joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x48126d
cmp dword [ebp + 0x14], edi
je 0x48126d
cmp ecx, edi
jne 0x481274
call fcn.00487210
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00480eca
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x481288
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4812a9
cmp ebx, 0xffffffff
je 0x481298
push ebx
push edi
push ecx
call fcn.004814f0
add esp, 0xc
cmp esi, edi
je 0x481255
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x481255
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4812c5
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4812cc
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4813bd
test word [esi + 0xc], 0x10c
je 0x481320
mov eax, dword [esi + 4]
test eax, eax
je 0x481320
jl 0x48141e
cmp ebx, eax
mov edi, ebx
jb 0x4812f1
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4813c5
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004807d8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4813b5
cmp ebx, dword [ebp - 0xc]
jb 0x48138d
cmp dword [ebp - 0xc], 0
je 0x48134a
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x48133f
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x481346
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x481355
mov eax, SysReAllocString
cmp ebx, eax
ja 0x481355
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4813f1
push eax
push dword [ebp - 8]
push esi
call fcn.004837fd
pop ecx
push eax
call fcn.0048d87a
add esp, 0xc
test eax, eax
je 0x481430
cmp eax, 0xffffffff
je 0x48141e
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4813b5
push esi
call fcn.0048d199
cmp eax, 0xffffffff
pop ecx
je 0x481422
cmp dword [ebp - 4], 0
je 0x4813f1
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4812d4
mov eax, dword [ebp + 0x14]
jmp 0x48126f
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4813dc
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004814f0
add esp, 0xc
call fcn.00487210
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x481265
cmp dword [ebp + 0xc], 0xffffffff
je 0x481407
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004814f0
add esp, 0xc
call fcn.00487210
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x481265
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x48126f
or dword [esi + 0xc], 0x10
jmp 0x481422
Function at 0x4846b3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4846e0
call fcn.00487223
mov dword [eax], esi
call fcn.00487210
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00480eca
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4846bc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48470f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00487236
pop ecx
call fcn.00487210
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x484736
test al, 1
je 0x484736
test byte [esp + 0xc], 2
je 0x484736
call fcn.00487223
mov dword [eax], 5
call fcn.00487210
mov dword [eax], 0xd
jmp 0x484706
xor eax, eax
pop esi
ret

Function at 0x4861f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c6160]
jne 0x4861fb
repz ret
jmp fcn.004954d2

Function at 0x48aba5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4c6cb8]
je 0x48abc0
inc edi
cmp edi, 0x17
jb 0x48abb1
cmp edi, 0x17
jae 0x48ad40
push ebp
push 3
call fcn.00496fd7
cmp eax, 1
pop ecx
je 0x48ad0c
push 3
call fcn.00496fd7
test eax, eax
pop ecx
jne 0x48abf4
cmp dword [0x4c615c], 1
je 0x48ad0c
cmp ebx, 0xfc
je 0x48ad3f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4caf30
push ebp
call fcn.00484881
add esp, 0xc
test eax, eax
je 0x48ac2a
push esi
push esi
push esi
push esi
push esi
call fcn.00480dce
add esp, 0x14
push 0x104
mov esi, 0x4caf49
push esi
push 0
mov byte [0x4cb04d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x48ac6e
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00484881
add esp, 0xc
test eax, eax
je 0x48ac6e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00480dce
add esp, 0x14
push esi
call fcn.0047e9b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x48acb3
push esi
call fcn.0047e9b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4cb244
push 0x4a685c
sub ecx, eax
push ecx
push eax
call fcn.004949b6
add esp, 0x14
test eax, eax
je 0x48acb3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00480dce
add esp, 0x14
jmp 0x48acb5
xor esi, esi
push 0x4a6858
push ebx
push ebp
call fcn.00494945
add esp, 0xc
test eax, eax
je 0x48acd5
push esi
push esi
push esi
push esi
push esi
call fcn.00480dce
add esp, 0x14
push dword [edi*8 + 0x4c6cbc]
push ebx
push ebp
call fcn.00494945
add esp, 0xc
test eax, eax
je 0x48acf7
push esi
push esi
push esi
push esi
push esi
call fcn.00480dce
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00496e1a
add esp, 0xc
jmp 0x48ad3f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x48ad3f
cmp ebp, 0xffffffff
je 0x48ad3f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4c6cbc]
push dword [esi]
call fcn.0047e9b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x496e1a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0048a626
xor ebx, ebx
cmp dword [0x4cb9e4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x496ef0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x496fd0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x496fd0
push eax
call fcn.0048a5b8
mov dword [esp], 0x4a6c48
push edi
mov dword [0x4cb9e4], eax
call esi
push eax
call fcn.0048a5b8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4cb9e8], eax
call esi
push eax
call fcn.0048a5b8
mov dword [0x4cb9ec], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00485d30
test eax, eax
pop ecx
pop ecx
je 0x496ebe
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00480dce
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x496ef0
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0048a5b8
cmp eax, ebx
pop ecx
mov dword [0x4cb9f4], eax
je 0x496ef0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048a5b8
pop ecx
mov dword [0x4cb9f0], eax
mov eax, dword [0x4cb9f0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x496f75
cmp dword [0x4cb9f4], ecx
je 0x496f75
push eax
call fcn.0048a62f
push dword [0x4cb9f4]
mov esi, eax
call fcn.0048a62f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x496f75
cmp edi, ebx
je 0x496f75
call esi
cmp eax, ebx
je 0x496f42
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x496f42
test byte [ebp - 0x18], 1
jne 0x496f75
lea eax, [ebp - 0x10]
push eax
call fcn.00485d67
test eax, eax
pop ecx
je 0x496f5d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00480dce
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x496f6c
or dword [ebp + 0x10], 0x200000
jmp 0x496fb0
or dword [ebp + 0x10], 0x40000
jmp 0x496fb0
mov eax, dword [0x4cb9e8]
cmp eax, dword [ebp - 8]
je 0x496fb0
push eax
call fcn.0048a62f
cmp eax, ebx
pop ecx
je 0x496fb0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x496fb0
mov eax, dword [0x4cb9ec]
cmp eax, dword [ebp - 8]
je 0x496fb0
push eax
call fcn.0048a62f
cmp eax, ebx
pop ecx
je 0x496fb0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4cb9e4]
call fcn.0048a62f
cmp eax, ebx
pop ecx
je 0x496fd0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x496fd2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409080
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
cmp dword [0x479484], 0x13f7
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 8], 0xc6ef3720
mov dword [ebp - 0x14], eax
jne 0x4090c9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
cmp dword [0x479484], 0x60b
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], eax
jne 0x409112
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov dword [ebp - 0xc], 0x20
lea esp, [esp]
mov ecx, dword [ebp - 0x1c]
mov eax, edi
push ecx
shl eax, 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], eax
call fcn.00409020
mov eax, dword [ebp - 8]
lea ebx, [eax + edi]
mov eax, edi
shr eax, 5
add eax, dword [ebp - 0x10]
cmp dword [0x479484], 0x1b
mov dword [ebp + 0xc], eax
mov dword [0x45c8e4], 0xffcf03fc
jne 0x409188
push 0
push 0
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0x401330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov eax, dword [ebp + 0xc]
xor eax, ebx
xor eax, dword [ebp - 4]
mov dword [0x45c8e4], 0
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
add dword [0x45c8e4], eax
sub esi, dword [ebp + 0xc]
mov dword [0x45c8e8], 0xc5e121b4
mov edx, esi
shr edx, 5
mov dword [0x45c8ec], 0xffffffff
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x18]
add dword [ebp + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x14]
add ecx, esi
xor eax, ecx
mov dword [ebp - 4], eax
push edx
lea eax, [ebp - 4]
push eax
call fcn.00408ff0
sub edi, dword [ebp - 4]
push 0x9e3779b9
lea ecx, [ebp - 8]
push ecx
call fcn.00408320
sub dword [ebp - 0xc], 1
jne 0x409120
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409220
Capabilities:
Copy file
Manipulate console buffer
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
cmp dword [0x479484], 0x516
jne 0x409275
push 0
lea eax, [ebp - 0xddc]
push eax
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
mov word [ebp - 2], dx
lea eax, [ebp - 8]
push eax
mov word [ebp - 4], cx
mov ecx, dword [ebp - 4]
push ecx
push edx
lea edx, [ebp - 0x5dc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [ebp + 0xc]
shr eax, 3
test eax, eax
jbe 0x409392
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], eax
cmp dword [0x479484], 0x29
jne 0x4092d4
lea edx, [ebp - 0x2c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
cmp dword [0x479484], 0xe1b
jne 0x4092f7
lea ecx, [ebp - 0x42c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x479484], 0x1c
jne 0x40934b
push 0
call esi
push 0
push 0
push 0
lea edx, [ebp - 0x1dc]
push edx
call edi
lea eax, [ebp - 0xc0]
push eax
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
call fcn.00409080
cmp dword [0x479484], 0x4fa
jne 0x409381
xor edx, edx
xor ecx, ecx
lea eax, [ebp - 0x10]
push eax
mov word [ebp + 8], cx
mov word [ebp + 0xa], dx
mov ecx, dword [ebp + 8]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
add dword [ebp + 0xc], 8
sub dword [ebp - 4], 1
jne 0x4092a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4093a0
Capabilities:
Check for unexpected memory writes
Connect pipe
Extract resource via kernel32 functions
Get disk information
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
cmp dword [0x479484], 0x37
jne 0x40947f
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
push ecx
push 0x401364
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
lea eax, [ebp - 0x438]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
mov dword [ebp - 4], 0
mov eax, dword [0x479488]
add dword [ebp - 4], eax
mov eax, 0x38d6
add dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dl, byte [ecx + eax]
mov ecx, dword [0x45c8e0]
mov byte [ecx + eax], dl
mov esp, ebp
pop ebp
ret 4

Function at 0x4094e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x452228
mov byte [0x452229], al
mov byte [0x45222a], 0x72
mov byte [0x452230], 0x2e
mov byte [0x452231], 0x64
mov byte [0x452232], cl
mov byte [0x452234], 0
mov byte [0x45222c], al
mov byte [0x45222d], cl
mov byte [0x45222e], 0x33
mov byte [0x45222f], 0x32
mov byte [0x452233], al
mov byte [0x45222b], 0x6e
mov byte [0x452228], 0x6b
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x479484]
mov edx, dword [0x45c8e0]
mov dword [0x478b1c], eax
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push edx
mov byte [0x452236], 0
mov byte [0x45222f], 0x50
mov byte [0x45222d], 0x61
mov byte [0x452228], 0x60
mov byte [0x452230], 0x7c
mov byte [0x452231], 0x6f
mov byte [0x452235], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x4095c0
Capabilities:
Copy file
Get common file path
Read .ini file
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x918
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
xor edi, edi
lea ebx, [ebx]
push 0
call esi
cmp dword [0x479484], 0x16
jne 0x409615
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
call esi
cmp dword [0x479484], 0x9e
jne 0x40964a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea eax, [ebp - 0x918]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea ecx, [ebp - 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp edi, 0x3775ee
jg 0x40965b
inc edi
cmp edi, 0x332beaf6
jl 0x4095e0
mov edx, dword [0x479484]
mov eax, dword [0x45c8e0]
push 0x427010
push edx
push eax
call fcn.00409220
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
xor esi, esi
cmp dword [0x479484], 0x10
jne 0x4096a1
push 0
call edi
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
call ebx
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnfix]
cmp esi, 0x1e673
jne 0x4096ae
call fcn.004094c0
inc esi
cmp esi, 0x3e79e
jl 0x409680
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 4], 0xdd9a7
cmp dword [0x479484], 0xc01
jne 0x40970f
push 0
push 0
call esi
call edi
push 0
push 0
push 0
push 0
call ebx
push 0
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
sub dword [ebp - 4], 1
jne 0x4096d0
mov cl, 0x6d
mov al, 0x6c
push 0x452228
mov byte [0x452228], cl
mov byte [0x452229], 0x73
mov byte [0x452232], al
mov byte [0x45222e], 0x32
mov byte [0x45222a], 0x69
mov byte [0x45222d], 0x33
mov byte [0x452233], 0
mov byte [0x45222c], 0x67
mov byte [0x452230], 0x64
mov byte [0x45222b], cl
mov byte [0x452231], al
mov byte [0x45222f], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x479484], 0x1144
pop edi
pop esi
pop ebx
jne 0x4097f1
push 0x401384
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0
push 0
lea edx, [ebp - 0x918]
push edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
push 0x40139c
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40a6e0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40a703
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40a70a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40a721
mov edx, dword [ebp - 4]
push edx
call fcn.00410810
add esp, 4
or eax, 0xffffffff
jmp 0x40a723
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40aa00
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40aa1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40aa26
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40aa3d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00410810
add esp, 4
or eax, 0xffffffff
jmp 0x40aa3f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x415530
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4513f4]
jne 0x41553a
repz ret
jmp fcn.0041b610
Function at 0x495e30
Capabilities:
Accept command line arguments

Disassembly:
push esi
call fcn.0044b610
jmp fcn.00bb3466

Function at 0x605526
Capabilities:
Encode data using xor

Disassembly:
pop es
and byte [ebx + 0x868b120], ch
and al, 0x3c
jecxz 0x6054f6
ja 0x605539
das
dec eax
out 0x17, eax
sar byte [edx - 0x84f4d81], 1
inc ecx
bnd retf 0x9908
push ebp
ret
in eax, 0xa8
cmpsd dword [esi], dword es:[edi]
aas
push es
test byte [edi - 0x13], ah
cmpsd dword [esi], dword es:[edi]
add byte [ecx], bl
lcall 0x8047, 0x20fb8426
pop ecx
outsb dx, byte [esi]
cmp esp, dword [ecx + 0x2d540c24]
pop eax
jno 0x6054ca
call 0x72c7aada
mov bh, 0x38
add al, 0xca
xor dword [ebx], 0xffffffca
dec ecx
mov bh, 0x60
loope 0x605543
mov esi, 0xe1c0fff2
bound ecx, qword [edi + 0x2837bcec]
mov edx, 0xd7282710
pop esi
jge 0x60558b
ret
retf 0x2fc4

Function at 0x609606
Capabilities:
Encode data using xor

Disassembly:
dec eax
dec eax
loop 0x609607
fadd qword [esi - 0xe]
lds esi, [eax + eax - 0x37471919]
movsb byte es:[edi], byte [esi]
inc esi
xchg ecx, eax
out 0x67, eax
fsub dword [edi - 0x5f]
fisttp word [edx]
push 0xffffffffffffff80
invalid
Function at 0x406f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [eax + 0xc758b56]
and eax, 3
push edi
adc al, byte [edx]
add ch, bl
add byte [eax], al
imul dword [ebx]
xor dh, 0x74
sbb al, 0x8b
jge 0x406f33
test edi, edi
jne 0x406f6b
sub dword [esi + 3], 0x74
adc byte [ecx + eax*8], bh
cdq
je 0x406f7d
pop edi
mov eax, 0x83661187
pop esi
pop ebp
ret 0x7418
pop edi
mov eax, 0x30016
pop esi
ret 0x18
mov eax, 2
sub ah, cl
stosb byte es:[edi], al
push edi
sub dword [ebx - 0x38aeebb3], ecx
push esi
push edx
call 0x1066fa0
and al, byte [eax]
sbb byte [edi + 0x5e], bl
pop ebp
ret 0x18

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub dword [esp + edx - 0x7d], 0x7d
adc byte [eax + 0x7c], cl
pop es
mov dword [ebp + 0x55], 0x4e
fld qword [ebp - 0x30]
fcomp qword [0x40b930]
mov esp, dword [eax - 0x4f74ace8]
and byte [esi - 0x20a809cd], cl
pop ebp
and esi, dword [ebp - 4]
invalid