joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464ef3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0x4b59d0
mov ecx, 0x4c2830
call fcn.0048b8d7
push eax
push 0x4b59e4
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x46bb2f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push 0x4b62d8
mov ecx, 0x4c2830
call fcn.0048b8d7
push eax
push 0x4b62ec
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x180]
push ecx
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x48b901
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov dword [ebp - 0x250], ecx
cmp dword [ebp + 8], 0
je 0x48ba08
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x48ba08
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x24c], eax
push str..
lea edx, [ebp - 0x248]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x48b9e0
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp + eax - 0x248]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x80
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x48b985
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x48ba08
mov edx, dword [ebp - 0x24c]
mov byte [ebp + edx - 0x249], 0
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esp, ebp
pop ebp
ret 8
Function at 0x491dbe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x2d
je 0x491dde
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0x2f
jne 0x491e58
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x43
je 0x491e0d
cmp dword [ebp - 0xc], 0x63
je 0x491e0d
jmp 0x491e11
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 0x20
je 0x491e48
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x491e48
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x491e48
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
cmp ecx, 9
je 0x491e48
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
cmp eax, 0x78
jne 0x491e53
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
jmp 0x491e11
jmp 0x491dc8
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
je 0x491e6b
call dword [sym.imp.KERNEL32.dll_AllocConsole]
xor eax, eax
test eax, eax
je 0x491e86
push 0
push 0
push 0
push 0x491d6e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [0x4c2bac], ecx
push str.Sword3
mov edx, dword [ebp + 8]
push edx
mov ecx, 0x4c2bb0
call dword [sym.imp.Engine.dll_public_virtual:_int___thiscall_KWin32App::Init_struct_HINSTANCE_____char__]
test eax, eax
je 0x491eb2
mov ecx, 0x4c2bb0
call dword [sym.imp.Engine.dll_public_virtual:_void___thiscall_KWin32App::Run_void_]
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
je 0x491ec4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.004959dd
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x492a37
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov dword [ebp - 0x364], ecx
mov dword [ebp - 8], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x492c14
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x492c14
mov edx, dword [ebp - 0x128]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
je 0x492bef
mov dword [ebp - 0x358], 0x224
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x492bef
push str.coreclient.dll
call fcn.00491f18
add esp, 4
push eax
lea edx, [ebp - 0x338]
push edx
call fcn.00491f18
add esp, 4
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x492b6c
push str.game.exe
call fcn.00491f18
add esp, 4
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00491f18
add esp, 4
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x492b6c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 3
jle 0x492b6c
mov edx, dword [ebp - 0x128]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x35c], eax
push 0
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x35c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push str.SbieDll.dll
call fcn.00491f18
add esp, 4
push eax
lea edx, [ebp - 0x338]
push edx
call fcn.00491f18
add esp, 4
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x492bd4
mov eax, dword [ebp - 0x128]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x360], eax
push 0
mov ecx, dword [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x360]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x492acb
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x492a85
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x492c27
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x492cb6
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x492cb6
mov edx, dword [ebp - 0x124]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x492ca2
mov eax, dword [ebp - 0x130]
push eax
call fcn.00492cc6
add esp, 4
and eax, 0xff
test eax, eax
je 0x492ca2
mov eax, 1
jmp 0x492cc2
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x492c60
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4695a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x4695c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4695c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4695b8
mov eax, 1
add ebx, ebx
jne 0x4695db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4695d0
jne 0x4695ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4695d0
xor ecx, ecx
sub eax, 3
jb 0x469600
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x469672
mov ebp, eax
add ebx, ebx
jne 0x46960b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x469618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46963c
inc ecx
add ebx, ebx
jne 0x469628
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46961d
jne 0x469639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46961d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46965c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46964d
jmp 0x4695be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46965c
add edi, ecx
jmp 0x4695be
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46967a
cmp byte [edi], 0
jne 0x46967a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46967f
lea edi, [esi + 0x67000]
mov eax, dword [edi]
or eax, eax
je 0x4696ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x696a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x696f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4696ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x696f8]
or eax, eax
je 0x4696e8
mov dword [ebx], eax
add ebx, 4
jmp 0x4696c9
call dword [esi + 0x696f4]
mov ebp, dword [esi + 0x696fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x469722
sub esp, 0xffffff80
jmp 0x407c28
Function at 0x4092f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 0
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x409335
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040a25b
add esp, 0x20c
ret
cmp word [esi], 0
mov ecx, dword [esp + 0x214]
je 0x40934c
add esi, 2
dec ecx
cmp word [esi], 0
jne 0x409342
cmp word [esp + 4], 0
je 0x409377
lea edx, [esp + 4]
sub edx, esi
nop word [eax + eax]
cmp ecx, 1
jb 0x409394
mov ax, word [edx + esi]
dec ecx
mov word [esi], ax
add esi, 2
cmp word [edx + esi], 0
jne 0x409360
mov ecx, dword [esp + 0x20c]
xor eax, eax
mov word [esi], ax
mov al, 1
pop esi
xor ecx, esp
call fcn.0040a25b
add esp, 0x20c
ret
call fcn.0040c6b5
int3
Function at 0x4097c0
Capabilities:
Terminate process

Disassembly:
push ecx
call fcn.0040cb7f
add esp, 4
push 2
call fcn.0040c69f
int3

Function at 0x409800
Capabilities:
Terminate process

Disassembly:
mov ecx, str.Error__couldnt_runtime_expand_target_path.
jmp fcn.004097c0

Function at 0x409810
Capabilities:
Terminate process

Disassembly:
mov ecx, str.Error__couldnt_decode_attached_data.
jmp fcn.004097c0

Function at 0x409820
Capabilities:
Terminate process

Disassembly:
mov ecx, str.Error__could_find_attached_data_header.
jmp fcn.004097c0

Function at 0x409830
Capabilities:
Terminate process

Disassembly:
mov ecx, str.Error__couldnt_read_attached_data.
jmp fcn.004097c0

Function at 0x409840
Capabilities:
Terminate process

Disassembly:
mov ecx, str.Error__couldnt_allocate_memory.
jmp fcn.004097c0

Function at 0x409850
Capabilities:
Terminate process

Disassembly:
mov ecx, str.Error__couldnt_launch_child
call fcn.00409770
push 2
call fcn.0040c69f
int3
jmp 0x4097e0

Function at 0x409860
Capabilities:
Terminate process

Disassembly:
push 0x4253d0
push str.Error__failed_to_open__ls_for_writing._n
push 2
call fcn.0040ca1c
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 2
call fcn.0040c69f
int3

Function at 0x4099f0
Capabilities:
Create directory

Disassembly:
mov eax, 0x200c
call fcn.0041ad80
mov eax, dword [0x424004]
xor eax, esp
mov dword [esp + 0x2004], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [0x427bd0]
mov ebp, ecx
test edi, edi
jne 0x409a57
push 0x1000
mov edx, str._HOME_
lea ecx, [esp + 0x14]
call fcn.004093a0
add esp, 4
test al, al
je 0x409b3a
lea eax, [esp + 0x10]
push eax
call fcn.0040f8b2
mov edi, dword [0x427bd0]
add esp, 4
mov dword [edi*4 + 0x429bf0], eax
inc edi
mov dword [0x427bd0], edi
xor esi, esi
test edi, edi
jle 0x409aa4
nop dword [eax]
mov eax, dword [esi*4 + 0x429bf0]
mov ecx, ebp
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x409a96
test dx, dx
je 0x409a92
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x409a96
add ecx, 4
add eax, 4
test dx, dx
jne 0x409a70
xor eax, eax
jmp 0x409a9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x409acb
inc esi
cmp esi, edi
jl 0x409a60
mov ecx, ebp
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ab0
sub ecx, edx
sar ecx, 1
cmp ecx, 2
jne 0x409acf
cmp word [ebp + 2], 0x3a
jne 0x409acf
mov al, 1
jmp 0x409b21
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x409af2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409af2
mov bl, 1
jmp 0x409af6
test bl, bl
je 0x409b1f
cmp dword [0x427bd0], 0x400
jge 0x409b1f
push ebp
call fcn.0040f8b2
mov ecx, dword [0x427bd0]
add esp, 4
mov dword [ecx*4 + 0x429bf0], eax
inc ecx
mov dword [0x427bd0], ecx
mov al, bl
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a25b
add esp, 0x200c
ret
mov ecx, str._HOME_
call fcn.00409890
int3
Function at 0x409c50
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
mov eax, dword [0x427bd4]
sub esp, 0x20
test eax, eax
je 0x409c86
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x409c7a
push 0
push dword [0x427bd4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x427bd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x42abfc], 0
je 0x409d5b
push ebx
push ebp
push esi
mov eax, 0x414
mov dword [esp + 0xc], 0
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x427be8
mov dword [esp + 0x20], 0x421b18
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0x421b18
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x427be8
call ebp
cmp eax, 0xffffffff
je 0x409d57
test al, 0x10
je 0x409d57
push 0x64
call ebx
mov eax, 0x414
mov dword [esp + 0x10], 0
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 0x427be8
mov dword [esp + 0x20], 0x421b18
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0x421b18
call edi
inc esi
cmp esi, 0x14
jl 0x409cf4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x413caa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413927

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x40615b
Capabilities:
Create pipe
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4e4c58]
mov ecx, dword [0x4e3bac]
sub esp, 0xe84
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x40625e
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x4e4c58], 0x959
jne 0x40624c
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x405920
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x405978
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00405f68
add ebx, 8
dec dword [ebp - 8]
jne 0x406184
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40886b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433718]
jne 0x408875
repz ret
jmp fcn.0041010c

Function at 0x411e87
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409fed
and dword [ebp - 4], 0
cmp dword [0x4357a0], 0
mov ebx, eax
jne 0x411f38
push 0x40392c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411fe9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403920
push edi
call esi
test eax, eax
je 0x411fe9
push eax
call fcn.00409f7b
mov dword [esp], 0x403910
push edi
mov dword [0x4357a0], eax
call esi
push eax
call fcn.00409f7b
mov dword [esp], 0x4038fc
push edi
mov dword [0x4357a4], eax
call esi
push eax
call fcn.00409f7b
mov dword [esp], 0x4038e0
push edi
mov dword [0x4357a8], eax
call esi
push eax
call fcn.00409f7b
pop ecx
mov dword [0x4357b0], eax
test eax, eax
je 0x411f38
push 0x4038c8
push edi
call esi
push eax
call fcn.00409f7b
pop ecx
mov dword [0x4357ac], eax
mov eax, dword [0x4357ac]
cmp eax, ebx
je 0x411f90
cmp dword [0x4357b0], ebx
je 0x411f90
push eax
call fcn.00409ff6
push dword [0x4357b0]
mov esi, eax
call fcn.00409ff6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411f90
test edi, edi
je 0x411f90
call esi
test eax, eax
je 0x411f87
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411f87
test byte [ebp - 0xc], 1
jne 0x411f90
or dword [ebp + 0x10], 0x200000
jmp 0x411fc9
mov eax, dword [0x4357a4]
cmp eax, ebx
je 0x411fc9
push eax
call fcn.00409ff6
pop ecx
test eax, eax
je 0x411fc9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411fc9
mov eax, dword [0x4357a8]
cmp eax, ebx
je 0x411fc9
push eax
call fcn.00409ff6
pop ecx
test eax, eax
je 0x411fc9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4357a0]
call fcn.00409ff6
pop ecx
test eax, eax
je 0x411fe9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411feb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ce65
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44cea4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44cea4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44cea4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44cea4
cmp dword [ecx + 0x74], 0xe
jbe 0x44cea4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x452d56
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x47ba30
push str.FlsAlloc
push 0x1f
call fcn.00452a24
mov esi, eax
add esp, 0x10
test esi, esi
je 0x452d8a
push dword [ebp + 8]
mov ecx, esi
call dword [0x46f280]
call esi
jmp 0x452d90
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x452dd4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x47ba54
push str.FlsGetValue
push 0x21
call fcn.00452a24
mov esi, eax
add esp, 0x10
test esi, esi
je 0x452e0b
push dword [ebp + 8]
mov ecx, esi
call dword [0x46f280]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x452e13
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x47ba68
push str.FlsSetValue
push 0x22
call fcn.00452a24
mov esi, eax
add esp, 0x10
test esi, esi
je 0x452e4d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x46f280]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]