joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4158e0
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x3d
lodsd eax, dword [esi]
sar byte [ecx + 0xd], 1
xchg esi, eax
sbb ah, byte [ebx + 0x2d]
sub esi, dword [esi + 0x3b4b2cc]
cmp eax, 0x9921c125
daa
mov ebp, dword [esi - 0x5f1440ba]
adc dword [ebp + 0x5a], 0x2de470c8
and dword [ecx + 0x46ae8b27], ebx
mov edi, 0x5581a0eb
pop edx
enter 0xffffffffffffe470, 0x2d
dec ecx
rol dword [eax + 0x11c06013], 1
mov edi, 0xd14eed0d
in eax, 0x57
aad 0x6a
adc dword [edi + 0x31], esi
push 0x8ea8bca1
add ebx, dword [ebx - 0x14af64e7]
wait
sbb dword [ebx + 0x5851eb50], ebx
wait
sbb dword [ebx + 0x5851eb50], ebx
inc esp
scasd eax, dword es:[edi]
jbe 0x41595f
pop esi
inc esi
mov bl, 0x27
and ecx, esi
xor byte [ebp + 8], bl
sbb eax, 0x6b1c519c
dec ebp
add al, 0x28
fbld tbyte [edi + 0xfe88261]
popal
sub al, 0xf
pop ds
je 0x4158a4
jnp 0x4158fe
mov cl, 0xa5
adc byte [edi + 0x37], ch
fisub dword [ebp - 0x2b]
dec eax
adc dword [esi + 0x32], ebx
out dx, eax
jl 0x415923
xor dword [eax + 0x6646cc4c], esi
wait
sub dword [edx + ecx*2 - 0x1fa0c522], ecx
xchg ecx, eax
pop edi
loopne 0x4158b7
sub eax, 0x3ec512bb
push edx
fdivr dword [esi + eax*8 - 0x70cda9f3]
rdtsc
popfd
mov dword [esi - 0x785c4809], 0xfa9ad2c3
dec edx
jno 0x41594a
je 0x4159c0
xchg ebx, eax
outsd dx, dword [esi]
xchg dword [edx + 0x1037c297], edx
mov ah, 0xdd
dec byte [edi - 0x6ec1b2b1]
das
pop ds
pop esp
jnp 0x4159d8
xchg edx, eax
xchg edi, eax
ret 0x1037
fimul dword [ebp - 0x3e]
xchg edi, eax
adc dword [esi - 0x2d], 0x69
invalid
dec edx
sbb ebp, 0x9c094f64
insd dword es:[edi], dx
cdq
adc bh, cl
and bl, byte [eax]
imul edi, dword [ebp - 0x5b], 0xffffff8d
hlt
outsd dx, dword [esi]
or ch, bh
std
pop edx
pop edx
invalid

Function at 0x44a900
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x214
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push 0x104
push eax
push ecx
mov word [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x44a9c2
cmp eax, 0x104
jne 0x44a945
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x44a9c2
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x44a9c2
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x44a9c2
mov ecx, dword [esp + 0x10]
push ebx
push esi
push edi
lea edx, [esp + 0x24]
push ecx
push edx
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44a9aa
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44a9aa
mov edx, dword [esp + 0x10]
mov ebx, 1
mov ax, word [edx]
mov word [ebp], ax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x214
ret 8
Function at 0x4a8fb4
Capabilities:
Encode data using xor

Disassembly:
shr dword [edx], 0x67
push ebp
push ebp
mov bl, 6
mov es, word [0x4db6dd27]
mov bh, 0x3c
mov dh, dh
pop ss
mov word [di], es
jb 0x4a8ef0
loop 0x4a8ed5
cmp al, dh
mov byte [ecx - 6], al
mov al, 0xd3
rol dword [eax - 0x2aefc2f2], cl
and byte [edx + 0x7a370ea5], dh
inc ebp
and dword [edi], 0x7fcd1605
xchg ebp, eax
aas
sub al, 0x67
daa
invalid
invalid
sti
jmp 0x4a8ed7
insd dword es:[edi], dx
xchg ebp, eax
cwde
out dx, eax
cmpsb byte [si], byte es:[di]
test dword [ecx + ebp*4 + 0x78708e70], esp
f2xm1
inc dword [edi - 0x79]
test eax, 0x23d9a78b
jmp 0xf4b48759
pop ss
sub dword [esi], eax
mov edi, 0x5aa3c7df
aam 0xfa
jne 0x4a8f25
jnp 0x4a8f37
cmpsb byte [esi], byte es:[edi]
inc esi
in al, dx
sbb dh, byte [esp + ebx*2 + 0x6d]
inc esi
mov bl, 0x44
dec eax
outsd dx, dword [esi]
daa
or byte [ecx + 0x36], bh
push esi
xor cl, byte [eax]
cmp cl, byte [eax + ebx*4 - 0xa142e0d]
cld
adc eax, 0xae85beca
cwde
pop eax
cdq
inc esi
xchg byte [esi], ah
mov dword [0x147562bf], eax
xor esp, dword [esi - 0x2e]
dec edi
mov ebx, 0xdde477c4
sbb dword [ecx - 0x2958c027], ebp
salc
salc
or al, 0x15
scasd eax, dword es:[edi]
mov esi, 0x28b4990b
ja 0x4a8f6d
mov ah, 0x5d
push ebp
idiv byte [ebp - 0x76]
movsb byte es:[edi], byte [esi]
aad 0x28
fisub word [esi + 0x392e2a46]
salc
cmp al, 0x7c
shr bl, 0x2a
mov ebp, 0x41a0a493
jle 0x4a8fd7
mov al, byte [0xbbfc7e41]
jge 0x4a8f95
mov ebx, 0x4e41b77d
inc ecx
dec esi
lodsd eax, dword [esi]
dec ebx
pop ecx
push es
rcl byte [edi - 0x6a], 0xea
sbb al, byte [ecx]
idiv ah
xchg ebp, eax
mov cl, 0xf5
leave
xchg ebp, eax
fstp dword [0xcfcdeced]
invalid
Function at 0x4edf0d
Capabilities:
Encode data using xor

Disassembly:
adc ch, ah
push es
xor byte [eax + 0x58], bl
mov dh, 0x43
xchg edi, eax
mov dh, 0x61
mov eax, dword [ecx + 0x68]
or byte [edx - 0x45], dl
mov ebx, 0xea94d867
scasb al, byte es:[edi]
mov ebx, 0xea94d867
scasb al, byte es:[edi]
push cs
or dword [ebx], 0xffffff83
cdq
cli
jg 0x4edefd
movsd dword es:[edi], dword [esi]
and al, byte [ecx - 0x537c1696]
push 9
cmp eax, 0x1b57ea5b
loopne 0x4edf9b
cld
lea ebx, [edi + esi*2]
rcl byte [ecx + 0x7a2bb86d], 9
fdivr dword [ecx - 0x3d]
dec ecx
std
cwde
and al, bl
jae 0x4edfb7
pop ds
leave
sbb al, 0xba
xor edi, dword [edx + 0x33]
mov byte [0xa99fc65d], al
mov al, byte [0x55818350]
test eax, 0x818350a0
push ebp
jns 0x4edf74
and dword [esi - 0x1d017f7c], eax
jno 0x4edfbe
test byte [eax + 0x6371e2fe], al
jne 0x4edf7e
mov ebx, 0xd7c3b17e
bnd ja 0x4edf80
add dword [ebx], edi
sub byte [edi - 0x57], dl
mov edi, 0x82a843d8
cmp edx, 0x4ccab874
dec esp
pop esi
push ebx
or dword [esi - 0x21], ecx
loop 0x4edf47
enter 0x7d69, 0x1c
jge 0x4edf9c
ret
in al, dx
add dh, byte [ecx + 0x464b842]
inc ecx
jge 0x4edf4b
invalid
imul edi, dword [ebp - 0x49], 0x67
dec edx
jge 0x4edf55
dec edx
out 0x60, al
pushal
jae 0x4edf8b
sbb ecx, ecx
ja 0x4ee01a
lodsd eax, dword [esi]
cld
pop esp
push eax
jnp 0x4edf95
jl 0x4edfa0
mov ebp, eax
or dword [ebx - 0x3c], edi
invalid
outsb dx, byte [esi]
inc eax
mov ebx, 0x5b3a6887
inc ebx
adc bh, byte [esi - 0x47]
sub byte [edi - 0x2e], bh
adc ecx, 0x59
ja 0x4edffe
inc esp
cmc
pop edx
sti
arpl bp, dx
push 0x18
jle 0x4edfa1
lds edi, [ecx + eax*8 - 0x17]
mov cl, 0xe1
mov esi, dword [ebx]
push eax
jnp 0x4edf9b
fld xword [ecx + 0x36ac5846]
sbb eax, 0xa389908f
mov edx, 0x8cd4e922
inc ebx
mov byte [edi + 0x725896c5], dh
and esi, edx
ja 0x4ee008
inc eax
mov dword [0xa6458e46], eax
mov es, word [ebp - 0x5a]
out 0xc7, eax
test byte [ebx - 0x5809c017], 0xa2
nop
mov byte [eax + 0x63], 0x9c
cmpsd dword [esi], dword es:[edi]
mov byte [0x6340c690], al
pushfd
cli
arpl word [0xa437c99f], di
sal dword [edx + esi - 0x15], 0x5a
pop edx
sub al, 0x3e
sbb byte [eax], al
stosd dword es:[edi], eax
aas
mov ecx, 0x12c2b94b
mov ch, dh
push cs
dec byte [esi + 0x4e]
salc
or eax, ecx
mov esp, 0x83c82319
push edi
mov dh, 0x11
add edi, dword [edx - 0x2a]
aam 0xde
pop ecx
mov esi, ebx
mov ecx, 0xcbda2b61
mov edx, dword [edx - 0x4c798e87]
iret

Function at 0x53313d
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x3c
invalid
and byte [edi], cl
test al, 0xe7
pop eax
adc byte [ecx - 0x52a20d5d], ah
aaa
jno 0x53313b
in al, 0x84
je 0x5330e1
and ebp, 0xac25d557
sti
inc esi
and ch, byte [ecx + 0x20e5f62e]
mov dword [esi + esi*2 + 0xc0c0f8f], esp
out dx, eax
mov byte [0xc1062a9d], al
dec byte [eax]
std
sub edi, dword [ebx + ecx*2]
push cs
outsd dx, dword [esi]
and eax, dword [ebx + 0xb]
and byte [ebp - 0x5da7759], bh
bound eax, qword [ebp - 0x50]
out dx, al
test ah, ch
sbb ecx, dword [ebx]
mov al, 0xb
das
sbb dword [ecx + 0x25], esi
xchg esi, eax
test dword [eax], ebp
ret 0xb01a
Function at 0x5f71e4
Capabilities:
Encode data using xor

Disassembly:
add dword [esi - 0x593a53d2], ecx
mov esi, 0xe03f91f3
scasd eax, dword es:[edi]
out dx, al
sbb dword [edx + 0x6c], ecx
adc eax, 0xa1569f81
push edi
or dword [0x8512013b], 0xdfb6ec75
invalid

Function at 0x5f729a
Capabilities:
Encode data using xor

Disassembly:
inc esi
cdq
inc edi
shr eax, 1
mov eax, 0x3476e4f8
mov dword [ebx + ebx + 0x10541600], esi
mov word [edi - 0x2dcafbfc], gs
ror dword [ebx], cl
xor al, 0xb5
sti
cmpsb byte [esi], byte es:[edi]
sub byte [ebp + 0x71], ah
and byte [ebp - 0x5e], al
cdq
add byte [ebp - 0x267a9ab3], ah
sub ah, byte [bx + di + 0x50]
dec esi
popfd
movsb byte es:[edi], byte [esi]
mov dword [ecx - 0x1b], esp
in eax, 0xd
mov cl, 0x4c
xlatb
sbb byte [edx + ebp - 0x6f92fcc7], dh
in eax, 0xd
mov cl, 0x4c
xlatb
sbb byte [edx + ebp - 0x6f92fcc7], dh
xlatb
xor bh, ah
dec edx
lea edi, [edi]
xchg esi, eax
cwde
cmp edx, dword [edx + 0x6c686985]
cmp byte [eax - 0x58], dl
or byte [edx + esi], bl
in eax, 1
or al, 0xc4
pop edx
push edi
cmc
cmp al, 0xd4
salc
xor dword [eax], esp
fbld tbyte [ecx - 0x7f835919]
xchg edi, eax
cwde
pop ebp
xor dword [edx], esp
jne 0x5f7263
cmp al, 0x44
add cl, byte [edx]
xor al, 0x53
xor eax, 0x52371483
adc byte [eax + 0x39], dl
add bl, byte [esi]
mov cl, 0x95
mov ebp, eax
pop edx
insd dword es:[edi], dx
sbb edx, dword [edi - 0x5b]
xchg ebp, eax
adc dword [eax - 0x444b7c98], esp
add bl, byte [ebx + 0x3952117b]
push es
add esp, dword [edi + 0x33]
adc al, 0xd2
rcl dh, cl
retf
Function at 0x5f7a04
Capabilities:
Encode data using xor

Disassembly:
add dword [eax + 0x5e], eax
sahf
adc al, 0x70
enter 0xffffffffffffa4b6, 0xffffffffffffffc0
mov bl, 0x72
mov fs, word [ebp + eax*4 + 0x33]
inc edx
out dx, eax
invalid
popal
in al, 0x2d
cli
adc byte [esi + esi*8], al
in al, 0xe4
or bh, bl
mov ch, 0x16
fisub dword [esi + 0x22a87bb6]
mov byte [0xf900a99d], al
push ds
or al, 0x46
add al, 0xb9
jnp 0x5f7966
xor cl, byte [eax]
pop es
outsb dx, byte [esi]
xchg ecx, eax
int1
and dword [eax], esp
pop ss
adc byte [edx], cl
inc edx
les eax, [edx]
xchg esp, eax
les esi, [ecx]
mov dword [0x711d6204], eax
test byte [esi - 0x34], ch
insd dword es:[edi], dx
add byte [ecx], 0x3a
mov al, 0x34
and dl, bl
pop esi
adc eax, 0x65bfb8a6
jmp 0xa90fd7da
xor ax, 0xdebf
in al, 0x3f
nop
movsd dword es:[edi], dword [esi]
mov dl, 0x80
aam 0xc6
jle 0x5f7a53
jns 0x5f799a
xor eax, 0x10334bc5
xor dword [ebx + 0x823745d], edx
hlt
adc byte [ecx], dh
xchg ebx, eax
pop ebp
je 0x5f7a42
or ah, dh
jns 0x5f7a83
loopne 0x5f79ad
cld
xchg esp, eax
mov al, 0x29
mov al, byte [0x97a8fc8b]
mov ebx, dword [ebx + 0x6c12e0b8]
int3
inc eax
rcr dword [0x80e61004], 0xe9
invalid
mov al, 0x7c
aaa
pop es
shl byte [ecx], cl
les edx, ss:[esi + ebx]
sbb bl, byte [ebp + 0x6c]
push esp
movsx esp, word [ecx]
sub esi, dword [edx - 0x42ca4adf]
movsb byte es:[edi], byte [esi]
adc dword [eax], 0x30
je 0x5f7a19
shr byte [edx + 0xd], cl
pop esi
popal
push ebx
bound esi, qword [edi - 0x34750fc]
loope 0x5f7ac9
jg 0x5f7ae2
sub esi, dword [ecx + 0x703a65c5]
bnd retf 0x3a34
mov cl, 0xc5
cmp dh, byte gs:[eax - 0xe]
retf 0x3a34
xchg ebx, eax
or dword [0xbac1e2cd], ebp
nop
test al, 0x80
loopne 0x5f7b14
test edx, ebp
lcall 0x6c27, 0x2b314f80
xor dh, byte [esi + 0x318c5af5]
and dword [ecx + 0x30], edi
out dx, al
xlatb
xchg byte [eax + 0x361924a2], bl
jl 0x5f7b5b
ljmp 0x272b:0x314f809a
pop edx
invalid
push 0xdbbf4693
dec edi
mov edi, 0x236fdf49
pop ds
or byte [eax - 0xb], dh
call 0xd3c70cec
inc esp
mov dword fs:[0x53e37670], eax
sub bl, byte [esi]
push eax
dec esp
shl dword [0x543c72b8], 1
insb byte es:[edi], dx
mov eax, 0x6c543c72
cmp al, 0
into
cwde
or al, byte [ebx - 0xc]
sal byte [eax + 0x5086f45e], 0xc1
mov byte [eax + 0x3323ce76], 0xb4
dec ebx
stosd dword es:[edi], eax
mov eax, dword [0x2ecda114]
xor esi, dword [ebx + ecx*2 - 0x5eeb5e55]
int 0x2e
cmp ch, byte [ebp + 0x4084bf97]
xchg edi, eax
mov bh, 0xa
loopne 0x5f7ad6
pop eax
aam 0x92
iretd
mov ch, 0x70
jae 0x5f7b2c
add eax, 0x55890cc7
inc edx
invalid
Function at 0x61a8a4
Capabilities:
Encode data using xor

Disassembly:
or al, byte [ebp - 0x24]
std
inc ebp
fdiv st(5), st(0)
sbb al, 0xf9
adc eax, 0x28ad53b2
loopne 0x61a890
pop ebx
push cs
add al, 0xa5
adc dword [ecx + 0x7886fd6a], ebx
or bh, byte [eax + 0x2824402d]
push 0xfffffffffffffffd
xchg byte [eax + 0xa], bh
mov eax, 0x2824402d
push 0x10be9d38
sar byte [ecx - 0xb], cl
popfd
sub eax, 0xa26071c9
cdq
and dword [ecx - 0x6b42a98e], ebp
xor dword [edi + 0x7d], edx
fnstcw word [edx]
test eax, 0x4a18ce4d
inc ecx
fyl2x
cmpsd dword [esi], dword es:[edi]
add dword [edi + 0x5d], ebp
dec ecx
fimul word [ecx + 0x9ad69ac]
push esi
pop eax
out 0xfc, al
jl 0x61a8a1
jns 0x61a891
shl dword [esi - 0x153d6590], cl
invalid

Function at 0x6319e4
Capabilities:
Encode data using xor

Disassembly:
invalid
wait
adc edx, ebx
jecxz 0x6318f1
cmp al, 0x4c
sbb ecx, dword [edx + 3]
or bl, dh
sti
xchg esp, eax
in eax, dx
mov al, byte [0x74227159]
cmpsb byte [esi], byte es:[edi]
shl byte [ebp - 0x1d9c4a94], 1
mov al, byte [0x32f17ad1]
in eax, 0x8a
leave
insb byte es:[edi], dx
mov dl, 0x69
test eax, 0xd3bcf166
invalid
outsb dx, byte [esi]
pop ebx
xlatb
mov edi, 0xa1f1b960
adc dh, bl
and eax, 0xec2d5e11
sti
pop es
out dx, eax
push ecx
push edi
xchg ebx, eax
mov dword [eax], esi
jo 0x6319d9
or byte [eax], dl
pop ecx
mov ch, 0x69
imul dl
jge 0x63199f
jle 0x63194c
cmp byte [ecx + 0x1d519b95], 0x16
xchg ebp, eax
xor eax, 0x2c2ce7d9
pop edi
sub bl, byte [ebx - 0x1b]
xor al, 0xf0
jnp 0x63197b
adc al, 0xf4
and eax, esi
jmp 0x58cf364f
into
add cl, bl
movsb byte es:[edi], byte [esi]
test eax, 0x61581942
rol dword [ecx], 1
mov ecx, 0x1ebe1481
or edi, edi
std
cdq
mov ebp, 0x80679b37
wait
xor byte [bx + di], 0xa0
popal
cdq
je 0x631999
wait
xor byte [bx + di], 0xa0
popal
cdq
je 0x631999
adc dword [ecx + 0x1d], edx
jno 0x6319d2
test eax, 0x9c398c4
adc esp, dword [esi + edx - 0x1fd23038]
fld qword [ecx + 0x39]
xchg byte [edx], dh
loope 0x6319ce
mov eax, dword [0x771c49bd]
xchg dword [eax], esp
push ss
mov al, byte [0xe70f86df]
arpl word [ecx - 0x6af7a4c4], ax
imul edi, eax, 0xffffffae
leave
pop esp
jle 0x631a69
xchg ecx, eax
or ecx, esi
pop ecx
popal
invalid
invalid

Function at 0x63ebad
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
xor dword [edi + 0x750be014], ebx
invalid
or cl, cl
cmp eax, 0xe6a91685
xchg esi, eax
dec esi
jecxz 0x63eb6a
adc cl, byte [ecx - 0x7b]
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
add dh, dl
dec ebp
add al, 0x24
pop eax
mov ebp, 0x2ddba0db
or cl, ch
jge 0x63ec31
or al, 4
pop es
mov ch, 0xac
cdq
pop ds
pop esp
retf
mov ebp, 0x542c0529
jno 0x63ec88
hlt
stc
cmp ebx, dword [eax]
ret 0x9ad5
Function at 0x405e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47499b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x40410c
call fcn.00406a91
push 4
mov dword [esp + 0x18], 0
call fcn.00407a84
mov edi, eax
add esp, 4
test edi, edi
je 0x405ea4
push ebx
call fcn.00406969
mov dword [edi], eax
call fcn.00406728
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406a52
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405e98
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406a7a
pop ebx
jmp 0x405ea6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4084f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x477f10]
jne 0x4084fb
repz ret
jmp fcn.0040d34c
Function at 0x4117b2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x477f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a61a
and dword [ebp - 0x14], 0
cmp dword [0x47c64c], 0
mov dword [ebp - 0x18], eax
jne 0x411865
push 0x40379c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41190d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403790
push ebx
call edi
test eax, eax
je 0x41190d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403780
push ebx
mov dword [0x47c64c], eax
call edi
push eax
call esi
push 0x40376c
push ebx
mov dword [0x47c650], eax
call edi
push eax
call esi
push 0x403750
push ebx
mov dword [0x47c654], eax
call edi
push eax
call esi
mov dword [0x47c65c], eax
test eax, eax
je 0x411865
push 0x403738
push ebx
call edi
push eax
call esi
mov dword [0x47c658], eax
mov eax, dword [0x47c658]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4118be
cmp dword [0x47c65c], ecx
je 0x4118be
push eax
call esi
push dword [0x47c65c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4118be
test ebx, ebx
je 0x4118be
call edi
test eax, eax
je 0x4118b5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4118b5
test byte [ebp - 8], 1
jne 0x4118be
or dword [ebp + 0x10], 0x200000
jmp 0x4118f1
mov eax, dword [0x47c650]
cmp eax, dword [ebp - 0x18]
je 0x4118f1
push eax
call esi
test eax, eax
je 0x4118f1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4118f1
mov eax, dword [0x47c654]
cmp eax, dword [ebp - 0x18]
je 0x4118f1
push eax
call esi
test eax, eax
je 0x4118f1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47c64c]
call esi
test eax, eax
je 0x41190d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41190f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004084f1
leave
ret
Function at 0x472860
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.00412100
cmp dword [0x8003e4], 0x37
jne 0x4728fa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x8013d8]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x481434]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x472b80
Capabilities:
Accept command line arguments
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x8003e4]
sub esp, 0x43c
push ebx
push ebp
push esi
mov esi, dword [0x481434]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x472d86
mov dword [esp + 0x34], 0x9e3779b9
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jmp 0x472bc6
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [0x8003e4], 0x1c
jne 0x472bdd
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x4782d0]
mov ebx, dword [0x4782d8]
mov ebp, dword [0x4782dc]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x4782d4]
mov dword [esp + 0x1c], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x3c], edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], 0x20
jmp 0x472c26
mov eax, dword [esp + 0x1c]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x20], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x800354], edi
mov eax, dword [esp + 0x20]
add dword [0x800354], eax
mov eax, dword [0x800354]
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x38]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x3c]
add dword [esp + 0x10], eax
cmp dword [0x8003e4], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x472cbd
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x30]
cmp dword [0x8003e4], 0x979
mov dword [0x800358], 0xff6b3619
mov dword [0x80035c], 0xffffffff
mov dword [esp + 0x20], eax
jne 0x472cf7
push 0
lea ecx, [esp + 0x4c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x34]
add dword [esp + 0x18], eax
sub esi, dword [esp + 0x18]
dec dword [esp + 0x2c]
jne 0x472c20
cmp dword [0x8003e4], 0x8d4
jne 0x472d3b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
cmp dword [0x8003e4], 0x17
jne 0x472d75
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea ecx, [esp + 0x48]
push ecx
push 0x403f40
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x24], esi
jne 0x472bc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x43c
ret
Function at 0x401060
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x401120
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4011af
cmp al, 9
je 0x4011a0
cmp al, 0x20
je 0x4011a0
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x401208
cmp al, 0x22
je 0x401218
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x4011af
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x401160
test edi, 1
jne 0x401160
lea esi, [esi]
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x4011a0
cmp al, 0x20
je 0x4011a0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x4011ca
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x401177
and dword [ebp - 0x6c], 1
jne 0x401170
xor edi, 1
jmp 0x401177