joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ce7
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 8]
mov dword [ebp - 0x30], edi
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4192d0]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4192d4]
mov dword [ebp - 0x2c], eax
call fcn.00406ce0
mov esi, dword [ebp - 8]
mov eax, dword [0x4192d8]
add esi, 0x23f
mov dword [ebp - 0x34], eax
mov eax, dword [0x4192dc]
push 0x20
mov dword [ebp - 8], esi
mov dword [ebp - 0x38], eax
pop edi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [0x1aa462c]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x406d7e
xor ecx, ecx
lea eax, [ebp - 0x3c]
push ecx
push eax
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [0x1aa462c]
add eax, dword [ebp - 0x34]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x1aa4628]
mov dword [ebp - 0xc], 0xedeb2e40
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp ecx, 0x3eb
mov dword [0x1aa4628], eax
mov eax, dword [0x1aa457c]
cmove eax, dword [ebp - 0xc]
mov dword [0x1aa457c], eax
lea eax, [esi + edx]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x24], 0
mov dword [0x1aa4624], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x10]
sub ebx, eax
mov dword [ebp - 0x18], eax
mov eax, ebx
mov dword [ebp - 0x10], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
nop
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 4], eax
cmp dword [0x1aa462c], 0xb03
jne 0x406e55
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0x406440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
and dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
add esi, 0x61c88647
mov dword [ebp - 8], esi
dec edi
jne 0x406d3b
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41254b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040e030
mov dword [ebp - 0x14], eax
cmp dword [0x4bcf1c], esi
jne 0x41263e
push 0x800
push esi
push 0x405b34
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4125cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41271e
push esi
push esi
push 0x405b34
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41271e
push 0x405b4c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41271e
push eax
call ebx
push 0x405b58
push edi
mov dword [0x4bcf1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405b68
push edi
mov dword [0x4bcf20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405b7c
push edi
mov dword [0x4bcf24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4bcf2c], eax
test eax, eax
je 0x41263b
push 0x405b98
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4bcf28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x412663
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x412656
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x412678
push 4
pop eax
jmp 0x412720
cmp dword [ebp - 0x14], esi
je 0x412678
push dword [0x4bcf1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41265d
mov eax, dword [0x4bcf28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4126d6
cmp dword [0x4bcf2c], edi
je 0x4126d6
push eax
call ebx
push dword [0x4bcf2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4126d6
test eax, eax
je 0x4126d6
call ecx
test eax, eax
je 0x4126cb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4126cb
test byte [ebp - 8], 1
jne 0x4126d6
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x412706
mov eax, dword [0x4bcf20]
cmp eax, edi
je 0x412703
push eax
call ebx
test eax, eax
je 0x412703
call eax
mov esi, eax
test esi, esi
je 0x412703
mov eax, dword [0x4bcf24]
cmp eax, edi
je 0x412703
push eax
call ebx
test eax, eax
je 0x412703
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4bcf1c]
call ebx
test eax, eax
je 0x41271e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x412720
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409594
mov esp, ebp
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5cb008], 0x8088405
inc edx
mov dword [ebx + 0x5cb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5af54a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5af551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5b08af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x5cd348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x5cd348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x5cc178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b08b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6e04245e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section._RDATA
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x67e0651d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4149cf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414845

Function at 0x419000
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418b53

Function at 0x402496
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.004023df
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x40365c
push eax
sub edi, fcn.00402e06
push edi
push fcn.00402e06
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402512
mov eax, fcn.00402e06
mov ebx, esi
mov edx, edi
call fcn.004023df
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call fcn.004019bc
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.00401250
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00402e06
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x415a07
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x415a2e
xor eax, eax
jmp 0x415a49
test byte [ebp - 4], 0x10
je 0x415a42
mov eax, 1
jmp 0x415a44
xor eax, eax
jmp 0x415a49
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push ebx
cdq
push esi
sub eax, edx
sar eax, 1
push edi
push ebp
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esi + eax*4 + 0x78]
test ecx, ecx
je 0x436754
mov eax, dword [ecx + 0xc]
cmp eax, edi
jne 0x436754
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], 1
inc eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
sub ecx, 2
mov dword [esp + 0x10], ecx
lea eax, [ecx + 8]
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
mov dword [esp + 0x1c], eax
mov edx, dword [esi + eax*4 + 0x78]
mov dword [esp + 0x20], edx
test edx, edx
je 0x436726
xor ebx, ebx
test edi, edi
jle 0x436717
lea edx, [esp + 0x28]
mov eax, edi
mov ebp, dword [edx]
lea ebp, [ebp + ebp*2]
mov ecx, dword [esi + ebp*8 + 0x20]
test ecx, ecx
je 0x436711
mov ebx, 1
add edx, 4
dec eax
jne 0x4366fe
test ebx, ebx
jne 0x436726
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x436760
mov eax, dword [esp + 0x14]
mov dword [esp + edi*4 + 0x28], eax
inc edi
add eax, 3
cdq
xor eax, edx
mov ecx, dword [esp + 0x18]
sub eax, edx
inc ecx
and eax, 3
mov dword [esp + 0x18], ecx
xor eax, edx
sub eax, edx
cmp ecx, 4
mov dword [esp + 0x14], eax
jl 0x4366c8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + eax*4 + 0x78]
push edx
call fcn.004358a0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + ecx*4 + 0x78]
mov ecx, dword [esi + eax*4 + 0x78]
push edx
call fcn.004358d0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x44d000
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x44d01a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44d02d
push eax
call fcn.00454570
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x44e420
Capabilities:
Terminate process

Disassembly:
cmp dword [0x478ca8], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x44e43e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x478ca4], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x478ca0], bl
jne 0x44e498
cmp dword [0xac7630], 0
je 0x44e486
mov edi, dword [0xac762c]
sub edi, 4
cmp edi, dword [0xac7630]
jb 0x44e486
mov eax, dword [edi]
test eax, eax
je 0x44e47b
call eax
sub edi, 4
cmp edi, dword [0xac7630]
jae 0x44e473
push 0x472030
push 0x472028
call fcn.0044e4d0
add esp, 8
push 0x472038
push 0x472034
call fcn.0044e4d0
add esp, 8
test ebx, ebx
jne 0x44e4bf
mov dword [0x478ca8], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret

Function at 0x44f010
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44f02f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44f042
push eax
call fcn.00454570
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x44f6c0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0
jne 0x44f6dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44f6ef
push eax
call fcn.00454570
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x450430
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x478f18
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x450457
add eax, 8
inc ecx
cmp eax, 0x478fa8
jb 0x450448
cmp dword [ecx*8 + 0x478f18], edx
lea ebx, [ecx*8]
jne 0x45061b
cmp dword [0x478af8], 1
je 0x4505d7
cmp dword [0x478af8], 0
jne 0x45048e
cmp dword [0x478afc], 1
je 0x4505d7
cmp edx, 0xfc
je 0x45061b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x4504cb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x45050f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x471580
push ebp
call fcn.0044e4f0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x471578
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x478f1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00451bf0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0xac7520], 0
je 0x4505ed
mov eax, dword [0xac7520]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x4505f7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x478f1c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x4509d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4509f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00454570
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x450a1a
test byte [esp + 8], 2
je 0x450a1a
mov dword [0x478c60], 0xd
mov dword [0x478c64], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret