joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x41d0c0
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x40e57e
mov dl, byte [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movsx edx, dl
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x40e669
lea esi, [ebp - 0x28]
mov ecx, eax
push esi
call fcn.0040612a
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x4ba1c0
call fcn.00418d68
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor edi, edi
dec edi
mov eax, edi
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x40e5b7
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x28]
push ebx
call eax
mov al, byte [ebp - 0x1d]
test al, al
mov esi, dword [ebp + 8]
jns 0x40e5e4
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
test al, al
js 0x40e5f9
movzx eax, al
add eax, ebp
add eax, 0xffffffd8
cmp ebx, eax
jne 0x40e605
jmp 0x40e64f
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add edx, eax
cmp ebx, edx
je 0x40e653
test ecx, ecx
je 0x40e61d
mov al, byte [ebx]
mov edi, dword [ecx + 0x18]
cmp edi, dword [ecx + 0x1c]
je 0x40e621
lea edx, [edi + 1]
mov dword [ecx + 0x18], edx
mov byte [edi], al
jmp 0x40e649
xor ecx, ecx
jmp 0x40e649
mov dword [ebp - 0x30], ebx
movzx eax, al
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x2c], ecx
push eax
call edx
xor ecx, ecx
cmp eax, 0xffffffff
je 0x40e643
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x30]
inc ebx
mov al, byte [ebp - 0x1d]
jmp 0x40e5e7
mov dword [esi], ecx
jmp 0x40e65e
mov dword [esi], ecx
push eax
call fcn.00473386
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x40fcc0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 8], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x41d150
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
push eax
sub esp, 0x18
mov ebx, esp
lea eax, [ebx + 8]
push eax
call fcn.0040b610
add esp, 4
mov dword [ebx], edi
mov dword [ebx + 4], 0x14
lea eax, [esi + 0x18]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
call fcn.0041f8ae
add esp, 0x1c
mov esp, dword [esi + 8]
mov dword [esi + 8], eax
add eax, esi
add eax, 0x50
mov ebx, dword [ebp + 0x10]
push ebx
mov dword [esi + 0x14], eax
push eax
push edi
call fcn.0040e8c4
add esp, 0xc
mov dword [esi + 0x10], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 0xc]
mov ecx, ebx
push edi
call fcn.0040612a
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
mov ecx, edi
push 0x4ba198
call fcn.00418d68
mov ebx, eax
mov ecx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40fdb2
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x14]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0x10]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 8]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00401420
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x40fe40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x41d160
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x40fe9f
movzx edx, word [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movzx edx, dx
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x40ff99
lea esi, [ebp - 0x28]
mov ecx, eax
push esi
call fcn.0040612a
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x4ba1c8
call fcn.00418d68
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor edi, edi
dec edi
mov eax, edi
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x40fed8
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x28]
push ebx
call eax
mov al, byte [ebp - 0x1d]
test al, al
jns 0x40ff02
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
test al, al
js 0x40ff1b
movzx edx, al
lea edx, [edx*2 - 0x28]
add edx, ebp
cmp ebx, edx
jne 0x40ff28
jmp 0x40ff78
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
lea edx, [edi + edx*2]
cmp ebx, edx
je 0x40ff7f
test ecx, ecx
je 0x40ff42
movzx eax, word [ebx]
mov esi, dword [ecx + 0x18]
cmp esi, dword [ecx + 0x1c]
je 0x40ff46
lea edx, [esi + 2]
mov dword [ecx + 0x18], edx
mov word [esi], ax
jmp 0x40ff64
xor edx, edx
jmp 0x40ff71
mov dword [ebp - 0x2c], ebx
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
movzx eax, ax
mov dword [ebp - 0x30], ecx
push eax
call edx
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
xor edx, edx
cmp ax, 0xffff
je 0x40ff6e
mov edx, ecx
mov al, byte [ebp - 0x1d]
add ebx, 2
mov ecx, edx
jmp 0x40ff05
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x40ff8f
mov esi, dword [ebp + 8]
mov dword [esi], ecx
push edi
call fcn.00473386
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x4135b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0041cd5c
mov ebx, eax
test esi, esi
je 0x4135e9
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x4135d6
movzx eax, word [eax]
jmp 0x4135dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x4135e9
test bl, bl
jne 0x4135ef
jmp 0x41364c
xor esi, esi
test bl, bl
jne 0x41363d
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x4135fe
movzx eax, word [eax]
jmp 0x413603
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x41362e
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x413627
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x4135bc
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x4135bc
mov ecx, edi
call fcn.0041cd5c
mov ebx, eax
test esi, esi
jne 0x413655
jmp 0x413646
mov ecx, edi
call fcn.0041cd5c
mov ebx, eax
test bl, bl
jne 0x413674
jmp 0x41367a
mov ecx, edi
call fcn.0041cd5c
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x413662
movzx eax, word [eax]
jmp 0x413669
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x41367a
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4137da
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.0041cd5c
mov edx, eax
test ebx, ebx
je 0x413801
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x413810
movzx eax, word [eax]
jmp 0x41381d
xor ebx, ebx
test dl, dl
je 0x413832
mov eax, 6
xor edi, edi
jmp 0x413888
mov eax, dword [ebx]
mov ecx, ebx
mov byte [ebp - 0x14], dl
call dword [eax + 0x20]
mov dl, byte [ebp - 0x14]
xor edi, edi
cmp ax, 0xffff
sete cl
cmove ebx, edi
mov eax, 6
cmp dl, cl
je 0x413888
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x413847
movzx eax, word [eax]
jmp 0x41384c
mov eax, dword [ecx]
call dword [eax + 0x20]
mov edx, dword [esi]
movzx edi, ax
mov ecx, esi
push edi
push 4
call dword [edx + 0xc]
test al, al
je 0x413881
mov dword [ebp - 0x14], ebx
mov eax, dword [esi]
mov ecx, esi
push 0
push edi
call dword [eax + 0x34]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x413897
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x41389c
xor edi, edi
mov eax, 4
mov ecx, dword [ebp + 0x10]
or dword [ecx], eax
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ecx]
call dword [eax + 0x24]
mov eax, dword [ebp + 0x18]
movsx edi, bl
mov ebx, eax
mov ecx, dword [ebp + 8]
call fcn.0041cd5c
mov edx, eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4138c2
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x4138c8
movzx eax, word [eax]
jmp 0x4138d5
mov al, 1
xor esi, esi
jmp 0x4138e4
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 0xd], dl
call dword [eax + 0x20]
mov dl, byte [ebp - 0xd]
xor ecx, ecx
cmp ax, 0xffff
sete al
je 0x4138e2
mov ecx, esi
mov esi, ecx
add edi, 0xffffffd0
cmp dl, al
je 0x41395d
cmp ebx, 2
jl 0x41395d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
je 0x413908
movzx eax, word [eax]
jmp 0x41390d
mov eax, dword [ecx]
call dword [eax + 0x20]
mov esi, dword [ebp + 0x14]
mov edx, dword [esi]
movzx ebx, ax
mov ecx, esi
push ebx
push 4
call dword [edx + 0xc]
test al, al
je 0x41388d
mov eax, dword [esi]
mov ecx, esi
push 0
push ebx
call dword [eax + 0x34]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x413946
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x41394b
mov eax, dword [ecx]
call dword [eax + 0x24]
lea eax, [edi + edi*4]
movsx ecx, bl
lea edi, [ecx + eax*2]
mov ebx, dword [ebp - 0x18]
dec ebx
jmp 0x4138a4
mov ecx, dword [ebp + 8]
call fcn.0041cd5c
mov ebx, eax
test esi, esi
je 0x413978
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41398a
movzx eax, word [eax]
jmp 0x413991
mov eax, 2
test bl, bl
jne 0x413888
jmp 0x41388d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x413888
jmp 0x41388d
Function at 0x414ad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x41d2d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.00401800
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.0040612a
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x4ba198
call fcn.00418d68
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.00414030
add esp, 0x2c
test al, al
je 0x414c30
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x414bca
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
jmp 0x414bd6
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x414bf2
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.0041dde6
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ecx, [edi - 1]
cmp edx, ecx
jae 0x414c1c
mov ecx, edx
not ecx
add ecx, edi
lea ebx, [edx + ecx]
cmp byte [edx], al
jne 0x414c1c
inc edx
dec ecx
jne 0x414c12
mov edx, ebx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.00414d10
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.00401b10
mov edi, dword [ebp + 8]
test al, al
je 0x414c49
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x414c62
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x414c84
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x41fe8e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.00473356
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x41fee0
push ecx
push ecx
call fcn.00481080
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x41fecd
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4209d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [0x4ba868]
test ebx, ebx
jne 0x420a9f
push 0x24
call fcn.00473356
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.00473356
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x4ba868], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
test eax, eax
je 0x420a6c
push edi
call fcn.0048a37d
add esp, 4
jmp 0x420a96
lea eax, [ebp - 0x14]
push 0x49b320
push 0x7c
push 0x49e73c
push eax
call fcn.0041ff70
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.0041ffe0
lea ecx, [ebp - 0x14]
call fcn.0041fff0
xor eax, eax
mov ecx, esi
push eax
push edi
call fcn.00420ac0
test ebx, ebx
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420ac0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x4b731c]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.00429780
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x420c85
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], eax
je 0x420b3a
push 0x49e71a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420b4a
mov ecx, eax
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x420b45
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x28], eax
jmp 0x420b51
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x420c40
mov dword [ebp - 0x2c], edi
cmp eax, 0x15555556
jae 0x420cc3
shl eax, 2
mov dword [ebp - 0x34], eax
lea edi, [eax + eax*2]
push edi
call fcn.00473356
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
add eax, edi
mov dword [ebp - 0x18], eax
xor edi, edi
jmp 0x420c06
mov dword [ebp - 0x24], esi
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.00473356
add esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [eax], ecx
or esi, 0x80000000
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], esi
mov esi, dword [ebp - 0x24]
mov dword [esi + 4], ebx
mov dword [ebp - 0x24], ecx
mov eax, ebx
add eax, ebx
push eax
push dword [ebp - 0x38]
push ecx
call fcn.004768d0
mov ecx, dword [ebp - 0x24]
add esp, 0xc
mov word [ecx + ebx*2], 0
add esi, 0xc
add edi, 4
cmp dword [ebp - 0x34], edi
je 0x420c35
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + edi]
mov dword [ebp - 0x38], eax
push eax
call fcn.0048a37d
add esp, 4
cmp eax, 0x7ffffff0
jae 0x420cbc
mov ebx, eax
cmp eax, 5
jae 0x420bb0
mov byte [esi + 0xb], bl
mov ecx, esi
test ebx, ebx
jne 0x420bde
jmp 0x420bf5
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x2c]
lea ebx, [ebp - 0x20]
jmp 0x420c42
xor esi, esi
mov ecx, edi
push ebx
call fcn.00420860
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x420c6e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x420c85
cmp esi, edi
jne 0x420ca6
mov dword [ebp - 0x1c], edi
push edi
call fcn.00473386
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, ebx
cmp ebx, edi
je 0x420c79
lea ebx, [esi - 0xc]
cmp byte [esi - 1], 0
jns 0x420ca0
push dword [esi - 0xc]
call fcn.00473386
add esp, 4
jmp 0x420ca0
mov ecx, esi
call fcn.0041d624
lea ecx, [ebp - 0x20]
call fcn.0041f41c
int3
Function at 0x424870
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00420ce0
test al, al
je 0x42497e
call fcn.00420cd0
mov esi, eax
mov ecx, eax
push 0x49ec95
call fcn.00421150
test al, al
jne 0x4248be
mov ecx, esi
push str.vmodule
call fcn.00421150
test al, al
je 0x42497e
cmp dword [0x4ba870], 0
je 0x4248f0
lea edi, [ebp - 0x1c]
push str._g_vlog_info_prev
push 0x198
push str..._.._base_logging.cc
push edi
call fcn.0041ff70
add esp, 0x10
mov ecx, edi
call fcn.0041ffe0
mov ecx, edi
call fcn.0041fff0
mov eax, dword [0x4ba874]
mov dword [0x4ba870], eax
push 0x14
call fcn.00473356
add esp, 4
mov edi, eax
push str.vmodule
call fcn.00489d00
add esp, 4
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push str.vmodule
push edx
call fcn.004211e0
push 0x49ec95
call fcn.00489d00
add esp, 4
lea ebx, [ebp - 0x28]
mov ecx, esi
push eax
push 0x49ec95
push ebx
call fcn.004211e0
mov ecx, edi
push 0x4ba878
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0042c890
mov dword [0x4ba874], edi
cmp byte [ebp - 0x1d], 0
jns 0x42496a
push dword [ebp - 0x28]
call fcn.00473386
add esp, 4
cmp byte [ebp - 0x11], 0
mov edi, dword [ebp + 8]
jns 0x42497e
push dword [ebp - 0x1c]
call fcn.00473386
add esp, 4
mov eax, dword [edi]
mov dword [0x4b72f0], eax
mov bl, 1
test al, 1
je 0x424a14
mov eax, dword [0x4ba88c]
test eax, eax
je 0x4249bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4ba88c], 0
mov ecx, dword [0x4ba87c]
test ecx, ecx
jne 0x4249eb
and byte [0x4b72f0], 0xfe
jmp 0x4249c6
mov ecx, dword [0x4ba87c]
test ecx, ecx
jne 0x4249eb
push 0xc
call fcn.00473356
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x4ba87c], eax
push dword [edi + 4]
call fcn.0041e3b6
cmp dword [edi + 0xc], 0
jne 0x424a0d
mov eax, dword [0x4ba87c]
cmp byte [eax + 0xb], 0
jns 0x424a06
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00424a30
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x428c70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x4b731c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
test ebx, ebx
je 0x428ccf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x428cb9
call fcn.00431f60
push dword [esi]
call fcn.00433240
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x428cc8
mov dword [esi], ebx
call fcn.00431f60
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x428d44
lea eax, [ebp - 0x18]
push 0x428ed0
push eax
call fcn.00420350
add esp, 8
mov ebx, eax
lea eax, [ebp + 8]
push 0x428ed0
push eax
call fcn.00420350
add esp, 8
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.handle___::GetCurrentProcess__
call fcn.00420500
cmp dword [ebp - 0x14], 0
je 0x428d44
lea ebx, [ebp - 0x1c]
push edi
push 0x21
push str..._.._base_process_process_win.cc
push ebx
call fcn.00420010
add esp, 0x10
mov ecx, ebx
call fcn.0041ffe0
mov ecx, ebx
call fcn.0041fff0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004733c1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4