joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de00
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4db06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0x10]
add ecx, 0x10
mov dword [ebp - 0x1c], eax
and ecx, 0xfffffff0
mov dword [ebp - 0x24], ecx
lea esi, [edi + 0x1e4]
add ecx, 0xfffffff0
mov dword [ebp - 0x2c], ecx
add ecx, ebx
mov dword [ebp - 0x28], ecx
cmp ebx, ecx
jae 0x40df0a
mov edx, eax
lea eax, [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebx + 4]
xor eax, dword [esi + 4]
mov ecx, dword [ebx]
xor ecx, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0xc]
xor eax, dword [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebx + 8]
xor ecx, dword [esi + 8]
lea esi, [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x214]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x40deb8
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0x10
push dword [ebp - 0x1c]
mov ecx, esi
push 0
push 0
push 0
push 0x10
push ecx
push eax
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x40dee7
push eax
push str.BCryptEncrypt_x_n
call fcn.0045f780
add esp, 8
mov ecx, edi
call fcn.0040dd20
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 4]
lea eax, [ebp - 0x14]
cmp eax, ecx
jae 0x40deea
mov ebx, dword [ebp - 0x18]
mov edx, dword [edi + 0x1e0]
lea eax, [ebx + esi]
push eax
push esi
mov ecx, edi
call fcn.0040d100
add esi, 0x10
lea eax, [ebp - 4]
add esp, 8
cmp esi, eax
jb 0x40dec5
mov ebx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add ebx, 0x10
mov esi, eax
mov dword [ebp - 0x20], ebx
add eax, 0x10
add edx, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
cmp ebx, dword [ebp - 0x28]
jb 0x40de50
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp + 0x10]
push ecx
movzx eax, cl
push eax
lea eax, [ebp - 4]
sub eax, ecx
push eax
call fcn.0048b570
mov eax, dword [ebp + 0x10]
add esp, 0xc
sub eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00489a20
mov eax, dword [esi]
add esp, 8
xor dword [ebp - 0x14], eax
mov ecx, edi
mov eax, dword [esi + 4]
xor dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [esi + 8]
push dword [ebp - 0x1c]
xor dword [ebp - 0xc], edx
mov edx, dword [esi + 0xc]
xor dword [ebp - 8], edx
push eax
call fcn.0040dd80
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00487555
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e3c0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x834
mov eax, dword [0x4db06c]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x10], ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], ebx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [ebp + 0xc]
lea ecx, [esp + 0x630]
push SysReAllocString
push esi
mov edx, ebx
mov dword [esp + 0x18], eax
call fcn.00462880
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x430]
push SysReAllocString
push esi
call fcn.00462880
mov esi, dword [sym.imp.KERNEL30.dll_GetFileAttributesW]
lea eax, [esp + 0x640]
add esp, 0x10
push eax
call esi
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jne 0x40e44a
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL30.dll_CreateDirectoryW]
test edi, edi
je 0x40e51a
cmp word [edi], 0
je 0x40e51a
push SysReAllocString
push dword [ebp + 0xc]
mov edx, edi
lea ecx, [esp + 0x228]
call fcn.00462880
add esp, 8
lea eax, [esp + 0x220]
push eax
call esi
cmp eax, 0xffffffff
je 0x40e51a
test ebx, ebx
jne 0x40e4a6
push 1
lea eax, [esp + 0x634]
push eax
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL30.dll_CopyFileW]
mov ebx, eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push SysReAllocString
push 0x4c0c9c
call fcn.00462880
push ecx
lea edx, [esp + 0x24]
mov ecx, edi
call fcn.00464ac0
add esp, 0xc
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push str._s.obsolete
push eax
call fcn.0040e140
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL30.dll_MoveFileW]
lea eax, [esp + 0x220]
push eax
call esi
mov edi, dword [sym.imp.KERNEL30.dll_DeleteFileW]
cmp eax, 0xffffffff
je 0x40e520
lea eax, [esp + 0x220]
push eax
call edi
jmp 0x40e520
mov edi, dword [sym.imp.KERNEL30.dll_DeleteFileW]
cmp dword [esp + 0x10], 0
jne 0x40e52b
test ebx, ebx
jne 0x40e5a3
lea eax, [esp + 0x428]
push eax
call esi
cmp eax, 0xffffffff
je 0x40e5a3
test ebx, ebx
jne 0x40e556
push 1
lea eax, [esp + 0x634]
push eax
lea eax, [esp + 0x430]
push eax
call dword [sym.imp.KERNEL30.dll_CopyFileW]
cmp dword [esp + 0x10], 0
je 0x40e5a3
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x1c]
push str._s.obsolete
push eax
call fcn.0040e140
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x42c]
push eax
call dword [sym.imp.KERNEL30.dll_MoveFileW]
lea eax, [esp + 0x428]
push eax
call esi
cmp eax, 0xffffffff
je 0x40e5a3
lea eax, [esp + 0x428]
push eax
call edi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push SysReAllocString
push str.to_ExeDir.lnk
call fcn.00462880
add esp, 8
lea eax, [esp + 0x18]
push eax
call esi
cmp eax, 0xffffffff
jne 0x40e5dc
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
sub esp, 0xc
call fcn.00464ac0
add esp, 0xc
mov ecx, dword [esp + 0x83c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00487555
mov esp, ebp
pop ebp
ret
Function at 0x4145f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4db06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov eax, ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea ebx, [eax + 0x28]
mov dword [ebp - 0x424], eax
push edi
mov ecx, ebx
mov dword [ebp - 0x420], edi
call fcn.0045bec0
push edi
mov ecx, ebx
lea eax, [eax + eax*2]
mov esi, dword [ebx + eax*8 + 0x18]
and esi, 1
shl esi, 5
call fcn.0045bec0
mov edi, esi
mov ecx, ebx
or edi, 0x2000
lea eax, [eax + eax*2]
mov eax, dword [ebx + eax*8 + 0x18]
and al, 4
cmove edi, esi
mov esi, dword [ebp - 0x420]
push esi
call fcn.0045bec0
push esi
lea eax, [eax + eax*2]
mov eax, dword [ebx + eax*8 + 0x18]
mov ebx, edi
or ebx, 0x40
and al, 2
cmove ebx, edi
call dword [sym.imp.KERNEL30.dll_GetDriveTypeW]
cmp eax, 4
jne 0x414679
or ebx, 0x10
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x430]
push eax
push 0x104
lea eax, [ebp - 0x41c]
push eax
push esi
call dword [sym.imp.KERNEL30.dll_GetVolumeInformationW]
test eax, eax
jne 0x4146de
test bl, 0x10
jne 0x4146c9
mov ecx, dword [ebp - 0x424]
push 1
push esi
push str.GetVolumeInformation
call fcn.0041a620
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00487555
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x214]
push str.NTFS
push eax
call fcn.004958b1
add esp, 8
test eax, eax
jne 0x4146fb
lea edx, [eax + 1]
jmp 0x414773
lea eax, [ebp - 0x214]
push str.REFS
push eax
call fcn.004958b1
add esp, 8
test eax, eax
jne 0x414718
lea edx, [eax + 4]
jmp 0x414773
lea eax, [ebp - 0x214]
push str.LTFS
push eax
call fcn.004958b1
add esp, 8
test eax, eax
jne 0x414737
mov edx, 0x80
jmp 0x414773
push 3
lea eax, [ebp - 0x214]
push 0x4c1728
push eax
call fcn.00495a26
add esp, 0xc
test eax, eax
je 0x41476e
lea eax, [ebp - 0x214]
push str.exFAT
push eax
call fcn.004958b1
add esp, 8
mov edx, 8
test eax, eax
jne 0x414773
mov edx, 2
mov esi, dword [ebp - 0x428]
or edx, ebx
mov ecx, edx
mov eax, esi
or ecx, 0x100
and al, 8
mov eax, esi
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and eax, 0x40000
mov eax, esi
cmove edx, ecx
mov ecx, edx
or ecx, 0x400
and al, 0x80
mov eax, dword [0x4e042c]
cmove ecx, edx
mov edx, ecx
or edx, 0x800
and esi, 0x400000
cmove edx, ecx
mov esi, edx
cmp eax, 7
jae 0x4147ef
cmp eax, 6
jne 0x4147d6
cmp dword [0x4e0430], 1
jae 0x4147ef
test dl, 5
mov esi, edx
setne cl
bt edx, 0xa
setb al
test al, cl
je 0x4147ef
or esi, 0xe00
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487555
mov esp, ebp
pop ebp
ret 4
Function at 0x4189f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp byte [esi + 0x10], 0
jne 0x418a0f
xor ecx, ecx
cmp ecx, dword [esi + 0xc]
pop esi
sbb eax, eax
neg eax
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 0x10]
neg edi
mov dword [esi + 0xc], 0
sbb edi, edi
and edi, 0xfa
push edi
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL30.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x418a55
cmp dword [ebx + 0x100c], 0
jne 0x418a89
cmp dword [ebp + 0x10], 0
je 0x418a92
push edi
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL30.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x418a35
push 1
lea edi, [esi + 0xc]
mov byte [esi + 0x10], 0
push edi
lea eax, [esi + 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL30.dll_GetOverlappedResult]
test eax, eax
jne 0x418a9e
call dword [sym.imp.KERNEL30.dll_GetLastError]
mov esi, eax
push esi
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL30.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL30.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 0xc
cmp dword [edi], 0
je 0x418a89
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc

Function at 0x4192f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
call dword [sym.imp.KERNEL30.dll_CancelIo]
mov eax, dword [ebp + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
nop dword [eax + eax]
mov esi, dword [eax + 4]
cmp esi, eax
je 0x4193df
test esi, esi
je 0x4193df
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41932e
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x41933a
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], 0
mov dword [esi], 0
dec dword [eax + 0x18]
cmp byte [esi + 0x10], 0
je 0x4193c3
push 0xfa
push dword [esi + 0x2c]
lea edi, [esi + 0xc]
mov dword [edi], 0
call dword [sym.imp.KERNEL30.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41938f
cmp dword [ebx + 0x100c], 0
jne 0x4193c0
push 0xfa
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL30.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x419371
push 1
push edi
lea eax, [esi + 0x1c]
mov byte [esi + 0x10], 0
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL30.dll_GetOverlappedResult]
test eax, eax
jne 0x4193c0
call dword [sym.imp.KERNEL30.dll_GetLastError]
mov edi, eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL30.dll_TlsSetValue]
push edi
call dword [sym.imp.KERNEL30.dll_SetLastError]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 4]
mov eax, dword [ecx]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [ecx]
mov dword [eax + 4], esi
inc dword [ecx + 8]
mov eax, dword [ebp - 4]
mov dword [ecx], esi
jmp 0x419310
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4193f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0xf44]
push esi
call dword [sym.imp.KERNEL30.dll_EnterCriticalSection]
cmp dword [ebx + 0x1020], 0
je 0x41949a
cmp dword [ebx + 0x100c], 0
jne 0x419494
xor esi, esi
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
cmp dword [ebx + 0x1004], esi
je 0x41945b
mov esi, dword [ebx + 0x10]
call dword [sym.imp.KERNEL30.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL30.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL30.dll_SetLastError]
test esi, esi
je 0x41945b
call fcn.00461690
mov edi, eax
mov dword [ebp - 4], edx
jmp 0x419464
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
push 0x64
lea ecx, [ebx + 0xf40]
call fcn.0045ea50
test esi, esi
je 0x41948b
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x41948b
call fcn.00461690
sub eax, edi
sbb edx, dword [ebp - 4]
add dword [esi], eax
adc dword [esi + 4], edx
cmp dword [ebx + 0x1020], 0
jne 0x419415
lea esi, [ebx + 0xf44]
push esi
call dword [sym.imp.KERNEL30.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1028]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a130
Capabilities:
Suspend thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xe84]
test eax, eax
jne 0x41a145
cmp dword [esi + 0xe88], eax
je 0x41a14e
cmp dword [esi + 0x1010], 0
je 0x41a152
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL30.dll_SuspendThread]
test eax, eax
je 0x41a160
push eax
call edi
mov eax, dword [esi + 0xe88]
test eax, eax
je 0x41a16d
push eax
call edi
mov eax, dword [esi + 0xe8c]
test eax, eax
je 0x41a17a
push eax
call edi
mov eax, dword [esi + 0xe90]
test eax, eax
je 0x41a187
push eax
call edi
mov dword [esi + 0x1010], 1
call dword [sym.imp.KERNEL30.dll_GetTickCount]
mov dword [esi + 0x1000], eax
mov eax, 1
pop edi
pop esi
ret

Function at 0x41a1b0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xe84], 0
jne 0x41a1c5
cmp dword [esi + 0xe88], 0
je 0x41a1ce
cmp dword [esi + 0x1010], 0
jne 0x41a1d2
xor eax, eax
pop esi
ret
push edi
mov dword [esi + 0x1010], 0
call dword [sym.imp.KERNEL30.dll_GetTickCount]
sub eax, dword [esi + 0x1000]
add dword [esi + 0xff4], eax
mov eax, dword [esi + 0xe84]
mov edi, dword [sym.imp.KERNEL30.dll_ResumeThread]
test eax, eax
je 0x41a202
push eax
call edi
mov eax, dword [esi + 0xe88]
test eax, eax
je 0x41a20f
push eax
call edi
mov eax, dword [esi + 0xe8c]
test eax, eax
je 0x41a21c
push eax
call edi
mov eax, dword [esi + 0xe90]
test eax, eax
je 0x41a229
push eax
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x41a420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
push 0
mov dword [ebp - 4], ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov eax, dword [esi + 4]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x24]
and byte [edi + 0x3c], 0xe0
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x40], eax
lea eax, [edi + 0x78]
push eax
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0x54], 0xffffffff
mov dword [edi + 0x38], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
call fcn.0048b570
movzx ecx, word [esi + 0x2c]
lea edx, [edi + 0xb8]
add esi, 0x2c
add esp, 0xc
mov eax, edx
mov dword [ebp + 0xc], eax
test cx, cx
je 0x41a50f
sub esi, edx
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi + eax]
test cx, cx
jne 0x41a500
movzx ecx, word [eax - 2]
lea ebx, [eax - 2]
add ecx, 0x2800
mov edx, 0x3ff
cmp cx, dx
cmova ebx, eax
xor eax, eax
mov word [ebx], ax
sub ebx, dword [ebp + 0xc]
and ebx, 0xfffffffe
lea esi, [ebx + 2]
lea ecx, [esi + 0xb8]
lea eax, [ecx + 7]
mov dword [edi + 0x48], ecx
cdq
and edx, 7
add eax, edx
and eax, 0xfffffff8
cmp dword [ebp + 0x10], 0
mov dword [edi + 0x4c], eax
je 0x41a5a0
push esi
lea ecx, [edi + 0xb8]
lea eax, [edi + 0xba]
add eax, ebx
push ecx
push eax
mov dword [edi + 0xc], eax
call fcn.00489a20
mov ecx, dword [ebp - 4]
xor eax, eax
add esp, 0xc
mov ecx, dword [ecx + 0x6a4]
and ecx, 4
or eax, ecx
jne 0x41a58a
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_CharUpperW]
push ecx
mov ecx, dword [edi + 0xc]
mov edx, esi
call fcn.00465c80
mov ecx, dword [edi + 0x48]
add esp, 4
mov dword [edi + 0x50], eax
add ecx, esi
lea eax, [ecx + 7]
cdq
and edx, 7
add eax, edx
and eax, 0xfffffff8
mov dword [edi + 0x48], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ab10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov eax, ecx
push esi
push edi
mov dword [esp + 0x1c], eax
mov esi, dword [eax + 0x10]
call dword [sym.imp.KERNEL30.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL30.dll_TlsGetValue]
mov ebx, eax
push edi
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL30.dll_SetLastError]
test ebx, ebx
je 0x41acfc
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x1004]
test ecx, ecx
jne 0x41ab63
cmp byte [esi + 0x1008], cl
jne 0x41ab63
xor al, al
jmp 0x41ab65
mov al, 1
mov byte [esp + 0xf], al
cmp al, byte [ebx + 0xc]
je 0x41ab93
movzx eax, al
xor eax, 1
inc eax
shl eax, 0x10
push eax
call dword [sym.imp.KERNEL30.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL30.dll_SetThreadPriority]
mov al, byte [esp + 0xf]
mov byte [ebx + 0xc], al
mov ecx, dword [esi + 0x1004]
cmp ecx, 1
jbe 0x41acfc
call fcn.00461690
mov esi, dword [ebx]
mov edi, eax
mov ecx, dword [ebx + 4]
sub eax, esi
mov dword [esp + 0x10], edx
sbb dword [esp + 0x10], ecx
or esi, ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
je 0x41acf7
or eax, dword [esp + 0x10]
je 0x41acf7
mov dword [ebx + 4], edx
mov edx, dword [esp + 0x10]
mov dword [ebx], edi
test edx, edx
jl 0x41abf0
jg 0x41abe7
mov esi, dword [esp + 0x20]
cmp esi, 0x3e8
jb 0x41abf4
mov esi, 0x3e8
xor edx, edx
jmp 0x41abf4
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, 0x64
sub eax, dword [ecx + 0x1004]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d0e00]
mov eax, dword [ebx + 0x10]
divsd xmm0, qword [0x4d0d50]
movsd qword [esp + 0x20], xmm0
test al, 0x10
je 0x41ac36
divsd xmm0, qword [0x4d0d38]
jmp 0x41ac42
test al, 0x20
jne 0x41ac48
mulsd xmm0, qword [0x4d0d20]
movsd qword [esp + 0x20], xmm0
subsd xmm0, qword [0x4d0d30]
mov ecx, esi
movsd qword [esp + 0x10], xmm0
call fcn.004a6100
movsd xmm1, qword [esp + 0x10]
mov esi, 0x2bc
mulsd xmm1, xmm0
mov ecx, dword [ebx + 8]
divsd xmm1, qword [esp + 0x20]
cvttsd2si eax, xmm1
sub ecx, eax
cmp ecx, esi
cmovl esi, ecx
test esi, esi
jle 0x41aced
mov ecx, dword [esp + 0x28]
mov ebx, edi
mov eax, dword [esp + 0x1c]
mov edx, 0xc8
cmp dword [eax + 0x100c], 0
jne 0x41ace4
cmp esi, 0xc8
mov eax, 1
cmovg eax, edx
push eax
call dword [sym.imp.KERNEL30.dll_Sleep]
call fcn.00461690
mov edi, eax
mov ecx, edx
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x1004], 0x7ffffff
je 0x41acd9
sub ebx, edi
xor edx, edx
add esi, ebx
cmp esi, 0xfffffe0c
cmovl esi, edx
mov ebx, edi
mov edx, 0xc8
test esi, esi
jg 0x41ac93
mov ebx, dword [esp + 0x34]
mov dword [ebx], edi
mov dword [ebx + 4], ecx
mov dword [ebx + 8], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], edi
mov dword [ebx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d700
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6a2c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4db06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push 0x2e
lea esi, [ecx + eax*2]
mov ecx, dword [ebp + 0xc]
push esi
lea eax, [ecx + eax*2]
mov dword [ebp + 0x10], eax
call fcn.00488f83
mov ebx, dword [ebp + 0x14]
add esp, 8
test eax, eax
je 0x41d756
sub eax, esi
mov ecx, ebx
sar eax, 1
sub ecx, eax
jmp 0x41d758
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cmp ebx, 0xff
jg 0x41d898
mov eax, dword fs:[0x2c]
mov esi, dword [ebp + 0x10]
mov edx, dword [eax]
mov eax, ebx
sub eax, ecx
mov dword [ebp - 0x1c], edx
lea eax, [esi + eax*2]
mov dword [ebp - 0x10], eax
nop
mov dword [ebp - 0x18], 0
nop word [eax + eax]
mov eax, dword [0x4f2adc]
cmp eax, dword [edx + 4]
jle 0x41d7e0
push 0x4f2adc
call fcn.00487731
add esp, 4
cmp dword [0x4f2adc], 0xffffffff
jne 0x41d7e0
mov dword [ebp - 4], 0
call fcn.00486245
push 0
push eax
mov ecx, 0x4f2ae0
call fcn.0041e1a0
push 0x4f2adc
mov dword [ebp - 4], 0xffffffff
call fcn.004876e7
add esp, 4
xor edi, edi
test ebx, ebx
jle 0x41d838
mov ecx, 0x4f2ae0
call fcn.0041ded0
mov esi, ebx
mov ecx, eax
sub esi, edi
cmp esi, 0xa
jle 0x41d802
mov esi, 0xa
jmp 0x41d806
test esi, esi
jle 0x41d831
mov ebx, dword [ebp + 0x10]
nop dword [eax]
mov eax, ecx
and eax, 0x3f
shrd ecx, edx, 6
shr edx, 6
movsx ax, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz__]
mov word [ebx + edi*2], ax
inc edi
sub esi, 1
jne 0x41d810
mov ebx, dword [ebp + 0x14]
cmp edi, ebx
jl 0x41d7e6
mov esi, dword [ebp + 0x10]
cmp dword [ebp - 0x14], 0
mov edi, dword [ebp - 0x10]
je 0x41d849
mov eax, 0x2e
mov word [edi], ax
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
mov word [esi + ebx*2], ax
call dword [sym.imp.KERNEL30.dll_MoveFileW]
test eax, eax
jne 0x41d8ae
call dword [sym.imp.KERNEL30.dll_GetLastError]
cmp eax, 0xb7
jne 0x41d898
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x80
jl 0x41d790
inc ebx
add edi, 2
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x10], edi
cmp ebx, 0xff
jle 0x41d780
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41e1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], esi
mov dword [esi + 0x1388], 0x55555555
lea eax, [esi + 0x10]
mov dword [esi + 0x138c], 0x55555555
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
mov esi, 1
mov dword [esp + 0x10], eax
nop
push 0x5851f42d
xor eax, eax
mov ecx, edi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edi
xor ecx, ebx
push eax
push ecx
call fcn.00488190
mov ebx, eax
mov edi, edx
mov eax, esi
cdq
add ebx, eax
mov eax, dword [esp + 0x10]
adc edi, edx
inc esi
mov dword [eax], ebx
mov dword [eax + 4], edi
add eax, 8
mov dword [esp + 0x10], eax
cmp esi, 0x138
jl 0x41e1e0
mov esi, dword [esp + 0x14]
mov eax, esi
pop edi
mov dword [esi], pe_nt_image_headers32
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8