joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10007008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [edx + 4]
mov edi, ecx
sub eax, dword [edx]
xor ecx, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
lea ebx, [eax + 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x1000142c
push ebx
lea ecx, [ebp - 0x10]
call fcn.100033e0
mov esi, dword [ebp - 0x10]
push ebx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x10]
lea eax, [esi + ebx]
mov edx, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x10]
push ecx
add eax, 4
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor esi, esi
nop dword [eax + eax]
mov ecx, dword [edi + 0x10]
mov edx, 1
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
jne 0x10001450
mov ecx, dword [ebp - 0xc]
mov eax, ecx
mov edx, dword [ebp - 0x10]
sub eax, edx
je 0x10001499
mov ebx, dword [sym.imp.WS2_32.dll_send]
sub ecx, edx
lea eax, [edx + esi]
push 0
sub ecx, esi
push ecx
push eax
push dword [edi + 0xc]
call ebx
cmp eax, 0xffffffff
je 0x10001499
mov ecx, dword [ebp - 0xc]
add esi, eax
mov edx, dword [ebp - 0x10]
mov eax, ecx
sub eax, edx
cmp esi, eax
jb 0x10001474
mov eax, dword [edi + 0x10]
xor ecx, ecx
xchg dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x100014d9
mov edx, dword [ebp - 8]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x100014cf
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100014cf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10003f01
add esp, 8
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.10003ba4
mov esp, ebp
pop ebp
ret 4
Function at 0x10001f20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10004dcd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10007008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 4], 0
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
sar ebx, 0x18
xor ecx, eax
movzx eax, bl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100037e0
mov edx, dword [0x10007418]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x10007418]
jne 0x10002006
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10001fea
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x10001fe0
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002042
push edx
push ecx
call fcn.10003f01
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10003ba4
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
mov edx, dword [edx + 0xc]
push ecx
push eax
call edx
add esp, 8
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10001fea
mov edx, dword [ebp + 0x10]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x10001fe0
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001fe0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, 0x1000201c
ret
Function at 0x10003470
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1000349c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x10007418]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10007420
lea eax, [edi + edi]
push eax
call fcn.10002b90
mov eax, dword [0x10007418]
lea ebx, [edi - 1]
mov dword [0x1000742c], ebx
mov dword [0x10007430], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100035d6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x10007420]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10003534
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100035a1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1000356e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10003566
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x100035a1
cmp ebx, edx
je 0x1000357e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100035b2
cmp ebx, edx
jne 0x10003572
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100035d6
mov ebx, dword [0x1000742c]
jmp 0x100034e2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100035a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401318
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0xa1f8
call fcn.00401a0c
call fcn.00401800
lea edi, [ebp - 0xa1e8]
mov esi, 0x403040
mov ecx, 0x2874
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.dll_FreeConsole
lea esi, [ebp - 0xa1e8]
mov ebx, dword [ebp - 0x418]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x52e8
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0xa1ec], eax
lea edi, [ebp - 0x418]
mov edx, eax
mov cl, byte [esi]
mov byte [edx], cl
inc edx
add esi, 2
cmp esi, edi
jne 0x401390
mov edx, dword [ebp - 0xa1ec]
add edx, 0x4ee8
mov ecx, 0x100
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea esi, [esi]
xor dword [eax], ebx
add ebx, 0x499602d2
add eax, 4
cmp eax, edx
jne 0x4013b4
call dword [ebp - 0xa1ec]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x4014f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401516
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4015aa
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401565
cmp eax, 0x40
je 0x401565
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401509
cmp eax, 0x40
je 0x401509
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x401509
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x2de1342
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x53997fb5
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x532753a6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x76ac2d55
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x443851
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x8776c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.0043720e]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004425c2
mov dword [ebp - 0x14], eax
cmp dword [0x88c5c0], edi
jne 0x443942
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4438cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x443a22
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443a22
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443a22
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x88c5c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x88c5c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x88c5c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x88c5d0], eax
test eax, eax
je 0x44393f
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x88c5cc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x443967
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44395a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x44397c
push 4
pop eax
jmp 0x443a24
cmp dword [ebp - 0x14], edi
je 0x44397c
push dword [0x88c5c0]
call dword [fcn.00437212]
push 3
jmp 0x443961
mov eax, dword [0x88c5cc]
mov ebx, dword [fcn.00437212]
cmp eax, esi
je 0x4439da
cmp dword [0x88c5d0], esi
je 0x4439da
push eax
call ebx
push dword [0x88c5d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4439da
test eax, eax
je 0x4439da
call ecx
test eax, eax
je 0x4439cf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4439cf
test byte [ebp - 8], 1
jne 0x4439da
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x443a0a
mov eax, dword [0x88c5c4]
cmp eax, esi
je 0x443a07
push eax
call ebx
test eax, eax
je 0x443a07
call eax
mov edi, eax
test edi, edi
je 0x443a07
mov eax, dword [0x88c5c8]
cmp eax, esi
je 0x443a07
push eax
call ebx
test eax, eax
je 0x443a07
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x88c5c0]
call ebx
test eax, eax
je 0x443a22
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x443a24
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e890
leave
ret
Function at 0x47d990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
add esp, 0xffffff78
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
and al, 1
mov byte [esp + 0x7e], al
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x4c], 0x3d39a87c
mov eax, dword [esp + 0x4c]
mov ecx, eax
sub ecx, 0xaae4c79b
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
jg 0x47d9fd
jmp 0x47d9e4
mov eax, dword [esp + 0x48]
add eax, 0x7a307eff
mov dword [esp + 0x40], eax
je 0x47dae0
jmp 0x47daa5
mov eax, dword [esp + 0x48]
sub eax, 0x542a93f
mov dword [esp + 0x3c], eax
jg 0x47da2d
jmp 0x47da15
mov eax, dword [esp + 0x48]
sub eax, 0xaae4c79c
mov dword [esp + 0x38], eax
je 0x47dbff
jmp 0x47daa5
mov eax, dword [esp + 0x48]
sub eax, 0x512af92d
mov dword [esp + 0x34], eax
jg 0x47da8d
jmp 0x47da45
mov eax, dword [esp + 0x48]
sub eax, 0x542a940
mov dword [esp + 0x30], eax
je 0x47dace
jmp 0x47da5d
mov eax, dword [esp + 0x48]
sub eax, 0xe4763e9
mov dword [esp + 0x2c], eax
je 0x47dc11
jmp 0x47da75
mov eax, dword [esp + 0x48]
sub eax, 0x3d39a87c
mov dword [esp + 0x28], eax
je 0x47daaa
jmp 0x47daa5
mov eax, dword [esp + 0x48]
sub eax, 0x512af92e
mov dword [esp + 0x24], eax
je 0x47db3a
jmp 0x47daa5
jmp 0x47dc22
mov ecx, dword [esp + 0x80]
call fcn.004fc5a0
mov ecx, 0x85cf8101
mov edx, 0x542a940
test al, 1
cmovne ecx, edx
mov dword [esp + 0x4c], ecx
jmp 0x47dc22
mov byte [esp + 0x7f], 0
mov dword [esp + 0x4c], 0xe4763e9
jmp 0x47dc22
lea eax, [esp + 0x50]
mov ecx, dword [0x87e06c]
mov edx, dword [esp + 0x78]
mov dword [esp + 0x20], ecx
mov ecx, edx
mov ecx, edx
mov dword [esp + 0x1c], eax
call fcn.00407ca0
mov ecx, esp
mov edx, dword [esp + 0x1c]
call fcn.0047dc30
call fcn.0047dc40
mov dword [ecx + 4], 0
mov eax, dword [esp + 0x20]
call eax
sub esp, 0xc
mov ecx, 0xaae4c79c
mov edx, 0x512af92e
cmp eax, 0
cmovne ecx, edx
mov dword [esp + 0x4c], ecx
jmp 0x47dc22
mov eax, 0
mov ecx, 0xffffffff
mov dl, byte [esp + 0x7e]
and dl, 1
movzx esi, dl
mov edi, dword [esp + 0x50]
mov ebx, 0x1fffff
mov ebx, ecx
xor ebx, 0x10
and ebx, 0x3ad5347a
mov edx, ecx
xor edx, 0x3ad5347a
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x10
mov dword [esp + 0x14], eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x3ad5347a
and edx, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
or ebx, eax
mov eax, dword [esp + 0x10]
or eax, edx
xor ebx, eax
mov eax, edi
xor eax, 0xffffffff
mov edx, ebx
and edx, eax
xor ebx, 0xffffffff
mov eax, edi
and eax, ebx
or edx, eax
xor edx, 0xffffffff
xor edi, 0xffffffff
xor ecx, 0xee8ec23c
or edx, edi
or ecx, 0xee8ec23c
xor edx, 0xffffffff
and edx, ecx
mov eax, dword [esp + 0x18]
cmp eax, edx
setne al
and al, 1
movzx ecx, al
cmp esi, ecx
sete al
and al, 1
mov byte [esp + 0x7f], al
mov dword [esp + 0x4c], 0xe4763e9
jmp 0x47dc22
mov byte [esp + 0x7f], 0
mov dword [esp + 0x4c], 0xe4763e9
jmp 0x47dc22
mov al, byte [esp + 0x7f]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x47d9c5
Function at 0x483d10
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, esp
call fcn.00483f10
mov ecx, dword [0x88c654]
mov edx, 0x800000
mov edx, eax
sub edx, 0x935de446
sub edx, 1
add edx, 0x935de446
imul eax, edx
and eax, 1
push ecx
mov ecx, 0x9c8e84ca
xor ecx, 0x9c8e84ca
cmp eax, ecx
pop ecx
sete bl
cmp ecx, 0xa
setl bh
mov al, bl
and al, bh
xor bl, bh
or al, bl
test al, 1
jne 0x483d7d
jmp 0x483f01
mov eax, 0x18
call fcn.00437f10
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, dword [0x88c650]
mov edx, dword [0x88c654]
mov edi, ecx
add edi, 0x53cd89d0
add edi, 0xffffffff
add edi, 0xac327630
imul ecx, edi
and ecx, 1
cmp ecx, 0
sete bl
cmp edx, 0xa
setl bh
mov cl, bl
and cl, bh
xor bl, bh
or cl, bl
test cl, 1
mov dword [esi + 0xc], eax
jne 0x483de2
jmp 0x483f01
jmp 0x483de7
mov ecx, 0x88ab58
call fcn.0044f760
push ebx
mov ebx, 0x38cbd752
xor ebx, 0x38cbd752
cmp eax, ebx
pop ebx
je 0x483eec
mov ecx, 0x88ab58
call fcn.0044f8b0
sub esp, 4
mov ecx, 0x200000
mov ecx, esp
mov dword [ecx], eax
mov ecx, dword [esi + 0xc]
call fcn.00498240
mov ecx, 0x88ab58
call fcn.00483f20
call fcn.004060a0
mov ecx, dword [esi + 0xc]
call fcn.004ddfd0
sub esp, 4
mov ecx, esp
call fcn.00483f30
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call eax
mov dword [esi + 4], eax
mov eax, 0
call fcn.00483f40
call fcn.00483f50
sub eax, 1
mov edi, ecx
add edi, eax
imul ecx, edi
and ecx, 1
cmp ecx, 0
sete bl
cmp edx, 0xa
setl bh
mov al, bl
and al, bh
xor bl, bh
or al, bl
test al, 1
jne 0x483e97
jmp 0x483ef4
mov ecx, dword [esi + 0xc]
call fcn.00551e20
mov ecx, 0
mov eax, dword [0x88c650]
mov edx, dword [0x88c654]
sub ecx, 1
mov edi, eax
add edi, ecx
imul eax, edi
and eax, 1
cmp eax, 0
sete bl
cmp edx, 0xa
setl bh
mov al, bl
and al, bh
xor bl, bh
or al, bl
test al, 1
jne 0x483ee7
jmp 0x483ef4
jmp 0x483de7
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esi + 0xc]
call fcn.00551e20
jmp 0x483e97
jmp 0x483d7d
Function at 0x51f0f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov edx, 0
add edx, 0x18
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x10]
add ecx, edx
mov esi, dword [eax + 0x10]
movzx esi, word [esi + 0x14]
add ecx, esi
mov esi, dword [eax + 0x10]
movzx esi, word [esi + 6]
imul esi, esi, 0x28
add ecx, esi
call fcn.0051f2f0
mov esi, dword [eax + 0x10]
add esi, edx
mov edx, dword [eax + 0x10]
movzx edx, word [edx + 0x14]
add esi, edx
mov eax, dword [eax + 0x10]
movzx eax, word [eax + 6]
imul eax, eax, 0x28
add esi, eax
add ecx, dword [esi - 0x20]
mov dword [ebp - 0x20], ecx
call fcn.0051f300
call fcn.0051f310
mov eax, dword [ebp - 0x1c]
call fcn.0051f320
call fcn.0051f330
mov eax, dword [ebp - 0x24]
mov ecx, 0
mov ecx, eax
add ecx, 0x8658fadf
call fcn.0051f340
mov dword [ebp - 0x2c], ecx
jg 0x51f23d
jmp 0x51f193
call fcn.0051f350
sub eax, 0x63cf574c
mov dword [ebp - 0x30], eax
jg 0x51f224
jmp 0x51f1ab
mov eax, dword [ebp - 0x28]
sub eax, 0x3eeb4208
call fcn.0051f360
jg 0x51f20e
jmp 0x51f1c3
mov eax, dword [ebp - 0x28]
sub eax, 0xa6d1fd94
call fcn.0051f370
je 0x51f291
jmp 0x51f1db
mov eax, dword [ebp - 0x28]
add eax, 0x5376d27c
call fcn.0051f380
je 0x51f2d3
jmp 0x51f1f4
call fcn.0051f390
sub eax, 0xe164c3fc
call fcn.0051f3a0
je 0x51f2b5
jmp 0x51f253
mov eax, dword [ebp - 0x28]
sub eax, 0x3eeb4209
mov dword [ebp - 0x44], eax
je 0x51f258
jmp 0x51f253
mov eax, dword [ebp - 0x28]
add eax, 0x9c30a8b3
call fcn.0051f3b0
je 0x51f281
jmp 0x51f253
mov eax, dword [ebp - 0x28]
sub eax, 0x79a70522
mov dword [ebp - 0x4c], eax
je 0x51f2c5
jmp 0x51f253
jmp 0x51f2df
mov eax, 0xa6d1fd94
mov ecx, 0x63ce7ce7
pushfd
sub ecx, 0xffff259a
popfd
mov edx, dword [ebp - 0xc]
call fcn.0051f3c0
cmp edx, esi
cmovb eax, ecx
call fcn.0051f3d0
jmp 0x51f2df
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x24], 0xac892d84
jmp 0x51f2df
mov eax, 0x79a70522
mov ecx, 0xe164c3fc
call fcn.0051f3e0
mov esi, dword [ebp - 0x1c]
add esi, dword [ebp - 0x20]
cmp edx, esi
cmovae eax, ecx
call fcn.0051f3f0
jmp 0x51f2df
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x24], 0xac892d84
jmp 0x51f2df
mov byte [ebp - 0xd], 1
call fcn.0051f400
jmp 0x51f2df
movzx eax, byte [ebp - 0xd]
add esp, 0x48
pop esi
pop ebp
ret 4
jmp 0x51f170