joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ac4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ad3bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004078b0
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
call fcn.00430310
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 2
mov dword [esi + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x4212d3
mov dword [esi + 0x28], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
call fcn.0043d890
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push 0x41e750
push 0
push 0
mov dword [edi], esi
mov dword [edi + 4], 0x42e9a0
mov dword [edi + 8], 0
call fcn.004555e0
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jne 0x421315
push 0x10
push edi
call fcn.0043d8e0
add esp, 8
mov dword [esi + 0x28], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4215f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ad24
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4ad3bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
xorps xmm0, xmm0
movups xmmword [esi + 8], xmm0
movq qword [esi + 0x18], xmm0
mov byte [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
lea edi, [esi + 0x30]
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
push 1
push 8
push 1
mov byte [ebp - 4], 3
call fcn.00404c60
add esp, 0xc
mov dword [edi], eax
test eax, eax
je 0x421687
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi]
mov byte [ebp - 4], 1
mov dword [eax], edi
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4216b1
mov dword [esi + 0x24], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov dword [esi + 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42ffd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42ffe5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x430026
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x430022
nop word [eax + eax]
cmp esi, edx
jae 0x430026
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x430010
cmp esi, edx
jb 0x43002b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x432610
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi - 0x2c]
test eax, eax
je 0x43265f
lea edi, [esi + 4]
test edi, edi
je 0x432661
cmp byte [edi + 0x1c], 0
lea ebx, [edi + 4]
jne 0x432656
push str.m_bInitialized
push 0x47f6ac
push 0
push 0xd4
push str.C:Program_Files__x86_Microsoft_Visual_Studio_14.0VC_atlmfcinclude_atlcore.h
push 2
call fcn.00448410
add esp, 0x18
cmp eax, 1
jne 0x432656
int3
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x432661
xor edi, edi
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x432689
mov eax, dword [esi + 0x30]
mov dword [esi + 0x2c], ebx
test eax, eax
je 0x4326ed
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], ebx
jmp 0x4326ed
cmp dword [esi + 0x2c], 0
je 0x432697
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x70]
push 0x18
mov dword [esi + 0x2c], ebx
call fcn.0043d890
mov ebx, eax
lea ecx, [esi - 0x2c]
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
push 0x41e7d0
push 0
push 0
mov dword [ebx], ecx
mov dword [ebx + 8], 0x42d060
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
call fcn.004555e0
add esp, 0x1c
mov dword [ebp + 8], eax
test eax, eax
jne 0x4326ea
push 0x18
push ebx
call fcn.0043d8e0
mov eax, dword [ebp + 8]
add esp, 8
mov dword [esi + 0x30], eax
test edi, edi
je 0x4326fb
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x45f800
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.00465ae0
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45f83e
cmp dword [ebp + 8], 0
je 0x45f82c
lea eax, [ebp + 8]
push eax
call fcn.0045fa00
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x45f83e
mov eax, 4
jmp 0x45f96e
call fcn.004658e0
movzx edx, al
test edx, edx
jne 0x45f86c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45f85d
mov dword [ebp - 0xc], 4
jmp 0x45f864
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x45f96e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45f915
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x45f9b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0046a150
lea ecx, [ebp - 8]
call fcn.0045fa40
movzx edx, al
test edx, edx
jne 0x45f8d7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0045fa20
mov eax, dword [ebp - 0x10]
jmp 0x45f96e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.0046a2d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x45f902
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0045fa20
mov eax, dword [ebp - 0x14]
jmp 0x45f96e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0045fa20
mov eax, dword [ebp - 0x18]
jmp 0x45f96e
call fcn.00465a30
movzx ecx, al
test ecx, ecx
jne 0x45f94e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0045f980
add esp, 0x10
jmp 0x45f96e
call fcn.00465940
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0045f980
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4696b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x477b30
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x4b308c], 1
jge 0x477b9f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x477b75
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x477b75
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x477b52
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x477b8b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x477b92
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x477c8f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x477c60
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x477c55
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x477c49
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x477c50
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x477c8f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x477c8a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x477c73
mov eax, dword [ebx + 8]
jmp 0x477c8f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x477c81
xor eax, eax
jmp 0x477c8f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x477bbf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4696be
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046924f
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x8c2116
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x8c1ea3
or edi, edx
and edi, edi
mov edi, 0xe1b08d3d
call fcn.008c2154
add edi, edi
mov edx, 0x2796203f
add edi, edx
xor dword [esi], ebx
dec edi
and edi, edi
mov edi, edx
inc esi
mov edi, 0xe1c93639
inc edi
cmp esi, eax
jne fcn.008c2116
add edx, 0x77d7a3b9
dec edx
add edi, 0xa878d5f9
ret
Function at 0x405d20
Capabilities:
Query environment variable

Disassembly:
add edi, edi
inc esi
or al, 0x1c
inc esi
add al, 0x70
loop 0x405d4e
and al, 0x49
aas
cmp dh, byte [edi + ebx - 0x75]
dec esi
sbb al, 0x8b
inc esi
adc byte [eax - 0x75], dl
adc dword [edx - 0x18], edx
xchg ecx, eax
dec eax
add byte [eax], al
push eax
mov eax, dword [esi + 8]
push 0x40f3c1
push eax
call dword [esi + 4]
add esp, 0x10
mov edx, dword [ebp + 0x10]
mov cl, dh
adc byte [edi - 0x48], bl
jl 0x405d1a
add dword [eax], eax
mov byte [edx], cl
pop esi
pop ebp
ret 0x10
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00405f20
test eax, eax
jne 0x405e30
cmp dword [0x4100dc], 0x14
psubusb mm5, mm6
add byte [eax], al
add byte [ecx + 0x410384], ah
test dword [ecx + 0xe1e90f], edx
add byte [eax], al
mov dword [0x410384], 1
add eax, 0x410384
add dword [eax], eax
add byte [eax], al
call dword [fcn.00404f5c]
mov esi, eax
test esi, esi
je 0x405db3
mov eax, dword [0x361e58]
test eax, eax
jne 0x405d89
push eax
push str.CommandLineToArgvW
push 4
call 0xc4406a40
and eax, 0xc
mov dword [0xb60358], eax
adc eax, eax
jge 0x405e38
lea ecx, [ebp - 4]
retf 0xff56
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ecx + 0x6a]
push dword [ebp - 1]
test byte [ecx + eax*8], ah
inc eax
add byte [eax - 0x18], dl
xor ebx, ebp
add byte [eax], al
mov edi, dword [ebp + 0x10]
add esp, 0xc
push dword fs:[ebp + ebp - 0x64]
xor al, 0x85
add al, 5
add byte [eax], al
push esi
push dword [ebp + 0x40c1a9]
xor dword [eax + 0x7c], 0xffffff89
pop es
call [esp + 0x3b]
inc eax
add byte [ebx - 0x74997459], cl
xor byte [ebx + 0x222c1d1], cl
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
adc ax, 0xc050
inc eax
xchg ebx, eax
push es
xor eax, 0x7340c128
call esi
mov ecx, dword [eax]
pop ebx
test ecx, ecx
je 0x405e2e
call esi
mov edi, dword [eax]
call esi
push edi
invalid
xor eax, eax
jo 0x405e90
mov esp, ebp
pop ebp
ret 0xb0
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0xe5401909
inc eax
add byte [ebx - 0x5d307408], cl
lea esi, [eax + eax*2 + 1]
push esi
sbb al, 0x2e
cld
daa
adc eax, 0xfbe3c189
add esp, 8
lea ecx, [ebp - 4]
mov dword [edi], eax
jle 0x405f04
adc byte [ecx - 0xf], dl
mov eax, dword [ebp + 0xc]
push edx
or byte [esp + esi - 0x7effffb3], cl
jnp 0x405ebb
add byte [ecx + 0x5a8bfc7b], al
jnp 0x405eb5
mov ebx, dword [edx + 0x7b]
push esi
push esi
push eax
jmp esi
cmp ch, byte [esi]
add al, 0x8f
add byte [edx], ah
add ah, bh
cmp byte [ebp - 0x75], dh
cmp dword [esi + 0x5b], ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40a22e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a6458]
jne 0x40a238
repz ret
jmp fcn.0040cf5b

Function at 0x40a9cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a6458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004084e7
and dword [ebp - 0x14], 0
cmp dword [0x4a89e0], 0
mov dword [ebp - 0x18], eax
jne 0x40aa7e
push 0x4021f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ab26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021e4
push ebx
call edi
test eax, eax
je 0x40ab26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4021d4
push ebx
mov dword [0x4a89e0], eax
call edi
push eax
call esi
push 0x4021c0
push ebx
mov dword [0x4a89e4], eax
call edi
push eax
call esi
push 0x4021a4
push ebx
mov dword [0x4a89e8], eax
call edi
push eax
call esi
mov dword [0x4a89f0], eax
test eax, eax
je 0x40aa7e
push 0x40218c
push ebx
call edi
push eax
call esi
mov dword [0x4a89ec], eax
mov eax, dword [0x4a89ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40aad7
cmp dword [0x4a89f0], ecx
je 0x40aad7
push eax
call esi
push dword [0x4a89f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40aad7
test ebx, ebx
je 0x40aad7
call edi
test eax, eax
je 0x40aace
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aace
test byte [ebp - 8], 1
jne 0x40aad7
or dword [ebp + 0x10], 0x200000
jmp 0x40ab0a
mov eax, dword [0x4a89e4]
cmp eax, dword [ebp - 0x18]
je 0x40ab0a
push eax
call esi
test eax, eax
je 0x40ab0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ab0a
mov eax, dword [0x4a89e8]
cmp eax, dword [ebp - 0x18]
je 0x40ab0a
push eax
call esi
test eax, eax
je 0x40ab0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a89e0]
call esi
test eax, eax
je 0x40ab26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ab28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a22e
leave
ret
Function at 0x4a1b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x82ca90], ax
mov word [0x82ca94], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x82ca90
mov dword [0x82ca9c], 0x320033
mov dword [0x82caa4], 0x6c006c
mov word [0x82ca96], cx
mov dword [0x82ca98], 0x6c0065
mov dword [0x82caa0], 0x64002e
mov word [0x82ca92], dx
mov word [0x82caa8], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x82ca8c]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x82ca88], eax
mov eax, dword [0x4adadc]
push edx
push eax
mov byte [0x4a8d53], 0x65
mov dword [0x4a8d49], 0x75747269
mov word [0x4a8d4d], 0x6c61
mov byte [0x4a8d48], 0x56
mov word [0x4a8d54], 0x7463
mov byte [0x4a8d56], 0
mov dword [0x4a8d4f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x4a1c10
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x148c
call fcn.0040cf30
cmp dword [0x82ca8c], 0x37
jne 0x4a1ce5
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046b4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp + 4]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x48c]
push edx
push 0x4046c4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
push 0x4046ec
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push 0
lea ecx, [esp + 0xc8c]
push ecx
push 0
push 0x4046f8
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404724
push 0x404740
push 0x404750
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [0x82da80]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + esi]
mov edx, dword [0x4adadc]
mov byte [edx + esi], cl
add esp, 0x148c
ret
Function at 0x4a1e80
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x82ca8c]
sub esp, 0x2dc
push ebx
push ebp
push esi
mov esi, dword [0x4adadc]
shr eax, 3
push edi
test eax, eax
je 0x4a202c
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x4a1eb4
mov esi, dword [esp + 0x18]
cmp dword [0x82ca8c], 0x1c
jne 0x4a1ed1
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x4a7210]
mov ecx, dword [0x4a7214]
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x28], edx
mov edx, dword [0x4a7218]
mov dword [esp + 0x2c], ecx
mov ecx, dword [str.Y5l_]
mov dword [esp + 0x14], eax
mov ebx, 0xc6ef3720
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0x20
jmp 0x4a1f15
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x34]
shl ecx, 4
add ecx, dword [esp + 0x24]
add eax, ebx
xor edx, ecx
xor edx, eax
sub edi, edx
mov ecx, edi
shl ecx, 4
mov dword [0x82c9fc], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
cmp dword [0x82ca8c], 0x1be
lea ebp, [ebx + edi]
jne 0x4a1f6a
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x82ca8c], 0x979
mov dword [0x82ca00], 0xff6b3619
mov dword [0x82ca04], 0xffffffff
jne 0x4a1faa
mov eax, dword [esp + 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor esi, ebp
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add ebx, 0x61c88647
dec dword [esp + 0x1c]
jne 0x4a1f11
cmp dword [0x82ca8c], 0x8d4
jne 0x4a1fdf
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], edi
cmp dword [0x82ca8c], 0x17
jne 0x4a201b
push 0
push 0
push 0
push 0x404690
push 0x4046a0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x4a1eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret