joyce8/EMBER2024-capa huggingface dataset:
Function at 0x559a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0050d2c0
add esp, 0x18
test eax, eax
je 0x559a32
cmp eax, 0xffffffff
jne 0x559a34
xor eax, eax
pop ebp
ret

Function at 0x55d290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x71906c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x7277fd], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x158], ebx
jne 0x55d2c6
call fcn.0055db00
test al, al
je 0x55d2d7
mov byte [0x7277fd], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e165
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5a8]
test eax, eax
je 0x55d2f8
push 0x400
push eax
call fcn.005b4810
add esp, 8
call fcn.0055db00
test al, al
jne 0x55d2c6
push esi
push edi
nop word [eax + eax]
mov ebx, 2
mov dword [ebp - 0x150], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], eax
nop
lea eax, [ebp - 0x188]
push eax
call fcn.0054c970
push 0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x178], xmm0
movups xmmword [ebp - 0x168], xmm0
call fcn.005561c0
lea eax, [ebp - 0x198]
push eax
call fcn.0054c970
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1a8]
push eax
call fcn.0054c970
add esp, 0x14
mov ecx, eax
mov eax, esi
inc ebx
cdq
mov dword [ebp - 0x154], ebx
add eax, dword [ecx]
push 0
adc edx, dword [ecx + 4]
push ebx
push edx
push eax
call fcn.0042ee10
movups xmm1, xmmword [ebp - 0x178]
mov esi, dword [ebp - 0x148]
mov edi, eax
mov ebx, edx
dec esi
movaps xmm0, xmm1
movd eax, xmm1
psrldq xmm0, 4
movd ecx, xmm0
shld ebx, edi, 8
push ecx
push eax
push 0
push esi
shl edi, 8
call fcn.0042ee10
xor edi, eax
xor ebx, edx
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x168], edi
push eax
mov dword [ebp - 0x164], ebx
call fcn.0054c970
lea esi, [eax + 8]
lea eax, [ebp - 0x1c8]
push eax
call fcn.0054c970
mov edx, dword [ebp - 0x148]
add esp, 8
mov ebx, dword [ebp - 0x154]
mov dword [ebp - 0x148], ebx
mov ecx, dword [eax]
add ecx, dword [esi]
lea eax, [edx + 2]
imul edx, dword [ebp - 0x160]
imul ecx, eax
mov eax, dword [ebp - 0x14c]
shl ecx, 0x10
xor ecx, edx
mov dword [ebp - 0x160], ecx
movups xmm0, xmmword [ebp - 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x150], 1
mov dword [ebp - 0x14c], eax
jne 0x55d320
movsd xmm0, qword [0x6a8fe0]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.005b4450
add esp, 0x10
call fcn.0055db00
test al, al
je 0x55d300
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.005b4660
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x55d4a6
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.005b4810
add esp, 8
call fcn.0055db00
test al, al
jne 0x55d2c6
push str.libcurl_is_now_using_a_weak_random_seed__n
push dword [ebp - 0x158]
call fcn.00546ef0
add esp, 8
call fcn.0055db00
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e165
mov esp, ebp
pop ebp
ret
Function at 0x5672a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x5672d2
push str.Couldnt_set_desired_mode
push esi
call fcn.00546e30
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x5672e9
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.00546ef0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x567302
push ebx
push esi
call fcn.00566f40
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x567317
push esi
call fcn.00565f60
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x56732c
push esi
call fcn.00566f20
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x56733c
push esi
call fcn.00567180
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x57a320
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x719dec]
mov edi, eax
add esp, 4
test edi, edi
jne 0x57a34d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x57a397
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x57a39d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x57a3fb
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x57a3c0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x57a427
mov eax, dword [esi + 4]
push 1
push 0x6acbe0
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6acbe1
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x57a400
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58fa50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x58fabb
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x58fa80
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5b4810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0042f4a0
mov eax, dword [0x71906c]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x44], edi
test eax, eax
jne 0x5b4855
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0042e165
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5b483e
push 0x6b307c
push eax
call fcn.005bf4c0
mov ebx, eax
add esp, 8
mov dword [esp + 0x40], ebx
test ebx, ebx
je 0x5b4975
push 0x30
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.00507a20
add esp, 0xc
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00526c6f
add esp, 4
push eax
call fcn.005a7683
add esp, 8
test eax, eax
js 0x5b496c
mov eax, 8
call fcn.0042f4a0
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.005b4450
add esp, 0x10
test dword [esp + 0x4e], 0x2000
je 0x5b48f0
mov eax, 0x800
cmp esi, 0xffffffff
push 0
push ebx
cmove esi, eax
call fcn.006743c8
add esp, 8
nop dword [eax]
mov edi, 0x400
test esi, esi
jle 0x5b48fe
cmp esi, edi
cmovl edi, esi
push ebx
push edi
lea eax, [esp + 0x80]
push 1
push eax
call fcn.00511f2c
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x5b4952
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.0042f4a0
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push ebx
push eax
call fcn.005b4450
add dword [esp + 0x54], ebx
add esp, 0x10
mov ebx, dword [esp + 0x40]
test esi, esi
jle 0x5b48f0
sub esi, edi
test esi, esi
jg 0x5b48f0
lea eax, [esp + 0x78]
push 0x400
push eax
call fcn.005beff0
mov ebx, dword [esp + 0x48]
add esp, 8
mov edi, dword [esp + 0x44]
push ebx
call fcn.00511556
add esp, 4
mov ecx, dword [esp + 0x47c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042e165
mov esp, ebp
pop ebp
ret
Function at 0x5dc5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x5dc601
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x5dc608
add edx, 4
add esi, 4
sub ecx, 4
jae 0x5dc5f0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x5dc643
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x5dc643
cmp ecx, 0xfffffffd
je 0x5dc643
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x5dc643
cmp ecx, 0xfffffffe
je 0x5dc643
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x5dc643
cmp ecx, 0xffffffff
je 0x5dc643
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x5dc65e
push 0x157
push 0x6caf50
push 0x6caf80
call fcn.005c0130
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x5dc67d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x5dc67d
inc ecx
inc edx
cmp ecx, ebx
jl 0x5dc670
lea edx, [ebx - 1]
test edx, edx
js 0x5dc6a1
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x5dc6a1
cmp byte [eax], 0xff
jne 0x5dc6a1
dec eax
sub edx, 1
jns 0x5dc690
cmp ecx, edx
jl case.0x5dc6cd.2
jle 0x5dc6b3
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x5dc6cd.2
movzx eax, byte [eax + 0x5dc740]
jmp dword [eax*4 + 0x5dc720]
mov eax, 7
jmp 0x5dc703
mov eax, 6
jmp 0x5dc703
mov eax, 5
jmp 0x5dc703
mov eax, 4
jmp 0x5dc703
mov eax, 3
jmp 0x5dc703
mov eax, 2
jmp 0x5dc703
mov eax, 1
test dl, dh
jne case.0x5dc6cd.2
and bl, dl
cmp bl, dl
jne case.0x5dc6cd.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x609550
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x60963c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x6095cd
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x6d5ab0]
mov byte [edx], al
jmp 0x609621
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x6095e1
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x6d5ab0]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x6d5ab0]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x60960b
lea eax, [esi + 0x3c]
jmp 0x609618
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x609570
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x60a780
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0042f4a0
mov eax, dword [0x71906c]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x60a7e6
cmp edi, dword [esi]
je 0x60a7dd
test ebp, ebp
je 0x60a860
test ebx, ebx
js 0x60a860
mov eax, 1
mov dword [esi], edi
jmp 0x60a7ec
mov edi, dword [esi]
test edi, edi
je 0x60a860
test ebp, ebp
je 0x60a97a
push edi
call fcn.005b30a0
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x60a820
push 0x28
push 0x6d5db8
push 0x6d5de0
call fcn.005c0130
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x60a87b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.005af500
add esp, 0xc
test eax, eax
je 0x60a860
push ebx
push ebp
push dword [esi + 4]
call fcn.005af6b0
add esp, 0xc
test eax, eax
je 0x60a860
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.005af460
add esp, 0xc
test eax, eax
jne 0x60a897
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e165
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x60a860
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.00507c70
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x60a8ba
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.00507a20
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x60a8c0
push edx
push edi
push dword [esi + 8]
call fcn.005af500
add esp, 0xc
test eax, eax
je 0x60a860
push edi
call fcn.005b30a0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.005af6b0
add esp, 0x10
test eax, eax
je 0x60a860
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x60a910
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.005af500
add esp, 0xc
test eax, eax
je 0x60a860
push edi
call fcn.005b30a0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.005af6b0
add esp, 0x10
test eax, eax
je 0x60a860
push dword [esi + 8]
push dword [esi + 4]
call fcn.005af6e0
add esp, 8
test eax, eax
je 0x60a860
mov eax, 1
jmp 0x60a862
test eax, eax
je 0x60a95a
jmp 0x60a8be
Function at 0x401080
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40109f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4010a6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4010bd
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401c60
add esp, 4
or eax, 0xffffffff
jmp 0x4010bf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4099b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e708]
jne 0x4099ba
repz ret
jmp fcn.00410bc0
Function at 0x41f770
Capabilities:
Connect pipe
Get hostname
Get thread local storage value
Read file on windows
Read pipe
Set current directory
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
cmp dword [0x442ad8], 0x37
jne 0x41f875
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
push 0
push str.kariliperudotunarojijotiiwoyimi_tavuyikapay_kilovefiwavovoputosaza_jububenusiuzahojimipor_hulur
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.vezakayo_wuyohasu_kefaj_fiyevumipuzivofovogaris_helezozojavoxa
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
push 0
lea ecx, [ebp - 0x1d8]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x18], 0
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push str.Cagosuxeyixag_gabis
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push str.ligapesogoyahojifevekegeyesuna_miwibogopehapixiyo
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.rohikiwizotivogirodimigodemejano_goyopujexic_pemekodogosovoyozetanulifuwojapo
push str.hesemomagupazayubixazezepecex
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 4], 0
mov eax, dword [0x442adc]
add dword [ebp - 4], eax
mov eax, 0x8c456
add dword [ebp - 4], eax
mov edx, dword [0x44171c]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [edx], cl
mov esp, ebp
pop ebp
ret 4
Function at 0x41fdc0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x442ad8], 0x12e
jne 0x41fe1d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
xor ecx, ecx
mov word [ebp - 0x434], cx
xor edx, edx
mov word [ebp - 0x432], dx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
push 0
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shr ecx, 3
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x41fe3e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x41feec
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
cmp dword [0x442ad8], 0xe1b
jne 0x41fe66
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [ebp - 0x10]
shl edx, 1
mov dword [ebp - 0x10], edx
cmp dword [0x442ad8], 0x1c
jne 0x41fe90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [ebp - 0x438]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*4]
push ecx
call fcn.0041fb00
cmp dword [0x442ad8], 0x4fa
jne 0x41fee7
xor edx, edx
mov word [ebp - 0x440], dx
xor eax, eax
mov word [ebp - 0x43e], ax
lea ecx, [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x440]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
jmp 0x41fe35
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ff00
Capabilities:
Manipulate console buffer
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a0
mov dword [ebp - 4], 0
jmp 0x41ff1b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x41ffde
cmp dword [0x442ad8], 0xfc
jne 0x41ff68
mov ecx, dword [ebp - 0x460]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea edx, [ebp - 0x45c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
lea eax, [ebp - 0x458]
push eax
push str.talamofupesatacicinuianux
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x442ad8], 0x5e4
jne 0x41ffce
push str.bafop
push 0
lea ecx, [ebp - 0x878]
push ecx
push str.kavuwiwagidevoyivekifubiwatufeye_cexegogasufibodohom
push str.sonejopux_cokinibeyocivavavudozatezuwacel_jusujulatixazuvinevefibaxorevo_rosurorijahamuxeyo_nefusodawidacuxakosuzihano
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
xor edx, edx
mov word [ebp - 0x87c], dx
xor eax, eax
mov word [ebp - 0x87a], ax
lea ecx, [ebp - 0x46c]
push ecx
mov edx, dword [ebp - 0x87c]
push edx
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x468]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
cmp dword [ebp - 4], 0x9be51dc
jle 0x41ffd9
jmp 0x41ffde
jmp 0x41ff12
push 0x43bcb0
mov edx, dword [0x442ad8]
push edx
mov eax, dword [0x44171c]
push eax
call fcn.0041fdc0
mov dword [ebp - 0x880], 0
jmp 0x420010
mov ecx, dword [ebp - 0x880]
add ecx, 1
mov dword [ebp - 0x880], ecx
cmp dword [ebp - 0x880], 0x3e7a3
jge 0x420080
cmp dword [0x442ad8], 0x10
jne 0x420065
xor edx, edx
mov word [ebp - 0x894], dx
xor eax, eax
mov word [ebp - 0x892], ax
lea ecx, [ebp - 0x898]
push ecx
mov edx, dword [ebp - 0x894]
push edx
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x890]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [ebp - 0x880], 0x4f3b3
jne 0x42007e
call fcn.0041f760
jmp 0x420001
mov dword [ebp - 0x89c], 0
jmp 0x42009b
mov edx, dword [ebp - 0x89c]
add edx, 1
mov dword [ebp - 0x89c], edx
cmp dword [ebp - 0x89c], 0xdd9a7
jge 0x4200a9
jmp 0x42008c
call dword [0x44171c]
cmp dword [0x442ad8], 0x1144
jne 0x4200d1
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov esp, ebp
pop ebp
ret