
cmp dword [ebp + 0xc], 0x40
jle 0x4963cf
lea eax, [ebp - 0xe8]
push eax
call fcn.00489a6f
pop ecx
lea edx, [ebp - 0xe8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call fcn.00489a9a
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
lea eax, [ebp - 0x90]
push eax
call fcn.00489b43
add esp, 8
lea edx, [ebp - 0x90]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], 0x10
xor eax, eax
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x80]
xor ebx, ebx
mov byte [edx], bl
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x4963d7
xor eax, eax
lea esi, [ebp - 0x40]
lea ecx, [ebp - 0x80]
mov edx, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jge 0x496404
mov bl, byte [edx]
mov byte [ecx], bl
mov byte [esi], bl
inc eax
inc esi
inc ecx
inc edx
cmp eax, dword [ebp + 0xc]
jl 0x4963f5
xor eax, eax
lea ecx, [ebp - 0x80]
lea edx, [ebp - 0x40]
jmp 0x49640f
xor byte [edx], 0x36
xor byte [ecx], 0x5c
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x49640c
lea eax, [ebp - 0xe8]
push eax
call fcn.00489a6f
pop ecx
push 0x40
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.00489a9a
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, edx
lea edx, [ebp - 0xe8]
xor eax, eax
jmp 0x49644f
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x49644c
lea eax, [ebp - 0xe8]
push eax
call fcn.00489a6f
pop ecx
push 0x40
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.00489a9a
mov edx, dword [ebp + 0x10]
add esp, 0xc
xor eax, eax
lea ecx, [edx + 0x10]
lea edx, [ebp - 0xe8]
jmp 0x496492
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x49648f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x497390
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x497464
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xa50]
test eax, eax
je 0x4973bf
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
lea eax, [ebx + 0x874]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x49742b
xor eax, eax
push ebp
push 0x497415
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0xa50], esi
inc esi
jne 0x49740b
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.00497834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497439
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00497834
mov eax, dword [ebp - 4]
mov dword [ebx + 0x840], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49746b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404634
ret
Function at 0x497674
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7fc
mov esi, edx
mov ebx, eax
xor edi, edi
jmp 0x4976f6
test edi, edi
jle 0x4976a1
mov ecx, 0x4977f0
mov dl, 1
mov eax, dword [0x407af4]
call fcn.0040ab84
call fcn.00404070
jmp 0x4976f6
cmp word [ebx + 0xa42], 0
jne 0x4976c3
mov ecx, 0x4977f0
mov dl, 1
mov eax, dword [0x407af4]
call fcn.0040ab84
call fcn.00404070
jmp 0x4976f6
mov byte [esp], 0
mov edx, esp
mov ecx, esi
mov eax, dword [ebx + 0xa44]
call dword [ebx + 0xa40]
cmp byte [esp], 0
jne 0x4976f5
mov ecx, 0x4977f0
mov dl, 1
mov eax, dword [0x407af4]
call fcn.0040ab84
call fcn.00404070
jmp 0x4976f6
inc edi
mov eax, esi
call fcn.00416a88
cmp edx, 0
jne 0x497705
cmp eax, 0
je 0x497685
mov byte [ebx + 0x870], 0
mov eax, ebx
call fcn.00497500
cmp dword [ebx + 0x848], 0
jne 0x497738
mov ecx, 0x497808
mov dl, 1
mov eax, dword [0x496e08]
call fcn.0040ab84
call fcn.00404070
mov ecx, 0x497824
mov dl, 2
mov eax, ebx
call fcn.004979f8
mov word [ebx + 0x844], 2
mov ax, word [ebx + 0x83c]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x846], ax
mov edi, 0x10
push 0
push 0
mov eax, esi
call fcn.00416a74
mov eax, esi
call fcn.00416a88
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x497788
call fcn.004037e4
mov ecx, eax
lea edx, [esp + 1]
mov eax, esi
call fcn.00416c80
push edi
lea eax, [ebx + 0x844]
push eax
push 0
mov eax, esi
call fcn.00416a88
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4977b4
call fcn.004037e4
push eax
lea eax, [esp + 0x11]
push eax
mov eax, dword [ebx + 0xa50]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0xa32], 0
je 0x4977de
mov edx, ebx
mov eax, dword [ebx + 0xa34]
call dword [ebx + 0xa30]
add esp, 0x804
pop edi
pop esi
pop ebx
ret

Function at 0x497ab8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x497b8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x800
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0xa50]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x834], eax
cmp word [ebx + 0xa2a], 0
je 0x497b76
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x497ba0
call fcn.004098d4
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x834]
mov edx, ebx
mov eax, dword [ebx + 0xa2c]
call dword [ebx + 0xa28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497b93
lea eax, [ebp - 8]
call fcn.00404610
ret
Function at 0x498c60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004988c4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404ac0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x498cbe
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b11e8]
mov dl, 1
mov eax, dword [0x4987bc]
call fcn.0040ac7c
call fcn.00404070
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x498cc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404ac0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x498d20
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b1410]
mov dl, 1
mov eax, dword [0x4987bc]
call fcn.0040ac7c
call fcn.00404070
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004988f4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5154
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar
Shutdown system

Disassembly:
push 5
push 0
push 0x4a5188
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 5
push 0
push 0x4a5190
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 1
call sub.user32.dll_ExitWindowsEx
ret
Function at 0x4054f0
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.00410c10
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x445c48], 0x594
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x405534
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov eax, dword [0x43b508]
mov dword [ebp - 0x24], eax
mov eax, dword [0x43b50c]
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.004054e9
mov eax, dword [0x43b510]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x43b514]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
shl eax, 4
cmp dword [0x445c48], 0xc
mov dword [ebp - 4], eax
jne 0x4055d2
lea eax, [ebp - 0x834]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1034]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x445c48]
cmp eax, 0xfa9
jne 0x4055ee
mov dword [0x4451e4], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4055fb
mov dword [0x444b90], esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
lea eax, [ebx + edx]
shr edx, cl
mov dword [ebp - 0x14], eax
mov dword [0x4451e0], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x445c48], 0x213
mov dword [ebp - 0x14], edx
jne 0x405635
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.004054e3
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, edx
shr eax, cl
lea edi, [ebx + edx]
add ebx, 0x61c88647
add eax, dword [ebp - 0x2c]
xor eax, edi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
dec dword [ebp - 0x18]
jne 0x405570
cmp dword [0x445c48], 0xa6d
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov dword [edi], eax
pop ebx
jne 0x40569e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], edx
pop edi
pop esi
leave
ret 4
Function at 0x405a12
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x445c48], 0x400
push edi
jne 0x405a79
push esi
push esi
call fcn.00405f45
push esi
push esi
call fcn.00405f45
push esi
push esi
call fcn.004061a8
push esi
push esi
push esi
call fcn.004065c9
add esp, 0x20
mov dword [esp], esi
call fcn.00405467
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405444
fstp st(0)
push esi
call fcn.0040667f
pop ecx
push esi
push esi
call fcn.00405e39
pop ecx
pop ecx
mov eax, dword [0x43bb94]
mov dword [0x445c48], eax
mov eax, dword [0x43bb6c]
mov dword [0x445c4c], eax
call fcn.0040573c
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x405ae0
cmp dword [esp + 0x18], 0x785074d5
jne 0x405aee
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x405a9b
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x4051bc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
lea eax, [esp + 0x14]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
cmp edi, ebx
jle 0x405b1f
cmp dword [esp + 0x18], 0x785074d5
jne 0x405b28
inc edi
cmp edi, 0x11915
jl 0x405af0
mov eax, dword [0x444b98]
mov dword [0x4451dc], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406ff0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a118]
jne 0x406ffa
repz ret
jmp fcn.0040b632
Function at 0x40b355
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004090bd
and dword [ebp - 4], 0
cmp dword [0x43c440], 0
mov ebx, eax
jne 0x40b406
push 0x4025c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b4b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4025b4
push edi
call esi
test eax, eax
je 0x40b4b7
push eax
call fcn.0040904b
mov dword [esp], 0x4025a4
push edi
mov dword [0x43c440], eax
call esi
push eax
call fcn.0040904b
mov dword [esp], 0x402590
push edi
mov dword [0x43c444], eax
call esi
push eax
call fcn.0040904b
mov dword [esp], 0x402574
push edi
mov dword [0x43c448], eax
call esi
push eax
call fcn.0040904b
pop ecx
mov dword [0x43c450], eax
test eax, eax
je 0x40b406
push 0x40255c
push edi
call esi
push eax
call fcn.0040904b
pop ecx
mov dword [0x43c44c], eax
mov eax, dword [0x43c44c]
cmp eax, ebx
je 0x40b45e
cmp dword [0x43c450], ebx
je 0x40b45e
push eax
call fcn.004090c6
push dword [0x43c450]
mov esi, eax
call fcn.004090c6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b45e
test edi, edi
je 0x40b45e
call esi
test eax, eax
je 0x40b455
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b455
test byte [ebp - 0xc], 1
jne 0x40b45e
or dword [ebp + 0x10], 0x200000
jmp 0x40b497
mov eax, dword [0x43c444]
cmp eax, ebx
je 0x40b497
push eax
call fcn.004090c6
pop ecx
test eax, eax
je 0x40b497
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b497
mov eax, dword [0x43c448]
cmp eax, ebx
je 0x40b497
push eax
call fcn.004090c6
pop ecx
test eax, eax
je 0x40b497
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43c440]
call fcn.004090c6
pop ecx
test eax, eax
je 0x40b4b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b4b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret