joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40345b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jl 0x403484
add eax, dword [0x472618]
push esi
push esi
push eax
push dword [0x40b014]
mov dword [0x42f1e4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004032dd
cmp eax, esi
jl 0x403573
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40b014]
call fcn.00405eea
test eax, eax
jne 0x4034b0
push 0xfffffffffffffffd
pop eax
jmp 0x403573
push dword [ebp + 8]
add dword [0x42f1e4], 4
call fcn.004032dd
mov dword [ebp - 8], eax
cmp eax, esi
jl 0x403573
push edi
cmp dword [ebp + 0x10], esi
jne 0x40353a
cmp dword [ebp + 8], esi
jle 0x40356f
mov esi, 0x42f1e8
cmp dword [ebp + 8], 0x4000
mov edi, dword [ebp + 8]
jl 0x4034ef
mov edi, 0x4000
push edi
push esi
push dword [0x40b014]
mov dword [ebp - 4], edi
call fcn.00405eea
test eax, eax
je 0x40355e
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403536
cmp dword [ebp + 0x14], edi
jne 0x403536
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x42f1e4], eax
cmp dword [ebp + 8], 0
jg 0x4034de
jmp 0x40356f
push 0xfffffffffffffffe
jmp 0x403560
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403545
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403563
push 0xfffffffffffffffd
pop eax
jmp 0x403572
mov eax, dword [ebp - 4]
add dword [0x42f1e4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0x10
Function at 0x405c4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x457280
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x457280], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405c8b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405e41
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405e61
and eax, 0xfffffffe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405e67
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405e96
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409624]
mov dword [ebp - 8], eax
mov eax, dword [0x409628]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405ee6
test edi, edi
jne 0x405ea3
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405ee0

Function at 0x405f19
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f92
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405f7b
cmp dword [ebp + 0x14], 1
je 0x405f80
cmp dword [ebp + 0x14], 2
je 0x405f80
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x406120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x406145
mov eax, dword [0x40b058]
cmp eax, 0xffffffff
je 0x40613c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b058], 0xffffffff
jmp 0x4061bd
cmp dword [0x460d28], edi
je 0x4061bd
cmp word [0x469d60], di
je 0x406185
cmp dword [0x40b058], 0xffffffff
jne 0x40618e
push 4
push 0x40000000
push 0x469d60
call fcn.00405e67
mov dword [0x40b058], eax
cmp eax, 0xffffffff
je 0x4061bd
push 2
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40b058], 0xffffffff
je 0x4061bd
push esi
push 0x409640
mov esi, 0x460d40
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40b058]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop edi
pop ebp
ret 4

Function at 0x4063a9
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405e41
mov edi, eax
cmp edi, 0xffffffff
je 0x4063ea
test byte [esp + 0x10], 1
push esi
je 0x4063d3
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4063db
xor eax, eax
inc eax
jmp 0x4063ec
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4063ca
test byte [esp + 0x10], 4
jne 0x4063ea
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x40644d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4572c8
push esi
call fcn.0040604f
push esi
call fcn.00405d6a
mov edi, eax
test edi, edi
jne 0x40646e
xor eax, eax
jmp 0x4064cb
push edi
call fcn.00406071
test byte [0x472628], 0x80
je 0x40648a
movzx eax, word [edi]
test ax, ax
je 0x40646a
cmp eax, 0x5c
je 0x40646a
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x4064ac
push esi
call fcn.004062d7
test eax, eax
je 0x4064a6
test byte [eax], 0x10
je 0x4064d0
push esi
call fcn.00406420
push esi
call ebx
cmp eax, edi
jg 0x406497
push esi
call fcn.004063f1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4064ca
Function at 0x40674e
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4097a0
mov ebx, 0x45b2d0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edi, 0x400
test esi, esi
je 0x40679d
push 1
push 0
push esi
call fcn.00405e67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x4068c8
cmp eax, edi
jg 0x4068c8
push edi
mov esi, 0x460128
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x4068c8
cmp eax, edi
jg 0x4068c8
push esi
push ebx
push str._ls_ls_r_n
push 0x45bd20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4725dc]
push dword [eax + 0x128]
push esi
call fcn.004064d4
push 4
push 0xc0000000
push esi
call fcn.00405e67
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, 0xffffffff
je 0x4068c8
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4068c1
push edi
push esi
push ebp
call fcn.00405eea
test eax, eax
je 0x4068c1
push str._Rename__r_n
push esi
call fcn.00405dc7
test eax, eax
jne 0x406853
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40688c
push 0x409784
add eax, 0xa
push eax
call fcn.00405dc7
mov ebp, eax
test ebp, ebp
je 0x406888
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x40687d
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406873
sub ebp, esi
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x1c]
jmp 0x40688e
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
push 0x45bd20
add eax, esi
push eax
call fcn.00405e1d
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x406901
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push esi
mov dword [ebp - 4], eax
call fcn.0040644d
mov dword [ebp - 8], eax
test bl, 8
je 0x40693f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x472688], eax
jmp 0x406b1a
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push edi
je 0x40695a
test eax, eax
je 0x406a9a
test bl, 2
je 0x406a9a
push esi
mov edi, 0x45c120
push edi
call fcn.0040604f
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x40697c
push str..
push edi
call ebx
jmp 0x406982
push esi
call fcn.00406420
cmp word [esi], 0
jne 0x406992
cmp word [0x45c120], 0x5c
jne 0x40699a
push 0x40879c
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + eax*2]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x406a8e
cmp word [ebp - 0x22c], 0x2e
jne 0x4069ed
cmp word [ebp - 0x22a], 0
je 0x406a71
cmp word [ebp - 0x22a], 0x2e
jne 0x4069ed
cmp word [ebp - 0x228], 0
je 0x406a71
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.0040604f
test byte [ebp - 0x258], 0x10
je 0x406a18
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406a71
push dword [ebp + 0xc]
push esi
call fcn.00406901
jmp 0x406a71
push esi
push str.Delete:_DeleteFile___s__
call fcn.004062a5
pop ecx
pop ecx
push dword [ebp - 4]
push esi
call fcn.004063a9
push esi
test eax, eax
jne 0x406a6a
cmp dword [ebp - 4], eax
je 0x406a56
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.004062a5
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00404f96
push 0
push esi
call fcn.004068ce
jmp 0x406a71
push str.Delete:_DeleteFile_failed___s__
call fcn.004062a5
inc dword [0x472688]
pop ecx
pop ecx
jmp 0x406a71
push 0xfffffffffffffff2
call fcn.00404f96
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4069bd
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406a9a
xor eax, eax
mov word [ebx - 2], ax
xor edi, edi
cmp dword [ebp + 8], edi
je 0x406b19
push esi
cmp dword [ebp - 8], edi
jne 0x406aae
push str.RMDir:_RemoveDirectory_invalid_input___s__
jmp 0x406b03
call fcn.004062d7
test eax, eax
je 0x406b19
push esi
call fcn.004063f1
push esi
push str.RMDir:_RemoveDirectory___s__
call fcn.004062a5
mov eax, dword [ebp - 4]
pop ecx
pop ecx
or eax, 1
push eax
push esi
call fcn.004063a9
push esi
test eax, eax
jne 0x406b12
cmp dword [ebp - 4], edi
je 0x406afe
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.004062a5
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00404f96
push edi
push esi
call fcn.004068ce
jmp 0x406b19
push str.RMDir:_RemoveDirectory_failed___s__
call fcn.004062a5
inc dword [0x472688]
pop ecx
pop ecx
jmp 0x406b19
push 0xffffffffffffffe5
call fcn.00404f96
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x406b20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46092c], 0
jne 0x406b5e
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b34
mov dword [ecx*4 + 0x460928], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2f
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406b8b
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460928]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406b6c
not eax
pop ebp
ret 0xc
Function at 0x410b3d
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x250]
push esi
xor esi, esi
push edi
mov edi, esi
cmp eax, 0xffffffff
jne 0x410b5a
inc edi
jmp 0x410c31
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 0x250], 0xffffffff
cmp dword [ebp + 8], esi
je 0x410c31
cmp dword [ebx + 0x14], esi
jne 0x410c31
push esi
push esi
push 3
push esi
push esi
push 0xc0000000
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x250], eax
cmp eax, 0xffffffff
jne 0x410bb8
call esi
mov edi, eax
test edi, edi
jle 0x410bb6
and edi, 0xffff
or edi, 0x80070000
test edi, edi
js 0x410c31
push 0
push 0
push dword [ebx + 0x244]
push dword [ebx + 0x240]
push dword [ebx + 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x410bf0
call esi
mov edi, eax
test edi, edi
jle 0x410bee
and edi, 0xffff
or edi, 0x80070000
test edi, edi
js 0x410c31
push dword [ebx + 0x250]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x410c18
call esi
mov edi, eax
test edi, edi
jle 0x410c16
and edi, 0xffff
or edi, 0x80070000
test edi, edi
js 0x410c31
mov eax, dword [ebx + 0x244]
mov edx, dword [ebx + 0x240]
mov esi, dword [ebx + 0x20]
mov ecx, dword [esi]
push eax
push edx
push eax
push edx
push esi
call dword [ecx + 0x50]
mov eax, dword [ebx + 0x250]
cmp eax, 0xffffffff
je 0x410c4a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 0x250], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x410f52
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov dh, 0x4d
test dh, 0x20
inc esi
test al, 0x5c
Function at 0x10005b9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10005baa
pop dword [ebp - 8]
mov eax, 0xa9124f51
add eax, 0x66ee0c59
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd869c7fa
add dword [ebp - 0x18], 0x75e87d51
mov dword [ebp - 0x14], 0xbb3e399d
add dword [ebp - 0x14], 0x76f512a8
mov dword [ebp - 0x10], 0xa12d7fe0
sub dword [ebp - 0x10], 0x54e13bb2
mov dword [ebp - 0xc], 0x53dcc029
sub dword [ebp - 0xc], 0x53dcc029
lea eax, [ebp - 0x18]
push eax
mov eax, 0x5c0b70b8
sub eax, 0x4c0ab094
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x526e8479
add dword [ebp - 0x18], 0x2203e4dd
mov dword [ebp - 0x14], 0x86cbbb89
add dword [ebp - 0x14], 0xbaa0a5ec
mov dword [ebp - 0x10], 0xb270cc7b
sub dword [ebp - 0x10], 0x4f01600f
mov dword [ebp - 0xc], 0xba397be2
sub dword [ebp - 0xc], 0xba397be2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x1bd2efe6
add eax, 0xf42dd046
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3ccc7
push 0
call eax
mov ecx, 0x54cea454
add ecx, 0xab31b6d6
xor ebx, ebx
add ebx, eax
mov edi, 0x218d8a59
sub edi, 0x11891659
add edi, dword [ebp - 8]
mov edx, 0x9648b2e5
add edx, 0x944ec309
mov dword [ebp - 4], 0x595b9ae5
mov esi, dword [edi]
xor dword [ebp - 4], eax
xor esi, edx
xor dword [ebp - 4], ecx
mov dword [ebx], esi
add ebx, 4
add edi, 0x99f1b4b9
sub edi, 0x99f1b4b5
loop 0x10005cce
add eax, 0x4edb77e2
sub eax, 0x4eda1867
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5d8ffa59
add ecx, 0xb27005a7
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x424fd7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x424fe6
pop dword [ebp - 0x38]
mov eax, 0x424fe6
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x4d296426
sub dword [ebp - 0x48], 0xfed71edb
mov dword [ebp - 0x44], 0x63d13776
sub dword [ebp - 0x44], 0x319deb31
mov dword [ebp - 0x40], 0xa8974528
sub dword [ebp - 0x40], 0x5c4b00fa
mov dword [ebp - 0x3c], 0x853e4c87
sub dword [ebp - 0x3c], 0x853e4c87
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd4f02c30
add dword [ebp - 0x48], 0x9f823d26
mov dword [ebp - 0x44], 0xfa096e68
sub dword [ebp - 0x44], 0xb89d0cf3
mov dword [ebp - 0x40], 0x5f7f80e4
sub dword [ebp - 0x40], 0xfc101478
mov dword [ebp - 0x3c], 0x5050e1cb
add dword [ebp - 0x3c], 0xafaf1e35
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x42eeb
push 0
call eax
mov ecx, 0x478c
mov ebx, eax
mov edi, 0x3a66de16
sub edi, 0x3a211616
add edi, dword [ebp - 0x38]
mov edx, 0x7fabf953
sub edx, 0xcddd373d
mov esi, dword [edi]
xor dword [ebp - 0x20], 0xcefca9ec
add esi, edx
sub dword [ebp - 0x28], ecx
mov dword [ebx], esi
mov dword [ebp - 0x24], 0x95e2d2a2
add ebx, 4
add edi, 0xa0e185af
add edi, 0x5f1e7a55
loop 0x4250f3
add eax, 0xc34d04a0
add eax, 0x3cb40c63
mov ebx, eax
add eax, 0x7f5fffd8
add eax, 0x80a0002d
mov ecx, 0x48e8b1
add ecx, 0xfff7174f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446004]
jne 0x40100a
repz ret
jmp fcn.0040149b

Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004039fa
and dword [ebp - 0x14], 0
cmp dword [0x448c40], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x448c40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x448c44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x448c48], eax
call edi
push eax
call esi
mov dword [0x448c50], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x448c4c], eax
mov eax, dword [0x448c4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x448c50], ecx
je 0x404637
push eax
call esi
push dword [0x448c50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x448c44]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x448c48]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x448c40]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x43ec10
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x446004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x837808]
imul eax, eax, 0x343fd
cmp dword [0x839c7c], 0x139e
mov dword [0x837808], eax
jne 0x43ec51
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [0x837808]
add eax, 0x269ec3
push esi
mov dword [0x837808], eax
movzx esi, word [0x83780a]
and esi, 0x7fff
cmp dword [0x839c7c], 0x8e7
jne 0x43ec86
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x43ecd0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x43ece4
call fcn.0043ec10
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x43ecd7
pop esi
cmp ebx, 0x2d
jne 0x43ecfe
mov dword [0x839c88], 0xa62e7790
mov dword [0x839c8c], 0xffffffff
ret

Function at 0x43ed00
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x446db8]
sub esp, 0x14
push ebx
mov ebx, dword [0x839c7c]
push edi
mov edi, dword [0x83780c]
call fcn.0043eca0
cmp dword [0x839c7c], 0x2f
jne 0x43ed5a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0043ecd0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x43f040
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00407bd0
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x43f069
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x43f111
cmp dword [0x839c7c], 0xa5f
jne 0x43f0b5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x818]
push edx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 4], 0x84620b
jne 0x43f0da
mov eax, dword [0x447bd8]
mov dword [0x839c7c], eax
mov ecx, dword [0x839c7c]
add ecx, 0xa231
mov dword [0x839c7c], ecx
cmp dword [0x839c7c], 0x141
jne 0x43f10c
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x449180], 0xec58acac
mov dword [0x449184], 0xffffffff
jmp 0x43f060
call fcn.0043ed70
jmp dword [0x83780c]