joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415980
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx + 0x10], 0
mov edi, edx
jne 0x415a59
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x4159ab
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x415a26
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x415a42
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4159e4
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x415a03
jmp 0x4159f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4159fc
cmp eax, 0x6d
jne 0x415a18
mov byte [esi + 1], 0
jmp 0x415a0d
mov ecx, 1
xor eax, eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
mov byte [esi + 1], 1
xor eax, eax
mov byte [esi], al
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov al, 1
jmp 0x415a0f
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.004378d0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x4159b6
mov ecx, ebx
push 1
call fcn.004378d0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x4159b6
add edi, 0x10
mov edx, esp
mov dword [esp], 0
mov ecx, edi
call fcn.004376d0
ud2
Function at 0x419780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41c8f0
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x34]
push eax
call fcn.004149e0
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x419813
cmp byte [ebp - 0x30], 3
jne 0x41983c
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edi
mov eax, dword [ecx]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 0
push eax
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x419801
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00402fa0
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00402fa0
add esp, 0xc
mov edi, dword [ebp - 0x24]
jmp 0x41983c
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x41983c
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419853
mov eax, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
jmp 0x419842
mov dword [edi], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [edi], 0
je 0x419842
add ebx, ebx
je 0x419842
push 2
push ebx
push esi
call fcn.00402fa0
add esp, 0xc
jmp 0x419842

Function at 0x41a0e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41c910
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
push 4
push 8
call fcn.00402f90
add esp, 8
mov ebx, eax
test eax, eax
je 0x41a1cb
mov eax, dword [ebp + 0xc]
mov dword [ebx], edi
mov dword [ebx + 4], esi
push 0
push 0x10000
push ebx
push 0x41a230
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41a15b
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
xor eax, eax
jmp 0x41a1b6
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x28], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 4]
test eax, eax
je 0x41a18f
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call fcn.00402fa0
add esp, 0xc
push 4
push 8
push dword [ebp - 0x20]
call fcn.00402fa0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov eax, 1
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0
push 4
push 8
call fcn.00438290
add esp, 8
ud2
Function at 0x41a3f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x41a405
test eax, eax
jne 0x41a51d
mov ebp, dword [0x446a4c]
test ebp, ebp
je 0x41a51d
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
jmp 0x41a427
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41a448
push dword [ebp + 4]
call edi
test eax, eax
je 0x41a420
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x41a420
test bl, 1
je 0x41a51d
mov ebp, dword [0x446a4c]
test ebp, ebp
je 0x41a51d
xor ebx, ebx
jmp 0x41a477
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41a498
push dword [ebp + 4]
call edi
test eax, eax
je 0x41a470
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x41a470
test bl, 1
je 0x41a51d
mov ebp, dword [0x446a4c]
test ebp, ebp
je 0x41a51d
xor ebx, ebx
jmp 0x41a4b7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41a4d8
push dword [ebp + 4]
call edi
test eax, eax
je 0x41a4b0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x41a4b0
test bl, 1
je 0x41a51d
mov ebp, dword [0x446a4c]
test ebp, ebp
je 0x41a51d
xor ebx, ebx
jmp 0x41a4f7
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41a518
push dword [ebp + 4]
call edi
test eax, eax
je 0x41a4f0
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
mov bl, 1
jmp 0x41a4f0
test bl, 1
jne 0x41a529
mov al, byte [0x442cc0]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebp, dword [0x446a4c]
jmp 0x41a534
mov ebp, dword [ebp + 8]
test ebp, ebp
je 0x41a51d
push dword [ebp + 4]
call edi
test eax, eax
je 0x41a531
mov esi, eax
push 0
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [ebp]
add esp, 4
jmp 0x41a531
Function at 0x41b760
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x446030]
mov esi, ecx
test eax, eax
je 0x41b77b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41b794
jmp 0x41b7a0
push 0x446030
call fcn.00411100
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41b7a0
cmp byte [eax + 4], 0
mov edi, eax
jne 0x41b835
mov eax, dword [0x446030]
test eax, eax
je 0x41b80c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41b825
mov edi, eax
test eax, eax
jne 0x41b7f5
push 4
push 8
call fcn.00402f90
add esp, 8
test eax, eax
je 0x41b83d
mov byte [eax + 4], 0
mov dword [eax], 0x446030
mov edi, eax
mov eax, dword [0x446030]
test eax, eax
jne 0x41b7ed
push 0x446030
call fcn.00411100
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41b82c
movzx eax, word [esi]
mov byte [esi], 0
mov ecx, eax
shr ecx, 8
and eax, 1
cmovne eax, ecx
jmp 0x41b82e
push 0x446030
call fcn.00411100
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41b7b5
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
xor eax, eax
mov byte [edi + 4], 1
mov byte [edi + 5], al
add edi, 5
mov eax, edi
pop esi
pop edi
ret
push 4
push 8
call fcn.00438290
add esp, 8
ud2

Function at 0x41b850
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x446038]
mov esi, ecx
test eax, eax
je 0x41b86c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41b885
jmp 0x41b894
push 0x446038
call fcn.00411100
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41b894
cmp dword [eax], 0
mov ebx, eax
je 0x41b894
add ebx, 4
jmp 0x41b97c
mov eax, dword [0x446038]
test eax, eax
je 0x41b915
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41b932
mov edi, eax
test eax, eax
jne 0x41b8f4
push 4
push 0x10
call fcn.00402f90
add esp, 8
test eax, eax
je 0x41b982
mov dword [eax], 0
mov dword [eax + 0xc], 0x446038
mov edi, eax
mov eax, dword [0x446038]
test eax, eax
jne 0x41b8ec
push 0x446038
call fcn.00411100
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor edx, edx
test esi, esi
je 0x41b936
mov ebx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi], 0
test ebx, ebx
je 0x41b93a
cmp ebx, 1
jne 0x41b93e
mov edx, ecx
jmp 0x41b957
push 0x446038
call fcn.00411100
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41b8ad
xor ebx, ebx
jmp 0x41b97c
xor eax, eax
jmp 0x41b957
mov eax, ebx
jmp 0x41b957
test ecx, ecx
je 0x41b953
xor eax, eax
lock dec dword [ecx]
mov edx, 0
jne 0x41b957
call fcn.004086a0
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 8]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], edx
je 0x41b97c
test ecx, ecx
je 0x41b97c
lock dec dword [ecx]
jne 0x41b97c
call fcn.004086a0
mov eax, ebx
pop esi
pop edi
pop ebx
ret
push 4
push 0x10
call fcn.00438290
add esp, 8
ud2
Function at 0x41b990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x446040]
mov esi, ecx
test eax, eax
je 0x41b9ab
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41b9c4
jmp 0x41b9cf
push 0x446040
call fcn.00411100
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41b9cf
cmp dword [eax], 0
mov edi, eax
jne 0x41ba6a
mov eax, dword [0x446040]
test eax, eax
je 0x41ba3f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41ba58
mov edi, eax
test eax, eax
jne 0x41ba27
push 4
push 0xc
call fcn.00402f90
add esp, 8
test eax, eax
je 0x41ba72
mov dword [eax], 0
mov dword [eax + 8], 0x446040
mov edi, eax
mov eax, dword [0x446040]
test eax, eax
jne 0x41ba1f
push 0x446040
call fcn.00411100
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41ba5f
mov ecx, dword [esi]
xor eax, eax
mov dword [esi], 0
cmp ecx, 1
jne 0x41ba61
mov eax, dword [esi + 4]
jmp 0x41ba61
push 0x446040
call fcn.00411100
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41b9e4
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
xor eax, eax
mov dword [edi], 1
mov dword [edi + 4], eax
add edi, 4
mov eax, edi
pop esi
pop edi
ret
push 4
push 0xc
call fcn.00438290
add esp, 8
ud2
Function at 0x427bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x427c48
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x427c40
cmp ebp, ebx
jb 0x427cc2
cmp ebp, dword [esp + 0x1c]
ja 0x427cd1
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x427c42
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x427c30
jmp 0x427c9f
ja 0x427c48
cmp edx, edi
mov ebx, ebp
jne 0x427c05
mov edx, dword [esp + 0x24]
test edx, edx
je 0x427ca3
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x427c80
mov esi, edi
sub ecx, ebx
jns 0x427c97
jmp 0x427ca5
cmp edi, edx
je 0x427cac
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x427ca5
xor al, 1
cmp esi, edx
jne 0x427c60
jmp 0x427ca5
xor eax, eax
jmp 0x427ca5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43d62c
push 0x2b
push str.called__Option::unwrap____on_a__None__value:
call fcn.004382c0
add esp, 0xc
ud2
sub esp, 4
push ebp
push ebx
call fcn.004384f0
add esp, 0xc
ud2
sub esp, 4
push dword [esp + 0x20]
push ebp
call fcn.004384e0
add esp, 0xc
ud2

Function at 0x4296a1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4296e0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4296e0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4296e0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4296e0
cmp dword [ecx + 0x74], 0xe
jbe 0x4296e0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x430ab3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x430b50
push ebx
push esi
call fcn.00430a7c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00430a10
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x430afd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x430b4f
push edi
push eax
call fcn.004316d0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x430b1d
call fcn.0042f571
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x430b4e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00430a10
add esp, 0x20
test eax, eax
jne 0x430b3c
push edi
call fcn.0042f571
jmp 0x430b44
push ebx
call fcn.0042f571
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x431e4d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43fe88
push 0x43fe80
push str.FlsAlloc
push 0x1f
call fcn.00431d0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x431e81
push dword [ebp + 8]
mov ecx, esi
call dword [0x4391bc]
call esi
jmp 0x431e87
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x431ecb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43fe98
push 0x43fe90
push str.FlsGetValue
push 0x21
call fcn.00431d0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x431f02
push dword [ebp + 8]
mov ecx, esi
call dword [0x4391bc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x431f0a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43fea0
push 0x43fe98
push str.FlsSetValue
push 0x22
call fcn.00431d0c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x431f44
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4391bc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4373a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4373cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4373cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x422f20]
and dword [ebp - 8], 0
mov dword [ebp - 0x24], eax
mov eax, dword [0x422f24]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
call fcn.00401022
mov eax, dword [0x422f28]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x422f2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [0x24409f4]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x40109c
mov dword [0x24409f0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010aa
and dword [0x244047c], 0
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x24409f4], 0xc
mov dword [0x24409ec], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010f1
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x24]
add ecx, edi
xor eax, ecx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401073
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40112f
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x24409f4]
mov ecx, dword [0x2440480]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4011ea
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x24409f4], 0x959
jne 0x4011d9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.zewaxuwawazuwuyuvivi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401157
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4014a1
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x24409f4], 0x400
push edi
jne 0x4014fe
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004016d6
push esi
push esi
call fcn.0040180c
push esi
call fcn.00401e21
push esi
push esi
call fcn.00401c6c
push esi
call fcn.00401eb7
push esi
push esi
call fcn.00401710
add esp, 0x24
xor edi, edi
cmp edi, 0x16d2a
jge 0x401516
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x40153b
inc edi
cmp edi, 0x3011b
jl 0x401500
mov eax, dword [0x42336c]
mov dword [0x24409f4], eax
call fcn.004011ed
mov edi, 0x3078f
cmp dword [0x24409f4], 0x51f
jne 0x401569
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x40154f
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40725a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422cfc]
jne 0x407264
repz ret
jmp fcn.00409062
Function at 0x40827d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422cfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040567a
and dword [ebp - 0x14], 0
cmp dword [0x42dfb4], 0
mov dword [ebp - 0x18], eax
jne 0x408330
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4083d8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4083d8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42dfb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42dfb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42dfbc], eax
call edi
push eax
call esi
mov dword [0x42dfc4], eax
test eax, eax
je 0x408330
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42dfc0], eax
mov eax, dword [0x42dfc0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408389
cmp dword [0x42dfc4], ecx
je 0x408389
push eax
call esi
push dword [0x42dfc4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408389
test ebx, ebx
je 0x408389
call edi
test eax, eax
je 0x408380
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408380
test byte [ebp - 8], 1
jne 0x408389
or dword [ebp + 0x10], 0x200000
jmp 0x4083bc
mov eax, dword [0x42dfb8]
cmp eax, dword [ebp - 0x18]
je 0x4083bc
push eax
call esi
test eax, eax
je 0x4083bc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4083bc
mov eax, dword [0x42dfbc]
cmp eax, dword [ebp - 0x18]
je 0x4083bc
push eax
call esi
test eax, eax
je 0x4083bc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42dfb4]
call esi
test eax, eax
je 0x4083d8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4083da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040725a
leave
ret