joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc63
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x34]
mov dword [ebp - 0x38], 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 3
mov ecx, dword [ebp - 0x2c]
pop eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push 0x4000000
push 0x30363165
mov dword [ebp - 0x14], esi
call fcn.0040c831
add esp, 0x14
push esi
push 0x202
call fcn.0040d6a2
push dword [ebp - 0x2c]
push 0x203
call fcn.0040d6a2
pop edi
pop esi
leave
ret 4

Function at 0x40ca03
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x46
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
mov dword [ebp - 0x11c], ebx
push 0x412f80
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 8]
push 1
pop esi
mov dword [0x412f98], eax
push esi
call fcn.0040b800
cmp eax, ebx
mov dword [0x412fa4], eax
je 0x40ca5a
push 4
call fcn.0040b800
test eax, eax
mov dword [0x412fa8], esi
je 0x40ca60
mov dword [0x412fa8], ebx
cmp dword [0x412fa4], ebx
mov dword [ebp - 0x11c], 0x11c
je 0x40caa2
cmp dword [0x412fa8], ebx
jne 0x40caa2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40caa2
cmp dword [ebp - 0x114], esi
jae 0x40ca9c
cmp dword [ebp - 0x118], 6
jb 0x40caa2
mov dword [0x412fa0], esi
push 4
call fcn.0040b800
test eax, eax
je 0x40cac2
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov dword [0x412fac], esi
jne 0x40cac8
mov dword [0x412fac], ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x412fb0], eax
call fcn.0040c9d1
push dword [ebp + 0xc]
call fcn.0040d4cc
push dword [ebp + 0xc]
call fcn.0040e01d
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x609b88
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
pop esp
pop edx
push cs
adc al, 0xfc
xor dword [edx + edx + 0x18], ebx
cmp ch, byte [esi + 0x31407495]
push esi
invalid
lodsd eax, dword [esi]
shr dword [ebp + 0x17144747], cl
test byte [ecx + 0x5e52b91c], bl
in eax, dx
sub byte [eax], bl
push 0xd8d79f0c
jg 0x609b87
test byte [ecx - 0x16], dl
loope 0x609b4e
cdq
loop 0x609c18
xlatb
inc eax
fcmovu st(0), st(4)
imul eax, dword [ebx], 0x5f
xor ah, dl
xchg esp, eax
jmp 0xd0a6cea5
inc edx
push esp
invalid
jne 0x609bb6
sub ah, byte [edx + 0x73]
rcl dword [eax - 0x58]
lcall 0x6458, 0x9d738224
sbb ecx, dword [esi - 4]
push edi
xor ebp, eax
or eax, edi
jle 0x609c57
cmp esp, dword [ebp - 0x16]
clc
mul byte [ebx + 0x36c5685a]
jp 0x609bf2
push ebp
and esp, dword [edi - 0x807c26]
test eax, 0xde13c21
call [eax]
aaa
push ss
fstp qword [ecx]
push ebp
xor bl, byte ds:[eax + 0x47e5612f]
inc edi
cwde
mov ah, 0xae
sti
invalid

Function at 0x654598
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x5abfd65e
inc edi
cdq
rcl dword [0x9d95cdad], 0xc2
loopne 0x654563
xchg ebp, eax
invalid
or byte [esi + 0x414b6111], bl
pop edi
push cs
mul byte ds:[edx]
push ecx
mov edi, 0xa8e4f10f
hlt
xor bl, ch
stosd dword es:[edi], eax
mov esi, 0x544f16af
std
scasb al, byte es:[edi]
jecxz 0x654558
sahf
movsd dword es:[edi], dword [esi]
add al, 0xe4
mov al, 0xe0
push ss
push es
mov edx, 0x24dd35d1
push cs
jo 0x65451a
add dword [ecx + 0x40], esi
and dword [edx - 0x18c2e98b], eax
xor byte [ebp + 0x16], 0x3d
out 0xa2, eax
aaa
inc ecx
std
mov byte [ecx - 0x77acca60], al
out 0xb4, eax
xor al, 0xff
jecxz 0x6545f0
xor byte [ebp + 0x16], 0x3d
out 0xa2, eax
aaa
inc ecx
std
mov byte [ecx - 0x77acca60], al
out 0xb4, eax
xor al, 0xff
jecxz 0x6545f0
jle 0x654577
and eax, 0x4a9b3376
xchg edx, eax
xchg edx, eax
inc esp
and eax, 0x25011fe3
iretd
movsb byte es:[edi], byte [esi]
jl 0x654636
lahf
loopne 0x654609
pop ds
ret 0xafe8
push ecx
pushal
inc esi
invalid
xchg edi, eax
inc esi
bound esp, qword [esi - 0x17]
mov ch, 0xf9
xor al, 0x9a
xchg esi, eax
adc eax, 0xd59725d5
push ebx
xor ebx, eax
not cl
shl byte [esi - 0x3e74622b], cl
stc
jo 0x654618
xchg ebp, eax
or eax, 0x83f190c2
lds ecx, [ebx - 0x7d]
inc esp
invalid
pop edx
fmul dword [esi + 0x77]
inc ebp
push 0x56
and eax, 0x97ba272f
aad 0xbf
out 0x39, al
mov ah, 0xe1
movsd dword es:[edi], dword [esi]
mul byte [ebx + 0x25a59d2c]
test ebx, 0xb0c790fd
popal
aas
inc ecx
test dword [edi + 0x507be493], eax
push edi
jg 0x654601
invalid
mov al, byte [0xc0e1a57b]
cmpsb byte [esi], byte es:[edi]
xor dword [ebp + 0x61], ebp
jnp 0x654653
enter 0xffffffffffffb7ea, 0x62
push ss
bound edx, qword [esi]
dec edi
dec esp
cmp al, 0x3b
jbe 0x6546d5
jno 0x65466f
jle 0x654690
xlatb
adc edx, dword [esp + edi]
invalid
add eax, 0x4a42b4dd
popfd
push ebp
pop es
push dword [0x15e2aa62]
dec esi
mov ecx, 0x71805553
mov eax, dword [0x11b1b75c]
stosb byte es:[edi], al
mov edi, 0xf65fd5a7
salc
Function at 0x4015dd
Capabilities:
Delete file
Execute command
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x41d28
call fcn.00404520
sub esp, eax
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call eax
sub esp, 8
test eax, eax
jne 0x401621
mov dword [esp], str.GetTempPath
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401786
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x41300c
lea eax, [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call eax
sub esp, 0x10
test eax, eax
jne 0x401668
mov dword [esp], str.GetTempFileName
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401786
lea eax, [ebp - 0x41c18]
mov edx, 0x41304c
mov ecx, 0x41a00
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0xc], 0x41a00
mov dword [esp + 4], 0x413020
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4016c4
mov dword [esp], str.fopen
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401786
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [ebp - 0x41c18]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x401703
mov dword [esp], str.fwrite
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401786
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.start__s
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x41d18]
mov dword [esp], eax
call fcn.00404fd0
lea eax, [ebp - 0x41d18]
mov dword [esp], eax
call sub.msvcrt.dll_system
cmp eax, 0xffffffff
jne 0x40175c
mov dword [esp], str.system
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401786
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
test eax, eax
jne 0x401786
mov dword [esp], str.DeleteFile
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x401786
leave
ret
Function at 0x402561
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x18], al
mov byte [ebp - 5], 0
jmp 0x4025db
mov byte [ebp - 6], 0
jmp 0x4025d1
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 6]
mov ecx, dword [ebp + 0xc]
shl eax, 2
add eax, ecx
add eax, edx
movzx ebx, byte [eax]
movzx eax, byte [ebp - 0x18]
lea edx, [eax*4]
movzx eax, byte [ebp - 5]
add eax, edx
lea edx, [eax*4]
movzx eax, byte [ebp - 6]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
movzx edx, byte [eax]
movzx eax, byte [ebp - 5]
movzx ecx, byte [ebp - 6]
xor edx, ebx
mov ebx, dword [ebp + 0xc]
shl eax, 2
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 6], 1
cmp byte [ebp - 6], 3
jbe 0x40257a
add byte [ebp - 5], 1
cmp byte [ebp - 5], 3
jbe 0x402574
nop
nop
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4025e8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x402641
mov byte [ebp - 0xa], 0
jmp 0x402637
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x4025fc
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x4025f6
nop
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x403101
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
jmp 0x40315a
mov byte [ebp - 0xa], 0
jmp 0x403150
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ecx, dword [ebp + 8]
shl eax, 2
add eax, ecx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx edx, byte [eax + 0x47c260]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 3
jbe 0x403115
add byte [ebp - 9], 1
cmp byte [ebp - 9], 3
jbe 0x40310f
nop
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x403360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
jmp 0x403398
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ebx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx ecx, byte [eax]
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
cmp byte [ebp - 5], 0xf
jbe 0x40336d
nop
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4037f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040e0a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0040e0a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x403850
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x47ecb0]
test esi, esi
jle 0x403970
mov eax, dword [0x47ecb4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x403884
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x403907
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x403870
mov dword [esp], ebx
call fcn.00404250
mov edi, eax
test eax, eax
je 0x403997
mov eax, dword [0x47ecb4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00404390
mov edx, dword [0x47ecb4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x403977
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x403900
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x403910
add dword [0x47ecb0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
add ebx, dword [0x47ecb4]
mov edx, dword [esp + 0x14]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x403900
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004037f0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40388e
mov eax, dword [0x47ecb4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004037f0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004037f0
lea esi, [esi]
nop
Function at 0x403ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x47eccc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x47ecc4]
sub esp, 4
test ebx, ebx
je 0x403f15
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x403f0e
test eax, eax
jne 0x403f0e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403ef0
mov dword [esp], 0x47eccc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404250
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x404275
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x404280
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x404275
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x4042c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4042be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4042ca
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x4042b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x403c05
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0040ec30
mov eax, dword [0x283d82c]
mov ecx, dword [0x283d2b8]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403cd9
mov edi, ecx
mov ebx, eax
cmp dword [0x283d82c], 0x959
jne 0x403cc9
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403770
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x403794
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x4037b0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1800]
push eax
push esi
push 0x4037c8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.00403a97
add edi, 8
dec ebx
jne 0x403c31
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f97
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1800
call fcn.0040ec30
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 0x986
jge 0x403fd5
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthI]
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, 0x4f4c8ec
jg 0x403ff0
inc edi
cmp edi, 0x3455969
jl 0x403fad
cmp dword [0x283d82c], 0x400
jne 0x4040fd
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [esp + 0x80c]
push eax
push esi
push 0x403948
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [esp + 0x100c]
push eax
push 0x403924
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0x40398c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call fcn.004047fa
pop ecx
push esi
call fcn.00404684
pop ecx
push esi
push esi
call fcn.004047ba
push esi
push esi
call fcn.00404ab6
push esi
call fcn.00404ee9
add esp, 0x14
push esi
call fcn.0040510a
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404160
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404240
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404990
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404370
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404be0
fstp st(0)
push esi
push esi
call fcn.00404d34
push esi
call fcn.0040517e
add esp, 0x14
push esi
push esi
call fcn.004046be
push esi
push esi
call fcn.00404614
push esi
call fcn.00404f4e
add esp, 0x14
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x40411d
inc edi
cmp edi, 0x3011b
jl 0x4040ff
mov eax, dword [0x445c84]
mov dword [0x283d82c], eax
call fcn.00403cde
mov edi, 0x2ec37
cmp dword [0x283d82c], 0x51f
jne 0x40414c
push esi
lea eax, [esp + 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x404131
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4075a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4421f8]
jne 0x4075b2
repz ret
jmp fcn.0040c880
Function at 0x40cebe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4421f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409723
and dword [ebp - 0x14], 0
cmp dword [0x45a80c], 0
mov dword [ebp - 0x18], eax
jne 0x40cf71
push 0x402e34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d019
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402e28
push ebx
call edi
test eax, eax
je 0x40d019
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402e18
push ebx
mov dword [0x45a80c], eax
call edi
push eax
call esi
push 0x402e04
push ebx
mov dword [0x45a810], eax
call edi
push eax
call esi
push 0x402de8
push ebx
mov dword [0x45a814], eax
call edi
push eax
call esi
mov dword [0x45a81c], eax
test eax, eax
je 0x40cf71
push 0x402dd0
push ebx
call edi
push eax
call esi
mov dword [0x45a818], eax
mov eax, dword [0x45a818]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40cfca
cmp dword [0x45a81c], ecx
je 0x40cfca
push eax
call esi
push dword [0x45a81c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40cfca
test ebx, ebx
je 0x40cfca
call edi
test eax, eax
je 0x40cfc1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40cfc1
test byte [ebp - 8], 1
jne 0x40cfca
or dword [ebp + 0x10], 0x200000
jmp 0x40cffd
mov eax, dword [0x45a810]
cmp eax, dword [ebp - 0x18]
je 0x40cffd
push eax
call esi
test eax, eax
je 0x40cffd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cffd
mov eax, dword [0x45a814]
cmp eax, dword [ebp - 0x18]
je 0x40cffd
push eax
call esi
test eax, eax
je 0x40cffd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45a80c]
call esi
test eax, eax
je 0x40d019
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d01b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004075a8
leave
ret
Function at 0x42564a
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x42e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0x19f
mov dword [ebp - 0x408], eax
jne 0x42567a
push edi
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
jle 0x4256ec
push esi
lea esi, [ebp - 0x40c]
mov dword [ebp - 0x40c], edi
call fcn.0042563f
mov eax, dword [ebp - 0x408]
mov cl, byte [ebp - 0x40c]
add eax, ebx
xor byte [eax], cl
cmp dword [ebp + 0xc], 0xf
jne 0x4256e5
push edi
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.texeholiturafayeroj
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push str.rivarixux_lofoxu_hexekavoga_fucuwotahokariz
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x425682
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
pop ebx
jne 0x425705
or dword [0x43e844], 0xffffffff
mov dword [0x43e840], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
leave
ret