joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442edb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x457bd8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x442f1b
cmp byte [ebx], 0xa
jne 0x442f1b
or byte [edi + eax + 0x28], 4
jmp 0x442f20
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x44301f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x443002
inc eax
cmp dl, 0xd
je 0x442f4c
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x442f72
cmp eax, ecx
jae 0x442f80
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x442f34
jmp 0x44301f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x442ffd
cmp dword [ebp - 0x10], 0
je 0x442ffd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x457bd8]
test byte [eax + edi + 0x28], 0x48
je 0x442fd7
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x442fc2
mov byte [esi], dl
jmp 0x442fd3
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x457bd8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x44301f
cmp byte [ebp - 1], 0xa
jne 0x442fe6
cmp esi, ebx
jne 0x442fe6
mov byte [esi], 0xa
jmp 0x44301e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00442d2d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x44301f
mov byte [esi], 0xd
jmp 0x44301e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x457bd8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x44301c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x44301f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x443028
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x457bd8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44306e
cmp word [ebx], dx
jne 0x44306e
or byte [eax + edi + 0x28], 4
jmp 0x443073
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4431d6
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4431b6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4430b4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4430ea
cmp eax, edx
jae 0x4430f8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x44308f
jmp 0x4431d6
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4431b1
cmp dword [ebp - 0x18], 0
je 0x4431b1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x457bd8]
test byte [eax + edi + 0x28], 0x48
je 0x443187
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x44314b
mov word [esi], cx
jmp 0x443182
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x457bd8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x457bd8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x457bd8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4431d6
pop eax
cmp word [ebp - 4], ax
jne 0x443197
cmp esi, ebx
jne 0x443197
mov word [esi], ax
jmp 0x4431d3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00442d2d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4431d6
push 0xd
pop eax
jmp 0x443192
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x457bd8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4431d0
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4431d6
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x447cc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x447ced
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x447ced
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10004b4c
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x10011024], 0xffffffff
jne 0x10004b58
xor eax, eax
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [0x10011024]
mov edx, 0x100015f0
push 0x1000162c
push 0x10001624
push 2
pop ecx
mov edi, eax
call fcn.10004d5d
pop ecx
mov esi, eax
pop ecx
push ebx
test esi, esi
je 0x10004b95
mov ecx, esi
call dword [0x100120b4]
call esi
jmp 0x10004b9b
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10004bb2
test ebx, ebx
jne 0x10004bea
or edx, 0xffffffff
call fcn.10004de7
test eax, eax
jne 0x10004bb6
xor ebx, ebx
jmp 0x10004bea
push 0x28
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10004bd3
mov edx, esi
call fcn.10004de7
test eax, eax
jne 0x10004bde
xor edx, edx
call fcn.10004de7
xor ebx, ebx
jmp 0x10004be2
mov ebx, esi
xor esi, esi
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x10004bf7
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x10011024], 0xffffffff
jne 0x10004c03
xor eax, eax
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x10011024]
mov edx, 0x100015f0
push 0x1000162c
push 0x10001624
push 2
pop ecx
mov ebx, eax
call fcn.10004d5d
pop ecx
mov esi, eax
pop ecx
push edi
test esi, esi
je 0x10004c40
mov ecx, esi
call dword [0x100120b4]
call esi
jmp 0x10004c46
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esi + 1]
neg eax
pop edi
sbb eax, eax
and eax, esi
pop esi
pop ebx
ret
Function at 0x1000b29c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
sub edx, esi
je 0x1000b357
sub edx, 1
je 0x1000b33f
sub edx, 1
je 0x1000b32d
sub edx, 1
jne 0x1000b3dc
mov esi, dword [0x10011024]
cmp esi, 0xffffffff
je 0x1000b3d9
push 0x1000162c
push 0x10001624
push 2
mov edx, 0x100015f0
pop ecx
call fcn.10004d5d
pop ecx
mov edi, eax
pop ecx
push esi
test edi, edi
je 0x1000b2fd
mov ecx, edi
call dword [0x100120b4]
call edi
jmp 0x1000b303
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov esi, eax
call fcn.10004de7
test esi, esi
je 0x1000b3d9
cmp esi, 0x100115a0
je 0x1000b3d9
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000b3d9
call fcn.10004b4c
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x1000b3dc
call fcn.10004a0b
test al, al
je 0x1000b3dc
inc dword [0x10011580]
jmp 0x1000b3d9
mov eax, dword [0x10011580]
test eax, eax
jle 0x1000b3dc
dec eax
mov dword [0x10011580], eax
cmp dword [ebp + 8], esi
jne 0x1000b3d9
mov edi, dword [0x10011024]
cmp edi, 0xffffffff
je 0x1000b3b1
push ebx
xor ecx, ecx
mov edx, 0x100015e8
push 0x1000162c
push 0x10001624
inc ecx
call fcn.10004d5d
pop ecx
mov ebx, eax
pop ecx
push edi
test ebx, ebx
je 0x1000b3a3
mov ecx, ebx
call dword [0x100120b4]
call ebx
jmp 0x1000b3a9
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x10011024], 0xffffffff
pop ebx
call fcn.10004a81
mov edi, 0x100115e4
cmp dword [edi], esi
je 0x1000b3ce
cmp dword [edi], 0xffffffff
je 0x1000b3cc
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi], esi
add edi, 4
cmp edi, 0x100115f0
jne 0x1000b3bb
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1000c6d5
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000c710
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1000c6f7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1000c708
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000c712
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000c6ed
xor eax, eax
pop edi
pop esi
ret

Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push 2
push 0x40200a
push section.DATA
call sub.KERNEL32.dll_OpenFile
test eax, eax
je 0x40105c
push eax
push 0
push 0
push 0x1294b
push eax
call sub.KERNEL32.dll_SetFilePointer
test eax, eax
je 0x40105c
pop eax
push 0
push 0x402093
push 1
push 0x402092
push eax
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x40105c
push 0
push 0x402094
push 0x402098
push 0
call sub.USER32.dll_MessageBoxA
push 0
call sub.KERNEL32.dll_ExitProcess
push 0
push 0x4020b3
push 0x4020b9
push 0
call sub.USER32.dll_MessageBoxA
push 0
call sub.KERNEL32.dll_ExitProcess
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
Function at 0x4013f0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x401419
xor eax, eax
jmp 0x40148b
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x401440
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40148b
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp dword [ebp - 0x30], 0
je 0x401489
cmp dword [ebp - 0x1c], 4
jne 0x40147b
mov dword [ebp - 0x2c], 1
jmp 0x401482
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
jmp 0x40148b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret
Function at 0x4014a0
Capabilities:
Create service
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401620
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4014cd
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4014d4
xor eax, eax
jmp 0x401613
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4014f3
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40153b
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 3
push 1
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40152a
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40153b
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x401613
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x401553
mov byte [ebp - 2], 1
jmp 0x401557
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x4015fa
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x12
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x4015ae
mov byte [ebp - 3], 1
jmp 0x4015b2
mov byte [ebp - 3], 0
mov al, byte [ebp - 3]
mov byte [ebp - 5], al
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x4015fa
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4015d8
mov byte [ebp - 4], 1
jmp 0x4015dc
mov byte [ebp - 4], 0
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x4015fa
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401620
add esp, 4
xor eax, eax
jmp 0x401613
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401620
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x28], eax
push 0x10022
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret
Function at 0x41eaf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x41eb17
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41eb1e
mov al, 1
jmp 0x41ec0b
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.00427360
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.00427360
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.0041be70
add esp, 8
movzx eax, al
test eax, eax
je 0x41eb64
xor al, al
jmp 0x41ec0b
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x41eba7
cmp dword [ebp - 0x34], 1
je 0x41ebae
cmp dword [ebp - 0x34], 3
je 0x41ebfe
jmp 0x41ec09
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x41ebde
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x41ebde
xor al, al
jmp 0x41ec0b
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x41ebf2
mov dword [ebp - 0x3c], 1
jmp 0x41ebf9
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x41ec0b
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x41ec0b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret
Function at 0x4277c0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a395
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4a4080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push str.__timeout__t_5_
lea eax, [ebp + 8]
push eax
push str.start_cmd__C__color_b__title_Error__echo
lea ecx, [ebp - 0x48]
push ecx
call fcn.004093a0
add esp, 0xc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00409260
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.00421e80
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.0041b1e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041b1e0
nop
xor ecx, ecx
int 0x29
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041b1e0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4280d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a48d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a4080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push str.ALLUSERSPROFILE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42812f
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.004189e0
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
jmp 0x428179
lea edx, [ebp - 0x38]
push edx
call fcn.00422ab0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.0042ef80
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0041b9a0
nop
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x428560
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a4bd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4a4080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x30]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], 0
jmp 0x4285e6
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x28
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x34], ecx
jge 0x42868a
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
call fcn.004189e0
mov dword [ebp - 4], 0
push 0x48d9a4
lea eax, [ebp - 0x28]
push eax
call fcn.00409020
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x428633
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041b1e0
nop
jmp 0x4285d4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x40]
call fcn.00422670
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x48]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x44]
mov dword [eax + 8], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041b1e0
nop
jmp 0x4285d4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486b00
mov esp, ebp
pop ebp
ret 8
Function at 0x42f9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x42f9ec
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x42fad3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x42fa84
jg 0x42fa15
cmp dword [ebp + 0xc], 0
jbe 0x42fa84
cmp dword [ebp - 8], 0
jl 0x42fa84
jg 0x42fa23
cmp dword [ebp - 0xc], 0
jbe 0x42fa84
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x42fa41
jl 0x42fa35
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x42fa41
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00422590
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
nop
cmp dword [ebp + 0x10], 0
jl 0x42fac7
jg 0x42fa92
cmp dword [ebp + 0xc], 0
jbe 0x42fac7
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x42fac7
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc