joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x402dd5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x402e40
jg 0x402dfb
test esi, esi
je 0x402e40
test ecx, ecx
jl 0x402e7a
jg 0x402e05
test eax, eax
je 0x402e7a
cmp edi, ecx
jg 0x402e15
jl 0x402e0f
cmp esi, eax
jae 0x402e15
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x402e67
jg 0x402e4d
test esi, esi
je 0x402e67
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x402e67
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x402e4d
Function at 0x403aa1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403ae0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403ae0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403ae0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403ae0
cmp dword [ecx + 0x74], 0xe
jbe 0x403ae0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001070
sub eax, edx
mov edi, eax
xor eax, eax
lea ecx, [ecx]
mov byte [eax + 0x1000fa68], al
inc eax
cmp eax, 0x100
jl 0x10001080
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 8]
movzx ebx, byte [ecx + 0x1000fa68]
movzx edx, byte [edx + eax]
add edx, ebx
add esi, edx
and esi, 0x800000ff
jns 0x100010b7
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [esi + 0x1000fa68]
mov byte [ecx + 0x1000fa68], al
inc ecx
mov byte [esi + 0x1000fa68], bl
cmp ecx, 0x100
jl 0x10001090
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x100015f0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
call fcn.10001440
xor byte [0x1000edc0], al
call fcn.10001c00
add al, 0x67
mov byte [0x1000edc1], al
mov al, byte [0x1000edc6]
add al, 0x36
push 0x5c
push edi
mov byte [0x1000edca], al
call fcn.100036d0
add esp, 8
mov esi, eax
call fcn.10001c00
sub al, byte [0x1000edbd]
mov cl, byte [0x1000edbc]
mov byte [0x1000edba], al
mov al, cl
and al, 0x6d
mov edx, 3
mov bl, 0x74
mov byte [0x1000edca], 0xfa
mov byte [0x1000edc9], 0x6f
mov byte [0x1000edc5], 0x7d
mov byte [0x1000edc7], al
mov byte [0x1000edb8], dl
mov byte [0x1000edc0], bl
test esi, esi
jne 0x100016c0
mov dword [ebp - 8], edx
mov dl, byte [0x1000edc1]
mov byte [0x1000edc3], 0x48
jmp 0x10001690
mov esi, 4
jmp 0x100016a0
mov al, byte [0x1000edbb]
or al, dl
mov byte [0x1000edc4], al
call fcn.100014a0
dec esi
jne 0x100016a0
dec dword [ebp - 8]
jne 0x10001690
mov esi, edi
jmp 0x100017c8
mov dl, byte [0x1000edc4]
cmp dl, 9
jne 0x100017a2
movsx ecx, cl
mov byte [0x1000edc7], al
mov byte [0x1000edca], 0xfa
mov byte [0x1000edc9], 0x6f
mov byte [0x1000edc5], 0x7d
cmp ecx, 0xcfe203
jg 0x100017c7
call fcn.10001440
cmp byte [0x1000edbe], al
jle 0x100017c7
mov al, byte [0x1000edbc]
mov edi, 2
jmp 0x10001720
and al, 0x6d
cmp byte [0x1000edc3], 0x3f
mov byte [0x1000edc7], al
jle 0x10001757
call fcn.10001b40
mov al, byte [0x1000edbc]
mov dl, byte [0x1000edc5]
sub dl, byte [0x1000edba]
mov byte [0x1000edc7], dl
lea ebx, [eax - 0x37]
mov byte [0x1000edc0], bl
jmp 0x1000179d
call fcn.10001b40
movsx eax, al
cmp eax, 0x711899
jl 0x10001798
mov cl, 0x60
sub cl, byte [0x1000edc6]
mov byte [0x1000edbc], 0x59
mov byte [0x1000edc7], cl
call fcn.10001550
mov bl, byte [0x1000edbd]
mov dl, 0x6d
imul dl
or bl, 0x72
mov byte [0x1000edc1], al
mov byte [0x1000edc0], bl
mov al, byte [0x1000edbc]
dec edi
jne 0x10001720
jmp 0x100017c7
cmp dl, 0xdf
jle 0x100017c7
mov al, byte [0x1000edbb]
xor al, byte [0x1000edbe]
mov cl, 0x90
mov byte [0x1000edc5], al
movzx eax, byte [0x1000edc7]
imul cl
mov byte [0x1000edc4], al
inc esi
mov al, bl
add al, byte [0x1000edc4]
mov cl, 0xc8
sub cl, byte [0x1000edc5]
or al, bl
mov byte [0x1000edb8], 0xcb
mov byte [ebp - 1], cl
mov byte [0x1000edc8], al
call fcn.10001b40
mov dl, 0xc8
sub dl, al
mov al, byte [ebp - 1]
add al, 0x58
mov byte [0x1000edba], al
movsx eax, byte [0x1000edc3]
mov byte [0x1000edbb], dl
cmp eax, 0x7d6532
jl 0x1000184e
mov byte [0x1000edca], 0xfa
call fcn.100014a0
mov cl, byte [0x1000edbc]
and cl, 0x6d
mov byte [0x1000edbb], 0x79
mov byte [0x1000edc7], cl
mov byte [0x1000edca], 0xfa
mov byte [0x1000edc9], 0x6f
mov byte [0x1000edc5], 0x7d
mov byte [0x1000edbc], 0x25
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10003669
push eax
push eax
push eax
push 0x10001c50
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10003680
Capabilities:
Create thread

Disassembly:
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
call dword [sym.imp.USER32.dll_DdeClientTransaction]
call dword [sym.imp.USER32.dll_DlgDirListA]
call dword [sym.imp.USER32.dll_DefDlgProcA]
call dword [sym.imp.ole32.dll_StgIsStorageILockBytes]
call dword [sym.imp.ole32.dll_CoRevokeMallocSpy]
jmp dword [sym.imp.ole32.dll_HMENU_UserUnmarshal]

Function at 0x100036b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100036c0
repz ret
jmp fcn.10003b31

Function at 0x10009911
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10004c9a
and dword [ebp - 0x14], 0
cmp dword [0x1000fa4c], 0
mov dword [ebp - 0x18], eax
jne 0x100099c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10009a6c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10009a6c
mov esi, dword [0x1000edb4]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000fa4c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000fa50], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000fa54], eax
call edi
push eax
call esi
mov dword [0x1000fa5c], eax
test eax, eax
je 0x100099c4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000fa58], eax
mov eax, dword [0x1000fa58]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x1000edb0]
cmp eax, ecx
je 0x10009a1d
cmp dword [0x1000fa5c], ecx
je 0x10009a1d
push eax
call esi
push dword [0x1000fa5c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10009a1d
test ebx, ebx
je 0x10009a1d
call edi
test eax, eax
je 0x10009a14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10009a14
test byte [ebp - 8], 1
jne 0x10009a1d
or dword [ebp + 0x10], 0x200000
jmp 0x10009a50
mov eax, dword [0x1000fa50]
cmp eax, dword [ebp - 0x18]
je 0x10009a50
push eax
call esi
test eax, eax
je 0x10009a50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10009a50
mov eax, dword [0x1000fa54]
cmp eax, dword [ebp - 0x18]
je 0x10009a50
push eax
call esi
test eax, eax
je 0x10009a50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000fa4c]
call esi
test eax, eax
je 0x10009a6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10009a6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100036b6
leave
ret
Function at 0x10009730
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov edx, dword [eax + 4]
mov esi, dword [eax]
or edx, esi
je 0x100097cc
mov edx, 8
mov esi, ecx
shr esi, 0x1b
shl ecx, 5
or esi, ecx
xor ecx, ecx
mov cl, byte [eax]
imul ecx, ecx, 0x13cee4d1
xor ecx, esi
inc eax
dec edx
jne 0x1000974b
test ecx, ecx
jne 0x1000976e
mov ecx, 0x13cee4d1
mov eax, ecx
push edi
mov edi, dword [esp + 0x1c]
mov edx, ecx
shr eax, 0x18
mov byte [esp + 0xf], al
mov eax, edi
mov ebx, ecx
shr eax, 2
shr edx, 8
shr ebx, 0x10
test eax, eax
mov byte [esp + 0x14], bl
jle 0x100097b6
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x1000979f
mov bl, byte [esp + 0x14]
xor byte [eax], cl
xor byte [eax + 1], dl
inc eax
inc eax
xor byte [eax], bl
mov bl, byte [esp + 0xf]
xor byte [eax + 1], bl
inc eax
inc eax
dec esi
jne 0x1000979b
jmp 0x100097ba
mov eax, dword [esp + 0x18]
and edi, 3
mov edx, edi
pop edi
jle 0x100097cc
mov bl, byte [eax]
xor bl, cl
mov byte [eax], bl
inc eax
dec edx
jne 0x100097c2
pop esi
pop ebx
pop ecx
ret

Function at 0x10020620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, 0x5e9212fc
mov edx, 0xa761f0f7
sub eax, eax
mov esi, dword [ebp + 0xc]
lea edi, [esi - 1]
inc edi
cmp byte [edi], 0
jne 0x10020638
cmp esi, edi
je 0x10020661
mov al, byte [esi]
inc esi
imul ecx, eax, 0x71b2c107
ror edx, 6
xor ecx, edx
imul edx, eax, 0xebae624d
ror ebx, 7
xor edx, ebx
mov ebx, ecx
cmp esi, edi
jb 0x10020642
and ebx, 0x7fffffff
cmp ebx, 0x7fffffab
jb 0x10020675
sub ebx, 0x7fffffab
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10020709
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push ebp
mov ebp, dword [ebp + 8]
mov ebx, dword [ebp + 0x8c]
mov ecx, dword [ebp + 0x94]
test ecx, ecx
je 0x10020749
lea edx, [esi + ecx]
cmp edx, edi
jbe 0x10020732
mov edx, edi
mov al, byte [esi]
xor bl, al
mov byte [esi], bl
ror ebx, 8
dec ecx
inc esi
cmp esi, edx
jb 0x10020732
test ecx, ecx
jne 0x100207e8
mov edx, dword [ebp]
sub edi, 4
jmp 0x1002078e
mov eax, 0x9c4e
mul edx
mov ecx, 0x7fffffab
div ecx
mov ecx, dword [ebp + 4]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov dword [ebp + 4], ecx
mov eax, dword [ebp + 8]
shr eax, 0x1b
mov ecx, dword [ebp + eax*4 + 0xc]
sub ecx, dword [ebp + 4]
mov dword [ebp + 8], ecx
mov dword [ebp + eax*4 + 0xc], edx
xor ebx, ecx
xor ebx, dword [esi]
mov dword [esi], ebx
add esi, 4
cmp esi, edi
jbe 0x10020751
add edi, 4
mov ecx, edi
sub ecx, esi
je 0x100207e5
mov eax, 0x9c4e
mul edx
mov ecx, 0x7fffffab
div ecx
mov ecx, dword [ebp + 4]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov dword [ebp + 4], ecx
mov eax, dword [ebp + 8]
shr eax, 0x1b
mov ecx, dword [ebp + eax*4 + 0xc]
sub ecx, dword [ebp + 4]
mov dword [ebp + 8], ecx
mov dword [ebp + eax*4 + 0xc], edx
xor ebx, ecx
mov ecx, 4
mov al, byte [esi]
xor bl, al
mov byte [esi], bl
ror ebx, 8
dec ecx
inc esi
cmp esi, edi
jb 0x100207d6
mov dword [ebp], edx
mov dword [ebp + 0x8c], ebx
mov dword [ebp + 0x94], ecx
pop ebp
pop ebx
pop edi
pop esi
leave
ret
Function at 0x401a40
Capabilities:
Encode data using xor

Disassembly:
std
invalid
add byte [eax], al
cmp eax, ebx
cmp dword [ecx], ebp
mov eax, dword [0x410260]
cmp eax, ebx
mov eax, 0x40d3bc
je 0x401a59
mov eax, 0x40c9c0
mov edx, dword [0x40d030]
pop ebx
push eax
push 0x407544
call dword [sym.imp.MSVCRT.dll_printf]
je 0x401a32
and al, 0x8b
cmp eax, 0x40d030
or ecx, 0xffffff88
cdq
jb 0x401a95
scasb al, byte es:[edi]
sbb ch, byte [esi]
add al, byte [0x49d1f700]
cmp eax, 1
mov dword [0xe34117ec], ecx
jl 0x401aff
mov eax, dword [0x410270]
dec esp
dec esp
add dword [ecx], eax
push ecx
push ecx
adc eax, sym.imp.MSVCRT.dll_malloc
and ebp, 4
test edi, esp
jne 0x401ac5
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push 0x40f914
add edx, 0x40
sbb bh, bh
adc eax, sym.imp.MSVCRT.dll_fprintf
pop esp
les ecx, [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
adc eax, ecx
xor al, dl
inc eax
add byte [ebx + 0x42ae8af0], cl
mov byte [eax + 0x75c98446], bh
test byte [ebx + 0x4317ece4], 0
mov ecx, dword [0x26c470]
test byte [0x413820], dh
lea edi, [edx + eax]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x40d030], eax
mov eax, dword [0x8b40c4]
mov cx, word [0x51410bb4]
or eax, 0x51410bb4
mov edx, dword [0xd61808]
push eax
push 0
push ecx
push 0x66
push edx
xor esp, edi
pop ss
inc ecx
loop 0x401b06
invalid
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
inc edi
xchg ebx, eax
in al, dx
mov edx, 0x7d8314ec
adc byte [edi + 0x7c], cl
pop es
mov dword [ebp + 0x10], 0xdc00004e
add ah, bl
fld qword [ebp + 8]
fcomp qword [0xbbdec230]
mov ecx, dword [ebp + 0x42]
push ebx
mov ebx, dword [ebp + 0x20]
mov byte [ebx], dh
not byte [edi - 0x21]
fnstsw ax
out 0x75, eax
cld
loopne 0x407f01
jne 0x407f18
mov dword [ecx], esi
test ah, 5
mov edi, ebx
jp 0x407f33
fld qword [ebp + 0x7f]
fchs
fstp qword [ebp + 8]
mov dword [ecx], 0xa
add byte [eax], al
invalid
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [eax - 0x3baeaf14]
jno 0x407f4a
fcmovnb st(0), st(1)
inc eax
add ch, bl
pop ebp
or ch, bl
inc ebp
in al, dx
fcomp qword [0x70c230]
xor dl, al
jo 0x407f51
jg 0x407f17
or al, 0xdf
loopne 0x407f4d
les eax, [ebx + edi*2 + 0x72]
lea esi, [ebx + 0x50]
loopne 0x407f63
jmp 0x407fba
fld qword [ebp - 0x14]
inc ebp
in al, dx
pop eax
sbb eax, 0x36c230
fnstsw ax
neg bh
inc esp
jnp 0x407fba
fld qword [ebp - 0x14]
fmul qword [0x7140c310]
dec esi
inc ebp
adc al, 0x50
pop edx
in al, dx
inc edi
fstp qword [esp]
inc dword [sym.imp.MSVCRT.dll_modf]
fnsave dword [edx]
hlt
pop ebp
and byte [ecx - 0x7737d5d0], dh
push cs
push esp
dec ebp
cld
inc ecx
arpl bx, si
mov dword [ebp - 4], ecx
ja 0x407f62
lea eax, [ebx + 0x50]
cmp esi, eax
jae 0x407fa7
mov dl, byte [esi]
ficom dword [edi]
inc edi
inc esi
xor al, dh
jb 0x407fc1
jmp 0x40801d
add byte [ebp + 0x10], al
lea esi, [eax + ebx]
lcall 0x375, 0xc0851c45
add esi, dword [ebp - 4]
adc byte [ebp + 0x459a1834], cl
sbb al, 0x85
sal byte [ebp + 3], 3
add eax, dword [ebx]
jne 0x408029
mov ecx, dword [ebp + 0x14]
cmp esi, ebx
jae 0x408047
mov dword [ebp - 0x2708c1f0], esp
mov dword [ecx], eax
mov byte [ebx], 0
mov eax, ebx
pop esi
fmul dword [ebx + 0x16a75de5]
push ss
push ebp
dec ebp
out dx, al
dec byte [ecx - 0x22c38818]
inc ebp
dec ecx
lea esp, [0x73f8c650]
xor ah, bl
or eax, 0x40c2f8
lea eax, [ebp - 0xc]
push eax
or dword [eax + ecx - 0xdbe323], 0x15
pop esi
ror ebp, 0
fld qword [ebp - 0xc]
add esp, 0xc
add eax, 0x8ba4fa35
dec ebp
push 0x4665d8b
xor byte [eax + 7], ch
inc edi
cmp edi, esi
pushfd
leave
fstp qword [ebp + ecx*4 - 0xdc4afad]
jb 0x40801f
pop edi
invalid
Function at 0x4022c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004e50f0
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1000
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004e69c0
mov ecx, dword [ebp - 0x1008]
add esp, 0xc
mov dword [ebp - 0x100c], 0
test ecx, ecx
jne 0x40231a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr eax, 2
push ebx
push edi
cmp eax, 0x40000
jbe 0x402358
mov eax, 0x10000
mov dword [ebp + 0xc], eax
push 4
push eax
call fcn.004eea94
mov ecx, dword [ebp - 0x1008]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x402375
mov eax, 0x400
lea ebx, [ebp - 0x1004]
mov dword [ebp + 0xc], eax
jmp 0x402378
shr eax, 2
mov dword [ebp + 0xc], eax
cmp eax, 0x400
ja 0x402331
mov eax, 0x400
lea ebx, [ebp - 0x1004]
mov dword [ebp + 0xc], eax
jmp 0x402378
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
xor edi, edi
cmp dword [0x55fd7c], esi
je 0x40244e
nop dword [eax]
cmp dword [ebp + 0x10], 0
je 0x4023b6
push 0
lea edx, [ebp - 0x100c]
shl eax, 2
push edx
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x100c]
shr ecx, 2
jmp 0x4023c5
push ecx
push eax
push 4
push ebx
call fcn.004e91b7
add esp, 0x10
mov ecx, eax
mov dword [ebp - 0x100c], ecx
test ecx, ecx
je 0x402440
xor esi, esi
cmp ecx, 8
jb 0x402420
mov eax, ecx
xorps xmm2, xmm2
and eax, 0xfffffff8
xorps xmm1, xmm1
movups xmm0, xmmword [ebx + esi*4]
paddd xmm2, xmm0
movups xmm0, xmmword [ebx + esi*4 + 0x10]
add esi, 8
paddd xmm1, xmm0
cmp esi, eax
jb 0x4023e1
paddd xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
add edi, eax
cmp esi, ecx
jae 0x402428
nop
add edi, dword [ebx + esi*4]
inc esi
cmp esi, ecx
jb 0x402420
mov eax, dword [ebp + 0xc]
add edi, ecx
cmp dword [0x55fd7c], 0
mov ecx, dword [ebp - 0x1008]
jne 0x402390
test edi, edi
jne 0x40244e
test esi, esi
mov eax, 1
cmovne edi, eax
pop esi
test ebx, ebx
je 0x402466
lea eax, [ebp - 0x1004]
cmp ebx, eax
je 0x402466
push ebx
call fcn.004eea9f
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x40cf20
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x587bec], 0
mov ax, word [ebp + 8]
mov word [ebp + 8], ax
mov ax, word [ebp + 0xc]
mov byte [ebp - 1], 0
mov word [ebp + 0xa], ax
je 0x40cf53
call fcn.004d9850
sub eax, dword [0x587bf0]
cmp eax, 0xfa0
jb 0x40cf79
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x587bec], eax
cmp eax, 0xffffffff
jne 0x40cf6f
mov dword [0x587bec], 0
call fcn.004d9850
mov dword [0x587bf0], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 1]
push 1
push eax
push dword [0x587bec]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
jne 0x40cf9d
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
movsx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x40cfc0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
je 0x40d022
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40d02a
push ebx
mov ebx, dword [ebp + 8]
jns 0x40cff1
call fcn.0040e080
mov ecx, eax
mov eax, edi
cdq
sub ecx, ebx
mov edi, eax
xor edi, edx
sub edi, edx
cmp ecx, edi
cmovl edi, ecx
mov ax, word [ebp + 0xc]
mov word [ebp - 2], ax
lea eax, [ebp + 0x14]
push eax
mov word [ebp - 4], bx
push dword [ebp - 4]
push edi
push esi
call fcn.0040deb0
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
mov eax, dword [ebp + 0x14]
pop ebx
jne 0x40d035
cmp eax, edi
jg 0x40d02a
mov byte [eax + esi], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, edi
jg 0x40d046
mov byte [eax + esi], 0
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d1a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push 0x124
push 0
push eax
call fcn.004e69c0
add esp, 0xc
test esi, esi
je 0x40d2d2
cmp byte [esi], 0
je 0x40d2d2
push ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d212
push dword [ebp + 0xc]
push esi
push str.CountProcesses__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.00424a90
add esp, 0xc
or eax, ebx
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40d266
push dword [ebp + 0xc]
push esi
push str.CountProcesses__s___d__FAILED:_Process32First___FAILED_
call fcn.00424a90
add esp, 0xc
push 0x8e8
push str.C:UsersOfficeDocumentsVisual_StudioPAULAConsole.c
push str.CountProcesses
push ebx
call fcn.00426230
pop ebx
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
push edi
xor edi, edi
nop dword [eax]
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x108]
push esi
push eax
je 0x40d28c
call fcn.004eeba8
add esp, 8
test eax, eax
jne 0x40d299
jmp 0x40d298
call fcn.004a96e0
add esp, 8
test eax, eax
je 0x40d299
inc edi
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40d270
push 0x90c
push str.C:UsersOfficeDocumentsVisual_StudioPAULAConsole.c
push str.CountProcesses
push ebx
call fcn.00426230
mov eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x40dfc0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jne 0x40e046
mov esi, 0x5880d8
cmp edi, 0x100
jb 0x40e046
push esi
mov edi, 0xff
call fcn.004a55e0
add esp, 4
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov word [ebp + 0x12], ax
lea eax, [ebp + 0x14]
push eax
mov word [ebp + 0x10], bx
push dword [ebp + 0x10]
push edi
push esi
call fcn.0040deb0
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
jne 0x40e03f
cmp byte [0x5867dc], al
jne 0x40e03f
push str._GetLastError_
push edi
push dword [ebp + 0xc]
push ebx
push str.:3:GetConsoleText__d___d___d__FAILED:_ReadConsoleOutputCharacter___FAILED:__s
call fcn.00424fd0
add esp, 0x14
mov byte [0x5867dc], 1
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret
test eax, eax
mov esi, 0x5880d8
cmovne esi, eax
push esi
call fcn.004a55e0
add esp, 4
test edi, edi
jg 0x40dff1
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.:3:GetConsoleText__d___d___d__FAILED:_iCount_is_invalid:__d
call fcn.00424fd0
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x40e140
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x58880c], 0
jne 0x40e1ac
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x103
push eax
push 0x588708
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40e18b
push 0x588708
call fcn.004a73a0
add esp, 4
test eax, eax
jne 0x40e18b
mov dword [0x58880c], 1
mov eax, 0x588708
mov esp, ebp
pop ebp
ret
push 0x104
push str.UNKNOWN_USER
push 0x588708
call fcn.004a9a20
add esp, 0xc
mov dword [0x58880c], 0
mov eax, 0x588708
mov esp, ebp
pop ebp
ret