joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d840
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x40d886
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040b450
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x40d8af
lea ebx, [esi + 8]
jmp 0x40d8b1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00403a40
test al, al
jne 0x40d8c7
mov ecx, dword [ebp - 0x18]
call fcn.00404480
jmp 0x40d8c9
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x40d8ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d8ea
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x40d913
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40d928
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.0040fa5a
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa19
mov esp, ebp
pop ebp
ret 4

Function at 0x40de00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424015
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.0040fa2a
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call fcn.00412260
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b6fa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b3a8
Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x8a6135
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
call fcn.008a5f6d
test al, al
je 0x8a619e
xor esi, esi
mov edi, 0x50a720
push 0x2d7accf0
call fcn.008a5a95
cmp eax, 0xf
jg 0x8a6166
push 0xee
call fcn.008a5cc5
cmp eax, 0x62
jle 0x8a6168
mov ebx, esi
mov eax, 0xfffffff8
test bl, 1
je 0x8a617c
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x8a617e
shr ebx, 1
inc eax
jne 0x8a616d
push 0x404ad4
call fcn.008a5925
cmp eax, 0x42
jle 0x8a6192
mov dword [edi], ebx
inc esi
add edi, 4
cmp esi, 0x100
jne 0x8a6148
pop edi
pop esi
pop ebx
ret
Function at 0x65f424
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0065f4a3
jae 0x65f430
xor ecx, ecx
call fcn.0065f4a3
jae 0x65f45a
xor eax, eax
call fcn.0065f4a3
jae 0x65f46b
mov al, 0x10
call fcn.0065f4a3
adc al, al
jae 0x65f44c
jne 0x65f498
stosb byte es:[edi], al
jmp 0x65f431
call fcn.0065f4af
dec ecx
loop 0x65f477
mov eax, ebp
call fcn.0065f4ad
jmp 0x65f499
lodsb al, byte [esi]
shr eax, 1
je 0x65f4bf
adc ecx, 2
mov ebp, eax
jmp 0x65f499
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0065f4ad
cmp eax, 0x7d00
jae 0x65f497
cmp eax, 0x500
jae 0x65f498
cmp eax, 0x7f
ja 0x65f499
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x65f431
pop ebp
ret 8
Function at 0x6ef522
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6eb650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x6ef540
push eax
call dword [fcn.006eb020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.006ecaa7
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x6ef604
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x6ef5af
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x6ef5af
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x6ef594
cmp dword [ebp - 0x14], eax
je 0x6ef602
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x6ecf88
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x6ef602
push 4
pop ecx
mov edi, 0x6ecf88
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x6ef602
cmp dword [edx + 0x124], eax
je 0x6ef5f0
push 0x6ef324
jmp 0x6ef5f5
push 0x6ef50a
push ebx
push dword [ebp - 0x18]
push edx
call fcn.006ef0fb
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.006f05aa
leave
ret

Function at 0x700c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
test esi, esi
je 0x700c7f
mov eax, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [eax + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x700c78
mov edi, edi
mov ecx, dword [edi + 0x20]
lea edx, [ecx + ebx*4]
mov eax, dword [edx + esi]
mov ecx, dword [esp + 0x18]
add eax, esi
push ecx
push eax
call dword [0x1000707c]
test eax, eax
jne 0x700c70
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx*2]
movzx ecx, word [eax + esi]
mov edx, dword [edi + 0x1c]
lea eax, [edx + ecx*4]
mov ebp, dword [eax + esi]
add ebp, esi
add ebx, 1
cmp ebx, dword [edi + 0x18]
jb 0x700c40
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x702010
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, dword [edi + 0x3c]
add esi, edi
lea eax, [esi + 0x50]
push 0x40
mov dword [esp + 0x20], eax
mov eax, dword [eax]
push 0x1000
push eax
push 0
mov dword [esp + 0x20], esi
call dword [0x10007020]
mov ebp, dword [esi + 0x54]
mov ebx, eax
mov eax, dword [0x100e1010]
test eax, eax
jne 0x702067
push 0x100070f8
push 0x100070ec
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100e1010], eax
push ebp
push edi
push ebx
call eax
movzx ecx, word [esi + 0x14]
mov ebp, dword [esp + 0x1c]
add esp, 0xc
cmp word [ebp + 6], 0
lea esi, [esi + ecx + 0x18]
mov dword [esp + 0x18], 0
jbe 0x702130
add esi, 0x10
mov edi, dword [esi - 4]
mov eax, dword [0x100e1014]
mov edx, dword [esi]
mov ebp, dword [esi - 8]
add edi, ebx
test eax, eax
mov dword [esp + 0x14], edx
jne 0x7020c4
push 0x10007110
push 0x10007100
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100e1014], eax
push ebp
push edi
call eax
mov eax, dword [esp + 0x14]
cmp ebp, eax
mov dword [esp + 0x14], ebp
jl 0x7020d8
mov dword [esp + 0x14], eax
mov ebp, dword [esi + 4]
mov eax, dword [0x100e1010]
add ebp, dword [esp + 0x24]
test eax, eax
jne 0x702104
push 0x100070f8
push 0x100070ec
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100e1010], eax
mov ecx, dword [esp + 0x14]
push ecx
push ebp
push edi
call eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
movzx ecx, word [edx + 6]
add eax, 1
add esp, 0xc
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x702091
mov ebp, edx
mov eax, dword [ebp + 0xa4]
mov edi, dword [ebp + 0xa0]
mov esi, ebx
sub esi, dword [ebp + 0x34]
add edi, ebx
test eax, eax
mov dword [esp + 0x18], eax
mov edx, edi
jle 0x70218c
lea ecx, [ecx]
mov eax, dword [edx + 4]
sub eax, 8
shr eax, 1
test eax, eax
lea ecx, [edx + 8]
jle 0x702182
mov dword [esp + 0x24], eax
movzx eax, word [ecx]
test eax, 0xf000
je 0x702178
and eax, 0xfff
add eax, dword [edx]
add eax, ebx
add dword [eax], esi
add ecx, 2
sub dword [esp + 0x24], 1
jne 0x702163
mov edx, ecx
sub ecx, edi
cmp ecx, dword [esp + 0x18]
jl 0x702150
mov edi, dword [ebp + 0x80]
mov eax, dword [edi + ebx + 0xc]
add edi, ebx
test eax, eax
je 0x7021f1
lea esp, [esp]
add eax, ebx
push eax
call dword [0x10007050]
cmp dword [edi + 4], 0
mov ebp, eax
jne 0x7021b6
mov esi, dword [edi + 0x10]
jmp 0x7021b8
mov esi, dword [edi]
add esi, ebx
cmp dword [esi], 0
je 0x7021e3
nop
mov eax, dword [esi]
test eax, eax
jns 0x7021cd
and eax, 0xffff
jmp 0x7021d1
lea eax, [eax + ebx + 2]
push eax
push ebp
call dword [0x100070a4]
mov dword [esi], eax
add esi, 4
cmp dword [esi], 0
jne 0x7021c0
mov eax, dword [edi + 0x20]
add edi, 0x14
test eax, eax
jne 0x7021a0
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push eax
push ebx
call dword [0x10007094]
push eax
call dword [0x10007098]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x702222
lea esi, [eax + ebx]
test esi, esi
je 0x702222
push 0
push 1
push ebx
call esi
push 0
push 2
push ebx
call esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x705390
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 1
push 0x10007f98
push 0x10007fa8
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1224], eax
push 0x10007fbc
push 0x10007fcc
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1220], eax
push 0x10007fe0
push 0x10007ff4
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e121c], eax
push 0x10008008
push 0x10008014
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1218], eax
push 0x10008028
push 0x10008038
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1258], eax
push 0x10008054
push 0x10008064
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1254], eax
push 0
call dword [0x1000709c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0
jmp 0x7054b1
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x20], edx
jge 0x705516
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x28
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
push 8
lea ecx, [ebp - 0x2c]
push ecx
call dword [0x100e1224]
push 8
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [0x100e1220]
push 8
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [0x100e121c]
cmp eax, 8
jne 0x705514
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.007043f0
mov dword [ebp - 8], eax
jmp 0x705516
jmp 0x7054a8
mov esp, ebp
pop ebp
ret
Function at 0x7214b0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x100b081c
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.00726fa0
mov dword [esi], eax
mov ecx, 0x20
mov dword [esi + 4], ebx
add esp, 8
mov byte [eax], bl
mov eax, 1
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xac], ecx
push 0x100b2e47
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0x100b2ff8
mov dword [esp + 0x28], 0x20000
mov dword [esp + 0x2c], 0x100b2fe8
mov dword [esp + 0x30], 0x100000
mov dword [esp + 0x34], 0x100b2fdc
mov dword [esp + 0x38], 0x40000
mov dword [esp + 0x3c], 0x100b2fd0
mov dword [esp + 0x40], 0x80000
mov dword [esp + 0x44], 0x100b2fc4
mov dword [esp + 0x48], 0x80000000
mov dword [esp + 0x4c], 0x100b2fb4
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x54], 0x100b2fa4
mov dword [esp + 0x58], 0x20000000
mov dword [esp + 0x5c], 0x100b2f94
mov dword [esp + 0x60], 0x10000000
mov dword [esp + 0x64], 0x100b2f88
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x100b2f78
mov dword [esp + 0x70], 0x80
mov dword [esp + 0x74], 0x100b2f60
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0x100b2f50
mov dword [esp + 0x80], 2
mov dword [esp + 0x84], 0x100b2f40
mov dword [esp + 0x88], 0x100
mov dword [esp + 0x8c], 0x100b2f28
mov dword [esp + 0x90], 0x10
mov dword [esp + 0x94], 0x100b2f18
mov dword [esp + 0x98], 4
mov dword [esp + 0x9c], 0x100b2f04
mov dword [esp + 0xa4], 0x100b2ef4
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x100b2ee0
mov dword [esp + 0xb4], 0x100b2ed0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0070c640
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0070c640
cmp ebp, ebx
je 0x72166f
push ebp
call fcn.00727000
add esp, 4
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test dword [esp + 0x120], eax
je 0x7216a4
not eax
and dword [esp + 0x120], eax
cmp dword [edi + 8], ebx
je 0x721698
push 0x100b2ecc
mov ecx, esi
call fcn.0070c470
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.0070c470
add ebp, 1
cmp ebp, 0x13
jb 0x721671
cmp dword [edi + 8], ebx
jne 0x7216f3
push 0x100b2ec4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0070c640
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0070c640
cmp ebp, ebx
je 0x72172f
push ebp
call fcn.00727000
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [esp + 0x120]
cmp eax, ebx
je 0x72172f
push eax
lea ecx, [esp + 0x20]
push 0x100b2ebc
push ecx
call dword [0x100b0254]
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x721723
push 0x100b2ecc
mov ecx, esi
call fcn.0070c470
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0070c470
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
Function at 0x721c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x100b081c
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.00726fa0
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push 0x100b2e47
lea ecx, [esp + 0x14]
mov byte [eax], bl
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x100b326c
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0x100b3254
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 0x100b3240
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x100b3228
mov dword [esp + 0x40], 0x800
mov dword [esp + 0x44], 0x100b3214
mov dword [esp + 0x48], 8
mov dword [esp + 0x4c], 0x100b31f4
mov dword [esp + 0x50], 0x10
mov dword [esp + 0x54], 0x100b31d8
mov dword [esp + 0x58], 0x20
mov dword [esp + 0x5c], 0x100b31b8
mov dword [esp + 0x60], 0x80
mov dword [esp + 0x64], 0x100b319c
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x6c], 0x100b3180
mov dword [esp + 0x70], 0x200
mov dword [esp + 0x74], 0x100b3168
mov dword [esp + 0x78], 0x1000
mov dword [esp + 0x7c], 0x100b3150
mov dword [esp + 0x80], 0x2000
mov dword [esp + 0x84], 0x100b3138
mov dword [esp + 0x88], 0x4000
mov dword [esp + 0x8c], 0x100b311c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0070c640
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0070c640
cmp ebp, ebx
je 0x721dd7
push ebp
call fcn.00727000
add esp, 4
mov ebx, dword [esp + 0x190]
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test ebx, eax
je 0x721e0a
not eax
and ebx, eax
cmp dword [edi + 8], 0
je 0x721dfe
push 0x100b2ecc
mov ecx, esi
call fcn.0070c470
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.0070c470
add ebp, 1
cmp ebp, 0xe
jb 0x721de0
xor ebp, ebp
cmp dword [edi + 8], ebp
jne 0x721e5b
push 0x100b2ec4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.0070c640
mov ebx, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.0070c640
cmp ebx, ebp
je 0x721e96
push ebx
call fcn.00727000
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
cmp ebx, ebp
je 0x721e96
push ebx
lea ecx, [esp + 0x90]
push 0x100b2ebc
push ecx
call dword [0x100b0254]
add esp, 0xc
cmp dword [edi + 8], ebp
je 0x721e87
push 0x100b2ecc
mov ecx, esi
call fcn.0070c470
lea edx, [esp + 0x8c]
push edx
mov ecx, esi
call fcn.0070c470
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
Function at 0x72f120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x10], ebx
je 0x72f24d
mov ecx, dword [edi + 0x3c]
mov esi, dword [ecx + edi + 0x78]
add ecx, edi
add esi, edi
cmp dword [esi + 0x18], ebx
mov dword [esp + 0x18], ecx
jbe 0x72f24d
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
lea edx, [eax + ebx*4]
mov eax, dword [edx + edi]
add eax, edi
test eax, 0xffff0000
je 0x72f182
test ebp, 0xffff0000
je 0x72f182
push ebp
push eax
call dword [0x100b01ac]
mov ecx, dword [esp + 0x18]
neg eax
sbb eax, eax
add eax, 1
jmp 0x72f18b
xor edx, edx
cmp eax, ebp
sete dl
mov eax, edx
test eax, eax
jne 0x72f1a1
add ebx, 1
cmp ebx, dword [esi + 0x18]
jb 0x72f153
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x24]
lea edx, [eax + ebx*2]
movzx eax, word [edx + edi]
mov edx, dword [esi + 0x1c]
lea eax, [edx + eax*4]
mov ebx, dword [eax + edi]
add ebx, edi
cmp ebx, esi
jb 0x72f249
mov ecx, dword [ecx + 0x7c]
add ecx, esi
cmp ebx, ecx
ja 0x72f249
xor ecx, ecx
cmp byte [ebx], cl
mov eax, ebx
je 0x72f1de
add eax, 1
add ecx, 1
cmp byte [eax], 0
jne 0x72f1d3
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
jbe 0x72f1f2
push esi
call fcn.00727050
add esp, 4
mov edi, eax
push esi
push ebx
push edi
call fcn.00726f30
add esp, 0xc
cmp byte [edi], 0
mov esi, edi
je 0x72f211
cmp byte [esi], 0x2e
je 0x72f222
add esi, 1
cmp byte [esi], 0
jne 0x72f204
push edi
call fcn.00727000
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
mov byte [esi], 0
call dword [0x100b00d4]
add esi, 1
push esi
push eax
call fcn.0072f120
push edi
mov esi, eax
call fcn.00727000
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x753910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov dx, word [eax]
shr dx, 1
push esi
movzx esi, dx
xor ecx, ecx
test si, si
push edi
mov word [esp + 8], 0x5c
mov word [esp + 0xa], 0x2f
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0x2a
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x3c
mov word [esp + 0x16], 0x3e
mov word [esp + 0x18], 0x7c
jbe 0x753997
mov edi, dword [eax + 4]
jmp 0x753970
movzx edx, cx
movzx edx, word [edi + edx*2]
xor eax, eax
lea esp, [esp]
cmp dx, word [esp + eax*2 + 8]
je 0x7539a2
add eax, 1
cmp eax, 9
jb 0x753980
add ecx, 1
cmp cx, si
jb 0x753970
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x404a60
Capabilities:
Get common file path
Get disk information
Get memory capacity
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x48d368]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x48d36c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0x9e3779b9
mov dword [ebp - 0x20], edx
call fcn.00404a50
mov ecx, dword [0x48d370]
mov edx, dword [0x48d374]
add dword [ebp - 8], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0x20
jmp 0x404ad0
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov esi, dword [ebp - 0xc]
mov eax, dword [0x494b04]
shl esi, 4
add esi, dword [ebp - 0x28]
cmp eax, 0xfa9
jne 0x404afc
mov dword [0x494b00], 0xedeb2e40
jmp 0x404b17
cmp eax, 0x3eb
jne 0x404b17
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x494590], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x2c]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x494b04], 0x9e6
mov dword [0x494afc], 0xf4ea3dee
jne 0x404b50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
xor dword [ebp - 4], esi
cmp dword [0x494b04], 0x213
jne 0x404bc6
push 0
push 0
push 0
push 0
call ebx
lea eax, [ebp - 0x548]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
lea ecx, [ebp - 0x948]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub edi, dword [ebp - 4]
cmp dword [0x494b04], 0xc
jne 0x404bda
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [ebp - 8]
mov eax, edi
shr eax, 5
lea ecx, [edx + edi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov edx, edi
shl edx, 4
add edx, dword [ebp - 0x20]
xor edx, dword [ebp - 4]
xor edx, ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
sub dword [ebp - 0x14], 1
jne 0x404ad0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4