joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4311c5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00431141
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x431334
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x431334
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4312e9
jg 0x431221
test eax, eax
je 0x4312df
push 1
push 0x1000
call fcn.00424c02
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x431244
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4312d6
push 0x8000
push ebx
call fcn.00421418
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x43126d
jg 0x431268
cmp ecx, 0x1000
jb 0x43126d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0042693a
add esp, 0x10
cmp eax, 0xffffffff
je 0x4312b2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x431268
jl 0x431299
test ecx, ecx
jne 0x43125a
push dword [ebp - 0xc]
push ebx
call fcn.00421418
push esi
call fcn.00424c5f
add esp, 0xc
xor ebx, ebx
jmp 0x431342
cmp byte [edi + 0x24], 0
je 0x4312c9
cmp dword [edi + 0x20], 5
jne 0x4312c9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4312d4
mov ebx, dword [edi + 0x18]
jmp 0x4312d6
xor ebx, ebx
push esi
call fcn.00424c5f
pop ecx
jmp 0x431342
test ecx, ecx
jg 0x4312ab
jl 0x4312e9
test eax, eax
jae 0x4312ab
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004280b4
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x431309
cmp byte [edi + 0x1c], 0
je 0x4312ab
jmp 0x43133a
push ebx
call fcn.0042b308
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4312ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x431342
cmp byte [edi + 0x1c], 0
je 0x43133f
mov ebx, dword [edi + 0x18]
jmp 0x431342
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004280b4
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43277d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43277d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ecc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401f0b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401f0b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f0b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401f0b
cmp dword [ecx + 0x74], 0xe
jbe 0x401f0b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40cc20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40cc4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40cc4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401507
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
jmp 0x401379
or edi, 0x2530
pop edi
push eax
push edi
add esp, 4
and eax, 0x1572b
or eax, 0x471e
call 0x40139f
add byte [ecx], bh
dec esp
aas
inc ebx
aas
inc edi
inc ebx
dec edi
add esp, 4
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
push esi
add esp, 4
add edi, 0x6218
pop edi
push eax
push esi
add esp, 4
and eax, 0x113c2
add eax, 0xe793
and eax, 0x1288e
or eax, 0xa207
pop eax
push edi
and edi, 0x1717
pop ss
add byte [eax], al
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
or edi, 0x114e6
add edi, 0x498
or edi, 0x763c
pop edi
push ecx
push ebx
add esp, 4
call 0x4014e7
add byte [ecx], bh
inc ebp
xor al, 0x35
xor eax, 0x833e3e39
les eax, [ecx + eax*4]
leave
insb byte es:[edi], dx
mov es, word [eax]
add byte [ecx - 0x39], bl
inc ebp
lock add dword [eax], eax
add byte [eax], al
push ecx
call 0x401507
add byte [edx + esi + 0x45], al
dec esi
xor eax, 0x8339373e
les eax, [ebx + ebp*8]
add eax, 0x3c453a32
inc edx
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x51ce
pop ebx
push esi
push ecx
add esp, 4
sub esi, 0xc553
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
or ecx, 0xe612
or ecx, 0x7efa
and ecx, 0x140f6
pop ecx
push edi
push eax
add esp, 4
jmp 0x401574
sub edi, 0x4016
sub edi, 0xca82

Function at 0x4015b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xchg edi, eax
add byte [eax], al
mov eax, dword [eax]
add byte [ecx + 0x1a5eb], al
add byte [ebx - 0x39], bl
inc ebp
aam 1
add byte [eax], al
add byte [edx - 0x7f], dl
loop 0x4015aa
xor byte [ecx], al
add byte [edx + 0x51], bl

Function at 0x4017e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x1528], edx
push ecx
push esi
add esp, 4
jmp 0x4017fa
or ecx, 0x2bef
jmp 0x401805
pop ecx
push edx
push edi
add esp, 4
and edx, 0x11979
sub edx, 0x17c77
or edx, 0x637e
pop edx
push edi
push edi
Function at 0x404d26
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
add esp, 4
pop ecx
push esi
and esi, 0x8c77
xor esi, 0x72a8
sub esi, 0x397b
or esi, 0xfa93
pop esi
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x404e86
cmp dword [ebp - 0x14c4], 0
jne 0x404ecf
push eax
add eax, 0xb8b5
or eax, 0xb462
xor eax, 0x5f8e
pop eax
push ebx
push esi
add esp, 4
add ebx, 0x3034
pop ebx
push edi
push ebx
add esp, 4
and edi, 0xf4cf
add edi, 0x12ee1
pop edi
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x404f10
jmp 0x404c1d

Function at 0x404dc5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x404dd8
add byte [esi + 0x39], cl
inc ebp
push eax
dec ebx
cmp esi, dword [edx]
inc esp
inc ebx
inc ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404dfe
mov dword [ebp - 0x14c0], 1
jmp 0x404e08
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404e7a
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx

Function at 0x404dd8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x404dd8
add byte [esi + 0x39], cl
inc ebp
push eax
dec ebx
cmp esi, dword [edx]
inc esp
inc ebx
inc ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404dfe
mov dword [ebp - 0x14c0], 1
jmp 0x404e08
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404e7a
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx

Function at 0x404e44
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x404e44
add byte [eax + edx*2 + 0x4c], cl
inc edi
dec edx
inc ebx
aaa
cmp eax, dword [ebx - 0x74a6fb3c]
xchg ebp, eax
clc
invalid
Function at 0x405792
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4057a1
add byte [ecx + 0x48], al
dec edi
xor al, 0x3e
cmp al, 0x83
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x4057d1
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x405587
mov dword [ebp - 0x2e0], 0

Function at 0x4057a1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4057a1
add byte [ecx + 0x48], al
dec edi
xor al, 0x3e
cmp al, 0x83
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x4057d1
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x405587
mov dword [ebp - 0x2e0], 0
Function at 0x405fce
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
add esp, 4
xor ecx, 0x1139d
and ecx, 0xf4eb
pop ecx
push esi
and esi, 0xcfca
out 0xca, al
iretd
add byte [eax], al
pop esi
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x406019
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x406023
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x40603a
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x40604b
jmp 0x405e24
Function at 0x4401f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4615d4]
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x44020b
push eax
call esi
test eax, eax
jne 0x440221
call fcn.00440910
mov eax, dword [0x4615d4]
cmp eax, 0xffffffff
jne 0x44021e
xor eax, eax
jmp 0x440221
push eax
call esi
lea esi, [eax + 0x10]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0043f650
push dword [eax + 4]
mov ecx, esi
push dword [eax]
lea eax, [esp + 0xc]
push eax
call fcn.0043fec0
pop esi
add esp, 8
ret

Function at 0x440910
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447b10
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0043e3f0
mov esi, eax
push 0x43fe40
push 0x463060
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call fcn.0043faa0
mov eax, dword [0x4615d4]
add esp, 8
cmp eax, 0xffffffff
je 0x440970
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4410a0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x447bc8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x4615d4]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edi
cmp eax, 0xffffffff
je 0x441151
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441151
lea esi, [eax + 0x10]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00440250
mov eax, dword [esp + 0x10]
cmp eax, dword [esi]
je 0x441151
lea esi, [eax + 0x14]
test esi, esi
je 0x441151
cmp byte [esp + 0x34], 0
je 0x441126
mov ecx, dword [esi]
test ecx, ecx
je 0x441126
mov edx, dword [esi + 8]
test edx, edx
je 0x441126
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esp + 0x28], 0
mov ebx, dword [esp + 0x30]
jne 0x441140
test ebx, ebx
jne 0x441140
push edi
call fcn.004401f0
add esp, 4
jmp 0x44118d
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.0043f2c0
mov dword [esi + 8], ebx
jmp 0x44118d
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
test edx, edx
jne 0x441161
test eax, eax
je 0x44118d
push eax
sub esp, 8
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [esp + 0x38]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x38]
test eax, eax
je 0x441184
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
push edi
call fcn.0043f8f0
add esp, 0x10
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x4411c3
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x4411c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x4411c3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x442590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447e58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x45f01c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 1
push 0
sub esp, 8
mov eax, esp
push esi
mov dword [eax], 0
mov dword [esp + 0x30], 0
mov dword [eax + 4], 0
call fcn.004410a0
mov esi, dword [esi + 4]
add esp, 0x14
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x442617
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
jne 0x442617
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x442617
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474008]
jne 0x401010
repz ret
jmp fcn.00401916

Function at 0x40510a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004038c7
and dword [ebp - 4], 0
cmp dword [0x475d70], 0
mov ebx, eax
jne 0x4051bb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40526c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40526c
push eax
call fcn.00403855
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x475d70], eax
call esi
push eax
call fcn.00403855
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x475d74], eax
call esi
push eax
call fcn.00403855
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x475d78], eax
call esi
push eax
call fcn.00403855
pop ecx
mov dword [0x475d80], eax
test eax, eax
je 0x4051bb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403855
pop ecx
mov dword [0x475d7c], eax
mov eax, dword [0x475d7c]
cmp eax, ebx
je 0x405213
cmp dword [0x475d80], ebx
je 0x405213
push eax
call fcn.004038d0
push dword [0x475d80]
mov esi, eax
call fcn.004038d0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405213
test edi, edi
je 0x405213
call esi
test eax, eax
je 0x40520a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40520a
test byte [ebp - 0xc], 1
jne 0x405213
or dword [ebp + 0x10], 0x200000
jmp 0x40524c
mov eax, dword [0x475d74]
cmp eax, ebx
je 0x40524c
push eax
call fcn.004038d0
pop ecx
test eax, eax
je 0x40524c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40524c
mov eax, dword [0x475d78]
cmp eax, ebx
je 0x40524c
push eax
call fcn.004038d0
pop ecx
test eax, eax
je 0x40524c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x475d70]
call fcn.004038d0
pop ecx
test eax, eax
je 0x40526c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40526e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x470650
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x474008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x2ab099c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x2ab07e0], eax
jne 0x470691
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401006
add esp, 0x404
ret
Function at 0x4706c0
Capabilities:
Get hostname

Disassembly:
sub esp, 0xc14
mov eax, dword [0x474008]
xor eax, esp
mov dword [esp + 0xc10], eax
push esi
xor esi, esi
cmp dword [esp + 0xc1c], esi
mov dword [esp + 8], edx
jle 0x47079f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
mov edi, dword [esp + 0x14]
jmp 0x470700
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 5
mov dword [esp + 0x18], 0
call fcn.004706b0
mov eax, dword [esp + 0x18]
add eax, 0x46
mov dword [esp + 0x10], eax
nop
sub dword [esp + 0x10], 0x46
mov al, byte [esp + 0x10]
xor byte [edx + esi], al
cmp dword [esp + 0xc28], 0xf
jne 0x47078e
push 0
push 0
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.pujujahapoxewib
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea eax, [esp + 0x424]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push edi
push str.gedopeyepamomucegaderifuzupunej
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edx, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0xc28]
jl 0x470700
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc1c], 0x2d
pop esi
jne 0x4707be
mov dword [0x2ab0ad0], 0xa62e7790
mov dword [0x2ab0ad4], 0xffffffff
mov ecx, dword [esp + 0xc10]
xor ecx, esp
call fcn.00401006
add esp, 0xc14
ret

Function at 0x4707e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc04
mov eax, dword [0x474008]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x474fe0]
push esi
mov esi, dword [0x2ab099c]
push edi
mov edi, dword [0x2ab07e4]
push eax
call fcn.00470650
add esp, 4
cmp dword [0x2ab099c], 0x2f
jne 0x47081f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
mov edx, edi
call fcn.004706c0
add esp, 4
cmp dword [0x2ab099c], 0x568
pop edi
pop esi
jne 0x470859
push 0
push 0
lea ecx, [esp + 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.00401006
add esp, 0xc04
ret
Function at 0x40d035
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x422680]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x4100d0]
mov ecx, dword [0x422688]
mov dword [0x422680], eax
movzx eax, al
add eax, dword [0x422684]
imul eax, eax, 0x8088405
inc eax
mov dword [0x422684], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x4100d0]
mov eax, dword [esp + 4]
mov dword [0x422688], ecx
ret 4

Function at 0x40d0c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040d08f
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004094eb
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040d015
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040d035
inc esi
cmp esi, 0xc
jl 0x40d0e7
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x411548]
test byte [eax + 0x28], 2
movzx eax, byte [0x4215b7]
jne 0x40d122
movzx eax, byte [0x4215bf]
movzx ecx, cx
cmp ecx, eax
je 0x40d12e
or eax, 0xffffffff
jmp 0x40d173
mov ecx, dword [0x421560]
mov eax, ecx
cdq
cmp edx, dword [0x410924]
push edi
jl 0x40d150
mov edx, dword [0x410920]
jg 0x40d14c
cmp eax, edx
jbe 0x40d150
mov edi, edx
jmp 0x40d152
mov edi, ecx
mov esi, dword [0x421558]
jmp 0x40d16c
dec edi
call fcn.0040d015
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040d035
inc esi
test edi, edi
jne 0x40d15a
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x40da77
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x10051066
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3eae2a42
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219