joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x1c], 0xda
mov dword [ebp - 0x20], 0x385
mov dword [ebp - 0x24], 0x16b
mov dword [ebp - 0x28], 0x337
mov dword [ebp - 0x2c], 0xee
mov dword [ebp - 0x30], 0x180
mov dword [ebp - 0xc], 0x48
mov dword [ebp - 0x34], 0x238
mov dword [ebp - 0x38], 0x283
mov dword [ebp - 0x3c], 0x1b0
mov dword [ebp - 0x40], 0x156
mov dword [ebp - 0x44], 0x3b8
mov dword [ebp - 0x48], 0x19a
mov dword [ebp - 0x4c], 0x2ba
mov dword [ebp - 0x50], 0xff
mov dword [ebp - 0x54], 0x3d2
mov dword [ebp - 0x18], 0x34
mov dword [ebp - 0x14], 0xdc
mov dword [ebp - 0x58], 0x367
mov dword [ebp - 0x10], 0x3a5
mov dword [ebp - 0x5c], 0x377
mov dword [ebp - 8], 0x30d
mov dword [ebp - 0x60], 0x4b
mov dword [ebp - 0x64], 0x86
mov dword [ebp - 0x68], 0x139
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
jmp 0x40ea22
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x186d4
cmp dword [ebp - 4], ecx
jge 0x40ea41
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x40ea19
call fcn.00412c70
mov esp, ebp
pop ebp
ret
Function at 0x40f510
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x44], 0x1ab
mov dword [ebp - 0x20], 0x2bf
mov dword [ebp - 0x48], 0x274
mov dword [ebp - 4], 0x108
mov dword [ebp - 0x4c], 0x386
mov dword [ebp - 0x50], 0x3d2
mov dword [ebp - 0x54], 0x2e1
mov dword [ebp - 0x58], 0x156
mov dword [ebp - 0x5c], 0x1a1
mov dword [ebp - 0x24], 0xce
mov dword [ebp - 0x1c], 0x278
mov dword [ebp - 0x60], 0x307
mov dword [ebp - 0x64], 0xa3
mov dword [ebp - 0x18], 0x148
mov dword [ebp - 0x28], 0x325
mov dword [ebp - 0x68], 0x2a2
mov dword [ebp - 0x10], 0x107
mov dword [ebp - 0x34], 0x322
mov dword [ebp - 0x6c], 0xbc
mov dword [ebp - 0x2c], 0x2b
mov dword [ebp - 0x30], 0x24d
mov dword [ebp - 0x38], 0x120
mov dword [ebp - 0x70], 0x376
mov dword [ebp - 0x3c], 0x398
mov dword [ebp - 0x40], 0x303
mov dword [ebp - 8], 0
jmp 0x40f5d7
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1895f
cmp dword [ebp - 8], ecx
jge 0x40f622
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x28]
jge 0x40f5fc
mov dword [ebp - 0x14], 1
jmp 0x40f603
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x2c]
and ecx, dword [ebp - 0x14]
je 0x40f620
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40f5ce
mov eax, dword [ebp - 0x30]
add eax, 0xaf
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xb7
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x38
push edx
call fcn.00422150
add esp, 0xc
mov dword [ebp - 0xc], 0
jmp 0x40f656
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x1c]
sub ecx, 0x3bb
cmp dword [ebp - 0xc], ecx
jge 0x40f66f
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x40f64d
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x10]
jge 0x40f680
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x11
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x232
push eax
mov ecx, dword [ebp - 0x40]
sub ecx, 0x47
push ecx
mov edx, dword [ebp + 0x14]
sub edx, 0x239
push edx
mov eax, dword [ebp + 0x20]
add eax, 0x2ad
push eax
call fcn.0040c1d0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x411010
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x4c], 0x31e
mov dword [ebp - 0x30], 0x27e
mov dword [ebp - 0x50], 0x2b5
mov dword [ebp - 0x54], 0x189
mov dword [ebp - 0x44], 0x23b
mov dword [ebp - 0xc], 0x3b
mov dword [ebp - 0x58], 0x28d
mov dword [ebp - 0x18], 0x1eb
mov dword [ebp - 0x38], 0x3b9
mov dword [ebp - 0x40], 0x1f3
mov dword [ebp - 0x5c], 0xf1
mov dword [ebp - 8], 0x19e
mov dword [ebp - 0x3c], 0x166
mov dword [ebp - 0x28], 0x2c2
mov dword [ebp - 0x60], 0x29f
mov dword [ebp - 0x64], 0x9f
mov dword [ebp - 0x68], 0x3b8
mov dword [ebp - 0x6c], 0x379
mov dword [ebp - 0x70], 0x369
mov dword [ebp - 0x74], 0x257
mov dword [ebp - 0x78], 0x10d
mov dword [ebp - 0x34], 0x36c
mov dword [ebp - 0x14], 0x1e7
mov dword [ebp - 4], 0
jmp 0x4110c9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1ea
cmp dword [ebp - 4], ecx
jge 0x41117e
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x1c]
jge 0x4110ec
mov dword [ebp - 0x1c], 1
jmp 0x4110f3
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3c]
jge 0x411104
mov dword [ebp - 0x20], 1
jmp 0x41110b
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 0xc]
jge 0x41111c
mov dword [ebp - 0x24], 1
jmp 0x411123
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x24]
je 0x411179
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x30]
jge 0x411146
mov dword [ebp - 0x2c], 1
jmp 0x41114d
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x28]
or ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x14]
or ecx, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x48], 0
je 0x411179
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x4110c0
mov dword [ebp - 0x10], 0
jmp 0x411190
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x18a0c
cmp dword [ebp - 0x10], eax
jge 0x4111ae
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x411187
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov esp, ebp
pop ebp
ret
Function at 0x415f10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x14], 0x387
mov dword [ebp - 0x18], 0x3d8
mov dword [ebp - 0x1c], 0x38
mov dword [ebp - 0x20], 0x7b
mov dword [ebp - 0x24], 0x136
mov dword [ebp - 0x28], 0x297
mov dword [ebp - 0x2c], 0x29a
mov dword [ebp - 0x30], 0x36
mov dword [ebp - 0x34], 0x2b8
mov dword [ebp - 0x38], 0x4a
mov dword [ebp - 0x3c], 0x10e
mov dword [ebp - 0x40], 0x352
mov dword [ebp - 0x44], 0x311
mov dword [ebp - 0x48], 0x3c7
mov dword [ebp - 0x4c], 0x63
mov dword [ebp - 8], 0x2b6
mov dword [ebp - 0xc], 0x1ac
mov dword [ebp - 0x50], 0x1bc
mov dword [ebp - 0x54], 0x168
mov dword [ebp - 0x58], 0x192
mov dword [ebp - 0x10], 0x114
mov dword [ebp - 0x5c], 0x33c
mov dword [ebp - 4], 0
jmp 0x415fc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x1c]
sub ecx, 0x18a58
cmp dword [ebp - 4], ecx
jge 0x415fe1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x415fb9
mov eax, dword [ebp + 0x20]
add eax, 0x125
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x45
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x1f3
push edx
call fcn.00417a80
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41aa70
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x3c], 0x175
mov dword [ebp - 0x40], 0x3a6
mov dword [ebp - 0x44], 0x138
mov dword [ebp - 0x1c], 0x3c1
mov dword [ebp - 0x38], 0x228
mov dword [ebp - 0x48], 0xd9
mov dword [ebp - 0x4c], 0x383
mov dword [ebp - 0x50], 0x30d
mov dword [ebp - 0x54], 0x1bd
mov dword [ebp - 0x58], 0x28c
mov dword [ebp - 0x34], 0x165
mov dword [ebp - 0x5c], 0x2d3
mov dword [ebp - 0x60], 0x101
mov dword [ebp - 0x20], 0x24b
mov dword [ebp - 0x2c], 0x114
mov dword [ebp - 0x64], 0x119
mov dword [ebp - 0x68], 0x1e4
mov dword [ebp - 0x30], 0xbc
mov dword [ebp - 0x6c], 0x291
mov dword [ebp - 0x70], 0xa8
mov dword [ebp - 0x74], 0x1be
mov dword [ebp - 0xc], 0x3bb
mov dword [ebp - 0x24], 0x128
mov dword [ebp - 0x28], 0x3c2
mov dword [ebp - 4], 0x148
mov dword [ebp - 8], 0
jmp 0x41ab37
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x188eb
cmp dword [ebp - 8], ecx
jge 0x41ab94
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0xc]
jge 0x41ab56
mov dword [ebp - 0x14], 1
jmp 0x41ab5d
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 4]
jge 0x41ab6e
mov dword [ebp - 0x18], 1
jmp 0x41ab75
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 0x14]
and ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x2c]
or ecx, dword [ebp - 0x18]
je 0x41ab92
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x41ab2e
mov eax, dword [ebp - 0x30]
add eax, 0x116
push eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x94
push ecx
mov edx, dword [ebp - 4]
add edx, 0x1a9
push edx
call fcn.0041cb60
add esp, 0xc
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
jmp 0x41abd4
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
sub edx, 0x2a7
cmp dword [ebp - 0x10], edx
jge 0x41abed
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x41abcb
mov ecx, dword [ebp + 0x10]
sub ecx, 0x204
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x70
push edx
call fcn.0041b3c0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41db00
Capabilities:
Clear file content
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x28], 0x315
mov dword [ebp - 0x1c], 0x3cf
mov dword [ebp - 0x14], 0x1f3
mov dword [ebp - 0x2c], 0x285
mov dword [ebp - 0x30], 0x2c
mov dword [ebp - 0xc], 0x9a
mov dword [ebp - 0x34], 0x330
mov dword [ebp - 0x20], 0x14a
mov dword [ebp - 0x38], 0x1d
mov dword [ebp - 0x3c], 0x28b
mov dword [ebp - 0x40], 0x90
mov dword [ebp - 0x44], 0x1ac
mov dword [ebp - 0x18], 0x125
mov dword [ebp - 0x48], 0x266
mov dword [ebp - 0x24], 0x3b3
mov dword [ebp - 0x4c], 0x33a
mov dword [ebp - 0x50], 0x105
mov dword [ebp - 0x54], 0xd1
mov dword [ebp - 0x58], 0xac
mov dword [ebp - 0x10], 0x121
mov dword [ebp - 0x5c], 0x1d2
mov dword [ebp - 0x60], 0x21
mov dword [ebp - 0x64], 0x18c
mov dword [ebp - 0x68], 0x108
mov dword [ebp - 4], 0
jmp 0x41dbc0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x18893
cmp dword [ebp - 4], ecx
jge 0x41dbdf
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x41dbb7
mov eax, dword [ebp + 8]
sub eax, 0x1f6
push eax
call fcn.0041f990
add esp, 4
mov dword [ebp - 8], 0
jmp 0x41dc02
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x187c5
cmp dword [ebp - 8], edx
jge 0x41dc21
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x41dbf9
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xb0
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x293
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0x3b0
push eax
call fcn.00418d90
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x420820
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x54], 0x96
mov dword [ebp - 0x58], 0x76
mov dword [ebp - 0x5c], 0x274
mov dword [ebp - 0x34], 0x1a0
mov dword [ebp - 0x60], 0x1b4
mov dword [ebp - 0x44], 0x10
mov dword [ebp - 0x38], 0x30a
mov dword [ebp - 0x64], 0x288
mov dword [ebp - 8], 0x31a
mov dword [ebp - 0x48], 0x228
mov dword [ebp - 0x68], 0x313
mov dword [ebp - 0x6c], 0xc6
mov dword [ebp - 0x2c], 0x2e8
mov dword [ebp - 0x70], 0x208
mov dword [ebp - 0x50], 0x2b6
mov dword [ebp - 4], 0x369
mov dword [ebp - 0x74], 0x22d
mov dword [ebp - 0x40], 0xa
mov dword [ebp - 0x78], 0xba
mov dword [ebp - 0x20], 0x388
mov dword [ebp - 0x3c], 0x18f
mov dword [ebp - 0x1c], 0x104
mov dword [ebp - 0x30], 0x288
mov dword [ebp - 0x4c], 0x243
mov dword [ebp - 0x7c], 0x323
mov eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 0x14]
add edx, 1
mov dword [ebp + 0x14], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jge 0x4208fe
mov dword [ebp - 0x10], 1
jmp 0x420905
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp - 0x2c]
jge 0x420916
mov dword [ebp - 0x14], 1
jmp 0x42091d
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x38]
jge 0x420931
mov dword [ebp - 0x18], 1
jmp 0x420938
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
and eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
je 0x42094c
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1e3
push edx
mov eax, dword [ebp + 0x14]
add eax, 0xc3
push eax
mov ecx, dword [ebp + 0x14]
add ecx, 0x1af
push ecx
mov edx, dword [ebp + 0x18]
add edx, 0x55
push edx
mov eax, dword [ebp - 0x1c]
add eax, 0x232
push eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x20
push ecx
call fcn.0040fcf0
add esp, 0x18
mov dword [ebp - 0xc], 0
jmp 0x42099a
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x40]
sub eax, 0x186aa
cmp dword [ebp - 0xc], eax
jge 0x4209b8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x420991
mov edx, dword [ebp - 0x44]
add edx, 0x76
push edx
mov eax, dword [ebp - 0x48]
sub eax, 0x10d
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0xe5
push ecx
mov edx, dword [ebp - 8]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x4c]
sub eax, 0x16f
push eax
mov ecx, dword [ebp - 0x50]
sub ecx, 0x138
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x2ae
push edx
mov eax, dword [ebp - 8]
add eax, 0x3c
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xb1
push ecx
call fcn.0041e5c0
add esp, 0x24
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
mov esp, ebp
pop ebp
ret
Function at 0x4212c0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x30], 0x290
mov dword [ebp - 0x44], 0xea
mov dword [ebp - 0x3c], 0x397
mov dword [ebp - 0x6c], 0x1ab
mov dword [ebp - 0x70], 0x5d
mov dword [ebp - 0x4c], 0x352
mov dword [ebp - 0x74], 0x1fc
mov dword [ebp - 0x78], 0x39f
mov dword [ebp - 0x48], 0x157
mov dword [ebp - 0x10], 0x359
mov dword [ebp - 0x7c], 0x36
mov dword [ebp - 0x58], 0x32
mov dword [ebp - 0x80], 0x234
mov dword [ebp - 0x84], 0x367
mov dword [ebp - 0x88], 0x126
mov dword [ebp - 0x14], 0x1a1
mov dword [ebp - 0x64], 0x30b
mov dword [ebp - 0x68], 0x3de
mov dword [ebp - 4], 0x39
mov dword [ebp - 8], 0x185
mov dword [ebp - 0x38], 0x1aa
mov dword [ebp - 0x40], 0x3a0
mov dword [ebp - 0x34], 0x34
mov dword [ebp - 0x18], 0xcb
mov dword [ebp - 0xc], 0
jmp 0x421389
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x18a37
cmp dword [ebp - 0xc], ecx
jge 0x4213a8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 8]
sub edx, 1
mov dword [ebp + 8], edx
jmp 0x421380
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 4]
jge 0x4213c2
mov dword [ebp - 0x20], 1
jmp 0x4213c9
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x48]
jge 0x4213da
mov dword [ebp - 0x1c], 1
jmp 0x4213e1
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x4c]
jge 0x4213f2
mov dword [ebp - 0x24], 1
jmp 0x4213f9
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 8]
or edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x24]
je 0x42149e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x54]
jge 0x42149e
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x60]
jge 0x421457
mov dword [ebp - 0x28], 1
jmp 0x42145e
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jge 0x42146f
mov dword [ebp - 0x2c], 1
jmp 0x421476
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x64]
or eax, ecx
je 0x42149e
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x68]
and edx, dword [ebp - 0x34]
and edx, dword [ebp + 0x10]
je 0x42149e
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
mov esp, ebp
pop ebp
ret
Function at 0x422a70
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x5c], 0x33e
mov dword [ebp - 0x58], 0x330
mov dword [ebp - 0x2c], 0x42
mov dword [ebp - 0x40], 0x1c5
mov dword [ebp - 0x44], 0x32
mov dword [ebp - 0x6c], 0x31
mov dword [ebp - 0x18], 0x144
mov dword [ebp - 0x50], 0x284
mov dword [ebp - 0x54], 0x127
mov dword [ebp - 0x64], 0x174
mov dword [ebp - 0x3c], 0x147
mov dword [ebp - 4], 0x242
mov dword [ebp - 0x70], 0x121
mov dword [ebp - 0x10], 0x32d
mov dword [ebp - 0x1c], 0x345
mov dword [ebp - 0x74], 0x5a
mov dword [ebp - 0x4c], 0x2df
mov dword [ebp - 0x78], 0x2f
mov dword [ebp - 0x68], 0x1b4
mov dword [ebp - 0x60], 0x2bb
mov dword [ebp - 0x30], 0x2c7
mov dword [ebp - 0x48], 0xa
mov dword [ebp - 0xc], 0x3aa
mov dword [ebp - 0x7c], 0x1ff
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x30]
jge 0x422b32
mov dword [ebp - 0x28], 1
jmp 0x422b39
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x48]
jge 0x422b4a
mov dword [ebp - 0x20], 1
jmp 0x422b51
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0x18]
jge 0x422b62
mov dword [ebp - 0x24], 1
jmp 0x422b69
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x28]
je 0x422bc9
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 4]
jge 0x422b8e
mov dword [ebp - 0x34], 1
jmp 0x422b95
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x50]
or eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0xc]
jge 0x422ba9
mov dword [ebp - 0x38], 1
jmp 0x422bb0
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x38]
or ecx, edx
je 0x422bc9
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 8], 0
jmp 0x422bdb
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x54]
sub edx, 0x187c7
cmp dword [ebp - 8], edx
jge 0x422bfa
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x422bd2
mov ecx, dword [ebp - 0x58]
sub ecx, 0xf0
push ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x28f
push edx
mov eax, dword [ebp - 0x5c]
sub eax, 0x32d
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x2b1
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x65
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x340
push eax
mov ecx, dword [ebp - 0x60]
sub ecx, 0x1d4
push ecx
mov edx, dword [ebp - 0x64]
add edx, 0x13
push edx
call fcn.00421080
add esp, 0x20
mov dword [ebp - 0x14], 0
jmp 0x422c5c
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x68]
sub ecx, 0x1b3
cmp dword [ebp - 0x14], ecx
jge 0x422c7d
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x40]
je 0x422c7b
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x422c53
mov esp, ebp
pop ebp
ret
Function at 0x4245e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x18], 0x1f
mov dword [ebp - 0x1c], 0x3b5
mov dword [ebp - 0x20], 0x3d1
mov dword [ebp - 0x10], 0x32f
mov dword [ebp - 0x24], 0x2f
mov dword [ebp - 0x28], 0x3c4
mov dword [ebp - 0x2c], 0x2b4
mov dword [ebp - 0x30], 0x1f5
mov dword [ebp - 0x34], 0x30d
mov dword [ebp - 0x38], 0x144
mov dword [ebp - 0x3c], 0x15c
mov dword [ebp - 0x40], 0x3d1
mov dword [ebp - 0x14], 0x366
mov dword [ebp - 0x44], 0xf3
mov dword [ebp - 0x48], 0x2d5
mov dword [ebp - 0x4c], 0x3cd
mov dword [ebp - 0x50], 0x1cb
mov dword [ebp - 0xc], 0x1e9
mov dword [ebp - 0x54], 0x3bc
mov dword [ebp - 8], 0x19b
mov dword [ebp - 0x58], 0x22b
mov dword [ebp - 0x5c], 0x24
mov eax, dword [ebp - 8]
sub eax, 0x95
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x73
push ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x302
push edx
call fcn.0040f6c0
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4246b4
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x18a06
cmp dword [ebp - 4], ecx
jge 0x4246d3
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp + 0x14]
sub edx, 1
mov dword [ebp + 0x14], edx
jmp 0x4246ab
mov esp, ebp
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x10001000
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x54
sub eax, 1
jne 0x10001029
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x5c], 4
je 0x10001034
mov eax, 1
add esp, 0x54
ret 0xc
push ebx
mov ebx, dword [eax + 0xc]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax + 8]
push 0x40
lea ecx, [esp + 0x24]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100010a4
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
push 0xffffffffffffffbb
call dword [sym.imp.KERNEL32.dll_ExitProcess]