joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448dd3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call main
add esp, 0x10
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call main
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 0x45bae0
add eax, 0x1c
lea ecx, [ebp - 0x10]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + 0xc]
cmp eax, ecx
jg 0x448e40
mov eax, ecx
mov word [ebp - 0x1a], ax
movsx eax, word [ebp - 0x1a]
movsx ecx, word [ebp - 0x12]
add eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, 4
cmp eax, ecx
jl 0x448e6c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
movsx ecx, word [ebp - 0x12]
sub eax, ecx
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x10]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
cmp eax, ecx
jg 0x448e81
mov eax, ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 8]
sub eax, 4
movsx ecx, word [ebp - 0x14]
sub eax, ecx
movsx ecx, word [ebp - 0x1c]
cmp eax, ecx
jl 0x448e9f
mov eax, ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0xc]
movsx eax, word [eax + 8]
movsx ecx, word [ebp - 0x1c]
cmp eax, ecx
jl 0x448eb8
mov eax, ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1a]
mov dword [ebp - 0x18], eax
push 0x10
movsx eax, word [ebp - 0x12]
add eax, 3
push eax
movsx eax, word [ebp - 0x14]
add eax, 3
push eax
movsx eax, word [ebp - 0x1a]
push eax
movsx eax, word [ebp - 0x1c]
inc eax
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448f09
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
mov ax, word [0x457e88]
push eax
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x54]
call dword [eax + 0x40]
add esp, 0xc
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1a]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call main
test eax, eax
je 0x448f55
mov eax, dword [0x45bd14]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x44cd40
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453310
push 0x44f060
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.kernel32.dll_GetVersion]
mov dword [0x45a0e0], eax
xor eax, eax
mov al, byte [0x45a0e1]
mov dword [0x45a0ec], eax
mov eax, dword [0x45a0e0]
shr dword [0x45a0e0], 0x10
and eax, 0xff
mov dword [0x45a0e8], eax
shl eax, 8
add eax, dword [0x45a0ec]
mov dword [0x45a0e4], eax
call fcn.0044d770
test eax, eax
jne 0x44cdb4
push 0x1c
call fcn.0044cee0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0044ee80
call fcn.0044ee70
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4656c4], eax
call fcn.0044ea20
mov dword [0x4594d0], eax
test eax, eax
je 0x44cde7
cmp dword [0x4656c4], 0
jne 0x44cdf1
push 0xffffffffffffffff
call fcn.0044e630
add esp, 4
call main
call fcn.0044e930
call fcn.0044e600
mov esi, dword [0x4656c4]
mov al, byte [esi]
cmp al, 0x22
je 0x44ce18
cmp al, 0x20
jbe 0x44ce45
inc esi
cmp byte [esi], 0x20
ja 0x44ce10
jmp 0x44ce45
inc esi
cmp byte [esi], 0x22
je 0x44ce44
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x44ce3f
xor eax, eax
mov al, bl
push eax
call fcn.0044e8d0
add esp, 4
test eax, eax
je 0x44ce39
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x44ce21
cmp byte [esi], 0x22
jne 0x44ce45
inc esi
cmp byte [esi], 0
je 0x44ce55
cmp byte [esi], 0x20
ja 0x44ce55
inc esi
cmp byte [esi], 0
jne 0x44ce4a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x44ce79
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0044e630
jmp 0x44ceba
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406959
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x406994
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40697b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40698c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x406996
inc edi
add eax, 0x28
cmp edi, esi
jb 0x406971
xor eax, eax
pop edi
pop esi
ret

Function at 0x406b3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00406919
dec edi
sub eax, dword [ebp + 0x478b66e6]
push es
cmp ax, bx
jbe 0x406b73
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x406b6d
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x406b5e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00406919
jp 0x406c01
xor byte [edx - 0x73], ah
inc ebp
test al, 0x50
call fcn.00406929
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004068de
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x406c07
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00406919
ret

Function at 0x406d41
Capabilities:
Contain obfuscated stackstrings

Disassembly:
salc
aam 0x88
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
Function at 0x406fba
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x406fcd
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x406fc8
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
loop 0x406f94
lock add byte [eax], al
cmp edx, 0x3000
jne 0x406fb2
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp fcn.00406fba
cmp edx, ebx
jne 0x407108
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x406f89
add eax, dword [eax + 4]
jmp 0x406f76
mov dword [ebp + 0xc], ebx
jmp 0x406fd8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x406ff0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40700e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40706c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x407053
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40705c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x407066
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x407048
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406fd2
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x407002
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x406fcd
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x406fc8
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
loop 0x406f94
lock add byte [eax], al
cmp edx, 0x3000
jne 0x406fb2
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp fcn.00406fba
cmp edx, ebx
jne 0x407108
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x406f89
add eax, dword [eax + 4]
jmp 0x406f76
mov dword [ebp + 0xc], ebx
jmp 0x406fd8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x406ff0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40700e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40706c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x407053
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40705c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x407066
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x407048
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406fd2
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x4099ee
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x409a07
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409a7a
mov ecx, esi
call fcn.00409b29
test al, al
je 0x409a42
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x409a42
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.004099ee
jmp 0x409a7d
cmp dword [esi + 0xc], 1
jne 0x409a57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x409a57
xor eax, eax
jmp 0x409a7d
cmp dword [esi + 0xc], 0
jne 0x409a75
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x409a75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x409a75
push edi
jmp 0x409a36
or eax, 0xffffffff
jmp 0x409a7d
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x409b50
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1054
call fcn.0041e630
push ebx
mov ebx, dword [esp + 0x1060]
push ebp
push edi
mov edi, ecx
and dword [edi + 0x1024], 0
cmp byte [edi + 0x22], 0
jne 0x409b7c
test bl, 4
jne 0x409b7c
xor cl, cl
jmp 0x409b7e
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x409ba3
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x409bb2
or ebx, 2
xor eax, eax
lea ecx, [esp + 0x1c]
cmp byte [edi + 0x1b], al
setne al
dec eax
and eax, 0x8000000
mov dword [esp + 0x10], eax
call fcn.00407119
cmp byte [edi + 0x20], 0
je 0x409bd9
or esi, 0x100
push 0
push dword [esp + 0x14]
push 3
push 0
push ebx
push esi
push dword [esp + 0x1080]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x409c5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x1070]
call fcn.0040b85c
test al, al
je 0x409c4a
push 0
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x409c45
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x409c5b
cmp dword [esp + 0x14], 2
jne 0x409c5b
mov dword [edi + 0x1024], 1
cmp byte [edi + 0x20], 0
pop esi
je 0x409c81
cmp ebp, 0xffffffff
je 0x409c81
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
or dword [esp + 0x14], 0xffffffff
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
cmp ebp, 0xffffffff
mov byte [edi + 0x18], al
setne bl
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
cmp ebp, 0xffffffff
je 0x409cb3
push 0x800
push dword [esp + 0x1068]
lea ecx, [edi + 0x24]
mov dword [edi + 4], ebp
push ecx
call fcn.00410131
mov byte [edi + 0x21], 0
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0x1054
ret 8
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403203
pop dword [ebp - 0x10]
mov eax, 0x403203
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd6569985
sub dword [ebp - 0x20], 0x8804543a
mov dword [ebp - 0x1c], 0xf2fd4f2c
add dword [ebp - 0x1c], 0x3f35fd19
mov dword [ebp - 0x18], 0x93b7dc9
sub dword [ebp - 0x18], 0xbcef399b
mov dword [ebp - 0x14], 0xacfbefce
sub dword [ebp - 0x14], 0xacfbefce
lea eax, [ebp - 0x20]
push eax
mov eax, 0x2240089e
add eax, 0xde0077ee
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xa4137d49
sub dword [ebp - 0x20], 0x2fa113f3
mov dword [ebp - 0x1c], 0x5c65908d
add dword [ebp - 0x1c], 0xe506d0e8
mov dword [ebp - 0x18], 0x3b026acd
add dword [ebp - 0x18], 0x286d019f
mov dword [ebp - 0x14], 0x54c0c5ac
add dword [ebp - 0x14], 0xab3f3a54
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8eecc944
add eax, 0x7153b790
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3940d
push 0
call eax
mov ecx, 0x9c8079fe
sub ecx, 0x9c80275b
mov edx, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x10]
mov edi, 0x899c5aa7
add edi, 0xf4686ec4
xor dword [ebp - 8], 0x988017d2
mov esi, dword [ebx]
xor dword [ebp - 0xc], eax
sub esi, edi
mov dword [ebp - 0xc], 0xc772ea20
mov dword [edx], esi
sub dword [ebp - 8], 0xd1d9f93d
add edx, 0x18438a7e
add edx, 0xe7bc7586
add ebx, 0x26cf0eed
sub ebx, 0x26cf0ee9
loop 0x40331a
add eax, 0x3e8aaa7e
sub eax, 0x3e896d1f
xor ebx, ebx
add ebx, eax
add eax, 0x5b49c9d8
sub eax, 0x5b49c9d3
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x4a2a8c], 1
mov dword [0x4a2a90], 1
mov dword [0x4a2a94], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x477800
Capabilities:
Query environment variable

Disassembly:
push esi
mov eax, 0x10064
push ebx
call fcn.0047e2a8
xor edx, edx
sub esp, eax
xor eax, eax
lea ebx, [esp + 0x10]
mov word [esp + 0x60], ax
lea esi, [esp + 0x60]
mov eax, ebx
mov word [esp + 0x10], dx
call fcn.00477750
mov dword [esp + 8], 0x10000
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [eax - 1]
sub esp, 0xc
xor eax, eax
cmp edx, 0xffff
ja 0x477858
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add esp, 0x10064
pop ebx
pop esi
ret

Function at 0x47d2f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.0048cc70
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.0048cc70
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x47decc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x47deeb
mov eax, 0
jmp 0x47df2f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x47df0e
mov eax, 0
jmp 0x47df2f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x47df2a
mov eax, 0
jmp 0x47df2f
mov eax, 1
leave
ret

Function at 0x47df31
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x47df90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x47df88
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x47df88
mov eax, dword [ebp - 4]
jmp 0x47dfa4
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x47df65
mov eax, 0
leave
ret