joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce1f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe055
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x55a064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.004d6a10
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004cd9c0
mov edx, eax
mov ecx, edx
shr ecx, 1
and ecx, 1
cmp bl, cl
je 0x4ce26a
mov ecx, edx
lea eax, [ebp - 0x28]
and ecx, 0xfffffffd
or edx, 2
test bl, bl
cmove edx, ecx
cmp dword [ebp - 0x14], 8
push edx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ce28d
lea ecx, [ebp - 0x28]
call fcn.0042ff30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9056
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], eax
lea ecx, [ebp - 0x40]
call fcn.00462310
push eax
mov edx, str.Could_not_set_hidden_attribute__error_code:
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00434190
push 0x2e
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.0046cba0
add esp, 8
push eax
push esi
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 3
call fcn.004cb730
push 0x54bab8
lea eax, [ebp - 0x2d0]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4e2bc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501272
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x55a064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x24c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x24c], 1
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4e2c76
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e2c50
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push esi
push ecx
push eax
call dword [sym.imp.PocoFoundation.dll_public:_static_void___cdecl_Poco::UnicodeConverter::convert_wchar_t_const___unsigned_int__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____]
add esp, 0xc
jmp 0x4e2d67
mov ecx, edi
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e2c96
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x230]
call fcn.00415a50
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.PocoFoundation.dll_public:_static_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Poco::Environment::get_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov edi, eax
add esp, 8
cmp esi, edi
je 0x4e2d16
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x4e2ce4
inc ecx
push ecx
push dword [esi]
call fcn.00418150
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [ebp - 0x234]
cmp eax, 0x10
jb 0x4e2d31
inc eax
push eax
push dword [ebp - 0x248]
call fcn.00418150
add esp, 8
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
cmp eax, 0x10
jb 0x4e2d67
inc eax
push eax
push dword [ebp - 0x230]
call fcn.00418150
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9056
mov esp, ebp
pop ebp
ret
Function at 0x4e31d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50135e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x55a064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
lea edi, [esi + 0x30]
lea ebx, [esi + 2]
nop dword [eax]
test esi, esi
je 0x4e323f
push esi
call fcn.004e993c
add esp, 4
add edi, edi
xor ecx, ecx
mov eax, edi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e9941
add esp, 4
mov esi, eax
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x4e3230
mov ebx, dword [ebp + 8]
push ebx
push eax
push esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 1
call dword [sym.imp.PocoFoundation.dll_public:_static_void___cdecl_Poco::UnicodeConverter::convert_wchar_t_const___unsigned_int__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____]
add esp, 0xc
jmp 0x4e32aa
push esi
call fcn.004e993c
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e4ca0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x4e5f20
mov byte [ebp - 4], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp eax, 1
sete al
mov esp, ebp
pop ebp
ret

Function at 0x4e4ff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x55a064]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
setae al
xor ecx, ebp
call fcn.004e9056
mov esp, ebp
pop ebp
ret
Function at 0x4e5e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.004e4ff0
test al, al
mov dword [ebp - 0x34], 0
mov eax, dword [ebp + 0xc]
mov ecx, str.runas
cmove ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x38], 0x140
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
je 0x4e5f10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
cmp eax, 0x4c7
jne 0x4e5ee1
sub esp, 8
mov eax, esp
mov dword [eax], str.User_refused_elevation.
mov dword [eax + 4], 0x17
call fcn.004271c0
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], 0
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
sub esp, 8
mov eax, esp
mov dword [eax], str.Privilege_elevation_failed_____Cannot_continue.
mov dword [eax + 4], 0x31
call fcn.0047f7d0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [eax], 0
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov byte [eax + 4], 1
mov esp, ebp
pop ebp
ret
Function at 0x4e8950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x4e89bc
mov ecx, dword [ebp + 0xc]
movzx ebx, word [ecx + edi*2]
mov edx, ebx
movzx ecx, bl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x4e89bc
movzx ecx, bl
cmp esi, ecx
jne 0x4e89b4
cmp eax, edx
jge 0x4e89b4
mov ecx, dword [ebp + 8]
movzx esi, cl
nop dword [eax]
mov ecx, dword [ebp + 0x14]
movzx ecx, byte [eax + ecx]
cmp cx, si
je 0x4e89e8
inc eax
cmp eax, edx
jl 0x4e89a0
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x4e8973
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x4e8a00
mov esi, dword [ebp + 0x18]
nop word [eax + eax]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x4e89f1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x4e89f3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x4e8a00
inc eax
xor bl, 1
cmp eax, edi
jb 0x4e89d0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1c340784
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, str.kk
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5e2b1cdb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x401206
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.Mig1
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030c0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401325
push 1
push dword [0x4030c0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Gendalf
push str.Mig1
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030c8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4030c8]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401325
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401308
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4038cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417a60
cmp edx, dword [eax]
je 0x4038ef
add eax, 8
inc ecx
cmp eax, 0x417af0
jl 0x4038e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417a60]
jne 0x403a1d
mov eax, dword [0x418984]
cmp eax, 1
je 0x4039f7
test eax, eax
jne 0x403920
cmp dword [0x41795c], 1
je 0x4039f7
cmp edx, 0xfc
je 0x403a1d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403957
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404660
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403c10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40399a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403c10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x408dac
push edi
call fcn.00405cd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404660
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404670
lea eax, [ebp - 0xa0]
push 0x408d8c
push eax
call fcn.00404670
push dword [esi + 0x417a64]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404670
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405c39
add esp, 0x2c
pop edi
jmp 0x403a1d
lea eax, [ebp + 8]
lea esi, [esi + 0x417a64]
push 0
push eax
push dword [esi]
call fcn.00403c10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5c8c39ce
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1f406f81
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x405080
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40a6a8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x40509f
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x40a6a4], 1
mov byte [0x40a6a0], bl
jne 0x4050f9
mov ecx, dword [0x40aa28]
test ecx, ecx
je 0x4050e7
mov esi, dword [0x40aa24]
sub esi, 4
cmp esi, ecx
jb 0x4050e7
mov eax, dword [esi]
test eax, eax
je 0x4050e0
call eax
mov ecx, dword [0x40aa28]
sub esi, 4
cmp esi, ecx
jae 0x4050d2
push 0x407014
push 0x407010
call fcn.00405130
add esp, 8
push 0x40701c
push 0x407018
call fcn.00405130
add esp, 8
test ebx, ebx
jne 0x405120
push ebp
mov dword [0x40a6a8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x494990
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x81000]
push edi
jmp 0x4949aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4949b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4949a0
mov eax, 1
add ebx, ebx
jne 0x4949c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4949d4
jne 0x4949f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4949f3
dec eax
add ebx, ebx
jne 0x4949e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4949b8
add ebx, ebx
jne 0x4949ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x494a45
xor ecx, ecx
sub eax, 3
jb 0x494a0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x494a7a
sar eax, 1
mov ebp, eax
jmp 0x494a16
add ebx, ebx
jne 0x494a16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4949e4
inc ecx
add ebx, ebx
jne 0x494a24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4949e4
add ebx, ebx
jne 0x494a31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x494a26
jne 0x494a42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x494a26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x494a64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x494a56
jmp 0x4949a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x494a64
add edi, ecx
jmp 0x4949a6
pop esi
mov edi, esi
mov ecx, 0xaa5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x494a82
cmp byte [edi], 0x12
jne 0x494a82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x494a87
lea edi, [esi + 0x91000]
mov eax, dword [edi]
or eax, eax
je 0x494af6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf9354]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf937c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x494ab4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf9384]
or eax, eax
je 0x494af0
mov dword [ebx], eax
add ebx, 4
jmp 0x494ad1
call dword [esi + 0xf9380]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x494b27
cmp al, 0xef
ja 0x494b1a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x494afc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x494b09
mov ebp, dword [esi + 0xf9388]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x494b5b
sub esp, 0xffffff80
jmp 0x4068d0
Function at 0xa23088
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0xa28004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00a251ff
xor edi, edi
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], edi
call fcn.00a25497
mov esi, eax
cmp esi, edi
jl 0xa231f7
push ebx
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x21c]
call fcn.00a2573e
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x228]
push eax
call fcn.00a25237
mov esi, eax
cmp esi, edi
jl 0xa231f6
cmp dword [ebp - 0x228], edi
je 0xa23260
lea eax, [ebp - 0x224]
push eax
call fcn.00a2529e
mov esi, eax
cmp esi, edi
jl 0xa231f6
push 0xa213f0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00a26376
mov esi, eax
cmp esi, edi
jl 0xa231eb
cmp dword [ebp - 0x210], ebx
jne 0xa23171
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x218]
call fcn.00a25497
mov esi, eax
cmp esi, edi
jl 0xa231eb
push 0x44
lea eax, [ebp - 0x27c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x27c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x27c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0xa23248
call fcn.00a27074
mov esi, eax
push esi
push 0xa21398
push ebx
lea eax, [ebp - 0x214]
push 0xa
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], 2
call fcn.00a24bad
add esp, 0x14
push dword [ebp - 0x224]
call fcn.00a25325
pop ebx
push esi
push 0xa21348
push 3
lea eax, [ebp - 0x214]
push 0xa
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], 2
call fcn.00a24bad
push dword [ebp - 0x21c]
call fcn.00a256b0
push dword [ebp - 0x220]
call fcn.00a256b0
mov ecx, dword [ebp - 4]
add esp, 0x1c
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00a235d0
leave
ret 0x10
push dword [ebp - 0x238]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x234]
call ebx
jmp 0xa231eb
mov esi, 0xd79
cmp dword [ebp - 0x210], ebx
jne 0xa2329f
push 0xa21244
push dword [ebp - 0x218]
call fcn.00a255ad
test eax, eax
jne 0xa23286
add esi, 0xfffffffd
jmp 0xa2329f
push 0xa2124c
push dword [ebp - 0x218]
call fcn.00a255ad
test eax, eax
jne 0xa2329f
mov esi, 0xd77
push ebx
push esi
push edi
call fcn.00a23029
call fcn.00a2548a
mov esi, eax
jmp 0xa231f6
Function at 0xa23f22
Capabilities:
Get file size

Disassembly:
push 0x20
push 0xa274b8
call fcn.00a23774
mov edi, ecx
mov dword [ebp - 0x28], edi
cmp dword [edi + 0x10], 0xffffffff
je 0xa2405a
call fcn.00a23caf
test eax, eax
je 0xa2405a
xor ebx, ebx
push ebx
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x24], eax
test byte [edi + 0xc], 0x14
mov esi, 0x200000
je 0xa23f69
mov esi, 0x2d00000
cmp eax, 0xffffffff
je 0xa2404a
cmp eax, esi
jbe 0xa2404a
mov dword [ebp - 0x20], eax
push ebx
push ebx
push ebx
push 4
push ebx
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0xa2404a
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0xa24020
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
add eax, ebx
shr esi, 1
mov ecx, eax
sub ecx, esi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], eax
jae 0xa23fd1
mov edx, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp byte [edx], 0xa
jne 0xa23fbe
cmp dword [ebp - 0x1c], eax
jne 0xa23fd6
mov dword [ebp - 0x1c], ecx
sub eax, dword [ebp - 0x1c]
mov esi, eax
push esi
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0xa24019
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
je 0xa24048
push 0
push 0
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
mov eax, dword [0xa2839c]
cmp eax, ebx
je 0xa2405a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00a237b9
ret