joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039aa1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10039a1d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10039c10
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10039c10
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10039bc5
jg 0x10039afd
test eax, eax
je 0x10039bbb
push 1
push 0x1000
call fcn.1002a233
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10039b20
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10039bb2
push 0x8000
push ebx
call fcn.1003994e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10039b49
jg 0x10039b44
cmp ecx, 0x1000
jb 0x10039b49
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1002b1cb
add esp, 0x10
cmp eax, 0xffffffff
je 0x10039b8e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10039b44
jl 0x10039b75
test ecx, ecx
jne 0x10039b36
push dword [ebp - 0xc]
push ebx
call fcn.1003994e
push esi
call fcn.1002b3e7
add esp, 0xc
xor ebx, ebx
jmp 0x10039c1e
cmp byte [edi + 0x24], 0
je 0x10039ba5
cmp dword [edi + 0x20], 5
jne 0x10039ba5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10039bb0
mov ebx, dword [edi + 0x18]
jmp 0x10039bb2
xor ebx, ebx
push esi
call fcn.1002b3e7
pop ecx
jmp 0x10039c1e
test ecx, ecx
jg 0x10039b87
jl 0x10039bc5
test eax, eax
jae 0x10039b87
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1002e5cf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10039be5
cmp byte [edi + 0x1c], 0
je 0x10039b87
jmp 0x10039c16
push ebx
call fcn.100333ad
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10039b87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10039c1e
cmp byte [edi + 0x1c], 0
je 0x10039c1b
mov ebx, dword [edi + 0x18]
jmp 0x10039c1e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1002e5cf
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ce0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401d50
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401340
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x402750
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push 2
call dword [0x71401c]
add esp, 4
push str.1.0.8__13_Jul_2019
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to:_bzip2_devel_sourceware.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
push eax
call fcn.004027b0
add esp, 0x10
cmp esi, 0x3ef
jne 0x40279c
push 2
call dword [0x71401c]
add esp, 4
push eax
push 1
push 0x420
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
push 3
call sub.msvcrt.dll_exit
nop word cs:[eax + eax]
Function at 0x405810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [ecx + 0x34]
mov edi, dword [ecx + 0x38]
test edi, edi
jle 0x40588e
mov dword [esp], ebx
movzx edx, bl
mov esi, dword [ecx + 0x260]
cmp edi, 1
jne 0x405834
mov ebx, edi
jmp 0x40586d
mov ebx, edi
and edi, 0xfffffffe
mov ebp, dword [0x6af8d8]
nop
mov eax, esi
shl eax, 8
shr esi, 0x18
xor esi, edx
xor eax, dword [ebp + esi*4]
mov dword [ecx + 0x260], eax
mov esi, eax
shl esi, 8
shr eax, 0x18
xor eax, edx
xor esi, dword [ebp + eax*4]
mov dword [ecx + 0x260], esi
add edi, 0xfffffffe
jne 0x405840
test bl, 1
mov ebx, dword [esp]
je 0x40588e
mov eax, esi
shl eax, 8
shr esi, 0x18
xor esi, edx
mov edx, dword [0x6af8d8]
xor eax, dword [edx + esi*4]
mov dword [ecx + 0x260], eax
mov byte [ecx + ebx + 0x58], 1
mov eax, dword [ecx + 0x38]
cmp eax, 3
je 0x4058b6
cmp eax, 2
je 0x4058d4
cmp eax, 1
jne 0x4058f2
lea edx, [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x44]
mov byte [eax + ecx], bl
jmp 0x40594a
lea edx, [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
mov byte [eax + esi], bl
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
lea edi, [esi + 1]
mov dword [ecx + 0x44], edi
mov byte [eax + esi + 1], bl
jmp 0x4058e0
lea edx, [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
mov byte [eax + esi], bl
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
lea edi, [esi + 1]
mov dword [ecx + 0x44], edi
mov byte [eax + esi + 1], bl
jmp 0x40594a
mov byte [eax + ecx + 0x54], 1
lea edx, [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
mov byte [eax + esi], bl
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
lea edi, [esi + 1]
mov dword [ecx + 0x44], edi
mov byte [eax + esi + 1], bl
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
lea edi, [esi + 1]
mov dword [ecx + 0x44], edi
mov byte [eax + esi + 1], bl
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x44]
lea edi, [esi + 1]
mov dword [ecx + 0x44], edi
mov byte [eax + esi + 1], bl
mov eax, dword [ecx + 0x44]
lea esi, [eax + 1]
mov dword [ecx + 0x44], esi
movzx ebx, byte [ecx + 0x38]
add bl, 0xfc
mov ecx, dword [ecx + 0x24]
mov byte [ecx + eax + 1], bl
inc dword [edx]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov eax, 0xfffffffe
test esi, esi
je case.0x4064cb.58
cmp dword [esi + 0x20], 0
je case.0x4064cb.58
mov ecx, dword [esi + 0x24]
test ecx, ecx
je case.0x4064cb.58
mov edx, dword [esi + 0x1c]
test edx, edx
je case.0x4064cb.58
cmp dword [edx], esi
je 0x4064bc
pop esi
pop edi
pop ebx
ret
mov edi, dword [edx + 4]
lea ebx, [edi - 0x39]
cmp ebx, 0x38
ja case.default.0x4064cb
jmp dword [ebx*4 + 0x6b0d70]
mov eax, dword [edx + 8]
test eax, eax
je 0x4064e8
push eax
push dword [esi + 0x28]
call ecx
add esp, 8
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x24]
mov eax, dword [edx + 0x44]
test eax, eax
je 0x4064fe
push eax
push dword [esi + 0x28]
call ecx
add esp, 8
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x24]
mov eax, dword [edx + 0x40]
test eax, eax
je 0x406514
push eax
push dword [esi + 0x28]
call ecx
add esp, 8
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x24]
mov eax, dword [edx + 0x38]
test eax, eax
je 0x40652a
push eax
push dword [esi + 0x28]
call ecx
add esp, 8
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x24]
push edx
push dword [esi + 0x28]
call ecx
add esp, 8
mov dword [esi + 0x1c], 0
xor eax, eax
cmp edi, 0x71
setne al
lea eax, [eax + eax*2]
add eax, 0xfffffffd
pop esi
pop edi
pop ebx
ret
cmp edi, 0x29a
je case.0x4064cb.57
cmp edi, 0x2a
jne case.0x4064cb.58
jmp case.0x4064cb.57
Function at 0x43dc50
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov ecx, dword [ecx + 0x28]
mov ebx, edx
cmp ecx, 4
jbe 0x43dc6f
mov eax, dword [edi + 8]
mov edx, dword [edi + 4]
mov esi, ecx
jmp 0x43dc79
lea eax, [edi + 8]
mov esi, 4
mov edx, ecx
mov dword [ebp - 0x10], eax
cmp edx, ebx
ja 0x43ddbc
mov eax, 0x80000001
cmp ebx, 5
jae 0x43dce8
cmp ecx, 5
jb 0x43dcec
lea eax, [edi + 8]
lea ecx, [edx*8]
mov dword [edi], 0
push ecx
push dword [ebp - 0x10]
push eax
mov ebx, edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esi*8]
cmp esi, 0x1fffffff
mov dword [edi + 0x28], ebx
ja 0x43ddcd
cmp eax, 0x7ffffff9
jae 0x43ddcd
push 8
push eax
push dword [ebp - 0x10]
call fcn.004ed020
add esp, 0xc
mov eax, 0x80000001
jmp 0x43dcec
cmp esi, ebx
jne 0x43dcf4
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebx*8]
cmp ebx, 0x1fffffff
ja 0x43dd9a
cmp eax, 0x7ffffff8
mov dword [ebp - 0x14], eax
ja 0x43dd52
cmp ecx, 5
jae 0x43dd59
mov eax, dword [0x6b6a34]
mov dword [ebp - 0x18], edx
movzx eax, byte [eax]
push 8
mov esi, dword [ebp - 0x14]
push esi
call fcn.004ed010
add esp, 8
test eax, eax
je 0x43dda3
mov esi, dword [ebp - 0x18]
lea ecx, [esi*8]
push ecx
push dword [ebp - 0x10]
push eax
mov dword [ebp - 0x10], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
jmp 0x43dd86
mov edx, dword [ebp - 0x14]
xor eax, eax
jmp 0x43dcec
lea eax, [esi*8]
cmp esi, 0x1fffffff
ja 0x43dd9a
cmp eax, 0x7ffffff8
ja 0x43dd9a
push dword [ebp - 0x14]
push 8
push eax
push dword [ebp - 0x10]
mov esi, edx
call fcn.004ed040
add esp, 0x10
test eax, eax
je 0x43ddaf
mov dword [edi], 1
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0x28], ebx
jmp 0x43dce1
mov edx, eax
xor eax, eax
jmp 0x43dcec
mov eax, 8
mov edx, esi
jmp 0x43dcec
mov edx, dword [ebp - 0x14]
mov eax, 8
jmp 0x43dcec
push 0x6b4490
push 0x20
push str.assertion_failed:_new_cap___len
call fcn.004faaf0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push 0x6b4440
push 0x6b35d0
push eax
push 0x2b
push 0x6b35a4
call fcn.004faf90
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x43de00
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
movzx ebx, byte [ecx + 0x68]
mov esi, ecx
mov eax, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
lea edx, [esi + 0x28]
shld ecx, eax, 9
shl eax, 9
lea edi, [ebx*8]
mov byte [esi + ebx + 0x28], 0x80
or edi, eax
mov eax, ebx
xor eax, 0x3f
je 0x43de53
mov dword [ebp - 0x14], ecx
lea ecx, [ebx + edx + 1]
push eax
push 0
push ecx
mov dword [ebp - 0x10], edx
call sub.msvcrt.dll_memset
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add esp, 0xc
xor ebx, 0x38
bswap edi
bswap ecx
cmp ebx, 8
jae 0x43de9c
push 1
push edx
push esi
mov ebx, ecx
call fcn.005d3f10
add esp, 0xc
pxor xmm0, xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x58]
movdqu xmmword [ebp - 0x38], xmm0
movdqu xmmword [ebp - 0x48], xmm0
movdqu xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
push 1
push eax
jmp 0x43dea5
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], edi
push 1
push edx
push esi
call fcn.005d3f10
add esp, 0xc
movdqu xmm1, xmmword [esi]
movdqu xmm3, xmmword [esi + 0x10]
pxor xmm0, xmm0
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 4], 0xbb67ae85
mov dword [esi], 0x6a09e667
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x68], 0
movdqa xmm2, xmm1
punpcklbw xmm1, xmm0
punpckhbw xmm2, xmm0
pshuflw xmm1, xmm1, 0x1b
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm1, xmm1, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm1, xmm2
movdqa xmm2, xmm3
punpcklbw xmm3, xmm0
punpckhbw xmm2, xmm0
pshuflw xmm0, xmm3, 0x1b
movdqu xmmword [eax], xmm1
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm0, xmm0, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm0, xmm2
movdqu xmmword [eax + 0x10], xmm0
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x11f0
call fcn.005d1cf0
call fcn.00442688
Function at 0x469360
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
lea edi, [esp + 0x38]
mov dword [esp + 8], 0x6b67dd
mov dword [esp + 0xc], 0x1c
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0
mov byte [esp + 0x78], 0
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
cmp ebx, 0x3f
mov dword [esp + 4], eax
mov dword [esp], ecx
ja 0x469472
jmp 0x46949c
mov eax, ebx
mov dword [esp + 0x34], 0
shr eax, 6
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x10]
push eax
push esi
push ecx
call fcn.005d3f10
add esp, 0xc
mov eax, ebx
and ebx, 0x3f
and eax, 0xffffffc0
add esi, eax
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x80]
mov byte [esp + 0x78], bl
lea esi, [esp + 0x10]
mov ecx, 0x1c
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 4]
mov ecx, eax
push dword [esp]
call fcn.0042bdd0
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x469a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x11e8
call fcn.005d1cf0
call fcn.00469a78
Function at 0x471c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push edi
call sub.msvcrt.dll__open
add esp, 0xc
test eax, eax
js 0x471cae
push eax
call sub.msvcrt.dll__get_osfhandle
add esp, 4
mov dword [esp], eax
mov eax, esp
lea ecx, [esp + 8]
push eax
push ecx
call fcn.005a3ef0
add esp, 8
mov eax, dword [esp + 8]
xor eax, 2
or eax, dword [esp + 0xc]
jne 0x471cbe
movsd xmm0, qword [esp + 0x10]
movsd qword [esi], xmm0
jmp 0x471d52
call fcn.005bee30
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x471d5a
mov ebx, dword [esp + 0x48]
test ebx, 0x400
sete al
test dword [esp + 0x4c], 0x20000000
sete cl
shr bl, 4
or cl, al
and bl, cl
cmp bl, 1
jne 0x471d33
mov edi, dword [esp]
push edi
call fcn.006ac480
add esp, 4
or eax, 0x8000
push eax
push edi
call sub.msvcrt.dll__open_osfhandle
add esp, 8
push eax
call fcn.006a90b0
add esp, 4
test eax, eax
je 0x471d64
mov dword [esp + 4], eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
call fcn.00471950
movzx eax, byte [esp + 8]
mov edi, dword [ebp + 0xc]
cmp al, 4
jne 0x471d69
push dword [esp + 4]
call fcn.006a9260
add esp, 4
push edi
call sub.msvcrt.dll_remove
add esp, 4
mov cl, 4
test eax, eax
jns 0x471d4c
call fcn.005bee30
xor ecx, ecx
mov dword [esi + 4], eax
test bl, bl
mov byte [esi], cl
jne 0x471d5a
push dword [esp]
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x471cae
movzx edx, word [esp + 0xe]
mov edi, dword [esp + 0xa]
movzx ecx, byte [esp + 9]
mov word [esi + 6], dx
mov dword [esi + 2], edi
mov byte [esi], al
mov byte [esi + 1], cl
push dword [esp + 4]
call fcn.006a9260
add esp, 4
jmp 0x471d5a
Function at 0x472670
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
push 0
push ebx
call sub.msvcrt.dll__access
add esp, 8
test eax, eax
je 0x4726b5
push ebx
push edi
call sub.msvcrt.dll_rename
add esp, 8
mov cl, 4
test eax, eax
jns 0x4726ae
call fcn.005bee30
xor ecx, ecx
mov dword [esi + 4], eax
mov byte [esi], cl
jmp 0x472784
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.006acc80
add esp, 8
test eax, eax
js 0x472743
movzx eax, word [esp + 0x16]
and eax, 0xf000
cmp eax, 0x4000
jne 0x472750
push edi
call fcn.006a9040
add esp, 4
test eax, eax
je 0x472763
mov edi, eax
mov dword [esp + 0xc], eax
push ebx
call fcn.006a9040
add esp, 4
test eax, eax
je 0x472770
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
call fcn.00471450
add esp, 0xc
push dword [esp + 0x10]
call fcn.006a9260
add esp, 4
mov edi, dword [esp + 0xc]
jmp 0x47277b
call fcn.005bee30
mov dword [esi], 0
jmp 0x47276b
push ebx
call sub.msvcrt.dll_remove
add esp, 4
test eax, eax
jns 0x472694
jmp 0x472763
call fcn.005bee30
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x472784
call fcn.005bee30
mov byte [esi], 0
mov dword [esi + 4], eax
push edi
call fcn.006a9260
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b9760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [esp + 0x20], edx
mov eax, dword [edi + 8]
mov ebx, dword [edi]
cmp ebx, eax
mov dword [esp + 0x10], eax
jbe 0x4b97b5
mov ecx, dword [edi + 4]
test eax, eax
je 0x4b97be
push eax
push 1
push ebx
push ecx
mov dword [esp + 0x1c], ecx
call fcn.004ed040
add esp, 0x10
test eax, eax
jne 0x4b97cf
mov edi, dword [esp + 0xc]
push dword [esp + 0x10]
push 1
call fcn.004ed3a0
add esp, 8
ud2
mov ecx, dword [edi + 4]
mov dword [esp + 0xc], ecx
jmp 0x4b97dc
push 1
push ebx
push ecx
call fcn.004ed020
add esp, 0xc
mov eax, 1
mov dword [esp + 0xc], eax
mov dword [edi + 4], eax
mov eax, dword [esp + 0x10]
mov dword [edi], eax
lea ebx, [esp + 0x48]
push eax
push ebx
call fcn.004e5780
add esp, 8
mov edi, dword [esp + 0x48]
cmp edi, 2
jne 0x4b9843
mov edi, dword [esp + 0x4c]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x28]
push ebx
call fcn.004dda20
add esp, 0x10
mov eax, dword [esp + 0x48]
cmp eax, 2
jne 0x4b98e7
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xc], edi
mov word [esi + 0x10], ax
shr eax, 0x10
mov byte [esi + 0x12], al
mov dword [esi], 2
jmp 0x4b996a
mov eax, dword [esp + 0x78]
movsd xmm1, qword [esp + 0x60]
movsd xmm0, qword [esp + 0x58]
movsd xmm3, qword [esp + 0x68]
mov ebx, dword [esp + 0x4c]
movsd xmm2, qword [esp + 0x50]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
movsd qword [esp + 0x2c], xmm1
movsd xmm1, qword [esp + 0x70]
movsd qword [esp + 0x24], xmm0
movsd qword [esp + 0x34], xmm3
test eax, eax
movsd qword [esp + 0x3c], xmm1
je 0x4b98a6
push 1
push eax
push dword [esp + 0x14]
movaps xmmword [esp + 0x1c], xmm2
call fcn.004ed020
movaps xmm2, xmmword [esp + 0x1c]
add esp, 0xc
movsd xmm1, qword [esp + 0x34]
mov eax, dword [esp + 0x44]
movsd xmm0, qword [esp + 0x3c]
movsd xmm3, qword [esp + 0x24]
movsd qword [esi + 0x20], xmm1
movsd xmm1, qword [esp + 0x2c]
mov dword [esi + 0x30], eax
movsd qword [esi + 0x28], xmm0
movsd qword [esi + 0x10], xmm3
movsd qword [esi + 0x18], xmm1
mov dword [esi], edi
mov dword [esi + 4], ebx
movlps qword [esi + 8], xmm2
jmp 0x4b996a
movsd xmm0, qword [esp + 0x64]
movzx ecx, word [esp + 0x58]
movsd qword [esi + 0x1c], xmm0
movsd xmm0, qword [esp + 0x6c]
mov word [esp + 0x24], cx
movzx ecx, word [esp + 0x24]
movsd qword [esi + 0x24], xmm0
movsd xmm0, qword [esp + 0x74]
movsd qword [esi + 0x2c], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd qword [esi + 0x14], xmm0
mov word [esi + 0x10], cx
movzx ecx, byte [esp + 0x5a]
movsd xmm0, qword [esp + 0x50]
mov byte [esp + 0x26], cl
movzx ecx, byte [esp + 0x26]
mov byte [esi + 0x12], cl
mov dword [esi], eax
mov eax, dword [esp + 0x4c]
mov dword [esi + 4], eax
movzx eax, byte [esp + 0x5b]
movsd qword [esi + 8], xmm0
mov byte [esi + 0x13], al
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b996a
push 1
push eax
push dword [esp + 0x14]
call fcn.004ed020
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x502f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x502fc8
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x502fc0
cmp ebx, eax
ja 0x50303d
cmp eax, dword [ebp + 0x10]
ja 0x503049
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x502fc2
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x502fb0
jmp 0x50301f
ja 0x502fc8
cmp edx, edi
mov ebx, eax
jne 0x502f82
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x503023
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x503000
mov esi, edi
sub ecx, ebx
jns 0x503017
jmp 0x503025
cmp edi, edx
je 0x50302c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x503025
xor al, 1
cmp esi, edx
jne 0x502fe0
jmp 0x503025
xor eax, eax
jmp 0x503025
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6d0a88
push 0x2b
push 0x6cf29d
call fcn.004faaf0
push 0x6d0a98
push eax
push ebx
call fcn.00500740
push 0x6d0a98
push dword [ebp + 0x10]
push eax
call fcn.005006e0
nop word [eax + eax]
Function at 0x510510
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
call fcn.006251a0
test al, al
je 0x510557
mov esi, dword [fcn.004a11a0]
push 2
call esi
add esp, 4
push ebp
push ebx
push edi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.0050fc10
add esp, 0x14
push 2
call esi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00625290
Function at 0x58f730
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x310
mov edi, dword [ebp + 8]
call fcn.0058f747
Function at 0x593490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov edi, dword [edx + 0x1c]
mov dword [esp + 0x5c], ecx
test edi, edi
je 0x59489f
call fcn.005934b3