joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41327a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41eff4
call fcn.004047e0
push ecx
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x14], eax
call fcn.0041d59d
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x4132b9
call fcn.0041d59d
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4132c7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4132d5
or eax, 0xffffffff
jmp 0x4133c1
mov ecx, esi
call fcn.004131f6
mov edi, eax
mov dword [ebp - 0x20], edi
call fcn.00414067
push edi
call fcn.00413ab5
and dword [ebp - 0x1c], 0
test edi, edi
je 0x41330f
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41330f
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x1c], 1
and dword [ebp - 4], 0
push esi
call fcn.0041401b
push edi
call fcn.00413ab5
push ebx
push eax
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00412f92
xor ebx, ebx
cmp eax, ebx
je 0x413388
test byte [esi + 0x24], 0x10
je 0x413353
push 4
mov ecx, esi
pop ebx
call fcn.00416450
test ah, 1
je 0x413349
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00416047
xor ebx, ebx
cmp dword [esi + 0x1c], ebx
je 0x413388
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.004164df
jmp 0x413388
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], ebx
je 0x41339a
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4133b0
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4133b0
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0041322d
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x415f3d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x415f7f
call fcn.0041d59d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x415f7f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x415f76
xor eax, eax
jmp 0x415f87
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00415f8d
pop edi
pop esi
pop ebx
ret 4

Function at 0x417812
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
push dword [esp + 0xc]
call dword [eax + 0x30]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41783a
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417043
pop esi
ret 4

Function at 0x418f36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x418f53
cmp dword [0x42dd90], edi
jne 0x4190a5
cmp word [0x42dd9c], di
mov dword [0x42dd90], 1
jne 0x418f85
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
xor ecx, ecx
cmp eax, edi
setne cl
inc ecx
mov dword [0x42dd98], eax
mov word [0x42dd9c], cx
cmp word [0x42dd9c], 2
jne 0x418fc1
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x418fc1
mov ecx, dword [0x42dd98]
cmp ecx, edi
je 0x418fc1
push edi
push edi
push ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x42dd94], eax
jmp 0x4190aa
push 0x94
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.004048b0
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
mov dword [0x42dd94], 3
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4190a5
cmp dword [ebp - 0x8c], 1
je 0x419015
cmp dword [ebp - 0x8c], 2
jne 0x4190a5
cmp dword [ebp - 0x98], 4
jae 0x419084
lea eax, [ebp + 8]
push eax
push 1
push edi
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4190a5
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.WheelScrollLines
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419079
push 0xa
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.004052d0
add esp, 0xc
mov dword [0x42dd94], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4190a5
cmp dword [ebp - 0x8c], 2
jne 0x4190a5
cmp dword [ebp - 0x98], 4
jb 0x4190a5
push edi
push 0x42dd94
push edi
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x42dd94]
pop edi
leave
ret
Function at 0x41a4b3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x7c], 0
je 0x41a4f7
push dword [ebp + 8]
call fcn.0041e05c
mov esi, eax
test esi, esi
je 0x41a522
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x41a522
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0x42120c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10]
push dword [esi + 0x90]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
leave
ret 0xc

Function at 0x41d419
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41f41a
call fcn.004047e0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CNoTrackObject.0
xor eax, eax
push 0xa
lea ecx, [esi + 0x30]
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00411a4e
push 0xa
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00411a4e
push 0xa
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.004118cb
mov ecx, dword [ebp - 0xc]
mov dword [esi], vtable.AFX_MODULE_THREAD_STATE.0
mov dword [esi + 0xc], 0x54
mov dword [esi + 0x28], 0x412d77
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x41db76
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x41dba4
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 8]
jl 0x41dc46
cmp dword [esp + 0x10], 0
je 0x41dc46
test esi, esi
jne 0x41dbe0
push 0x10
call fcn.0041d993
test eax, eax
je 0x41dbb9
mov dword [eax], vtable.CThreadData.0
mov esi, eax
jmp 0x41dbbb
xor esi, esi
and dword [esi + 8], 0
and dword [esi + 0xc], 0
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [edi + 0x14]
call fcn.0041d935
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x41dbf8
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x41dc08
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x41dc14
call fcn.00411498
mov eax, dword [esi + 8]
mov ecx, eax
imul ecx, ecx, 0x3fffffff
add ecx, dword [edi + 0xc]
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
push 0
lea eax, [ecx + eax*4]
push eax
call fcn.004048b0
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [eax + edx*4], ecx
pop esi
ret 8
Function at 0x41dc7b
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov ebx, ecx
pop edi
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jle 0x41dcce
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41dcb1
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + edi*8 + 4], eax
je 0x41dcb1
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
je 0x41dcc8
and dword [ebp - 4], 0
jmp 0x41dcc8
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x41dcc1
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xc]
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jl 0x41dc92
cmp dword [ebp - 4], 0
je 0x41dd0d
lea edi, [ebx + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [ebx + 0x14]
call fcn.0041d948
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x41dd03
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1001d79f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d83c
push ebx
push esi
call fcn.1001d768
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d6fc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d7e9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d83b
push edi
push eax
call fcn.1001e75a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d809
call fcn.1001c244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d83a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d6fc
add esp, 0x20
test eax, eax
jne 0x1001d828
push edi
call fcn.1001c244
jmp 0x1001d830
push ebx
call fcn.1001c244
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001daa9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d9c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dadd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001dae3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001db27
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001d9c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001db5e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001db66
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001d9c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dba0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002324d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002324d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
xor eax, eax
jmp 0x401064
mov edi, edi
push ebp
mov ebp, esp
jmp 0x4010cb
sub esp, 0x20
mov eax, dword [0x404008]
cmp eax, 0
jne 0x40114f
mov eax, dword [0x40400c]
jmp 0x401145
cmp eax, 0
jne 0x40114f
jmp 0x4012f4
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
push 0x1388
jmp 0x4011be
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x40114f
mov dword [ebp - 0x14], eax
jmp 0x401239
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jl 0x40114f
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x40114f
mov eax, dword [0x404008]
cmp eax, 0
je 0x4012d1
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea eax, [ebp - 0x10]
jmp 0x4012ae
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401268
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
je 0x40114f
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
je 0x401268
mov eax, dword [0x40400c]
cmp eax, 0
je 0x4012f4
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x4012d1
cmp eax, dword [ebp - 0x14]
je 0x4012d1
push dword [0x404000]
mov eax, 0x40401a
mov ebx, 0x404302
sub ebx, eax
jmp 0x401316
push ebx
push 0x40401a
call fcn.0040130b
lea eax, [ebp - 4]
push eax
jmp 0x401394
push 0x40
mov eax, 0x401537
mov ebx, 0x4030d1
sub ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
push 0x401537
jmp 0x40141b
call sub.KERNEL32.dll_VirtualProtect
push dword [0x404004]
mov eax, dword [ebp - 0x14]
push eax
push 0x401537
call fcn.0040130b
lea eax, [ebp - 4]
push eax
jmp 0x40151c
push dword [eax]
mov eax, dword [ebp - 0x14]
push eax
push 0x401537
call sub.KERNEL32.dll_VirtualProtect
jmp 0x401537
push esi
push esi
push esi
push esi
xchg ecx, eax
fadd qword [eax]
add byte [esi + 0xce9a], ch
scasb al, byte es:[edi]
les eax, [ebp + 0x102e0086]
into
add byte [eax], al
salc
add byte [eax], al
add byte [esi], ch
enter 0, 0xffffffffffffffac
add byte [esi], ch
xor byte [ebp + 0x6f70000], ch
syscall
xchg ebx, eax
dec edi
and eax, dword [ebp + 0x2a]
out 0x95, al
xchg edi, eax
xchg esp, eax
xchg ecx, eax
nop
test dword [esi], 0x4f3a834f
cmp dword [esi], 0x4f
xor dword [edx], 0x4f
xor dword [esi], 0x4f
sub dword [edx], 0x4f
sub dword [esi], 0x4f
and dword [edx], 0x2e
fcmovnb st(0), st(5)
add byte [eax], al
dec edi
cmp dword [edx], 0xffffffae
ret 0xc7
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [str._r_vL9]
and dword [ebp - 8], 0
mov dword [ebp - 0x24], eax
mov eax, dword [0x423f24]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
call fcn.00401022
mov eax, dword [0x423f28]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x423f2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [0x24419f4]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x40109c
mov dword [0x24419f0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010aa
and dword [0x244147c], 0
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x24419f4], 0xc
mov dword [0x24419ec], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010f1
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x24]
add ecx, edi
xor eax, ecx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401073
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40112f
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x24419f4]
mov ecx, dword [0x2441480]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4011ea
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x24419f4], 0x959
jne 0x4011d9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.zewaxuwawazuwuyuvivi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401157
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4014a1
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x24419f4], 0x400
push edi
jne 0x4014fe
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004016d6
push esi
push esi
call fcn.0040180c
push esi
call fcn.00401e21
push esi
push esi
call fcn.00401c6c
push esi
call fcn.00401eb7
push esi
push esi
call fcn.00401710
add esp, 0x24
xor edi, edi
cmp edi, 0x16d2a
jge 0x401516
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x40153b
inc edi
cmp edi, 0x3011b
jl 0x401500
mov eax, dword [0x42436c]
mov dword [0x24419f4], eax
call fcn.004011ed
mov edi, 0x3078f
cmp dword [0x24419f4], 0x51f
jne 0x401569
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x40154f
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40725a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423cfc]
jne 0x407264
repz ret
jmp fcn.00409062
Function at 0x40b1e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and eax, 0xff
inc dword [eax]
add byte [eax], al
bt dword [0x49611c], eax
jae 0x40b1d2
mov eax, esi
call fcn.0040d3d4
mov esi, eax
jmp 0x40b24e
xor eax, eax
mov al, byte [esi]
cmp eax, 0x48
jg 0x40b1ee
invalid
je 0x40b258
sub eax, 0x22
je 0x40b245
sub eax, 5
je 0x40b245
sub eax, 0x1a
je 0x40b1fa
jmp 0x40b24d
sub eax, 0x61
je 0x40b1fa
sub eax, 7
je 0x40b258
jmp 0x40b24d
cmp byte [ebp - 0x1f], 0
jne 0x40b24d
mov edx, 0x40aa10
mov ecx, 5
mov eax, esi
call fcn.004098b8
test eax, eax
je 0x40b23f
invalid

Function at 0x40b1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and eax, 0xff
inc dword [eax]
add byte [eax], al
bt dword [0x49611c], eax
jae 0x40b1d2
mov eax, esi
call fcn.0040d3d4
mov esi, eax
jmp 0x40b24e
xor eax, eax
mov al, byte [esi]
cmp eax, 0x48
jg 0x40b1ee
invalid
je 0x40b258
sub eax, 0x22
je 0x40b245
sub eax, 5
je 0x40b245
sub eax, 0x1a
je 0x40b1fa
jmp 0x40b24d
sub eax, 0x61
je 0x40b1fa
sub eax, 7
je 0x40b258
jmp 0x40b24d
cmp byte [ebp - 0x1f], 0
jne 0x40b24d
mov edx, 0x40aa10
mov ecx, 5
mov eax, esi
call fcn.004098b8
test eax, eax
je 0x40b23f
invalid

Function at 0x40f996
Capabilities:
Packed with generic packer

Disassembly:
call 0x20413af3
pop ecx
inc ecx
add byte [ecx + ebx*2 + 0x2a0c0041], ch
Function at 0x40f9e6
Capabilities:
Packed with generic packer

Disassembly:
loopne 0x40f9cf
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ah
out 0x40, eax
add byte [eax + eax], cl
or al, 0
add byte [eax], al
clc
jl 0x40fa51
add byte [esp + esi + 0x40], dl
add byte [eax + 0x34], ah
inc eax
add byte [esp + esi + 0x40], ah
add byte [eax + 0x34], ch
inc eax
add byte [esp + esi + 0x40], bl
add byte [ecx + esi + 0x31c00040], ah
movsb byte es:[edi], byte [esi]
xor dword [eax], eax
sal byte [ecx], 0x40
add ah, bh
xor dword [eax], eax
push ss
inc ebp
push esi
popal
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + ebp*8 + 0x40], al
add byte [eax + eax], cl

Function at 0x40f9f6
Capabilities:
Packed with generic packer

Disassembly:
loopne 0x40f9cf
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ah
out 0x40, eax
add byte [eax + eax], cl
or al, 0
add byte [eax], al
clc
jl 0x40fa51
add byte [esp + esi + 0x40], dl
add byte [eax + 0x34], ah
inc eax
add byte [esp + esi + 0x40], ah
add byte [eax + 0x34], ch
inc eax
add byte [esp + esi + 0x40], bl
add byte [ecx + esi + 0x31c00040], ah
movsb byte es:[edi], byte [esi]
xor dword [eax], eax
sal byte [ecx], 0x40
add ah, bh
xor dword [eax], eax
push ss
inc ebp
push esi
popal
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + ebp*8 + 0x40], al
add byte [eax + eax], cl