joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f608
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f868
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x45f66b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0045f0d0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c5dc
cmp al, 1
jne 0x45f66b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0045f3e8
test al, al
je 0x45f7f7
cmp dword [ebp - 8], 0
jge 0x45f689
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0045f0d0
mov eax, dword [ebp - 0x210]
call fcn.00404838
cmp ebx, eax
jge 0x45f6d3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0045f0d0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x486c4c]
and eax, 0xff
bt dword [edx], eax
jae 0x45f6d3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x45f6e7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045f5e4
cmp ebx, dword [ebp - 8]
je 0x45f7e9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x45f713
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a24
and eax, 0x7f
movzx eax, word [eax*2 + 0x485e90]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x45f7d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a24
and eax, 0x7f
movzx eax, word [eax*2 + 0x485e90]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00441bf0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403a24
and eax, 0x7f
movzx eax, word [eax*2 + 0x485e90]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00441bf0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f7dd
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x45f84a
cmp dword [ebp - 8], 0
jge 0x45f802
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0045f0d0
mov eax, dword [ebp - 0x218]
call fcn.00404838
cmp eax, dword [ebp - 8]
jg 0x45f83c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0045f0d0
mov eax, dword [ebp - 0x21c]
call fcn.00404838
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045f5e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f86f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040459c
ret
Function at 0x46d2cc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46d2fa
mov eax, ebx
call fcn.0046dd80
cmp dword [ebx + 0x40], 0
je 0x46d2f3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46d36b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46d35d
cmp dword [ebx + 8], 0
je 0x46d31c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46d32e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46d35d
cmp dword [ebx + 8], 0
je 0x46d30f
cmp eax, 3
je 0x46d341
dec eax
jne 0x46d30f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46d30f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46d30f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46d389
cmp dword [ebx + 0x14], 0xcc
je 0x46d389
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046d394
pop ebx
ret

Function at 0x480880
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4808b8]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x480896
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4808a5
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4808b4
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x481bc8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x486ad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x481bee
push 0
mov eax, dword [0x486ad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x4840ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x483e0c
call fcn.0040638c
mov ebx, 0x488544
xor eax, eax
push ebp
push 0x4842e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402a30
mov edx, dword [ebp - 0x14]
mov eax, 0x487ff0
call fcn.00402d58
mov eax, dword [0x486b5c]
mov byte [eax], 0
mov edx, 1
mov eax, 0x487ff0
call fcn.00403208
call fcn.00402864
push 0x400
push 0x48854c
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x18]
mov eax, 0x48854c
call fcn.00408e0c
mov edx, dword [ebp - 0x18]
mov eax, 0x488548
mov ecx, 0x484300
call fcn.00404884
mov edx, dword [0x488548]
mov eax, 0x487ea4
call fcn.00402d58
mov eax, dword [0x486b5c]
mov byte [eax], 2
mov edx, 1
mov eax, 0x487ea4
call fcn.00403224
call fcn.004028e4
test eax, eax
jne 0x484283
mov edx, 0x34c
mov eax, 0x487ff0
call fcn.00403230
call fcn.00402864
mov edx, 0x488140
mov eax, 0x487ff0
call fcn.004030b4
call fcn.00402864
mov edx, 0x488141
mov eax, 0x487ff0
call fcn.004030b4
call fcn.00402864
mov edx, 0x488142
mov eax, 0x487ff0
call fcn.004030b4
call fcn.00402864
mov edx, 0x488143
mov eax, 0x487ff0
call fcn.004030b4
call fcn.00402864
mov eax, 0x487ff0
call fcn.00402ef0
call fcn.00402864
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a30
mov edx, dword [ebp - 0x1c]
mov eax, 0x487d58
call fcn.00402d58
mov eax, dword [0x486b5c]
mov byte [eax], 0
mov edx, 1
mov eax, 0x487d58
call fcn.00403208
call fcn.00402864
mov edx, dword [0x488140]
mov eax, 0x487d58
call fcn.00403230
call fcn.00402864
push ebx
mov edx, 0x488144
mov ecx, 0x400
mov eax, 0x487d58
call fcn.00402eb0
call fcn.00402864
push 0
mov edx, 0x488144
mov ecx, dword [ebx]
mov eax, 0x487ea4
call fcn.00402ed0
call fcn.00402864
cmp dword [ebx], 0x400
jae 0x48422b
mov eax, 0x487ea4
call fcn.00402ef0
call fcn.00402864
mov eax, 0x487d58
call fcn.00402ef0
call fcn.00402864
mov eax, dword [0x486ad8]
mov eax, dword [eax]
call fcn.0045b048
mov eax, dword [0x486ad8]
mov eax, dword [eax]
mov edx, 0x484314
call fcn.0045ac40
mov ecx, dword [0x486994]
mov eax, dword [0x486ad8]
mov eax, dword [eax]
mov edx, dword [0x481d24]
call fcn.0045b060
mov eax, dword [0x486ad8]
mov eax, dword [eax]
call fcn.0045b0e0
mov eax, dword [0x488548]
call fcn.00408a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4842f0
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040459c
ret
Function at 0x44aab0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x214
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push 0x104
push eax
push ecx
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44ab72
cmp eax, 0x104
jne 0x44aaf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44ab72
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44ab72
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x44ab72
mov ecx, dword [esp + 0x10]
push ebx
push esi
push edi
lea edx, [esp + 0x24]
push ecx
push edx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44ab5a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44ab5a
mov edx, dword [esp + 0x10]
mov ebx, 1
mov ax, word [edx]
mov word [ebp], ax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x214
ret 8
Function at 0x4931f7
Capabilities:
Encode data using xor

Disassembly:
pop ebp
in al, dx
outsb dx, byte [esi]
lodsd eax, dword [esi]
mov ah, 0xcd
xchg ebp, eax
in eax, dx
aam 0xca
cdq
or byte [ecx + 0x5b], ch
imul ebx, dword [ebx - 7], 0xd43a5360
mov ch, 0xeb
aad 0xf7
inc ebx
inc edi
jns 0x493224
mov eax, 0x4b1be578
push 0xaeffa977
xor eax, 0x26ed77d9
rcl dword [edi], cl
aad 0x83
fld qword [ecx]
xor byte [esi + 0x16], bh
test dword [esp], ebp
push esi
lodsb al, byte [esi]
in eax, dx
out 0xf6, eax
lea edx, [0x8e44ba14]
das
wait
pop es
and bh, byte [ecx]
mov esi, 0x1e5e3277
fiadd word [eax + 0x14a323f9]
rcl dword [ebx]
or eax, 0xa77b8f9c
jnp 0x4931a0
jnp 0x4931a0
xchg eax, ecx
dec byte [ebx]
comiss xmm7, dword [ecx]
call 0xde7ece7f
wait
stosb byte es:[edi], al
and eax, 0xa8a157d4
mov ecx, 0x8a47ed6
and dl, al
test cl, ah
out 0x4d, eax
invalid
movsb byte es:[edi], byte [esi]
or byte [edx], ah
rol byte [ecx + 0x31c74de7], 1
mov al, byte [0xde8216c]
fisub word [ecx]
or eax, 0x21b4a104
add al, 0xa1
mov ah, 0x21
mov ds, ecx
sbb ebx, dword [edi - 0x13]
add ah, dl
sal byte [ebx], 1
xlatb
cwde
xchg edx, eax
or dword [edi - 0x34], esp
pop ecx
movsb byte es:[edi], byte [esi]
out dx, eax
xor eax, 0x430c704
loope 0x493271
jge 0x493287
push cs
pop edi
dec eax
jne 0x493212
pop edx
cmp al, 0xb7
mov byte [eax], cl
mov ecx, 0x685422b0
mov byte [0x2ad4865c], al
inc eax
fidivr word [ebx + 0x40d2188d]
push ds
xor cl, bh
and byte [ebx], al
out 0x77, eax
out dx, al
stosd dword es:[edi], eax
std
arpl cx, dx
popal
mov ebp, 0x105dd47
inc esi
mov esp, 0xada7ff92
cld
push eax
add al, 0xbe
mov bl, 0
cmp byte [edx + 0x2e], 0x89
and dword [edi - 0x24582cef], ebx
pop ds
add dword [esi - 0x44], eax
xchg edx, eax
jmp dword [edi + 0x450fcad]
cmpsd dword [esi], dword es:[edi]
fistp dword [edi]
je 0x493294
les esp, [eax + 0x38]
in eax, dx
pop ebp
push ss
xor al, 7
test byte [ecx], cl
pop edi
and al, 0xb
jge 0x49328e
or dword [edi + 0x24], ebx
or edi, dword [ebp - 0xc]
loope 0x4932bb
ja 0x493286
push 0x40
aaa
imul edi, dword [edi + 0x7e], 0xfffffff7
out 0x17, eax
mov esp, 0x940fcfd7
dec edx
xor eax, 0x6ef1fe27
invalid
and eax, 0x48347059
ret
Function at 0x5cc28c
Capabilities:
Encode data using xor

Disassembly:
jbe 0x5cc2d5
mov dword [0x497cee4f], eax
je 0x5cc309
sub eax, 0x140e9b8d
or al, 0x14
lea esi, [esi]
mov byte [0x9c73a0f2], al
push ebp
pop eax
cmp eax, 0x59b2749b
sub eax, 0xf33a4c3a
mov edx, 0x7710a419
sbb eax, dword [eax - 0xffd2b10]
sbb al, 0x3f
cmp al, 0xe5
jbe 0x5cc2de
mov edi, 0x83448e06
inc esp
mov es, word [ebx + eax*4 + 0x44]
sbb al, byte [edi + 0x63ef7381]
mov ebx, 0x5b502634
inc esi
xor dl, byte [esp + ecx*8 - 0x6f43f85f]
shl byte [eax], cl
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xd290bc07]
and byte [esi + 0x3acce471], ah
mov word [edx], ds
and ebx, ebx
jae 0x5cc307
pop es
mov esp, 0xa620d290
jno 0x5cc2c2
int3
mov dword [0x139c0834], eax
scasb al, byte es:[edi]
cmc
adc dword [edx], ecx
ja 0x5cc2d6
dec ebx
pop es
sub ecx, esp
movsb byte es:[edi], byte [esi]
dec eax
or dl, cl
cmp bl, byte [ebx + ebx*8 + 0x4d]
das
jnp 0x5cc2b4
invalid
cmp eax, 0x1ac96137
in eax, 0x54
popal
leave
sbb ah, ch
push esp
lodsd eax, dword [esi]
inc esi
xchg esp, eax
into
ret 0x5d94
Function at 0x5f99c3
Capabilities:
Encode data using xor

Disassembly:
sbb edi, eax
add dword [edi + 0x4eb45c3], esp
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
sbb al, 0x24
pminub mm7, qword [0xea406801]
nop
clc
pushal
sub al, 0x59
adc al, 0x12
add esi, ebx
add ebx, dword [edi + ebx*2 + 0xd7566ac]
inc ebx
neg dword [edi]
cmp eax, 0x9a02f93b
add bl, byte [edx + 0x1b9c0595]
lodsb al, byte [esi]
pushfd
add dword [eax + 0x40], ebp
ljmp 0x1459
add bl, byte [edx + 0x1b9c0595]
lodsb al, byte [esi]
pushfd
xor dword [ebp + 0xf50d774], 0x95f525f2
xchg ebp, eax
xor eax, 0x58bf5d20
push esp
salc
imul bh
popfd
mov esi, 0x576d9f8c
sbb cl, byte [edi]
mov bl, 0x54
xor dword [eax + 0x5f], 0x365b491f
mov ebx, 0xee48abaa
jge 0x5f99a9
dec esp
and bh, byte [edi + 0x1c]
push 0xffffffffffffffe3
xchg ebp, eax
imul byte [esi + ebx - 0x495fac41]
pop esi
and eax, 0x29176462
stosb byte es:[edi], al
sub al, 0x4f
cmc
jmp 0x5f999a

Function at 0x401ae8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebx, section..text
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
sub ebx, 0x1000
mov dword [0x4028f4], ebx
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401b11
push esp
mov eax, str.contents
mov dword [ebp - 4], eax
lea eax, [0x401187]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x4028f4]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x4028f4]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x402904], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402904]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401bc9
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401bb0
pop ebp
ret 0x10

Function at 0x5d8a9d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x5d87dc
mov edi, ebx
call fcn.005d8ad8
mov edi, ebx
xor dword [esi], ecx
mov edi, 0x1bddf57b
add esi, 2
sub edi, 0x6b8fad49
mov edi, 0x99de8c2c
add ebx, edi
cmp esi, eax
jl fcn.005d8a9d
add ebx, 0x4e7be842
ret

Function at 0x8c2128
Capabilities:
Encode data using xor

Disassembly:
push 0x8c1ea3
mov edi, dword [esp]
add esp, 4
sub ebx, 0x9f42a7a7
call fcn.008c216e
inc eax
inc eax
xor dword [esi], edi
sub eax, 0x7890088b
or ebx, ebx
add eax, eax
inc esi
inc ebx
add ebx, ebx
mov eax, 0x86e79987
cmp esi, ecx
jne fcn.008c2128
dec eax
mov ebx, 0xa150eb5b
add ebx, 1
ret
Function at 0x406000
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x80ca7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042d4
call fcn.00406c61
push 4
mov dword [esp + 0x18], 0
call fcn.00407a93
mov edi, eax
add esp, 4
test edi, edi
je 0x406074
push ebx
call fcn.00406b39
mov dword [edi], eax
call fcn.004068f8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406c22
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406068
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406c4a
pop ebx
jmp 0x406076
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408501
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x810790]
jne 0x40850b
repz ret
jmp fcn.0040ca5c
Function at 0x4118e2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x810790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b045
and dword [ebp - 0x14], 0
cmp dword [0x815650], 0
mov dword [ebp - 0x18], eax
jne 0x411995
push 0x40379c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411a3d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403790
push ebx
call edi
test eax, eax
je 0x411a3d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403780
push ebx
mov dword [0x815650], eax
call edi
push eax
call esi
push 0x40376c
push ebx
mov dword [0x815654], eax
call edi
push eax
call esi
push 0x403750
push ebx
mov dword [0x815658], eax
call edi
push eax
call esi
mov dword [0x815660], eax
test eax, eax
je 0x411995
push 0x403738
push ebx
call edi
push eax
call esi
mov dword [0x81565c], eax
mov eax, dword [0x81565c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4119ee
cmp dword [0x815660], ecx
je 0x4119ee
push eax
call esi
push dword [0x815660]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4119ee
test ebx, ebx
je 0x4119ee
call edi
test eax, eax
je 0x4119e5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4119e5
test byte [ebp - 8], 1
jne 0x4119ee
or dword [ebp + 0x10], 0x200000
jmp 0x411a21
mov eax, dword [0x815654]
cmp eax, dword [ebp - 0x18]
je 0x411a21
push eax
call esi
test eax, eax
je 0x411a21
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411a21
mov eax, dword [0x815658]
cmp eax, dword [ebp - 0x18]
je 0x411a21
push eax
call esi
test eax, eax
je 0x411a21
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x815650]
call esi
test eax, eax
je 0x411a3d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411a3f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408501
leave
ret
Function at 0x80ab60
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004122e0
cmp dword [0xb993e4], 0x37
jne 0x80abfa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0xb9a3d8]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x81a434]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x80ae90
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb993e4]
sub esp, 0x97c
push ebx
push ebp
push esi
mov esi, dword [0x81a434]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x80b0a6
mov dword [esp + 0x30], 0x9e3779b9
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jmp 0x80aed6
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [0xb993e4], 0x1c
jne 0x80aeed
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x8112d0]
mov ebx, dword [0x8112d8]
mov ebp, dword [0x8112dc]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x8112d4]
mov dword [esp + 0x1c], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], 0x20
jmp 0x80af36
mov eax, dword [esp + 0x1c]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x20], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0xb99354], edi
mov eax, dword [esp + 0x20]
add dword [0xb99354], eax
mov eax, dword [0xb99354]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x3c]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x38]
add dword [esp + 0x10], eax
cmp dword [0xb993e4], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x80afcd
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0xb993e4], 0x979
mov dword [0xb99358], 0xff6b3619
mov dword [0xb9935c], 0xffffffff
mov dword [esp + 0x20], eax
jne 0x80b017
push 0
lea ecx, [esp + 0x18c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x48]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
add dword [esp + 0x18], eax
sub esi, dword [esp + 0x18]
dec dword [esp + 0x2c]
jne 0x80af30
cmp dword [0xb993e4], 0x8d4
jne 0x80b05b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0xb993e4], 0x17
jne 0x80b095
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x48]
push edx
push 0x403f40
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x24], esi
jne 0x80aed0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x97c
ret