joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f7760
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x101f792d
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb1000]
push edi
or ebp, 0xffffffff
jmp 0x101f778a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x101f7791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101f7780
mov eax, 1
add ebx, ebx
jne 0x101f77a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x101f7798
jne 0x101f77b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101f7798
xor ecx, ecx
sub eax, 3
jb 0x101f77c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x101f783a
mov ebp, eax
add ebx, ebx
jne 0x101f77d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x101f77e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x101f7804
inc ecx
add ebx, ebx
jne 0x101f77f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x101f77e5
jne 0x101f7801
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101f77e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x101f7824
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x101f7815
jmp 0x101f7786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x101f7824
add edi, ecx
jmp 0x101f7786
pop esi
mov edi, esi
mov ecx, 0x3a5f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x101f7842
cmp byte [edi], 0x1e
jne 0x101f7842
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x101f7847
lea edi, [esi + 0x1ef000]
mov eax, dword [edi]
or eax, eax
je 0x101f78bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1fc820]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1fc94c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101f7874
mov ecx, edi
jns 0x101f78a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1fc950]
or eax, eax
je 0x101f78b9
mov dword [ebx], eax
add ebx, 4
jmp 0x101f7891
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x101f78f0
cmp al, 0xef
ja 0x101f78e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x101f78c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x101f78d2
mov ebp, dword [esi + 0x1fc954]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x101f7924
sub esp, 0xffffff80
jmp 0x1007d644
Function at 0x52e090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
jmp 0x52e0aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52e0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0a0
mov eax, 1
add ebx, ebx
jne 0x52e0c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52e0d4
jne 0x52e0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0f3
dec eax
add ebx, ebx
jne 0x52e0e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52e0b8
add ebx, ebx
jne 0x52e0ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52e145
xor ecx, ecx
sub eax, 3
jb 0x52e10b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52e17a
sar eax, 1
mov ebp, eax
jmp 0x52e116
add ebx, ebx
jne 0x52e116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0e4
inc ecx
add ebx, ebx
jne 0x52e124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0e4
add ebx, ebx
jne 0x52e131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52e126
jne 0x52e142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52e126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52e164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52e156
jmp 0x52e0a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52e164
add edi, ecx
jmp 0x52e0a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52e182
cmp byte [edi], 0x11
jne 0x52e182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52e187
lea edi, [esi + 0x127000]
mov eax, dword [edi]
or eax, eax
je 0x52e1ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x183424]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1835a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52e1b4
mov ecx, edi
jns 0x52e1e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1835a4]
or eax, eax
je 0x52e1f9
mov dword [ebx], eax
add ebx, 4
jmp 0x52e1d1
call dword [esi + 0x1835b4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52e230
cmp al, 0xef
ja 0x52e223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52e205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52e212
mov ebp, dword [esi + 0x1835a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52e264
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x1197cb72
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x28]
je 0x116e5510
call fcn.1197ca54
add byte [eax], al
pop edi
inc ebx
dec ecx
je 0x1197cbe9
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + ebp*2 + 0x61], cl
dec esp
imul esp, dword [edx + 0x72], 0x41797261
add byte [eax + 0x66], ah
pushal
rol ax, 5
push dword [esp]
xchg al, ah
cmc
bt cx, 5
clc
add bx, ax
bt bx, dx
cwde
pushfd
sub ebp, 4
jmp 0x1197dcc0
and al, 0x2c
ja 0x1197eabd
bts eax, ebp
mov dx, bx
and al, cl
mov edx, esp
shr ecx, cl
inc al
bt cx, dx
lea ecx, [edi + 0x40]
and al, dh
aas
inc edi
test ah, dl
sub ecx, edx
xor ax, 0x60f3
btc ax, dx
aad 0x95
lea eax, [ebp - 0x80]
btr di, 4
adc di, di
jmp 0x1197f16a
mov word [esp], 0xc7f5
mov dword [ebp], eax
push dword [esp]
mov byte [esp], 0x65
mov byte [esp + 4], 0xd9
mov byte [esp + 8], 0xc7
lea esp, [esp + 0x34]
jmp 0x1197d815
Function at 0x5d21b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe0000]
push edi
or ebp, 0xffffffff
jmp 0x5d21d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5d21d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d21c8
mov eax, 1
add ebx, ebx
jne 0x5d21eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5d21fc
jne 0x5d221b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d221b
dec eax
add ebx, ebx
jne 0x5d2208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5d21e0
add ebx, ebx
jne 0x5d2217
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5d226d
xor ecx, ecx
sub eax, 3
jb 0x5d2233
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5d22a2
sar eax, 1
mov ebp, eax
jmp 0x5d223e
add ebx, ebx
jne 0x5d223e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d220c
inc ecx
add ebx, ebx
jne 0x5d224c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5d220c
add ebx, ebx
jne 0x5d2259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5d224e
jne 0x5d226a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5d224e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5d228c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5d227e
jmp 0x5d21ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5d228c
add edi, ecx
jmp 0x5d21ce
pop esi
mov edi, esi
mov ecx, 0x3b7d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5d22aa
cmp byte [edi], 0x1e
jne 0x5d22aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5d22af
lea edi, [esi + 0x1cf000]
mov eax, dword [edi]
or eax, eax
je 0x5d2327
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d4cd0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d4dfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5d22dc
mov ecx, edi
jns 0x5d230b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d4e00]
or eax, eax
je 0x5d2321
mov dword [ebx], eax
add ebx, 4
jmp 0x5d22f9
call dword [esi + 0x1d4e10]
mov ebp, dword [esi + 0x1d4e04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5d235b
sub esp, 0xffffff80
jmp 0x47f8ec
Function at 0x11b9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011b91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x11b907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11b906a
add dl, dl
jne 0x11b9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11b90dc
xor eax, eax
add dl, dl
jne 0x11b9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11b917d
add dl, dl
jne 0x11b90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11b90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11b9075
mov eax, 1
add dl, dl
jne 0x11b90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11b90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11b90e1
sub eax, ebx
mov ebx, 1
jne 0x11b9128
mov ecx, 1
add dl, dl
jne 0x11b910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11b9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11b9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11b9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11b913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11b914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11b9136
cmp eax, 0x7d00
jae 0x11b916d
cmp eax, 0x500
jb 0x11b9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11b9075
cmp eax, 0x7f
ja 0x11b9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11b9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x11b919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11b9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41a820
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0041a880

Function at 0x41a880
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x450420]
test esi, esi
jle 0x41a96d
mov edi, dword [0x450424]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x41a8b4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x41a966
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x41a8a0
mov dword [esp], eax
mov ebx, eax
call fcn.0041b1b0
test eax, eax
mov edi, eax
je 0x41a9aa
lea ebx, [esi + esi*2]
mov esi, dword [0x450424]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0041b2b0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x450424]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x41a98a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x41a95f
sub eax, 0x40
and eax, 0xffffffbf
je 0x41a95f
mov eax, dword [esp + 0x20]
add ebx, dword [0x450424]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x41a974
add dword [0x450420], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x41a8be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0041a820
mov eax, dword [0x450424]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0041a820
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0041a820
lea esi, [esi]
Function at 0x41ae20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x450438
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x450430]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x41ae75
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41ae6e
test esi, esi
je 0x41ae6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41ae50
mov dword [esp], 0x450438
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41b0d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x41b108
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x41b0fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x41b10a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x41b0f0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x41b3e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x41b55c
mov eax, dword [esp + 0x3c]
add eax, 1
lea edx, [eax*4]
cmp eax, 0x1fc00000
mov eax, 0xffffffff
cmovbe eax, edx
mov dword [esp], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov edi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x41b4eb
xor ebx, ebx
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sub.libstdc_6.dll_operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jg 0x41b440
mov dword [edi + eax*4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00402300
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x41b548
mov edx, dword [edi]
test edx, edx
je 0x41b548
xor ebx, ebx
jmp 0x41b537
mov edx, dword [edi + ebx*4]
test edx, edx
je 0x41b548
mov dword [esp], edx
add ebx, 1
call sub.libstdc_6.dll_operator_delete___void_
cmp dword [esp + 0x3c], ebx
jg 0x41b530
mov dword [esp], edi
call sub.libstdc_6.dll_operator_delete___void_
mov eax, esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, 0xffffffff
jmp 0x41b552
Function at 0x41cd60
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
sub ecx, 1
push esi
push ebx
mov ebx, 0x66666667
mov ebp, edx
mov esi, 1
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ecx
mov dword [esp + 0x10], ecx
sar eax, 0x1f
mov edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ecx
sar ecx, 0x1f
imul ebx
mov ebx, edx
sar ebx, 2
sub ebx, ecx
je 0x41cdb3
mov ecx, 0x66666667
mov eax, ebx
sar ebx, 0x1f
add esi, 1
imul ecx
sar edx, 2
sub edx, ebx
mov ebx, edx
jne 0x41cda0
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x41ce30
cmp eax, esi
cmovge esi, eax
mov eax, dword [edi + 8]
lea edx, [esi + 2]
cmp eax, edx
jg 0x41ce21
mov dword [edi + 8], 0xffffffff
mov eax, dword [esp + 0x1c]
mov dword [esp], edi
mov ecx, 1
mov edx, ebp
add esi, 1
call fcn.0041c630
mov eax, dword [edi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [edi + 4], edx
mov edx, edi
call fcn.0041c220
add dword [edi + 8], esi
mov eax, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041ca50
sub eax, edx
mov dword [edi + 8], eax
jmp 0x41cdd1
mov edx, dword [0x43e054]
cmp edx, 0xffffffff
je 0x41ce59
test edx, edx
mov eax, 2
jne 0x41ce51
call fcn.004212d0
and eax, 1
neg eax
add eax, 3
mov dword [edi + 0x28], eax
jmp 0x41cdbb
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x41ce7f
movsx eax, byte [eax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x43e054], edx
jmp 0x41ce3b
xor edx, edx
jmp 0x41ce77
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4093f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x409407
pop dword [ebp - 0x4c]
mov eax, 0x1a96cd9a
add eax, 0xe5a9c66d
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x5bd5dd46
sub dword [ebp - 0x5c], 0xd8397fb
mov dword [ebp - 0x58], 0x10fbc052
add dword [ebp - 0x58], 0x21378bf3
mov dword [ebp - 0x54], 0x34d96b3f
sub dword [ebp - 0x54], 0xe88d2711
mov dword [ebp - 0x50], 0x4689b544
add dword [ebp - 0x50], 0xb9764abc
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xd7eb1bac
add eax, 0x2855b4a0
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe2dc9d11
add dword [ebp - 0x5c], 0x9195cc45
mov dword [ebp - 0x58], 0x3c676924
add dword [ebp - 0x58], 0x504f851
mov dword [ebp - 0x54], 0x2f85e0c9
add dword [ebp - 0x54], 0x33e98ba3
mov dword [ebp - 0x50], 0xd51d67bc
sub dword [ebp - 0x50], 0xd51d67bc
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x80ac46eb
sub eax, 0x806b76a3
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bcee
push 0
call eax
mov ecx, 0x5156
mov ebx, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x4c]
mov edi, 0x8c748d2
sub edi, 0x8d3fcad2
xor dword [ebp - 0x48], 0xa853ffc5
mov esi, dword [edx]
xor dword [ebp - 0x28], ebx
sub esi, edi
mov dword [ebp - 0x24], 0x730b8c39
mov dword [ebx], esi
add ebx, 4
add edx, 0xce6b3d9c
sub edx, 0xce6b3d98
loop 0x40951d
add eax, 0xdf0ac7c6
sub eax, 0xdf098f9b
xor ebx, ebx
add ebx, eax
add eax, 0xafbb04e4
sub eax, 0xafbb04df
mov ecx, 0xf8897be2
sub ecx, 0xf8497be2
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x402453
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402462
pop dword [ebp - 0x50]
mov eax, 0x16f9bd66
sub eax, 0x16b99904
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x8dce171e
sub dword [ebp - 0x60], 0x3f7bd1d3
mov dword [ebp - 0x5c], 0x31b21b2f
sub dword [ebp - 0x5c], 0xff7eceea
mov dword [ebp - 0x58], 0x5172b075
sub dword [ebp - 0x58], 0x5266c47
mov dword [ebp - 0x54], 0xda06c763
sub dword [ebp - 0x54], 0xda06c763
lea eax, [ebp - 0x60]
push eax
mov eax, 0x9046e62b
sub eax, 0x900135c7
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x34b5730a
sub dword [ebp - 0x60], 0xc04309b4
mov dword [ebp - 0x5c], 0x905803ca
sub dword [ebp - 0x5c], 0x4eeba255
mov dword [ebp - 0x58], 0x93ab957d
add dword [ebp - 0x58], 0xcfc3d6ef
mov dword [ebp - 0x54], 0x5a30fea3
add dword [ebp - 0x54], 0xa5cf015d
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xdef8c0d7
sub eax, 0xdeb31057
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4f174
push 0
call eax
mov ecx, 0xe608fdf5
add ecx, 0x19f75139
mov ebx, eax
mov edi, 0xfee53636
sub edi, 0xfe9dd636
add edi, dword [ebp - 0x50]
mov edx, 0x7f9f0a8e
add edx, 0xa59dd5ec
add dword [ebp - 0x10], ecx
mov esi, dword [edi]
add dword [ebp - 0x48], 0x90903b0c
xor esi, edx
sub dword [ebp - 0x28], edx
mov dword [ebx], esi
add dword [ebp - 0x28], ebx
add ebx, 0xbbde4b7c
sub ebx, 0xbbde4b78
add edi, 0xfda33a76
sub edi, 0xfda33a72
loop 0x402584
add eax, 0x12f8b
mov ebx, eax
add eax, 0xe36eb4cc
add eax, 0x1c914b39
mov ecx, 0xa4e17d55
sub ecx, 0xa4a17d55
add ecx, dword [ebp - 0x50]
call ebx
leave
ret