joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513c60
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x128], edi
mov eax, dword [edi + 8]
mov dword [ebp - 0x108], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0xc]
add eax, 2
nop
movzx edx, byte [eax - 2]
lea eax, [eax + 4]
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [ebp + esi*4 - 0x104], edx
inc esi
cmp esi, 0x10
jl 0x513cd0
lea ebx, [ebp - 0xcc]
mov edi, 0x30
nop word [eax + eax]
mov ecx, dword [ebx - 0x34]
lea ebx, [ebx + 4]
mov edx, dword [ebx - 4]
mov esi, ecx
mov eax, ecx
rol esi, 0xe
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x513d10
mov edi, dword [ebp - 0x128]
xor ebx, ebx
mov ecx, dword [ebp - 0x11c]
nop dword [eax]
mov esi, dword [ebp - 0x108]
mov edx, ecx
mov eax, ecx
ror edx, 0xb
rol eax, 7
xor edx, eax
mov eax, ecx
ror eax, 6
xor edx, eax
mov eax, dword [ebp - 0x114]
xor eax, dword [ebp - 0x118]
and eax, ecx
mov ecx, esi
xor eax, dword [ebp - 0x118]
add edx, eax
ror ecx, 0xd
add edx, dword [ebx + 0x542200]
mov eax, esi
add edx, dword [ebp + ebx - 0x104]
add ebx, 4
add edx, dword [ebp - 0x124]
add dword [ebp - 0x10c], edx
rol eax, 0xa
xor ecx, eax
mov eax, esi
ror eax, 2
xor ecx, eax
mov eax, dword [ebp - 0x120]
mov esi, eax
add ecx, edx
and eax, dword [ebp - 0x108]
or esi, dword [ebp - 0x108]
and esi, dword [ebp - 0x110]
mov edx, dword [ebp - 0x108]
or esi, eax
mov eax, dword [ebp - 0x118]
add esi, ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x108], esi
cmp ebx, 0x100
jl 0x513d60
add dword [edi + 8], esi
add dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10c]
add dword [edi + 0x14], eax
mov eax, dword [ebp - 0x114]
add dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x118]
add dword [edi + 0x20], eax
add dword [edi + 0x18], ecx
mov eax, dword [ebp - 0x124]
add dword [edi + 0x24], eax
xor eax, eax
add dword [edi + 0xc], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
Function at 0x514b90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x552c20]
mov edi, eax
add esp, 4
test edi, edi
jne 0x514bbd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x514c04
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x514c0a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x514c6b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x514c30
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x514c97
mov eax, dword [esi + 4]
push 1
push 0x5423fe
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5423ff
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x514c70
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40633c
pop dword [ebp - 0x44]
mov eax, 0x40633c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x838b517d
sub dword [ebp - 0x54], 0x35390c32
mov dword [ebp - 0x50], 0x778aec80
add dword [ebp - 0x50], 0xbaa85fc5
mov dword [ebp - 0x4c], 0xb2f89b10
add dword [ebp - 0x4c], 0x9953a91e
mov dword [ebp - 0x48], 0xf91dfb49
sub dword [ebp - 0x48], 0xf91dfb49
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe06de3ab
add eax, 0x1fd28cb5
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xfef7579e
add dword [ebp - 0x54], 0x757b11b8
mov dword [ebp - 0x50], 0x33f9415c
add dword [ebp - 0x50], 0xd732019
mov dword [ebp - 0x4c], 0x8c5a0b6e
sub dword [ebp - 0x4c], 0x28ea9f02
mov dword [ebp - 0x48], 0xafaeba55
sub dword [ebp - 0x48], 0xafaeba55
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xab471b34
add eax, 0x54f955cc
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x34bb9
push 0
call eax
mov ecx, 0x96ea0a36
sub ecx, 0x96e9c9c1
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x44]
mov ebx, 0xc93dcc82
sub ebx, 0x8de69268
add dword [ebp - 4], 0xb9fd0b0c
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0x1c], ecx
mov dword [edi], edx
mov dword [ebp - 0x34], 0x52f37739
add edi, 0xd2a76753
add edi, 0x2d5898b1
add esi, 4
loop 0x406455
add eax, 0xeec2405f
sub eax, 0xeec14bb8
mov ebx, eax
add eax, 0x5bd62374
add eax, 0xa429dc91
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401360
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4073f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
call fcn.004010e0
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push 0xe
push ecx
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 4], 0
call dword [eax + 0x3c]
cmp eax, 0xe
je 0x4013d9
push 8
call sub.MFC42u.DLL_operatornew
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
mov byte [ebp - 4], 1
je 0x4013c2
call sub.MFC42u.DLL_CException::CException
jmp 0x4013c4
xor eax, eax
lea edx, [ebp - 0x14]
push 0x408b08
push edx
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], eax
call sub.MSVCRT.dll__CxxThrowException
cmp word [ebp - 0x2c], 0x4d42
je 0x401416
push 8
call sub.MFC42u.DLL_operatornew
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
mov byte [ebp - 4], 2
je 0x4013ff
call sub.MFC42u.DLL_CException::CException
jmp 0x401401
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x408b08
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0x22]
lea ebx, [ecx - 0xe]
push ebx
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esi + 0xc], eax
mov edx, dword [edi]
mov ecx, edi
push ebx
push eax
call dword [edx + 0x3c]
mov ecx, esi
jmp section..htext
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f004]
jne 0x40100a
repz ret
jmp fcn.0040149b

Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004039fa
and dword [ebp - 0x14], 0
cmp dword [0x421c40], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x421c40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x421c44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x421c48], eax
call edi
push eax
call esi
mov dword [0x421c50], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x421c4c], eax
mov eax, dword [0x421c4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x421c50], ecx
je 0x404637
push eax
call esi
push dword [0x421c50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x421c44]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x421c48]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x421c40]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x4175e0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x810808]
imul eax, eax, 0x343fd
cmp dword [0x812c7c], 0x139e
mov dword [0x810808], eax
jne 0x417621
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
mov eax, dword [0x810808]
add eax, 0x269ec3
push esi
mov dword [0x810808], eax
movzx esi, word [0x81080a]
and esi, 0x7fff
cmp dword [0x812c7c], 0x8e7
jne 0x417656
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x4176a0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x4176b4
call fcn.004175e0
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x4176a7
pop esi
cmp ebx, 0x2d
jne 0x4176ce
mov dword [0x812c88], 0xa62e7790
mov dword [0x812c8c], 0xffffffff
ret

Function at 0x4176d0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x41fdb8]
sub esp, 0x14
push ebx
mov ebx, dword [0x812c7c]
push edi
mov edi, dword [0x81080c]
call fcn.00417670
cmp dword [0x812c7c], 0x2f
jne 0x41772a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.004176a0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x417a10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00407bd0
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x417a39
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x417ae1
cmp dword [0x812c7c], 0xa5f
jne 0x417a85
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x818]
push edx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 4], 0x84620b
jne 0x417aaa
mov eax, dword [0x420bd8]
mov dword [0x812c7c], eax
mov ecx, dword [0x812c7c]
add ecx, 0xa231
mov dword [0x812c7c], ecx
cmp dword [0x812c7c], 0x141
jne 0x417adc
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x422180], 0xec58acac
mov dword [0x422184], 0xffffffff
jmp 0x417a30
call fcn.00417740
jmp dword [0x81080c]
Function at 0x407e2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ec50]
jne 0x407e39
repz ret
jmp fcn.0040c56d

Function at 0x40b2c0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406060
and dword [ebp - 4], 0
cmp dword [0x438620], 0
mov ebx, eax
jne 0x40b371
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b422
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b422
push eax
call fcn.00405fee
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x438620], eax
call esi
push eax
call fcn.00405fee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438624], eax
call esi
push eax
call fcn.00405fee
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438628], eax
call esi
push eax
call fcn.00405fee
pop ecx
mov dword [0x438630], eax
test eax, eax
je 0x40b371
push 0x42af10
push edi
call esi
push eax
call fcn.00405fee
pop ecx
mov dword [0x43862c], eax
mov eax, dword [0x43862c]
cmp eax, ebx
je 0x40b3c9
cmp dword [0x438630], ebx
je 0x40b3c9
push eax
call fcn.00406069
push dword [0x438630]
mov esi, eax
call fcn.00406069
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b3c9
test edi, edi
je 0x40b3c9
call esi
test eax, eax
je 0x40b3c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b3c0
test byte [ebp - 0xc], 1
jne 0x40b3c9
or dword [ebp + 0x10], 0x200000
jmp 0x40b402
mov eax, dword [0x438624]
cmp eax, ebx
je 0x40b402
push eax
call fcn.00406069
pop ecx
test eax, eax
je 0x40b402
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b402
mov eax, dword [0x438628]
cmp eax, ebx
je 0x40b402
push eax
call fcn.00406069
pop ecx
test eax, eax
je 0x40b402
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438620]
call fcn.00406069
pop ecx
test eax, eax
je 0x40b422
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b424
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.004015e1

Function at 0x40541b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403efa
and dword [ebp - 0x14], 0
cmp dword [0x42cd68], 0
mov dword [ebp - 0x18], eax
jne 0x4054ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405576
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405576
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42cd68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42cd6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42cd70], eax
call edi
push eax
call esi
mov dword [0x42cd78], eax
test eax, eax
je 0x4054ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42cd74], eax
mov eax, dword [0x42cd74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405527
cmp dword [0x42cd78], ecx
je 0x405527
push eax
call esi
push dword [0x42cd78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405527
test ebx, ebx
je 0x405527
call edi
test eax, eax
je 0x40551e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40551e
test byte [ebp - 8], 1
jne 0x405527
or dword [ebp + 0x10], 0x200000
jmp 0x40555a
mov eax, dword [0x42cd6c]
cmp eax, dword [ebp - 0x18]
je 0x40555a
push eax
call esi
test eax, eax
je 0x40555a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40555a
mov eax, dword [0x42cd70]
cmp eax, dword [ebp - 0x18]
je 0x40555a
push eax
call esi
test eax, eax
je 0x40555a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42cd68]
call esi
test eax, eax
je 0x405576
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405578
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x426110
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x42a004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x81b930]
imul eax, eax, 0x343fd
cmp dword [0x81bff4], 0x139e
mov dword [0x81b930], eax
jne 0x426151
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [0x81b930]
add eax, 0x269ec3
push esi
mov dword [0x81b930], eax
movzx esi, word [0x81b932]
and esi, 0x7fff
cmp dword [0x81bff4], 0x8e7
jne 0x426186
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x4261d0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x4261e4
call fcn.00426110
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x4261d7
pop esi
cmp ebx, 0x2d
jne 0x4261fe
mov dword [0x81c000], 0xa62e7790
mov dword [0x81c004], 0xffffffff
ret

Function at 0x426200
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x42b1e8]
sub esp, 0x14
push ebx
mov ebx, dword [0x81bff4]
push edi
mov edi, dword [0x81b934]
call fcn.004261a0
cmp dword [0x81bff4], 0x2f
jne 0x42625a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.004261d0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x426570
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409fb0
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x426599
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x426641
cmp dword [0x81bff4], 0xa5f
jne 0x4265e5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.zayekezipusunagozisanuhima
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84620b
jne 0x42660a
mov eax, dword [0x42c008]
mov dword [0x81bff4], eax
mov ecx, dword [0x81bff4]
add ecx, 0xa231
mov dword [0x81bff4], ecx
cmp dword [0x81bff4], 0x141
jne 0x42663c
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x42d2a8], 0xec58acac
mov dword [0x42d2ac], 0xffffffff
jmp 0x426590
call fcn.00426270
jmp dword [0x81b934]
Function at 0x10c3c1f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret
pop esi
add esi, dword [edi + eax*4]
ret 4
movzx eax, byte [edi]
lea edi, [edi + 1]
sub dword [esp], eax
cmp byte [edi], 1
jmp 0x10c3b4b
pop eax
ja 0x10c3c9a
xor eax, 0xbe9e9f04
jmp 0x10c3d2b
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
lea esi, [esi + ecx*2]
push ebx
movzx eax, word [esi]
jmp 0x10bf046
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
pop ecx
inc ecx
jmp 0x10c3cbe
mov edx, ebx
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
jmp 0x10c3bdb
pop eax
imul eax, eax, 0xf
push eax
jmp 0x10c3af8
lodsd eax, dword [esi]
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
je 0x10bf000
push 0
jmp 0x10c3c99
sbb eax, dword [esp + 4]
jne 0x10c3be1
lea edi, [ebx]
lea esi, [ebx]
jmp 0x10c3bc9
Function at 0x4045b8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406cfc
test esi, esi
jne 0x4045f0
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406e38
jmp 0x40460e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044fc
mov edi, eax
test esi, esi
je 0x40460e
cmp dword [ebx], 0
je 0x40460e
dec esi
jmp 0x4045f7
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405f24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5b6054], 0
je 0x405f85
cmp word [0x5b6330], 0xd7b2
jne 0x405f4d
cmp dword [0x5b6338], 0
jbe 0x405f4d
mov eax, 0x5b632c
call dword [0x5b6348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405fb0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5ad030], 0
jne 0x405fa1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x5ad034], 0
je 0x406156
mov edx, esi
mov eax, ebx
call dword [0x5ad034]
jmp 0x406165
mov eax, 8
call fcn.00404244
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x5b6055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4060f8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc