joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fa90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x6a0f5c]
push 0
push eax
push esi
call fcn.00515def
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
push 1
push ecx
push edx
call fcn.00515cb6
sub eax, 1
add esp, 0x1c
neg eax
sbb eax, eax
add eax, 1
ret

Function at 0x5617e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push edi
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
xor ebp, ebp
xor ebx, ebx
call fcn.0051600c
add esp, 4
test eax, eax
jne 0x561838
mov ebx, dword [edi + 0x10]
xor edx, edx
cmp dword [edi], ebp
mov dword [0x6a0f6c], ebp
mov dword [0x6a0f70], ebp
mov dword [0x6a0f74], ebp
mov dword [0x6a0f78], edx
mov dword [0x6a0f68], ebp
je 0x561855
mov eax, edi
add eax, 0x18
add edx, 1
cmp dword [eax], ebp
jne 0x561826
mov dword [0x6a0f78], edx
jmp 0x561855
cmp dword [0x6a0f68], ebp
je 0x561849
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov ebp, dword [0x6a0f6c]
mov edx, dword [0x6a0f78]
lea ecx, [ebp + ebp*2]
push esi
mov esi, ebp
lea ecx, [edi + ecx*8 + 0x14]
cmp esi, edx
jge 0x5619a8
mov eax, dword [ecx]
add eax, ebx
cmp eax, dword [esp + 0x38]
jg 0x56187c
add esi, 1
mov ebx, eax
add ecx, 0x18
jmp 0x561860
lea ecx, [esi + esi*2]
cmp dword [edi + ecx*8], 0x676c7966
lea eax, [edi + ecx*8]
mov dword [esp + 0x14], esi
jne 0x561986
cmp dword [0x6a0f74], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0xffff
jne 0x5618b5
mov edx, dword [eax + 0x14]
mov dword [0x6a0f74], edx
mov eax, dword [0x6a0f70]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
lea eax, [eax + eax*4]
lea ebp, [ecx + eax*4 + 4]
lea esp, [esp]
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x30]
jge 0x561968
movzx edi, word [ebp - 2]
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 4]
mov esi, dword [ebp]
movzx eax, di
push eax
push edx
call sym.convertifd.exe_TT_Get_Glyph_Loca
add esp, 8
cmp di, word [esp + 0x1c]
je 0x561943
movzx eax, di
lea ecx, [esi + ebx + 3]
cmp ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
jg 0x56193b
sub dword [0x6a0f74], esi
add ebx, esi
and esi, 3
jbe 0x56192f
mov eax, 4
sub eax, esi
add ebx, eax
sub dword [0x6a0f74], eax
jmp 0x561943
xor eax, eax
add ebx, eax
sub dword [0x6a0f74], eax
jmp 0x561943
mov dword [esp + 0x18], 1
add dword [esp + 0x10], 1
mov esi, dword [esp + 0x14]
add ebp, 0x14
cmp dword [esp + 0x18], 0
je 0x5618d0
mov eax, dword [esp + 0x10]
add eax, 0xffffffff
mov dword [0x6a0f70], eax
jmp 0x561998
cmp dword [esp + 0x18], 0
jne 0x56195a
add ebx, dword [0x6a0f74]
lea edx, [esi + 1]
mov dword [0x6a0f6c], edx
mov edx, dword [0x6a0f78]
jmp 0x5619a4
cmp esi, ebp
jne 0x56199e
push esi
push str.Table__d_didnt_fit._n
call fcn.005278bd
add esp, 8
mov edx, dword [0x6a0f78]
mov dword [0x6a0f6c], esi
cmp esi, edx
jl 0x5619b8
mov dword [0x6a0f6c], edx
mov dword [0x6a0f68], 1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
push ecx
push ebx
push 1
push edx
call fcn.00515cb6
add esp, 0x10
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x561a90
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1f404
call fcn.00516c30
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x1f400], eax
mov ecx, dword [esp + 0x1f40c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1f414]
lea eax, [esp + 0x1f41c]
push eax
lea ebx, [esp + 0x10]
push ecx
mov edx, ebx
push edx
call fcn.00517d3c
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x561ad6
sub eax, edx
cmp dword [0x6a0f60], 0
mov ebp, eax
je 0x561b98
cmp ebp, 0x7d00
jle 0x561b66
lea ecx, [ebp - 0x7d01]
mov eax, 0x10624dd3
mul ecx
mov eax, dword [0x6a0f64]
push edi
mov edi, edx
shr edi, 0xb
add edi, 1
mov edx, edi
imul edx, edx, 0xffff8300
add ebp, edx
lea ecx, [ecx]
test eax, eax
jle 0x561b3d
push str.__writestring_n
push esi
call fcn.00517e58
push str.handle__
push esi
call fcn.00517e58
add esp, 0x10
push esi
push 0x7d00
push 1
push ebx
call fcn.0051646d
add esp, 0x10
add ebx, 0x7d00
sub edi, 1
mov eax, 0x7d00
mov dword [0x6a0f64], eax
jne 0x561b20
pop edi
jmp 0x561b6b
mov eax, dword [0x6a0f64]
lea ecx, [eax + ebp]
cmp ecx, 0x7d00
jle 0x561b91
push str.__writestring_n
push esi
call fcn.00517e58
push str.handle__
push esi
call fcn.00517e58
add esp, 0x10
xor eax, eax
add eax, ebp
mov dword [0x6a0f64], eax
push esi
push ebp
push 1
push ebx
call fcn.0051646d
mov ecx, dword [esp + 0x1f41c]
add esp, 0x10
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00511a80
add esp, 0x1f404
ret
Function at 0x563030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x7e0c
call fcn.00516c30
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x7e08], eax
mov eax, dword [esp + 0x7e10]
push ebx
push ebp
push edi
mov ebx, ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x58f9f0
push 0
mov dword [esp + 0x1c], eax
mov ebp, 1
call sym.convertifd.exe_CfGetTempFileName
lea edx, [esp + 0x20]
push 0x58f498
push edx
call fcn.00515a07
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x5630a0
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7e08]
xor ecx, esp
call fcn.00511a80
add esp, 0x7e0c
ret
mov eax, dword [esp + 0x7e24]
mov ecx, dword [esp + 0x7e20]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push 0x5c01a8
push ebx
push edi
call sym.convertifd.exe_WriteTrueTypeFont
push 2
push 0
push edi
call fcn.00515def
push edi
call fcn.0051600c
mov ebx, eax
mov eax, dword [0x6a0f80]
push 6
push eax
mov dword [esp + 0x3c], ebx
call sym.convertifd.exe_HP_ReadFontHeader_1
mov ecx, dword [0x6a0f80]
push 6
push ecx
call sym.convertifd.exe_HP_EmbeddedDataPrefix
mov edx, dword [0x6a0f80]
push edx
call sym.convertifd.exe_HP_FlushStreamBuffer
push esi
push 0x47
call fcn.00518226
add esp, 0x44
push esi
push 0x54
call fcn.00518226
mov eax, ebx
shr eax, 0x18
push esi
push eax
call fcn.00518226
movzx ecx, byte [esp + 0x1e]
push esi
push ecx
call fcn.00518226
movzx edx, bh
push esi
push edx
call fcn.00518226
push esi
and ebx, 0xff
push ebx
call fcn.00518226
push 0
push 0
push edi
call fcn.00515def
push edi
push 0x7d00
lea eax, [esp + 0x150]
push 1
push eax
call fcn.00515cb6
mov ebx, eax
add esp, 0x44
test ebx, ebx
jle 0x5631be
mov ecx, dword [0x6a0f80]
push ebx
push ecx
call sym.convertifd.exe_HP_ReadFontHeader_1
mov edx, dword [0x6a0f80]
push ebx
push edx
call sym.convertifd.exe_HP_EmbeddedDataPrefix
mov eax, dword [0x6a0f80]
push eax
call sym.convertifd.exe_HP_FlushStreamBuffer
push esi
push ebx
lea ecx, [esp + 0x130]
push 1
push ecx
call fcn.0051646d
push edi
push 0x7d00
lea edx, [esp + 0x140]
push 1
push edx
mov ebp, eax
call fcn.00515cb6
mov ebx, eax
add esp, 0x34
test ebx, ebx
jg 0x563168
mov eax, dword [0x6a0f80]
push 6
push eax
call sym.convertifd.exe_HP_ReadFontHeader_1
mov ecx, dword [0x6a0f80]
push 6
push ecx
call sym.convertifd.exe_HP_EmbeddedDataPrefix
mov edx, dword [0x6a0f80]
push edx
call sym.convertifd.exe_HP_FlushStreamBuffer
push esi
push 0xff
call fcn.00518226
push esi
push 0xff
call fcn.00518226
push esi
push 0
call fcn.00518226
push esi
push 0
call fcn.00518226
push esi
push 0
call fcn.00518226
push esi
push 0
call fcn.00518226
add esp, 0x44
push edi
call fcn.005158c7
lea eax, [esp + 0x14]
push eax
call fcn.00511b16
mov ecx, dword [esp + 0x7e1c]
add esp, 8
pop edi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00511a80
add esp, 0x7e0c
ret
Function at 0x563630
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push 1
push edx
call fcn.0051646d
mov eax, dword [esp + 0x14]
add esp, 0x10
mov dword [eax + 8], 0
ret

Function at 0x5636a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x5bd254]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov dword [esp + 8], eax
xor eax, eax
push edi
push ebp
mov esi, ecx
mov byte [esp + 0x18], 0
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
call sym.convertifd.exe_CV_GetSymAbbrev
movzx ecx, word [ebx + 0x558]
movzx edx, word [ebx + 0x55a]
push eax
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebx + 0x34c]
push ecx
lea edx, [esp + 0x24]
push str.__13.13s_1.1d__2.2s
push edx
call fcn.005135ca
lea eax, [esp + 0x2c]
add esp, 0x18
lea edi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x563710
mov ecx, dword [0x6a0f80]
sub eax, edi
push 0
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call sym.convertifd.exe_HP_BeginFontHeader_1
mov edx, dword [0x6a0f80]
push 8
push edx
call sym.convertifd.exe_HP_ReadFontHeader_1
mov eax, dword [0x6a0f80]
push 8
push eax
call sym.convertifd.exe_HP_EmbeddedDataPrefix
mov ecx, dword [0x6a0f80]
push ecx
call sym.convertifd.exe_HP_FlushStreamBuffer
push esi
push 2
push 1
push 0x58fa0c
call fcn.0051646d
push ebp
call sym.convertifd.exe_CV_GetPCLName
mov edi, eax
add esp, 0x38
cmp byte [edi], 0
je 0x5637a9
push edi
call fcn.00511d40
mov ecx, edi
lea edx, [ecx + 1]
add esp, 4
mov dword [esp + 0x10], edx
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x563787
sub ecx, dword [esp + 0x10]
shl eax, 5
movzx cx, byte [ecx + edi - 1]
add cx, ax
sub cx, 0x40
movzx eax, cx
jmp 0x5637ae
mov eax, 0x115
movzx edi, ax
mov edx, edi
shr edx, 8
push esi
push edx
call fcn.00518226
push esi
and edi, 0xff
push edi
call fcn.00518226
push esi
push 2
push 1
push 0x58fa00
call fcn.0051646d
movzx edi, word [esp + 0x54]
mov eax, edi
shr eax, 8
push esi
push eax
call fcn.00518226
push esi
and edi, 0xff
push edi
call fcn.00518226
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x3c]
push ebp
push ecx
push edx
mov ecx, ebx
call fcn.00563030
mov eax, dword [0x6a0f80]
push eax
call sym.convertifd.exe_HP_EndFontHeader_1
mov ecx, dword [0x6a0f80]
add esp, 0x40
push ecx
call sym.convertifd.exe_HP_FlushStreamBuffer
mov ecx, dword [esp + 0x2c]
add esp, 4
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00511a80
add esp, 0x20
ret
Function at 0x574800
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x57480e
mov eax, 1
ret
mov ax, word [esp + 8]
cmp ax, word [ecx + 0x152]
jb 0x574822
mov eax, 0x404
ret
mov edx, dword [esp + 0xc]
movzx eax, ax
shl eax, 4
add eax, dword [ecx + 0x158]
movzx ecx, word [eax]
mov word [edx], cx
movzx ecx, word [eax + 2]
mov edx, dword [esp + 0x10]
mov word [edx], cx
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x14]
mov word [edx], cx
mov ax, word [eax + 6]
mov ecx, dword [esp + 0x18]
mov word [ecx], ax
xor eax, eax
ret

Function at 0x575640
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x6a1040]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push ecx
push esi
push 1
push edx
call fcn.00515cb6
sub eax, esi
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0x201
pop esi
ret
Function at 0x57f930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0xc]
shl eax, 7
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00515def
add esp, 0xc
test eax, eax
je 0x57f953
mov eax, 0xfffff811
jmp 0x57f9bd
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0x80
mov eax, dword [ebp + 8]
push eax
call fcn.00515cb6
add esp, 0x10
cmp eax, 1
je 0x57f976
mov eax, 0xfffff810
jmp 0x57f9bd
push 0x600ae0
mov ecx, dword [ebp + 8]
add ecx, 0x7e
push ecx
call sym.convertifd.exe_Swabber
add esp, 8
test eax, eax
je 0x57f995
mov eax, 0xfffff80f
jmp 0x57f9bd
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x7e]
mov ecx, dword [eax*4 + 0x600ab0]
push ecx
mov edx, dword [ebp + 8]
push edx
call sym.convertifd.exe_Swabber
add esp, 8
test eax, eax
je 0x57f9bb
mov eax, 0xfffff80f
jmp 0x57f9bd
xor eax, eax
pop ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41f60a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x41f619
pop dword [ebp - 0x50]
mov eax, 0x41f619
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd53acaef
add dword [ebp - 0x60], 0x79177a5c
mov dword [ebp - 0x5c], 0x1f19d7ee
add dword [ebp - 0x5c], 0x13197457
mov dword [ebp - 0x58], 0x94254d0a
sub dword [ebp - 0x58], 0x47d908dc
mov dword [ebp - 0x54], 0xc61496d3
sub dword [ebp - 0x54], 0xc61496d3
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x1fdd3baa
sub dword [ebp - 0x60], 0xab6ad254
mov dword [ebp - 0x5c], 0xd88d889f
sub dword [ebp - 0x5c], 0x9721272a
mov dword [ebp - 0x58], 0x9c08c441
add dword [ebp - 0x58], 0xc766a82b
mov dword [ebp - 0x54], 0x15e8d89
add dword [ebp - 0x54], 0xfea17277
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x618a7b12
add eax, 0x9eb7b612
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x40437
push 0
call eax
mov ecx, 0xf8983604
add ecx, 0x7681c4d
mov ebx, eax
mov edx, 0x175ff9b5
add edx, 0xe8e34a4b
add edx, dword [ebp - 0x50]
mov edi, 0xd28ecf05
add edi, 0x24bfb6bc
mov esi, dword [edx]
sub dword [ebp - 0x1c], 0xe7b45b1b
xor esi, edi
xor dword [ebp - 0x34], 0xa733c7c
mov dword [ebx], esi
sub dword [ebp - 0x24], 0xe5064b29
add ebx, 0xe2d34b1e
sub ebx, 0xe2d34b1a
add edx, 0xa9577986
sub edx, 0xa9577982
loop 0x41f731
add eax, 0x779e6dce
add eax, 0x8862ce49
mov ebx, eax
add eax, 0x1ebd9d2c
add eax, 0xe14262d9
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f004]
jne 0x40100a
repz ret
jmp fcn.00401647

Function at 0x4071c9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404019
and dword [ebp - 0x14], 0
cmp dword [0x421d84], 0
mov dword [ebp - 0x18], eax
jne 0x40727c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407324
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407324
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x421d84], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x421d88], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x421d8c], eax
call edi
push eax
call esi
mov dword [0x421d94], eax
test eax, eax
je 0x40727c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x421d90], eax
mov eax, dword [0x421d90]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4072d5
cmp dword [0x421d94], ecx
je 0x4072d5
push eax
call esi
push dword [0x421d94]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4072d5
test ebx, ebx
je 0x4072d5
call edi
test eax, eax
je 0x4072cc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4072cc
test byte [ebp - 8], 1
jne 0x4072d5
or dword [ebp + 0x10], 0x200000
jmp 0x407308
mov eax, dword [0x421d88]
cmp eax, dword [ebp - 0x18]
je 0x407308
push eax
call esi
test eax, eax
je 0x407308
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407308
mov eax, dword [0x421d8c]
cmp eax, dword [ebp - 0x18]
je 0x407308
push eax
call esi
test eax, eax
je 0x407308
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x421d84]
call esi
test eax, eax
je 0x407324
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407326
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x41b5f0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x4222a4]
imul eax, eax, 0x343fd
cmp dword [0x22c4e8c], 0x139e
mov dword [0x4222a4], eax
jne 0x41b643
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x4222a4]
add eax, 0x269ec3
push esi
mov dword [0x4222a4], eax
movzx esi, word [0x4222a6]
and esi, 0x7fff
cmp dword [0x22c4e8c], 0x8e7
jne 0x41b678
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x41b700
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4201f0]
push ebx
mov ebx, dword [0x22c4830]
push edi
mov edi, dword [0x22c4e8c]
call fcn.0041b690
cmp dword [0x22c4e8c], 0x2f
jne 0x41b765
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0041b6c0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x41bac0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41bae9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x41bb91
cmp dword [0x22c4e8c], 0xa5f
jne 0x41bb35
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x41bb5a
mov eax, dword [0x421010]
mov dword [0x22c4e8c], eax
mov ecx, dword [0x22c4e8c]
add ecx, 0xa231
mov dword [0x22c4e8c], ecx
cmp dword [0x22c4e8c], 0x141
jne 0x41bb8c
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4222a8], 0xec58acac
mov dword [0x4222ac], 0xffffffff
jmp 0x41bae0
call fcn.0041b780
jmp dword [0x22c4830]
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
push edi
pop ecx
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x1000b190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10002900
mov ecx, eax
call fcn.1000b4b0
call fcn.10002900
mov dword [eax], 7
call fcn.10002900
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x1000b211
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10002900
mov edx, eax
xor ecx, ecx
cmp dword [edx + 0x2c], ecx
jbe 0x1000b23b
nop
mov eax, dword [edx + 0x24]
mov esi, dword [edx + 0x20]
sub eax, esi
sar eax, 2
cmp eax, ecx
jbe 0x1000b254
mov al, byte [esi + ecx*4]
mov byte [ecx + edi], al
inc ecx
cmp ecx, dword [edx + 0x2c]
jb 0x1000b220
cmp dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 0x10
push str.invalid_vector_T__subscript
call fcn.1000bd0f
int3

Function at 0x1000b260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10002900
mov ecx, eax
call fcn.1000b4b0
call fcn.10002900
mov dword [eax], 8
call fcn.10002900
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x1000b2df
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
pop esi
sete al
xor ecx, ebp
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000e095
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [str.kernel32.dll]
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x10034a90]
mov ebp, eax
push ecx
push 0