joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c3920
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c3941
xor eax, eax
pop esi
add esp, 0x224
ret
push edi
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x224
xor edi, edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x5c399b
jmp 0x5c3960
lea ecx, [esp + 0x28]
push str..exe
push ecx
call fcn.005c5070
add esp, 8
test eax, eax
jne 0x5c3997
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x5c3960
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret

Function at 0x5c5850
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61ec48
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x5c5923
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
lea ebx, [eax + 1]
mov dword [esp + 0x24], ebp
mov eax, SysReAllocString
test ebx, ebx
js 0x5c589e
shr eax, 1
test ebx, eax
je 0x5c5898
add eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.005c5730
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.005c56f0
mov eax, dword [esi + 4]
lea edx, [eax + eax*2]
lea eax, [edi + edx*8]
add esp, 0xc
cmp eax, ebp
je 0x5c58eb
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [ecx]
movq qword [eax], xmm0
movq xmm0, qword [ecx + 8]
movq qword [eax + 8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push 1
mov dword [esi], edi
push 1
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.005abed0
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, dword [esi]
lea edx, [eax + eax*2]
lea ecx, [ecx + edx*8]
inc eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x5c5953
mov eax, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
movq xmm0, qword [eax + 8]
movq qword [ecx + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5d0127
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6f6dfc]
jne 0x5d0131
repz ret
jmp fcn.005d96af

Function at 0x5d034e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5d037f
call fcn.005d7252
mov dword [eax], esi
call fcn.005d723f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005d1300
add esp, 0x14
push 0x16
pop eax
jmp 0x5d03d4
test dword [ebp + 0xc], 0xfffffff9
jne 0x5d035b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5d03ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005d7265
pop ecx
call fcn.005d723f
mov eax, dword [eax]
jmp 0x5d03d4
test al, 0x10
jne 0x5d03d2
test al, 1
je 0x5d03d2
test byte [ebp + 0xc], 2
je 0x5d03d2
call fcn.005d7252
mov dword [eax], 5
call fcn.005d723f
mov dword [eax], 0xd
jmp 0x5d03a3
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5e4624
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005d9827
and dword [ebp - 4], 0
cmp dword [0x7a1ed0], 0
mov ebx, eax
jne 0x5e46d5
push 0x6b75d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5e4786
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6b75cc
push edi
call esi
test eax, eax
je 0x5e4786
push eax
call fcn.005d97b5
mov dword [esp], 0x6b75bc
push edi
mov dword [0x7a1ed0], eax
call esi
push eax
call fcn.005d97b5
mov dword [esp], 0x6b75a8
push edi
mov dword [0x7a1ed4], eax
call esi
push eax
call fcn.005d97b5
mov dword [esp], 0x6b758c
push edi
mov dword [0x7a1ed8], eax
call esi
push eax
call fcn.005d97b5
pop ecx
mov dword [0x7a1ee0], eax
test eax, eax
je 0x5e46d5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005d97b5
pop ecx
mov dword [0x7a1edc], eax
mov eax, dword [0x7a1edc]
cmp eax, ebx
je 0x5e472d
cmp dword [0x7a1ee0], ebx
je 0x5e472d
push eax
call fcn.005d9830
push dword [0x7a1ee0]
mov esi, eax
call fcn.005d9830
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5e472d
test edi, edi
je 0x5e472d
call esi
test eax, eax
je 0x5e4724
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5e4724
test byte [ebp - 0xc], 1
jne 0x5e472d
or dword [ebp + 0x10], 0x200000
jmp 0x5e4766
mov eax, dword [0x7a1ed4]
cmp eax, ebx
je 0x5e4766
push eax
call fcn.005d9830
pop ecx
test eax, eax
je 0x5e4766
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5e4766
mov eax, dword [0x7a1ed8]
cmp eax, ebx
je 0x5e4766
push eax
call fcn.005d9830
pop ecx
test eax, eax
je 0x5e4766
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x7a1ed0]
call fcn.005d9830
pop ecx
test eax, eax
je 0x5e4786
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5e4788
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7aa4d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7aa4de
pushal
call 0x7aa4e4
pop ebp
sub ebp, 0x10
sub ebp, 0x3aa4d4
jmp 0x7aa4fa
mov eax, 0x3aa4d4
add eax, ebp
add eax, 0x4c
mov ecx, 0x622
mov edx, 0x867299f5
xor byte [eax], dl
inc eax
dec ecx
jne 0x7aa511
jmp 0x7aa524
jle 0x7aa55e
jle 0x7aa5a4
leave
cmc
cmc
cmc
je 0x7aa562
or eax, 0xf6f5f5f5
cmp byte [ebp - 0x10], cl
cmc
cmc
cmc
dec edi
invalid
invalid
int 0xdc
fprem1
hlt
int1
aaa
stc
cmc
jle 0x7aa623
sal ecx, 1
cmc
cmc
cmc
popfd
imul ecx, dword [esi - 0x32620a05], 0xf4f5d9dc
invalid
js 0x7aa55a
ror dword [ecx], 1
jl 0x7aa5a6
shl dword [ecx - 0x67ff558], 1
or al, byte [eax - 0xa8ee203]
cmc
cmc
jle 0x7aa625
std
cmc
cmc
cmc
je 0x7aa5e7
and ecx, dword [ebp - 0x23]
xor byte [esp + eax + 0x23], dh
dec ebp
fnsave dword [eax]
je 0x7aa5ed
and ecx, dword [ebp - 0x23]
xor dh, al
cmp al, 0x74
pop es
int1
fadd qword [edx + 0x6b]
je 0x7aa5fe
invalid
int1
fadd qword [edx + 0x6b]
invalid
inc edx
imul eax, esi, 0x27
jbe 0x7aa61c
sbb eax, 0x71fabdf0
mov ebx, 0xfaf5f5f5
invalid
cmc
cmc
cmc
cli
jge 0x7aa5c7
cmc
cmc
cmc
xchg ebx, eax
jle 0x7aa5f9
int3
sbb al, 0xfa
jno 0x7aa604
cmc
cmc
cmc
xchg ebx, eax
je 0x7aa634
push cs
or dl, al
cli
jno 0x7aa60b
cmc
cmc
cmc
mov ah, 0x1c
cmp dword [edx], ecx
or cl, byte [edx]
fdivr qword [ecx + 0x3476f4cc]
invalid
Function at 0x418070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 2
mov esi, ecx
mov dword [0x420e6c], 0
push 1
push esi
mov dword [0x420e68], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4181e0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [0x420e6c], eax
test eax, eax
je 0x4181e5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x420e64], eax
test eax, eax
je 0x4181eb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x28
jbe 0x4181eb
mov esi, dword [0x420e64]
cmp dword [esi], 0x28
jne 0x4181eb
mov eax, dword [esi + 4]
movzx ecx, word [esi + 0xe]
mov dword [0x420e60], eax
mov eax, dword [esi + 8]
mov dword [0x420e5c], eax
cmp ecx, 0x18
jne 0x41810c
mov dword [ebp - 4], 0
jmp 0x418126
cmp dword [esi + 0x20], 0
je 0x418118
movzx eax, word [esi + 0x20]
jmp 0x418123
mov eax, 1
shl ax, cl
movzx eax, ax
mov dword [ebp - 4], eax
movzx eax, word [esi + 0xe]
cmp eax, 4
je 0x41813f
cmp eax, 8
jne 0x4181cf
mov edi, 0x100
jmp 0x418144
mov edi, 0x10
push ebx
lea eax, [edi*4 + 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4181c8
mov word [ebx + 2], di
mov eax, 0x300
mov word [ebx], ax
test edi, edi
jle 0x4181a2
lea ecx, [ebx + 5]
lea edx, [esi + 0x29]
jmp 0x418180
movzx eax, byte [edx + 1]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [edx - 5]
mov byte [ecx - 3], al
mov byte [ecx - 2], 0
dec edi
jne 0x418180
push ebx
call dword [sym.imp.GDI32.dll_CreatePalette]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebx
mov dword [0x420e68], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [0x420e64]
pop ebx
mov eax, dword [ebp - 4]
movzx eax, ax
add eax, 0xa
lea eax, [esi + eax*4]
mov dword [0x420e70], eax
mov eax, dword [0x420e6c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [0x420e6c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov dword [0x420e6c], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call fcn.1000106f
Function at 0x41cc8d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c92f

Function at 0x41cc98
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041cabe

Function at 0x41d092
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a1b0
mov eax, dword [0x4d5900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041a989
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41d0d4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41d230
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00426c50
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4d7838]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041e262
mov ecx, dword [esi*4 + 0x4d7838]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41d229
cmp eax, dword [edi + ecx + 0x24]
jne 0x41d229
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d229
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041e262
add esp, 0x14
test edx, edx
jl 0x41d229
jg 0x41d19f
test eax, eax
jb 0x41d229
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41d229
jl 0x41d1b9
cmp dword [ebp - 0x1008], eax
ja 0x41d229
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41d1d7
test ebx, ebx
je 0x41d210
cmp ecx, edi
jae 0x41d210
mov al, byte [ecx]
cmp al, 0xd
jne 0x41d1f1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41d1fd
cmp byte [ecx + 1], 0xa
jne 0x41d1fd
inc ecx
jmp 0x41d1fd
movzx eax, al
movsx eax, byte [eax + 0x4d5bd8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41d1d7
cmp edx, ebx
jne 0x41d1d7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41d22e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409453
leave
ret
Function at 0x41d700
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4d7838]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d740
cmp byte [ebx], 0xa
jne 0x41d740
or byte [eax + edi + 0x28], 4
jmp 0x41d745
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41d843
mov al, byte [edx]
cmp al, 0x1a
je 0x41d825
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41d774
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41d799
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41d7a3
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41d756
jmp 0x41d843
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d820
cmp dword [ebp - 0xc], 0
je 0x41d820
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4d7838]
test byte [eax + edi + 0x28], 0x48
je 0x41d7fa
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41d7e5
mov byte [esi], dl
jmp 0x41d7f6
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4d7838]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41d843
cmp byte [ebp - 1], 0xa
jne 0x41d809
cmp esi, ebx
jne 0x41d809
mov byte [esi], 0xa
jmp 0x41d842
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041e280
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41d843
mov byte [esi], 0xd
jmp 0x41d842
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4d7838]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d83f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d843
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41d84c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4d7838]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d88f
cmp word [esi], dx
jne 0x41d88f
or byte [edi + eax + 0x28], 4
jmp 0x41d894
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41d9e7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41d9c7
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41d8d6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d90c
cmp eax, edx
jae 0x41d918
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41d8ae
jmp 0x41d9e7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d9c3
cmp dword [ebp - 0x14], 0
je 0x41d9c3
mov eax, dword [ebx*4 + 0x4d7838]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41d99b
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41d964
mov word [esi], cx
jmp 0x41d997
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4d7838]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4d7838]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4d7838]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41d9e7
pop ebx
cmp word [ebp - 4], bx
jne 0x41d9ac
cmp esi, dword [ebp + 0xc]
jne 0x41d9ac
mov word [esi], bx
jmp 0x41d9e4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041e280
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41d9e7
push 0xd
jmp 0x41d9e0
mov ecx, dword [ebx*4 + 0x4d7838]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d9de
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d9e7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41f7de
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41f87b
push ebx
push esi
call fcn.0041f7a7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e42c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41f828
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f87a
push edi
push eax
call fcn.00419ae3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41f848
call fcn.00418da9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f879
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e42c
add esp, 0x20
test eax, eax
jne 0x41f867
push edi
call fcn.00418da9
jmp 0x41f86f
push ebx
call fcn.00418da9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x426a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4285ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sar eax, 2
push edi
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x42866c
push esi
xor esi, esi
cmp dword [ebp + 0x18], esi
jbe 0x42866b
push ebx
mov ebx, 0x4d6e00
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebx
mov byte [edi + esi], al
call fcn.00401200
push eax
call fcn.00402518
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebx
mov byte [edi + esi], al
call fcn.00401200
push eax
call fcn.00402518
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x4293f0
mov byte [edi + esi], al
call fcn.0040eb3e
xor byte [edi + esi], al
add esp, 0x1c
inc esi
cmp esi, dword [ebp + 0x18]
jb 0x42860e
pop ebx
pop esi
lea ecx, [ebp + 8]
call fcn.00404306
pop edi
pop ebp
ret 0x14
Function at 0x40288e
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x4028b2
inc edi
cmp edi, 0x1f6502b0
jl 0x40289a
cmp dword [0x2be9a9c], 0x400
jne 0x4028ff
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push str.yogihubuwefugus
push esi
call fcn.004030a8
push esi
push esi
push esi
call fcn.00403078
push esi
push esi
call fcn.00402ea0
push esi
call fcn.00403254
push esi
call fcn.00403263
add esp, 0x24
xor edi, edi
cmp edi, 0xd0fe
jge 0x402910
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp edi, 0x3a37ee
jg 0x402937
inc edi
cmp edi, 0xe52f
jl 0x402901
mov eax, dword [0x42b2e4]
mov dword [0x2be9a9c], eax
call fcn.004025e3
mov edi, 0x3078f
cmp dword [0x2be9a9c], 0x51f
jne 0x402963
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x40294b
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x40856e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ab80]
jne 0x408578
repz ret
jmp fcn.0040b50c
Function at 0x409e3e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42ab80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404556
and dword [ebp - 0x14], 0
cmp dword [0x435e60], 0
mov dword [ebp - 0x18], eax
jne 0x409ef1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409f99
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409f99
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x435e60], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x435e64], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x435e68], eax
call edi
push eax
call esi
mov dword [0x435e70], eax
test eax, eax
je 0x409ef1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x435e6c], eax
mov eax, dword [0x435e6c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409f4a
cmp dword [0x435e70], ecx
je 0x409f4a
push eax
call esi
push dword [0x435e70]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409f4a
test ebx, ebx
je 0x409f4a
call edi
test eax, eax
je 0x409f41
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409f41
test byte [ebp - 8], 1
jne 0x409f4a
or dword [ebp + 0x10], 0x200000
jmp 0x409f7d
mov eax, dword [0x435e64]
cmp eax, dword [ebp - 0x18]
je 0x409f7d
push eax
call esi
test eax, eax
je 0x409f7d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409f7d
mov eax, dword [0x435e68]
cmp eax, dword [ebp - 0x18]
je 0x409f7d
push eax
call esi
test eax, eax
je 0x409f7d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x435e60]
call esi
test eax, eax
je 0x409f99
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409f9b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040856e
leave
ret
Function at 0x10001ac4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 4], dl
push esi
test dl, dl
je 0x10001af6
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10001b08
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xffff
inc dword [edx]
cmp dword [edx], 2
jl 0x10001ae2
jmp 0x10001b08
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10001b08
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret