joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442e08
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x442e16
xor eax, eax
inc eax
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
jmp 0x442e66
mov eax, dword [0x463064]
cmp eax, 0xffffffff
je 0x442e4a
test eax, eax
je 0x442e7a
call esi
mov ecx, dword [0x463064]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x442e7a
push 1
push 0x8000012f
mov byte [0x463069], 0
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
push dword [0x465208]
call edi
test eax, eax
je 0x442e2b
xor eax, eax
inc eax
mov dword [ebx + 0x18], eax
jmp 0x442e7c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4431bb
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
jmp 0x4431c6
mov esi, dword [esi + 4]
cmp byte [esi + 0xf], 0
je 0x4431c3
mov edi, dword [esp + 0x14]
cmp byte [edi + 0xf], 0
jne 0x4431d9
mov edi, dword [edi + 4]
xor ebx, ebx
inc ebx
cmp byte [esi + 0xf], bl
jne 0x443212
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x44320e
push ebx
push 0
push dword [edi + 4]
mov ecx, esi
push 0
call fcn.00401592
test eax, eax
je 0x44325e
mov eax, dword [edi + 4]
inc eax
push eax
push dword [edi]
push dword [esi]
call fcn.00455650
add esp, 0xc
or byte [esi + 0xd], bl
mov eax, ebx
jmp 0x44325e
mov ecx, 0x466180
call fcn.00442e08
test eax, eax
jne 0x443236
push 0x4585d8
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x465c88
call fcn.0044a7cd
jmp 0x44325e
push ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [edi]
mov eax, dword [edi + 4]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x443269
push 0
mov ecx, 0x466180
call fcn.00442a74
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x443251
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x443251
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x443251
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4432ce
test ebx, ebx
je 0x4432b8
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x4432f3
push ebx
push esi
push eax
call fcn.00455650
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x443265
jmp 0x443251
push 0
mov ecx, 0x466180
call fcn.00442a74
push 0x4585d8
push str.Out_of_memory.
mov ecx, 0x465c88
call fcn.0044a7cd
jmp 0x44325d
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
mov ecx, 0x466180
call fcn.00442a74
push 0x4585d8
push str.GlobalLock
jmp 0x4432e4
Function at 0x443312
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.0044418e
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x44350d
test al, al
push esi
jne 0x443363
cmp byte [esp + 0x34], al
jne 0x443363
push 0x465130
xor esi, esi
push esi
push esi
push 0x44431c
push 0x2000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x4663b8], eax
je 0x4433fa
push 0xf
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x465130]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x44339e
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x44337d
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x443404
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x443435
cmp dword [esp + 0x24], esi
je 0x443464
mov byte [esp + 0x13], 1
call fcn.0044418e
test al, al
jne 0x443464
cmp byte [esp + 0x40], al
jne 0x4434e0
mov byte [esp + 0x3c], al
jmp 0x4433af
call fcn.0044411b
jmp 0x44350c
cmp byte [esp + 0x40], 0
je 0x443418
call fcn.0044418e
xor esi, esi
test al, al
je 0x443464
jmp 0x443435
lea eax, [esp + 0x14]
push eax
push dword [0x4663b8]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x44344e
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x443464
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4433af
push dword [0x4663b8]
call ebx
and dword [0x4663b8], 0
call fcn.0044411b
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x4434d9
cmp dword [0x465338], esi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateMutexA]
je 0x443490
test byte [esp + 0x12], 1
jne 0x4434a5
push str.AHK_Keybd
push esi
push esi
call edi
mov dword [0x466394], eax
jmp 0x4434a5
test byte [esp + 0x12], 1
je 0x4434a5
push dword [0x466394]
call ebx
mov dword [0x466394], esi
cmp dword [0x46533c], esi
je 0x4434c4
test byte [esp + 0x12], 2
jne 0x4434d9
push str.AHK_Mouse
push esi
push esi
call edi
mov dword [0x466398], eax
jmp 0x4434d9
test byte [esp + 0x12], 2
je 0x4434d9
push dword [0x466398]
call ebx
mov dword [0x466398], esi
cmp byte [esp + 0x13], 0
je 0x443509
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x459a88
mov byte [0x463069], 0
call fcn.0043b5df
add esp, 0x18
mov byte [0x463069], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x4444af
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [esp + 4], 0x10
je 0x4444b9
xor al, al
ret
cmp byte [esp + 8], 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
je 0x4444ce
cmp byte [esp + 0xc], 0x10
jne 0x444523
xor cl, cl
cmp byte [esp + 0x10], cl
jne 0x444523
cmp byte [0x466387], cl
je 0x4444f1
call fcn.00444104
test al, al
jne 0x4444f1
mov byte [0x466387], cl
xor al, al
pop esi
ret
cmp byte [0x466381], cl
je 0x444523
xor eax, eax
mov ax, word [0x466384]
push eax
xor eax, eax
mov al, byte [0x466386]
push eax
call fcn.0044444b
add esp, 8
test al, al
je 0x444523
call esi
sub eax, dword [0x46637c]
cmp eax, 0x16
jb 0x4444ed
call esi
mov dword [0x46635c], eax
mov al, 1
pop esi
ret
Function at 0x4463ff
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x466380], 0
je 0x44647a
mov al, byte [0x466386]
cmp al, 0xa0
je 0x446418
cmp al, 0x10
jne 0x44647a
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x46637c]
cmp eax, 0x16
jae 0x44647a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044444b
add esp, 8
cmp byte [0x466381], 0
jne 0x446452
call fcn.00444104
test al, al
je 0x44647a
mov byte [0x466387], 1
jmp 0x44645c
cmp byte [ebp + 0x14], 0
jne 0x446445
test al, al
je 0x44647a
mov al, byte [0x466378]
mov byte [0x465226], al
mov al, byte [0x466377]
mov byte [0x465238], al
mov al, byte [0x466376]
mov byte [0x4652c8], al
mov al, byte [0x465226]
mov ecx, dword [0x4663a8]
mov byte [0x466378], al
mov al, byte [0x465238]
push ebx
push esi
movzx esi, byte [ebp + 0xc]
mov byte [0x466377], al
mov al, byte [0x4652c8]
mov byte [0x466376], al
lea eax, [esi + esi*8]
shl eax, 5
mov bl, byte [eax + ecx + 4]
test bl, bl
push edi
mov edi, dword [ebp + 8]
je 0x4465c4
push dword [ebp + 0x14]
cmp dword [edi + 0x10], 0xffc3d44f
push dword [ebp + 0xc]
setne byte [ebp + 0xb]
push dword [edi + 8]
call fcn.004444af
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x44656a
cmp byte [ebp + 0x18], 0
jne 0x4464fc
mov cl, bl
not cl
and byte [0x465224], cl
cmp byte [ebp + 0xb], 0
je 0x4464fc
and byte [0x465225], cl
test al, al
je 0x4465c4
not bl
and byte [0x465226], bl
sub esi, 0xa0
mov byte [esi + 0x4652c8], 0
je 0x446563
dec esi
je 0x446557
dec esi
je 0x44654b
dec esi
je 0x446544
dec esi
je 0x446535
dec esi
jne 0x4465c4
mov al, byte [0x4652cc]
jmp 0x44653a
mov al, byte [0x4652cd]
mov byte [0x46523a], al
jmp 0x4465c4
mov al, byte [0x4652ca]
jmp 0x446550
mov al, byte [0x4652cb]
mov byte [0x465239], al
jmp 0x4465c4
mov al, byte [0x4652c8]
mov byte [0x465238], al
jmp 0x4465c4
mov al, byte [0x4652c9]
jmp 0x44655c
cmp byte [ebp + 0x18], 0
jne 0x446582
or byte [0x465224], bl
cmp byte [ebp + 0xb], 0
je 0x446582
or byte [0x465225], bl
test al, al
je 0x4465c4
or byte [0x465226], bl
cmp byte [ebp + 0xc], 0xa0
mov byte [esi + 0x465228], 0x80
jb 0x4465c4
cmp byte [ebp + 0xc], 0xa1
jbe 0x4465bd
cmp byte [ebp + 0xc], 0xa3
jbe 0x4465b4
cmp byte [ebp + 0xc], 0xa5
ja 0x4465c4
mov byte [0x46523a], 0x80
jmp 0x4465c4
mov byte [0x465239], 0x80
jmp 0x4465c4
mov byte [0x465238], 0x80
mov cx, word [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [0x466384], cx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push dword [edi + 8]
mov byte [0x466386], al
mov byte [0x466381], cl
call fcn.004444af
add esp, 0xc
mov byte [0x466380], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
pop edi
pop esi
mov dword [0x46637c], eax
pop ebx
pop ebp
ret
Function at 0x4468da
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
jne 0x44690e
cmp byte [0x466134], al
je 0x4469ab
push 1
push eax
push 0xffffffffffffffff
push 0x459f14
jmp 0x4469a0
cmp byte [0x466134], 0
push ebx
push ebp
push esi
mov ebp, 0x465b28
jne 0x446923
lea ebp, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push ebp
mov esi, 0x104
push esi
call ebx
test eax, eax
je 0x44697e
cmp byte [edi], 0
je 0x446989
cmp byte [edi + 1], 0x3a
jne 0x446989
cmp byte [edi + 2], 0
jne 0x446989
push ebp
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x446989
push edi
lea eax, [esp + 0x14]
push 0x45cd94
push eax
call fcn.00409d3b
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x446989
push ebp
push esi
call ebx
test eax, eax
jne 0x446989
push esi
push edi
push ebp
call fcn.00438c79
add esp, 0xc
cmp byte [0x466134], 0
pop esi
pop ebp
pop ebx
je 0x4469ab
push 1
push 0
push 0xffffffffffffffff
push 0x45871c
mov ecx, dword [0x465b20]
call fcn.00401592
pop edi
add esp, 0x10c
ret
Function at 0x44dc15
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c58
call fcn.004561f0
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44dc93
lea ecx, [ebp - 0x8c58]
call fcn.0043aeeb
mov al, byte [ebp + 8]
mov byte [ebp - 0x8414], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8410], eax
lea eax, [ebp - 0x8c58]
push eax
push 0x44e25b
mov dword [ebp - 0x8418], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8428], 0
je 0x44dc93
mov eax, dword [0x46518c]
cmp eax, 0xffffffff
jle 0x44dc93
cmp eax, 0x19
jge 0x44dc89
cmp byte [0x466341], 0
je 0x44dc89
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44dc93
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x44e115
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c5c
call fcn.004561f0
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x44e252
push ebx
call fcn.0044e45f
test eax, eax
je 0x44e255
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x465138
push eax
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.0044de97
test eax, eax
je 0x44e164
xor esi, esi
mov dword [0x468f6c], esi
jmp 0x44e16a
mov esi, dword [0x468f6c]
lea ecx, [ebp - 0x8c5c]
call fcn.0043aeeb
cmp byte [ebp + 8], bl
je 0x44e184
cmp esi, ebx
mov byte [ebp - 0x8434], bl
je 0x44e18b
mov byte [ebp - 0x8434], 1
mov eax, dword [0x468f68]
mov dword [ebp - 0x8424], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x841c], eax
lea eax, [ebp - 0x8c5c]
push eax
push 0x44e361
mov dword [ebp - 0x8420], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x842c], ebx
je 0x44e227
push dword [ebp - 0x842c]
call fcn.0043be36
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44e1e3
push dword [ebp - 0x842c]
call fcn.0044e42d
pop ecx
mov dword [ebp - 0x842c], esi
push dword [ebp - 0x842c]
call fcn.0043b79c
push dword [ebp - 0x842c]
call fcn.0044e42d
mov eax, dword [0x46518c]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x44e251
cmp eax, 0x19
jge 0x44e21b
cmp byte [0x466341], bl
je 0x44e21b
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44e251
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
jmp 0x44e251
mov eax, dword [0x468f6c]
cmp eax, ebx
je 0x44e251
cmp eax, 1
setg al
cmp al, bl
mov dword [0x468f6c], ebx
je 0x44e251
push dword [ebp - 4]
call fcn.0044e42d
pop ecx
push ebx
mov ecx, edi
call fcn.0044e115
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x44e551
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x467958], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x466f98
jne 0x44e571
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.0041357e
pop ecx
mov dword [0x4641d8], 0x270
mov dword [0x466f90], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e590
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e5c6
mov edx, dword [0x466f98]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44e7cd
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x44e8f8
cmp byte [eax], bl
je 0x44e8f8
push 0x10
call fcn.0044be71
cmp eax, ebx
pop ecx
je 0x44e81b
mov dword [eax], 0x4585d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x44e81d
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x44e8f8
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.004469b3
cmp eax, 1
jne 0x44e8f8
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449a4c
test eax, eax
je 0x44e8f8
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b5f6
test eax, eax
je 0x44e8f8
push dword [0x465c2c]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449a4c
test eax, eax
je 0x44e8f8
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449a4c
test eax, eax
je 0x44e8f8
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b955
test eax, eax
je 0x44e8f8
push ebx
push ebx
push ebx
push str.ErrorLevel
mov ecx, esi
call fcn.0041c17a
cmp eax, ebx
mov dword [0x465b20], eax
je 0x44e8f8
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
mov ecx, eax
call fcn.00401592
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.0041357e
mov eax, dword [esi + 8]
pop ecx
jmp 0x44e8fb
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x455b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x468fc4], esi
push edi
jne 0x455ba0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x468fc0], esi
mov byte [0x468fbc], al
jne 0x455c06
mov ecx, dword [0x46a58c]
test ecx, ecx
je 0x455be7
mov eax, dword [0x46a588]
sub eax, 4
cmp eax, ecx
jmp 0x455be0
mov eax, dword [eax]
test eax, eax
je 0x455bd2
call eax
mov eax, dword [0x46a588]
sub eax, 4
cmp eax, dword [0x46a58c]
mov dword [0x46a588], eax
jae 0x455bca
mov eax, 0x463040
mov esi, 0x463048
cmp eax, esi
mov edi, eax
jae 0x455c06
mov eax, dword [edi]
test eax, eax
je 0x455bff
call eax
add edi, 4
cmp edi, esi
jb 0x455bf7
mov eax, 0x46304c
mov esi, 0x463050
cmp eax, esi
mov edi, eax
jae 0x455c25
mov eax, dword [edi]
test eax, eax
je 0x455c1e
call eax
add edi, 4
cmp edi, esi
jb 0x455c16
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x455c3f
push dword [ebp + 8]
mov dword [0x468fc4], 1
call fcn.0043d3dd
pop ebp
ret

Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad77bae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x3ad77bbd
pop dword [ebp - 0x4c]
mov eax, 0x21ab691d
add eax, 0x192c12a0
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3d70a
push 0
mov eax, 0xf490b1f0
add eax, 0x46465ec4
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5f5e
xor edx, edx
add edx, eax
mov esi, 0xd4d50c12
sub esi, 0x99fc7e12
add esi, dword [ebp - 0x4c]
mov ebx, 0xc0743b76
add ebx, 0xb0e72d58
mov dword [ebp - 4], 0xf0694a87
mov edi, dword [esi]
xor dword [ebp - 0x40], ecx
add edi, ebx
sub dword [ebp - 0x1c], ebx
mov dword [edx], edi
xor dword [ebp - 0x1c], edi
add edx, 0x96202b3c
sub edx, 0x96202b38
add esi, 0x7480db4a
add esi, 0x8b7f24ba
loop 0x3ad77c18
add eax, 0xe055f7af
sub eax, 0xe0548764
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3e02b603
add ecx, 0xfcd449fd
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40ac1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40ac29
pop dword [ebp - 0x1c]
mov eax, 0x40ac29
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x7bc3511e
add dword [ebp - 0x2c], 0xd28ef42d
mov dword [ebp - 0x28], 0x581d036d
sub dword [ebp - 0x28], 0x25e9b728
mov dword [ebp - 0x24], 0x7824f24
sub dword [ebp - 0x24], 0xbb360af6
mov dword [ebp - 0x20], 0x214f26d
sub dword [ebp - 0x20], 0x214f26d
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5660683e
add dword [ebp - 0x2c], 0x1e120118
mov dword [ebp - 0x28], 0x2639859d
add dword [ebp - 0x28], 0x1b32dbd8
mov dword [ebp - 0x24], 0x8618fb6d
add dword [ebp - 0x24], 0xdd5670ff
mov dword [ebp - 0x20], 0x8f7d9e9a
sub dword [ebp - 0x20], 0x8f7d9e9a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a42c
push 0
call eax
mov ecx, 0x42cc5242
add ecx, 0xbd33f794
xor edi, edi
add edi, eax
mov ebx, 0x15db9451
add ebx, 0xea661baf
add ebx, dword [ebp - 0x1c]
mov esi, 0x7a6cfcdc
add esi, 0x4fcf5c7a
add dword [ebp - 4], edx
mov edx, dword [ebx]
xor dword [ebp - 4], edx
add edx, esi
add dword [ebp - 4], eax
mov dword [edi], edx
add dword [ebp - 8], 0x927b347e
add edi, 4
add ebx, 0x588a797e
sub ebx, 0x588a797a
loop 0x40ad3e
add eax, 0x844ab71f
sub eax, 0x84499cf4
mov ebx, eax
add eax, 0x5e7f1ca9
add eax, 0xa180e35c
mov ecx, 0xaef95837
add ecx, 0x5146a7c9
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x403880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x40e]
push eax
movzx eax, word [ebp - 0x410]
push eax
movzx eax, word [ebp - 0x412]
push eax
movzx eax, word [ebp - 0x414]
push eax
movzx eax, word [ebp - 0x416]
push eax
movzx eax, word [ebp - 0x41a]
push eax
movzx eax, word [ebp - 0x41c]
push eax
push str.__4d__02d__02d__02d:_02d:_02d._03d_
lea eax, [ebp - 0x40c]
push 0x400
push eax
call fcn.00405c7a
mov esi, eax
mov ecx, 0x400
lea eax, [ebp + 0xc]
sub ecx, esi
push eax
push dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0x40c]
add ecx, esi
push ecx
call fcn.004079f0
push 0x417ee0
add esi, eax
lea eax, [ebp - 0x420]
push str.ventoy.log
push eax
call fcn.00406087
mov eax, dword [ebp - 0x420]
add esp, 0x48
test eax, eax
je 0x403970
push eax
push esi
lea eax, [ebp - 0x40c]
push 1
push eax
call fcn.00406225
push dword [ebp - 0x420]
push 1
push 1
push 0x417ef0
call fcn.00406225
push dword [ebp - 0x420]
call fcn.00406376
add esp, 0x24
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.004059f4
mov esp, ebp
pop ebp
ret
Function at 0x403980
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x107]
mov dword [ebp - 0x10c], 0
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.0040aca0
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4039c4
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
js 0x403a03
mov cl, byte [esi + eax]
cmp cl, 0x5c
je 0x4039e6
cmp cl, 0x2f
je 0x4039e6
dec eax
jns 0x4039d4
jmp 0x403a03
inc eax
add eax, esi
push eax
push 0x417ef4
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.00405c7a
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push esi
push str.Load_NT_driver:__s__s
call fcn.00403880
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x403a55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_Error:_u
call fcn.00403880
lea eax, [edi + 1]
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004059f4
mov esp, ebp
pop ebp
ret
push str.OpenSCManager_OK
call fcn.00403880
add esp, 4
lea eax, [ebp - 0x108]
push 0
push 0
push 0
push 0
push 0
push esi
push 1
push 3
push 1
push 0xf01ff
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x403b1e
call esi
mov esi, eax
cmp esi, 0x3e5
je 0x403ad6
cmp esi, 0x431
je 0x403ad6
push esi
push str.CreateService_failed_v__u
call fcn.00403880
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004059f4
mov esp, ebp
pop ebp
ret
push 0xf01ff
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x403b18
push esi
push str.OpenService_failed__u
call fcn.00403880
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004059f4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateService_imdisk_OK
call fcn.00403880
add esp, 4
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x403b49
push str.StartService_OK
call fcn.00403880
add esp, 4
jmp 0x403b76
call esi
cmp eax, 0x420
jne 0x403b5e
mov dword [ebp - 0x10c], 0
jmp 0x403b76
push eax
push str.StartService_error___u
call fcn.00403880
add esp, 8
mov dword [ebp - 0x10c], 1
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
mov esi, dword [ebp - 0x10c]
mov eax, str.success
test esi, esi
mov ecx, str.failed
cmove ecx, eax
push ecx
push str.Load_NT_driver__s
call fcn.00403880
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004059f4
mov esp, ebp
pop ebp
ret