joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496f77
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca467
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x49709a
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6797
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970b1
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66a7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e03d7
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138c7
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04fa
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffbf7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0511
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb07
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x529b07
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.0055cff7
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c2a
push ecx
lea ecx, [esi + 0x18]
call fcn.00549327
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c41
push ecx
lea ecx, [esi + 0x24]
call int.00549237
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x573117
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6607
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57323a
push ecx
lea ecx, [esi + 0x18]
call fcn.00592937
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573251
push ecx
lea ecx, [esi + 0x24]
call fcn.00592847
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bd317
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f0807
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd43a
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcb37
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd451
push ecx
lea ecx, [esi + 0x24]
call fcn.005dca47
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5db747
Capabilities:
Encode data using xor

Disassembly:
leave
inc esp
lea ebp, [esi + ecx*4]
enter 0x3208, 0x73
inc esi
pop ecx
retf
scasb al, byte es:[edi]
invalid
in eax, dx
inc edx
sti
ja 0x5db775
sub dword [ecx + esi*8 + 0x43], edi
jl 0x5db73f
inc ebx
mov edx, 0x69846453
xchg ebx, eax
push edi
je 0x5db7aa
nop
pushal
cli
mov ss, word [ebp - 0x2cd51359]
loop 0x5db70a
clc
inc esp
pop ds
rcr byte [edx + 0x73], 1
cmpsb byte [esi], byte es:[edi]
sbb dword [ecx + 7], ecx
retf 0x70e7
inc ebp
loope 0x5db70a
js 0x5db7e8
pop ebp
xchg ebx, eax
pushfd
in al, dx
fiadd word [esi - 0x10]
mov cl, 0x29
sub dh, byte [esp + ecx*4]
push ebp
lea esi, [ebx + esi*2]
add byte [ecx - 0x61812410], bl
dec ebp
pop ebp
out 0x5d, eax
pop eax
sub edi, esp
push ebp
mov ch, 0x48
movsb byte es:[edi], byte [esi]
cli
xchg esp, eax
lea edx, [eax]
call 0x5af3d928
push eax
sal byte [eax], 1
les ebp, [eax]
sbb eax, 0x80051736
in al, 0x99
shr dword [eax - 0x706d871b], 1
pop esi
jge 0x5db74b
pop ss
add eax, 0xd199e480
test al, 0xe5
js fcn.005db747
invalid
imul esi, dword [ebp + 0x59], 0xc9cc5092
jns 0x5db7aa
pop ss
mov dword [ebp + 0x92e3acb], 0x1391ffa9
sbb ebx, ebp
fsubr qword [edx - 0x13]
add dword [ecx - 0x39], ebx
pop ecx
invalid
pop ss
and byte [eax + 0x147d24bc], ch
sahf
add eax, 0x6c34e03c
shl dword [ebp - 0x2a5141ad], 0x73
and dword [edi], esi
invalid
Function at 0x5e7027
Capabilities:
Encode data using xor

Disassembly:
test byte [esi - 0x6c966687], 0x4d
xchg esp, eax
inc ecx
std
stosd dword es:[edi], eax
add al, 0x79
fst dword [ecx]
cdq
cmp esi, dword [edi - 0x6614ba59]
leave
outsd dx, dword [esi]
add ebx, dword [edx + 0x4496852b]
fcom dword [esp + esi]
push ebp
cmp ah, al
mov ch, 0xa0
mov al, byte [esp + edx*4]
mov ebp, 0xc17beb7c
adc dword [edx], ebx
fsubrp st(4)
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
inc ecx
pop esi
or ah, ah
lodsd eax, dword [esi]
jbe 0x5e7081
jp 0x5e70c6
add byte [eax - 0x3d702c7], cl
stosb byte es:[edi], al
xchg ebx, eax
test bl, ch
jle 0x5e70a4
push esp
mov ecx, ecx
push 0xc135d964
push ebx
and byte [ebx + eax*2 + 0x1dde098a], ch
pushal
jmp 0x66af7f16
invalid
loopne 0x5e7094
movsb byte es:[edi], byte [esi]
sub byte [ecx - 0x27], ch
out 0x59, al
jo 0x5e70b6
loop 0x5e705d
invalid
test al, 0x19
jne 0x5e7096
pop ss
test al, 0x60
test eax, 0x2481ad4f
test byte [ebx + 0x16], dh
mov edi, ebp
call 0x3050528c
shl cl, cl
int1
das
mov ah, 0xfe
hlt
cdq
je 0x5e70f0
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
mov ebx, 0xec0b899a
invalid
or eax, 0x2329e4aa
dec esp
jge 0x5e7160
imul bh
and eax, 0xb409258f
jbe 0x5e717e
iretd
fisubr word [eax]
push 0xae625b8
mov byte [ecx - 0x1e], 0xdb
mov eax, 0xec696d2
xchg esi, eax
loop 0x5e71cb
pop ecx
and al, 0x69
inc ebx
sar byte [ecx - 0x468526d6], 1
imul ecx, dword [edi - 0x3b], 0x12
loop 0x5e713e
fsubr qword [esi - 6]
outsb dx, byte [esi]
cli
dec ebx
pop esp
leave
sub ch, byte [edx - 0x662a2ad2]
out dx, al
test al, ah
xchg esi, ebp
mov dh, 0x86
push eax
test al, 0x9b
in eax, 0x3f
mov eax, dword [0x84646bd9]
fisttp qword [ecx + 0x7690572f]
fistp dword [esi + 0x25b58c7]
adc al, 0xa8
loopne 0x5e7205
test ch, bl
mov dword [edi], ebp
push edi
nop
jbe 0x5e7161
sahf
invalid
mov cl, 0xea
retf
cmp dword [eax], ebp
or dword [edi], edx
xchg esi, eax
push ebp
adc byte [ebp - 0x6766cf70], ah
mov ecx, 0x2cffcf0e
and al, 0xe
shl al, 1
jne 0x5e71d0
stosb byte es:[edi], al
push esp
push esp
enter 0x3d7f, 0x38
push esp
push esp
sub bl, ch
xor dword [eax - 0x6aa81187], esi
imul ebp, esp, 0xa977e50f
in al, dx
pop ebx
xor al, 0x94
pop ecx
test byte [esi - 0x79b4d07c], dh
add al, 0x13
adc edx, dword [edi - 0x2a]
push edi
salc
xor al, 0xa3
dec eax
adc al, 0x59
add al, 0x6f
in al, 0x69
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
mov ecx, 0xa78d9186
mov esp, 0x193f78f0
pop edx
pop eax
stosb byte es:[edi], al
adc dword [ecx + ebx - 0x49], 0xffffffd8
inc ebp
neg byte [ecx - 0x5de330ca]
dec ebx
jg 0x5e7206
insd dword es:[edi], dx
invalid
Function at 0x61b317
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xc24e9468
call 0x4ed70161
das
mov byte [0x52655ad5], al
mov esp, 0x86ebd78b
cmp byte [esi - 0x32], ah
mov eax, 0x3bbe9e28
add bh, byte [eax]
pop edi
cmpsd dword [esi], dword es:[edi]
sbb al, 0x93
xor eax, 0xb6cfa3ce
dec esp
pop ebp
sub eax, 0xcae8921a
fstp qword [edx]
xor ecx, dword [ebp - 0x654040ed]
push cs
pop edx
movsb byte es:[edi], byte [esi]
dec eax
cmp byte [edi], bl
lea edi, [esi + 0x1d]
xchg edx, eax
sbb edx, ebp
add al, 0x96
and byte [edx], dh
sbb eax, 0x53e07ba8
mov dword [ebp + 0x7c5c6d32], eax
xor dh, ch
ror byte [edx], 0x29
cmpsd dword [esi], dword es:[edi]
xor eax, dword [eax - 0x43]
pop eax
xchg esi, eax
push cs
pop ecx
mov byte [0x9c035519], al
cmp eax, 0xe975c7bd
add dword [ecx + 0x39], esi
pop es
mov word [edi], ss
pop ss
fmul qword [ebp + 0x4dcc97b0]
jg 0x61b347
mov eax, 0x7d6bd2d
dec ebp
mov edi, 0xbd7fc11
test dword [esi + 0x582b86bf], edi
salc
adc eax, 0x6dccccc9
clc
dec ecx
pop ebp
cmc
popfd
inc esp
imul ecx, ebp, 0xffffffc3
fistp word [ebx + 0x43]
jg 0x61b3bc
cld
jl 0x61b427
das
add dl, ch
pop eax
test al, 0x74
movsd dword es:[edi], dword [esi]
in eax, dx
lea edi, [ecx]
sub byte [esi], ch
ret
lds eax, [edx + 0x23ce8dfc]
mov ebx, 0xcabf75ff
fist dword [eax]
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
das
insb byte es:[edi], dx
pop edx
sub eax, 0xbbf7a97e
mov edi, 0xc1c0fefd
ret

Function at 0x639bc7
Capabilities:
Encode data using xor

Disassembly:
iretd
xchg ecx, eax
or ch, ah
inc ebx
sbb al, 0x1d
inc ecx
aam 0xbb
sbb al, 0xbc
jb 0x639b7b
push edi
clc
jns 0x639b41
rol byte [ebx - 0x1a203775], 0x35
pushfd
in eax, 0x5d
leave
salc
mov bl, 0x12
jmp 0x639b7e
pushfd
pop eax
test al, 0x2b
pop ebp
call 0xefff49a
nop
mov word [eax + 0x55be6baa], gs
xchg esp, eax
cmp eax, 0x3f3eb1f1
fcomp qword [ebx + ebx + 0x544555b9]
or eax, 0x5934ed57
inc ebx
mov cl, ah
cld
ror esp, 0xcb
xor dword [edi + 0x5124bf10], eax
or ecx, dword [esi + 0xe182d3c]
salc
aas
jecxz 0x639ba6
dec edi
dec ebp
cmp ch, bl
aas
cld
invalid
Function at 0x409ec4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f97
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409fb0
push ebx
push 0x409fbc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409f44
mov al, 0x6a
call fcn.00409b20
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409e98
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409f4d
call fcn.00409e98
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f9e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x40a050
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a104
jmp 0x40a0f9
cmp dword [esi + 0x10], 0x1000
jne 0x40a0e5
test byte [esi + 0x15], 1
jne 0x40a0e5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40a0a4
cmp eax, 2
je 0x40a0a4
cmp eax, 0x10
je 0x40a0a4
cmp eax, 0x20
jne 0x40a0b9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40a0b9
mov bl, 1
xor ebp, ebp
jmp 0x40a0ca
mov eax, dword [esi]
add eax, ebp
call fcn.0040a048
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40a0bd
test bl, bl
je 0x40a0e5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a104
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40a07c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402c00
pop dword [ebp - 0x38]
mov eax, 0x94cb353
add eax, 0xf6f378ad
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd6c70243
sub dword [ebp - 0x48], 0x8874bcf8
mov dword [ebp - 0x44], 0x9e0292a7
sub dword [ebp - 0x44], 0x6bcf4662
mov dword [ebp - 0x40], 0x428fb2a9
add dword [ebp - 0x40], 0x9bc9185
mov dword [ebp - 0x3c], 0x36f743f3
sub dword [ebp - 0x3c], 0x36f743f3
lea eax, [ebp - 0x48]
push eax
mov eax, 0xb1dcf5ad
add eax, 0x4e637ab7
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb31caf10
add dword [ebp - 0x48], 0xc155ba46
mov dword [ebp - 0x44], 0x2b7ffe28
sub dword [ebp - 0x44], 0xea139cb3
mov dword [ebp - 0x40], 0x6b8f4ecd
sub dword [ebp - 0x40], 0x81fe261
mov dword [ebp - 0x3c], 0x344c6340
add dword [ebp - 0x3c], 0xcbb39cc0
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x8d510d44
sub eax, 0x8d109c9c
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3758e
push 0
call eax
mov ecx, 0x4aa2
xor edi, edi
add edi, eax
mov edx, 0xb5587aee
add edx, 0x4ae88512
add edx, dword [ebp - 0x38]
mov esi, 0x749e605b
sub esi, 0x52f3edc2
add dword [ebp - 0x1c], 0xcb126f0c
mov ebx, dword [edx]
add dword [ebp - 0x14], edx
add ebx, esi
xor dword [ebp - 0x2c], 0x68304a38
mov dword [edi], ebx
mov dword [ebp - 0x14], 0x77f9abcd
add edi, 0xbd79ddc0
add edi, 0x42862244
add edx, 4
loop 0x402d1e
add eax, 0xf381cec1
sub eax, 0xf380b166
mov ebx, eax
add eax, 0x813b979e
add eax, 0x7ec46867
mov ecx, 0x9114e603
sub ecx, 0x90d4e603
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x429278], 1
mov dword [0x429274], 1
mov dword [0x429270], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x41c00c], eax
mov eax, dword [0x429284]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x429298]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x429280]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x41602c], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401c31
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.004081c0
sub esp, eax
lea eax, [ebp - 0x1009]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._unquote
mov eax, dword [0x41c044]
test eax, eax
je 0x401c86
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
lea edx, [ebp - 0x1009]
mov dword [esp + 8], edx
mov dword [esp + 4], str.remove__s_n
mov dword [esp], eax
call sym._fprintf
lea eax, [ebp - 0x1009]
mov dword [esp], eax
call sym._remove
leave
ret
Function at 0x4022eb
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov eax, 0x1020
call fcn.004081c0
sub esp, eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x1011]
mov ecx, 0x1001
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov byte [ebp - 0x1011], 0
lea eax, [ebp + 8]
mov dword [esp], eax
call sym._next_filename
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402426
mov dword [esp + 8], 0x1000
mov dword [esp + 4], str.parallelize
lea eax, [ebp - 0x1011]
mov dword [esp], eax
call sym._safecat
mov eax, dword [0x41c040]
test eax, eax
je 0x402393
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x4179af
lea eax, [ebp - 0x1011]
mov dword [esp], eax
call sym._safecat
mov dword [esp + 8], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1011]
mov dword [esp], eax
call sym._safecat
mov eax, dword [0x41c040]
test eax, eax
je 0x4023e1
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
lea edx, [ebp - 0x1011]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x4179b3
mov dword [esp], eax
call sym._fprintf
lea eax, [ebp - 0x1011]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402426
mov eax, dword [0x41c040]
test eax, eax
je 0x402426
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], str.parallelize_command_returned_result__d_n
mov dword [esp], eax
call sym._fprintf
cmp dword [ebp - 0xc], 0
jne 0x40232f
nop
nop
add esp, 0x1020
pop ebx
pop edi
pop ebp
ret