joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4063e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x4334c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x434388]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24c], ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4340d0]
cmp eax, dword [ecx + 4]
jg 0x4065a7
cmp dword [0x433498], 0
jne 0x40658a
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call fcn.004071c0
test al, al
jne 0x406499
push esi
lea eax, [ebp - 0x1c]
push str._05d
push eax
call fcn.00401250
mov esi, eax
add esp, 0xc
cmp esi, 0x433488
je 0x406581
mov ecx, dword [0x43349c]
cmp ecx, 0x10
jb 0x40653e
mov edx, dword [0x433488]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406534
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4065dd
jmp 0x406534
push edi
push 0
push 2
mov dword [ebp - 0x24c], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov edi, eax
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.0040fc60
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x406507
cmp dword [ebp - 0x240], esi
je 0x4064fb
lea eax, [ebp - 0x248]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4064e0
jmp 0x406507
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x24c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 0x24c]
lea eax, [ebp - 0x1c]
push str._05d__05d
push eax
call fcn.00401250
add esp, 0x10
mov esi, eax
cmp esi, 0x433488
pop edi
jmp 0x406456
push ecx
push edx
call fcn.0040e103
add esp, 8
mov dword [0x433498], 0
mov dword [0x43349c], 0xf
mov byte [0x433488], 0
movups xmm0, xmmword [esi]
movups xmmword [0x433488], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x433498], xmm0
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [esi + 0x14], 0xf
lea ecx, [ebp - 0x1c]
call fcn.004014b0
pop esi
push 0x433488
mov ecx, ebx
call fcn.00402750
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040e2f6
mov esp, ebp
pop ebp
ret
push 0x4340d0
call fcn.0040e220
add esp, 4
cmp dword [0x4340d0], 0xffffffff
jne 0x40641d
push 0x4273e0
call fcn.0040e563
push 0x4340d0
call fcn.0040e1d6
add esp, 8
jmp 0x40641d
call fcn.0041164f
int3
Function at 0x4065f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426656
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4334c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x24c], esi
call fcn.0040fc60
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.0040f960
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406675
sub ecx, edi
mov dword [ebp - 0x220], 0
sar ecx, 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
push eax
test edx, edx
je 0x40676e
call fcn.00401ef0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0040b7c0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00406c00
mov ecx, dword [ebp - 0x234]
add esp, 0x10
cmp ecx, 0x10
jb 0x40671f
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406715
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4067b3
push ecx
push edx
call fcn.0040e103
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x406796
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40678c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4067b3
jmp 0x40678c
call fcn.00401ef0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.0040b7c0
add esp, 8
jmp 0x40673a
push ecx
push edx
call fcn.0040e103
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e2f6
mov esp, ebp
pop ebp
ret
call fcn.0041164f
int3
Function at 0x40ec91
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ecd0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ecd0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ecd0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40ecd0
cmp dword [ecx + 0x74], 0xe
jbe 0x40ecd0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x419dbb
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419d3d

Function at 0x41c601
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x434a88]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c641
cmp byte [ebx], 0xa
jne 0x41c641
or byte [eax + edi + 0x28], 4
jmp 0x41c646
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41c744
mov al, byte [edx]
cmp al, 0x1a
je 0x41c726
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41c675
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41c69a
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41c6a4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41c657
jmp 0x41c744
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c721
cmp dword [ebp - 0xc], 0
je 0x41c721
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x434a88]
test byte [eax + edi + 0x28], 0x48
je 0x41c6fb
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41c6e6
mov byte [esi], dl
jmp 0x41c6f7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x434a88]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41c744
cmp byte [ebp - 1], 0xa
jne 0x41c70a
cmp esi, ebx
jne 0x41c70a
mov byte [esi], 0xa
jmp 0x41c743
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041d04f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41c744
mov byte [esi], 0xd
jmp 0x41c743
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x434a88]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c740
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c744
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41c74d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x434a88]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c790
cmp word [esi], dx
jne 0x41c790
or byte [edi + eax + 0x28], 4
jmp 0x41c795
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41c8e8
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41c8c8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41c7d7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41c80d
cmp eax, edx
jae 0x41c819
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41c7af
jmp 0x41c8e8
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c8c4
cmp dword [ebp - 0x14], 0
je 0x41c8c4
mov eax, dword [ebx*4 + 0x434a88]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41c89c
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41c865
mov word [esi], cx
jmp 0x41c898
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x434a88]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x434a88]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x434a88]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41c8e8
pop ebx
cmp word [ebp - 4], bx
jne 0x41c8ad
cmp esi, dword [ebp + 0xc]
jne 0x41c8ad
mov word [esi], bx
jmp 0x41c8e5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041d04f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41c8e8
push 0xd
jmp 0x41c8e1
mov ecx, dword [ebx*4 + 0x434a88]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c8df
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c8e8
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41e400
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c368
push 0x42c360
push str.FlsAlloc
push 0x1e
call fcn.0041e29e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e434
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281dc]
call esi
jmp 0x41e43a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41e47e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c378
push 0x42c370
push str.FlsGetValue
push 0x20
call fcn.0041e29e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e4b5
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281dc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41f7b4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41f851
push ebx
push esi
call fcn.0041f77d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e09a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41f7fe
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f850
push edi
push eax
call fcn.0041a66d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41f81e
call fcn.0041a633
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f84f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e09a
add esp, 0x20
test eax, eax
jne 0x41f83d
push edi
call fcn.0041a633
jmp 0x41f845
push ebx
call fcn.0041a633
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x424655
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004245d1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4247cd
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4247cd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x42477c
jg 0x4246ae
test eax, eax
je 0x424772
push 1
push 0x1000
call fcn.0041e7b7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4246d4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x424769
push 0x8000
push ebx
call fcn.00417d38
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x424700
jg 0x4246fb
cmp ecx, 0x1000
jb 0x424700
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041d99a
add esp, 0x10
cmp eax, 0xffffffff
je 0x424745
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4246fb
jl 0x42472c
test ecx, ecx
jne 0x4246ed
push dword [ebp - 0xc]
push ebx
call fcn.00417d38
push esi
call fcn.0041a633
add esp, 0xc
xor edi, edi
jmp 0x4247de
cmp byte [edi + 0x24], 0
je 0x42475c
cmp dword [edi + 0x20], 5
jne 0x42475c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x424767
mov edi, dword [edi + 0x18]
jmp 0x424769
xor edi, edi
push esi
call fcn.0041a633
pop ecx
jmp 0x4247de
test ecx, ecx
jg 0x42473e
jl 0x42477c
test eax, eax
jae 0x42473e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d04f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x42479f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42473e
jmp 0x4247d6
push ebx
call fcn.0041fc1e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42473e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4247de
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4247db
mov edi, dword [edi + 0x18]
jmp 0x4247de
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041d04f
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425bcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425bcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401010
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40104b
push 6
call fcn.00401f76
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0xffffffff
je 0x401066
cmp dword [ebp - 4], 0xffffffff
je 0x401066
xor eax, eax
jmp 0x40106b
mov eax, 1
test eax, eax
je 0x4010c8
push 0x80000004
push 0
push 0x404200
push 0
push 0
push 0
push 2
mov ebx, 0x904
call fcn.004021d0
add esp, 0x1c
push 0
push 0
push 0
push 1
mov ebx, 0x908
call fcn.004022c0
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4010be
push ebx
call fcn.00401f64
add esp, 4
mov eax, 0
jmp 0x40115c
push 0x14
call fcn.00401227
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4010f7
push 6
call fcn.00401f76
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x401107
push ebx
call fcn.00401f64
add esp, 4
call fcn.00401427
mov dword [ebp - 0xc], esp
push 0xa
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401133
push 6
call fcn.00401f76
add esp, 4
mov dword [ebp - 0xc], esp
call dword [0x40433b]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401152
push 6
call fcn.00401f76
add esp, 4
mov eax, 0
jmp 0x40115c
mov esp, ebp
pop ebp
ret
Function at 0x4021d0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0x10
test ecx, ecx
mov eax, 0xfffffff5
je 0x4021ec
cmp dword [esp + 0x18], 2
jne 0x4021ec
mov eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
cmp eax, 1
jle 0x4022b8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea esi, [esp + 0x30]
dec eax
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x14], 0
cmp eax, 0x80000004
jne 0x402231
mov ebx, dword [esi]
jmp 0x402248
push esi
call fcn.00402950
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40229e
mov dword [esp + 0x14], 1
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x402289
mov edi, ebx
mov eax, 0x400
mov dword [esp + 0x10], 0
cmp esi, eax
jae 0x40226d
mov eax, esi
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push edi
push edx
call ebp
mov eax, dword [esp + 0x10]
sub esi, eax
add edi, eax
test esi, esi
ja 0x40225a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40229a
push ebx
call sub.MSVCRT.dll_free
add esp, 4
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
add esi, 0xc
dec eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], eax
jne 0x40221b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4025b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x402619
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.004020b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x402650
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.004020b0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x4026a7
push ebx
push edi
call fcn.00402100
push esi
mov ebx, esi
call fcn.004020b0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x40267e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4026e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x402772
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x402764
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x40275c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x402725
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x4e10cd
Capabilities:
Encode data using xor

Disassembly:
pushal
mov dword [esp + 3], eax
mov word [esp + 6], di
jmp 0x4e10f0
lea esp, [esp + 0x24]
call eax
sub esp, 0xc
mov dword [esp + 1], ebp
mov dword [ebp - 8], eax
jmp 0x4e1121

Function at 0x4e11b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pushal
rdtsc
mov ebx, ecx
rdtsc
jmp 0x4e11c2
push dword [esp + 6]
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x4e1198
mov al, ah
mov dword [esp + 0x14], ebp
popal
jmp 0x4e11fb
lea edx, [edx - 8]
mov eax, dword [edx]
pop edx
clc
stc
jmp 0x4e11e0

Function at 0x59ff36
Capabilities:
Parse pe header

Disassembly:
pop dword [esp + 0xa]
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x59fefe
jmp 0x59ff17

Function at 0x59ffa3
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov dword [esp + 1], eax
mov byte [esp + 0xb], bh
push esp
call fcn.0059ff36
leave
push edx
shl byte [edi - 0x35ac04ae], 0x65
Function at 0x40f810
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf7fb
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x4fe320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xdc], ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xd8]
push 0x84
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xd8]
call fcn.00471870
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push edi
push 0x4d9958
push eax
mov dword [ebp - 4], 0
call fcn.00472010
add esp, 0xc
mov dword [ebp - 0x50], 0x40
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
jne 0x40f8f1
cmp ecx, 0x2200
ja 0x40f8f1
test eax, eax
jne 0x40f8ea
cmp ecx, 0x1c00
ja 0x40f8ea
test eax, eax
jne 0x40f8e3
cmp ecx, 0xe00
ja 0x40f8e3
test eax, eax
jne 0x40f8dc
cmp ecx, 0xa00
ja 0x40f8dc
mov eax, 0x300
jmp 0x40f8f6
mov eax, 0x400
jmp 0x40f8f6
mov eax, 0x800
jmp 0x40f8f6
mov eax, 0xc00
jmp 0x40f8f6
mov eax, 0x1000
cmp edi, eax
jne 0x40f910
mov ecx, str.recommend_postfix
call fcn.0040bfa0
push eax
lea ecx, [ebp - 0xd8]
call fcn.00471b20
mov esi, dword [ebx]
lea ecx, [ebp - 0xd8]
call fcn.00425880
push eax
mov ecx, ebx
call dword [esi + 0x3c]
mov eax, dword [ebx]
mov ecx, ebx
push edi
call dword [eax + 0xd8]
mov eax, dword [ebp - 0xdc]
lea ecx, [ebx + 0x760]
mov edx, dword [ecx]
push 0
mov eax, dword [eax]
cmp dword [eax + 0x62c], edi
sete al
movzx eax, al
push eax
call dword [edx + 0x1c]
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0xffffffff
call fcn.00471930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bce6c
mov esp, ebp
pop ebp
ret 8