joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b1d0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [0x20], al
and byte [edx], al
add byte [eax], al
add dword [edx], eax
add byte [eax], al
add byte [eax], al
add byte [0x20], al
add al, byte [eax]
add byte [eax], al
add byte [eax], al
add eax, 0x20
and byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor al, 2
push es
dec ebx
jns 0x41b1dd
xor byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc eax, dword [eax]
or byte [eax], al
or ch, 0x44
test dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + esi*4], ah
cmp al, 0x91
and al, 0xb6
cmp al, 0x91
add byte [eax], al
add byte [eax], al

Function at 0x43cd62
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x43cd80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x43cd77
pop esi
pop ebp
ret 0xc
Function at 0x43f9ea
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
add byte [ebx - 0x76f8a8ac], cl
push ebp
fdivr dword [ebx]
invalid

Function at 0x4a9c50
Capabilities:
Get number of processors

Disassembly:
add al, ah
mov word [ebx], gs
push ax
mov edx, eax
adc byte [ebx + 0x27e066d0], cl
in al, 0x66
mov al, 0x9f
ja 0x4a9c7f
adc bh, 0x94
adc dl, ah
test eax, 0x6f6d1065
loopne 0x4a9c75
pop esp
imul edx, dword [eax], 0x5065aa23
add byte [edx + 0x63], dl
mov al, byte [0xb06744cd]
adc dh, bh
nop
mov al, 0x12
mul dword [esi - 0x70]
push ebp
pop esp
imul esi, eax, 0x80695c55
test dword [edi + 0x64], edx
rol byte [edi], 1
js 0x4a9cab
lock sub byte [ebp + 0x69], bl
xor ah, dl
call 0xb5b81cb2
arpl word [eax + 0x70695d2d], si
mov al, 0x2d
pop ebp
imul esi, dword [eax + 0x6f], 0xa02063b5
ja 0x4a9cc7
loopne 0x4a9bff
mov al, 0x2d
pop ebp
imul esi, dword [eax + 0x6f], 0xa02063b5
ja 0x4a9cc7
loopne 0x4a9bff
ja 0x4a9ccb
and byte [edx - 0x20bf9489], 0x70
loopne 0x4a9c84
pop esp
imul eax, dword [eax + 0x20695c1a], 0x306b77a3
pop ebp
imul esp, dword [eax + 0x2e], 0x1b10695d
pop esp
imul eax, dword [eax + 0x1b], 0xbf80695c
jo 0x4a9cef
cmp byte [edi + 0x47f06770], 0x70
xor byte [0x6352], al
xor byte [ecx + 0x7406725], bh
add dword [ebp - 0x50], esp
loop 0x4a9c2f
invalid
adc byte [si], bl
pop esp
imul esi, eax, 0xf0677047
inc edi
jo 0x4a9d0f
invalid
xor byte [ebx + 0x4c], ch
inc eax
sbb al, 0x5c
imul eax, dword [eax + 0x10695d38], 0xf067977c
inc edi
jo 0x4a9d23
cmp byte [edi - 0x1d4f9890], 0x94
cmp byte [bx + 0x6770], 0x40
cmp byte [edi - 0x20bf9890], 0x70
inc eax
fbstp tbyte [eax + 0x67]
loopne 0x4a9cea
loopne 0x4a9cea
pop esp
imul esp, dword [eax], 0x70679ed2
jmp 0x396b01f3
pop ebp
imul esp, eax, 0x7063b89c
sbb dword [edx + 0x6b], edi
arpl word [eax + 0x19], si
jp 0x4a9d5f
nop
jecxz 0x4a9ca0
add byte gs:[ebx - 0x166f9c56], al
mov ch, 0x63
shr byte [edx + 0x45], 1
arpl word [eax - 0x21], ax
jo 0x4a9d6f
mov al, byte [0x906500d7]
mov fs, word [ebp + 0x5d3d0063]
imul esi, eax, 0xc0634901
arpl word [eax], ax
cmp eax, 0x1f0695d
dec ecx
arpl ax, ax
jecxz 0x4a9cc4
nop
xor al, 0xc3
invalid
arpl ax, sp
into
mov bl, 0x63
adc dl, dl
mov bl, 0x63
invalid
and byte gs:[edi], dl
pop esp
imul eax, dword [eax + 0x1e], 0x1e70695c
pop esp
imul esi, dword [eax], 0x695c1f
sub dword [edx + 0xdef063], 0x65
invalid
imul eax, dword [eax], 0xf063aa83
fiadd word [eax]
invalid
Function at 0x4aa1b0
Capabilities:
Get number of processors

Disassembly:
mov al, 0x12
mul dword [esi - 0x20]
and ebp, dword [edx - 0x5d04cf9b]
mov al, 0xfa
sbb dword [ebp - 0x30], esp
pop es
xor byte [ecx + 0x7406725], bh
add dword [ebp - 0x50], esp
loop 0x4aa14f
cmp byte [bx + 0x6770], 0xf0
inc edi
jo 0x4aa22b
invalid
mov al, 4
push edx
arpl word [eax], ax
cmp eax, 0x1f0695d
dec ecx
arpl ax, si
add dword [ecx + 0x63], ecx
nop
xor al, 0xc3
invalid
Function at 0x4cdd50
Capabilities:
Get number of processors

Disassembly:
xor byte [eax], al
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
sar bh, 0xff
push dword [esi + 0x6b]
sub byte [eax], al
or al, 0
add byte [eax], al
call 0x34e4b27
add byte [eax], al
add byte [ecx], al
add byte [ebp + 1], ch
jnp 0x4cdda4
xor al, 0x64
bound esp, qword [edx + 0x30]
arpl word [0x31313339], bp
sub eax, 0x64336234
sub eax, 0x30666339
sub eax, 0x66663831
xor dword [0x39333635], esi
xor al, 0x7d
sub al, 0x34
sar bh, 0xff
push dword [esi + 0x6b]
sub byte [eax], al
add al, 0
add byte [eax + 1], al
add dword [eax], eax
add byte [eax], al
add al, 0
add byte [eax], al
add dword [eax], eax
add byte [eax], al
jnp 0x4cdde3
popal
xor eax, 0x33303864
sub eax, 0x32393464
sub eax, 0x64646534
sub eax, 0x33326338
sub eax, 0x30633065
aaa
xor byte [ebp + 0x7d], ah
sub al, 0x37
sar bh, 0xff
push dword [esi + 0x6b]
sub byte [eax], al
or al, 0
add byte [eax], al
clc
add al, bh
mov dh, 0x6d
add dword [ebx], eax
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ebx + 0x32], bh
xor al, 0x64
bound esp, qword [edx + 0x30]
arpl word [0x31313339], bp
sub eax, 0x64336234
sub eax, 0x30666339
sub eax, 0x66663831
xor dword [0x39333635], esi
xor al, 0x7d
sub al, 0x33
sar bh, 0xff
push dword [esi + 0x6b]
sub byte [eax], al
or al, 1
add byte [eax], al
invalid

Function at 0x4e31a0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], bh
add byte [ecx], bh
add byte [eax + eax], dh
popal
add byte [ebx], ah
popal
add byte [eax + eax], dh
add byte [eax + eax], dh
xor al, byte [eax]
xor eax, 0x32006100
add byte [eax + eax + 0x32], ah
add byte [esi], dh
add byte [eax], dh
add byte [eax], bh
add byte [ecx], ah
add byte fs:[eax + eax + 0x39], ah
add byte [esi], ah
xor eax, dword [eax]
bound eax, qword [eax]
add byte gs:[ebx], ah
xor dword [eax], eax
xor byte [eax], al
xor al, byte [eax]
arpl word [eax], ax
cmp dword [eax], eax
xor eax, dword [eax]
cmp byte [eax], al
xor byte [eax], al
xor al, byte [eax]
add byte cs:[ebx], ah
popal
add byte [eax + eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax + 0x48000000], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x50], dl
add byte [eax], al
add byte [ebx + 0x50], dl
add byte [eax], al
add byte [ecx], dh
push es
sub al, 0xd
or byte [eax], al
jne 0x4e31e0
Function at 0x4ed710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xf4d71c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1149230]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0xf9e548
mov dword [esp + 0x14], 3
call fcn.004e4350
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 2
call fcn.004e3e60
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.004e3db0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], 0
call 0x59104a
lea ecx, [esi + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004df750
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x50d320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0x58], edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1a690034]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov eax, 0xffffff
and eax, dword [ecx + 0x14]
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 0x14]
sub edx, ecx
sar edx, 3
imul edx, edx, 0xaaaaaaab
mov esi, dword [ebp + 0x24]
cmp edx, eax
jbe 0x50d3c5
lea eax, [eax + eax*2]
movups xmm0, xmmword [ecx + eax*8]
movaps xmmword [esp + 0x80], xmm0
movsd xmm0, qword [ecx + eax*8 + 0x10]
movsd qword [esp + 0x90], xmm0
mov eax, dword [esp + 0x80]
test eax, eax
je 0x50d3e5
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x50d3e5
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], ebx
lea ecx, [esp + 0x84]
lea edx, [esp + 0xa0]
call fcn.0050dca0
cmp dword [eax], 0
jne 0x50d695
dec ebx
jne 0x50d396
jmp 0x50d3e5
mov eax, dword [edi + 0xc]
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], eax
test esi, esi
jne 0x50d40a
lea eax, [ebp + 0xc]
mov ecx, dword [eax + 0x10]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x5c], xmm0
mov dword [esp + 0x6c], ecx
mov cl, byte [ebp + 0x30]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x70], eax
lea edx, [ebp + 0x28]
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov dword [esp + 0x74], esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x50], edx
mov dword [esp + 0x7c], edx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x74]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [esp + 0x6c]
movsd qword [esp + 0x14], xmm0
movups xmm0, xmmword [esp + 0x5c]
movups xmmword [esp + 4], xmm0
movzx eax, cl
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
lea edx, [esp + 0xa0]
mov ecx, edi
call fcn.0050d6c0
mov eax, dword [esi]
movzx ecx, word [eax + 8]
cmp ecx, 0x3a
je 0x50d4a8
cmp ecx, 0xe0
je 0x50d4a8
xor ebx, ebx
cmp ecx, 0xda
jne 0x50d4c8
cmp dword [eax + 0xc], 0
jle 0x50d6b9
mov eax, dword [esi + 0x14]
not eax
add esi, 0x20
test eax, 0xf000000
jne fcn.0050d4c6
mov esi, dword [esi]
add esi, 0xc
mov ecx, dword [eax + 4]
lea edx, [ebp + 0x28]
cmp ecx, dword [edx]
jne 0x50d3e5
xor ecx, ecx
lea edx, [ebp + 0x28]
mov edx, dword [edx + 4]
cmp dword [eax + 8], edx
je 0x50d3ec
jmp 0x50d3e5
Function at 0x514790
Capabilities:
Encode data using xor

Disassembly:
or dword [eax], ebx
add byte [eax], al
add byte [eax], al
xor esi, dword [esi + 0x238f3b]
add dword [edi], esp
stc
adc byte [esi + 0x47], 0x16
dec ebp
add byte [ebx - 0x3f], bl
les esp, [esp + ebx*2]
push cs
pop esi
add byte [eax], al
jbe 0x5146e9
add byte [edi + 0x76], bh
lcall 0x7f3f, 0x27006a8a
aas
jnp 0x51474e
mov eax, dword [0x534100e6]
out 0, al
inc ecx
push ebx
mov eax, dword [0x24f583b8]
add byte [eax], al
xchg byte [eax], al
add byte [edx + edx + 0xdbbd60], bh
mov word [esp + edi + 0x3c2acef4], es
xor al, 0
push cs
popal
jns 0x51471d
pop ds
retf
xchg esi, eax
add byte [eax], al
loope 0x514782
mov dword [esp + ecx], 0x6894ae8a
int 0xd1
inc ecx
add byte es:[eax], cl
mov ebp, 0x7efc5eae
rol dword [eax], cl
add byte [esi + 0x68c70000], bl
jb 0x5146c8
mov esi, 0xd5990b00
jnp 0x514779
jo 0x5146f7
add byte [eax], 0xf1
jl 0x51478d
pop ebp
sbb edx, dword [ebx]
cdq
add byte [eax], al
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
bound ebx, qword [edx + 0x71]
das
js 0x51475c
xor cl, byte [esi - 0x5f]
push es
invalid
test byte [esi + edx*8 + 0xcba154], 0x29
in eax, 0x77
pop es
ja 0x51478b
sbb al, 0xf9
dec ecx
add byte [esi], cl
mov ah, 0x11
adc eax, 0x38dd003f
add ch, bl
cmp byte [edi + 0x8541fd], dl
xchg edi, eax
std
inc ecx
test dword [eax], eax
Function at 0x519620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
movzx ebx, byte [ecx + 0xb]
test bl, bl
jns 0x519638
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
jmp 0x51963b
and ebx, 0x7f
xor edi, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ecx
cmp edi, ebx
jae 0x519709
lea esi, [edi + 1]
movzx edx, byte [ecx + edi]
test dl, dl
js 0x519665
add edx, 0xffffffc6
mov edi, esi
cmp edx, 0xfffffff6
jb 0x519643
jmp 0x519713
cmp esi, ebx
je 0x519709
cmp dl, 0xe0
jb 0x5196a6
cmp dl, 0xef
ja 0x5196ca
and edx, 0xf
movzx edi, byte [edx + 0x19a2a208]
movzx eax, byte [ecx + esi]
mov ebx, eax
shr ebx, 5
bt edi, ebx
jae 0x519709
and al, 0x3f
mov ebx, dword [ebp - 0x14]
inc esi
cmp esi, ebx
je 0x519709
shl edx, 6
movzx eax, al
or edx, eax
mov ecx, dword [ebp - 0x10]
jmp 0x5196ae
cmp dl, 0xc2
jb 0x519709
and edx, 0x1f
movzx ebx, byte [ecx + esi]
xor ebx, 0x80
cmp bl, 0x3f
ja 0x519709
shl edx, 6
or edx, ebx
js 0x519709
inc esi
mov ebx, dword [ebp - 0x14]
jmp 0x519656
cmp dl, 0xf4
ja 0x519709
add edx, 0xffffff10
movzx esi, byte [ecx + esi]
mov eax, esi
shr eax, 4
movsx eax, byte [eax + 0x19a2a219]
bt eax, edx
jae 0x519709
add edi, 2
cmp edi, ebx
je 0x519709
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi]
add al, 0x80
cmp al, 0x3f
ja 0x519709
shl edx, 6
and esi, 0x3f
or edx, esi
mov esi, edi
jmp 0x519694
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x51970b
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d86680d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d86680d
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d86680d
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d86680d
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d86680d
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d86680d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d86680d
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d86680d
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d86680d
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d86680d
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920
Function at 0x2d86680d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2d86681c
pop dword [ebp - 0x20]
mov eax, 0x546a5fc2
sub eax, 0x26e3f7a6
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x7b757d29
add dword [ebp - 0x30], 0xd2dcc822
mov dword [ebp - 0x2c], 0x9539d4e8
add dword [ebp - 0x2c], 0x9cf9775d
mov dword [ebp - 0x28], 0xfe8d52fe
sub dword [ebp - 0x28], 0xb2410ed0
mov dword [ebp - 0x24], 0xc0d0928b
add dword [ebp - 0x24], 0x3f2f6d75
lea eax, [ebp - 0x30]
push eax
mov eax, 0x4829e93b
add eax, 0xe565c74d
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x167edd5b
add dword [ebp - 0x30], 0x5df38bfb
mov dword [ebp - 0x2c], 0x483b63ba
add dword [ebp - 0x2c], 0xf930fdbb
mov dword [ebp - 0x28], 0xf6cb9b54
sub dword [ebp - 0x28], 0x935c2ee8
mov dword [ebp - 0x24], 0x1b5d151a
add dword [ebp - 0x24], 0xe4a2eae6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x7503b02c
sub eax, 0x4773ff9c
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x6bac1
push 0
call eax
mov ecx, 0x5b3844ea
add ecx, 0xa4c80506
mov edx, eax
mov esi, 0x3d24da08
add esi, 0xf07605f8
add esi, dword [ebp - 0x20]
mov ebx, 0x75e467c9
sub ebx, 0x5e812847
xor dword [ebp - 0x14], 0xfb5e4566
mov edi, dword [esi]
sub dword [ebp - 0x14], esi
add edi, ebx
sub dword [ebp - 4], edi
mov dword [edx], edi
add dword [ebp - 0x10], 0x34ae976
add edx, 0x2dce61d7
sub edx, 0x2dce61d3
add esi, 0xcbdd4a32
sub esi, 0xcbdd4a2e
loop 0x2d86693e
add eax, 0x11a93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3ce067d0
sub ecx, 0xf6067d0
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10004145
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10004154
pop dword [ebp - 0x14]
mov eax, 0x91617559
add eax, 0x7e9ecbfb
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x18c322a5
sub dword [ebp - 0x24], 0xca70dd5a
mov dword [ebp - 0x20], 0xf25668a6
sub dword [ebp - 0x20], 0xc0231c61
mov dword [ebp - 0x1c], 0xa3c63427
add dword [ebp - 0x1c], 0xa8861007
mov dword [ebp - 0x18], 0xfc26686d
sub dword [ebp - 0x18], 0xfc26686d
lea eax, [ebp - 0x24]
push eax
mov eax, 0x2a6992fb
sub eax, 0x1a6942b7
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x7ad10e6f
sub dword [ebp - 0x24], 0x65ea519
mov dword [ebp - 0x20], 0xebef3962
sub dword [ebp - 0x20], 0xaa82d7ed
mov dword [ebp - 0x1c], 0x128c63a6
add dword [ebp - 0x1c], 0x50e308c6
mov dword [ebp - 0x18], 0xb9039108
sub dword [ebp - 0x18], 0xb9039108
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x73423263
add eax, 0x9cbe1ded
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x36784
push 0
call eax
mov ecx, 0x4680
mov esi, eax
mov edi, 0x2aecf00d
sub edi, 0x1aec580d
add edi, dword [ebp - 0x14]
mov edx, 0x78371f25
sub edx, 0xa1bbd3ad
add dword [ebp - 0xc], 0xecc18e76
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0xb8666839
xor ebx, edx
add dword [ebp - 4], 0xc30731c2
mov dword [esi], ebx
sub dword [ebp - 4], eax
add esi, 0x26206e74
sub esi, 0x26206e70
add edi, 0xbc5bb4ae
sub edi, 0xbc5bb4aa
loop 0x10004270
add eax, 0x393fc233
sub eax, 0x393eb560
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7cadba24
sub ecx, 0x6cadba24
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40d830
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42843c]
jne 0x40d83a
repz ret
jmp fcn.00414980
Function at 0x41d2f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
cmp dword [0x177d4a8], 0x37
jne 0x41d38c
push str.leboxokegizalinoru_rudadulasace_judatasokoh
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x278]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push 0
push 0
push 0
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push str.tuyunifevekarozeli
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push str.mopuziwikemudeziko
push 0
push str.vilikowaxojasaz
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 4], 0
mov eax, dword [0x177d4ac]
add dword [ebp - 4], eax
mov eax, 0x12336
add dword [ebp - 4], eax
mov eax, dword [0x1774ef4]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [eax], dl
mov esp, ebp
pop ebp
ret 4
Function at 0x41da10
Capabilities:
Copy file
Manipulate console buffer
Read .ini file
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x177d4a8], 0x516
jne 0x41da65
push 0
push 0
call sub.KERNEL32.dll_Process32FirstW
xor ecx, ecx
mov word [ebp - 0x418], cx
xor edx, edx
mov word [ebp - 0x416], dx
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
push 0
lea edx, [ebp - 0x410]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shr ecx, 3
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x41da86
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x41db45
cmp dword [0x177d4a8], 0x29
jne 0x41dac0
push 0
push 0
push 0
push 0
push str.wuwaxafalipibuviyivanotuhokigu
push str.cefijah
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
push str.jujeduh
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
cmp dword [0x177d4a8], 0xe1b
jne 0x41dadc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 0x10]
shl edx, 1
mov dword [ebp - 0x10], edx
cmp dword [0x177d4a8], 0x1c
jne 0x41db2d
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x430], 0
xor eax, eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*4]
push ecx
call fcn.0041d660
jmp 0x41da7d
mov esp, ebp
pop ebp
ret 0xc