joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41b050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x41e520]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax + 0xe0]
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0x28
test esi, esi
jne 0x404abc
push str.Advapi32.dll
mov dword [ebp - 0x10], esi
call dword [0x41e57c]
test eax, eax
je 0x404aaf
lea ecx, [ebp - 0x10]
push ecx
mov edx, 0xabcb0a67
mov ecx, eax
call fcn.004019e0
mov esi, dword [ebp - 0x10]
sub esi, 2
mov dword [ebp - 0x10], esi
jmp 0x404ab1
xor esi, esi
mov eax, dword [0x41e520]
mov dword [eax + 0xe0], esi
lea edi, [ebx + 0x58]
push edi
push 0x20
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x404ae0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ae85
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x41e520]
mov ecx, dword [eax + 0xe0]
test ecx, ecx
jne 0x404b29
push str.Advapi32.dll
mov dword [ebp - 0xc], ecx
call dword [0x41e57c]
test eax, eax
je 0x404b1c
lea ecx, [ebp - 0xc]
push ecx
mov edx, 0xabcb0a67
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0xc]
sub ecx, 2
mov dword [ebp - 0xc], ecx
jmp 0x404b1e
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0xe0], ecx
lea esi, [ebx + 0x50]
push esi
push 8
push dword [ebp - 0x14]
call ecx
test eax, eax
je 0x404acb
mov ecx, 0x40
lea eax, [ebx + 0x10]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x404b40
mov eax, dword [edi]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x38], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x10], 0x61707865
mov dword [ebx + 0x14], 0x3320646e
mov dword [ebx + 0x18], 0x79622d32
mov dword [ebx + 0x1c], 0x6b206574
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x44], ecx
mov eax, dword [esi]
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 4]
lea edx, [ebx + 0x78]
mov dword [ebx + 0x4c], eax
mov ecx, 8
sub edx, edi
nop
mov eax, dword [edi]
mov dword [edx + edi], eax
lea edi, [edi + 4]
dec ecx
jne 0x404bb0
lea edx, [ebx + 0x98]
mov ecx, 2
sub edx, esi
mov eax, dword [esi]
mov dword [edx + esi], eax
lea esi, [esi + 4]
dec ecx
jne 0x404bc8
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 0x78]
push eax
sub esp, 8
call fcn.004031b0
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0040ae85
mov esp, ebp
pop ebp
ret 4
Function at 0x408e10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x41b050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x408fab
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
jne 0x408ea7
mov eax, dword [0x41e520]
mov ecx, dword [eax + 0x48]
test ecx, ecx
jne 0x408fa8
push str.Kernel32.dll
mov dword [ebp - 0x234], ecx
call dword [0x41e57c]
test eax, eax
je 0x408f9e
lea ecx, [ebp - 0x234]
push ecx
mov edx, 0xa5eb6e47
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x234]
sub ecx, 2
mov dword [ebp - 0x234], ecx
jmp 0x408fa0
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Process32NextW]
mov edi, edi
mov eax, dword [0x41e520]
mov ecx, dword [eax + 0x70]
test ecx, ecx
jne 0x408eff
push str.Kernel32.dll
mov dword [ebp - 0x234], ecx
call dword [0x41e57c]
test eax, eax
je 0x408ef5
lea ecx, [ebp - 0x234]
push ecx
mov edx, 0xd72e57a9
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x234]
sub ecx, 2
mov dword [ebp - 0x234], ecx
jmp 0x408ef7
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0x70], ecx
push str.explorer.exe
lea eax, [ebp - 0x20c]
push eax
call ecx
test eax, eax
jne 0x408f46
push 4
call fcn.0040b4e4
mov edx, eax
add esp, 4
test edx, edx
je 0x408f58
mov dword [edx], 0
mov ecx, dword [ebp - 0x228]
mov dword [edx], ecx
lea ecx, [edx + 4]
mov dword [ecx], 0
mov eax, dword [edi + 4]
mov dword [edx + 8], eax
mov eax, dword [edi + 4]
mov dword [eax], edx
mov dword [edi + 4], ecx
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x408eb0
mov eax, dword [0x41e520]
pop ebx
mov ecx, dword [eax + 0x48]
test ecx, ecx
jne 0x408fa8
push str.Kernel32.dll
mov dword [ebp - 0x238], ecx
call dword [0x41e57c]
test eax, eax
je 0x408f9e
lea ecx, [ebp - 0x238]
push ecx
mov edx, 0xa5eb6e47
mov ecx, eax
call fcn.004019e0
mov ecx, dword [ebp - 0x238]
sub ecx, 2
mov dword [ebp - 0x238], ecx
jmp 0x408fa0
xor ecx, ecx
mov eax, dword [0x41e520]
mov dword [eax + 0x48], ecx
push esi
call ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ae85
mov esp, ebp
pop ebp
ret
Function at 0x40e96a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040c6bb
mov dword [ebp - 0x14], eax
cmp dword [0x41e4b4], edi
jne 0x40ea5b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40e9e8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x57
jne 0x40eb3b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40eb3b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40eb3b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x41e4b4], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41e4b8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x41e4bc], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x41e4c4], eax
test eax, eax
je 0x40ea58
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x41e4c0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
je 0x40ea80
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ea73
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40ea95
push 4
pop eax
jmp 0x40eb3d
cmp dword [ebp - 0x14], edi
je 0x40ea95
push dword [0x41e4b4]
call dword [sym.imp.KERNEL32.DLL_DecodePointer]
push 3
jmp 0x40ea7a
mov eax, dword [0x41e4c0]
mov ebx, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, esi
je 0x40eaf3
cmp dword [0x41e4c4], esi
je 0x40eaf3
push eax
call ebx
push dword [0x41e4c4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40eaf3
test eax, eax
je 0x40eaf3
call ecx
test eax, eax
je 0x40eae8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40eae8
test byte [ebp - 8], 1
jne 0x40eaf3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40eb23
mov eax, dword [0x41e4b8]
cmp eax, esi
je 0x40eb20
push eax
call ebx
test eax, eax
je 0x40eb20
call eax
mov edi, eax
test edi, edi
je 0x40eb20
mov eax, dword [0x41e4bc]
cmp eax, esi
je 0x40eb20
push eax
call ebx
test eax, eax
je 0x40eb20
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x41e4b4]
call ebx
test eax, eax
je 0x40eb3b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40eb3d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ae85
leave
ret
Function at 0x591b9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004048f8
xor eax, eax
push ebp
push 0x591c67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409a0c
test al, al
je 0x591c49
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409ee4
mov eax, dword [ebp - 0x10]
mov edx, 0x591c80
call fcn.00404854
jne 0x591c49
mov dl, 1
mov eax, dword [0x4bf170]
call fcn.004c43f0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x591c42
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [ebx + 0x678]
mov eax, dword [eax + 0x30]
xor edx, edx
call fcn.004ca1b4
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591c49
mov eax, dword [ebp - 0xc]
call fcn.00403634
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591c6e
lea eax, [ebp - 0x10]
call fcn.00404448
lea eax, [ebp - 4]
call fcn.00404448
ret
Function at 0x404a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x404b26
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x404b15
jg 0x404a80
test edx, edx
je 0x404b15
nop dword [eax]
call fcn.004063a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404ad4
jg 0x404a97
test esi, esi
je 0x404ad4
cmp ebx, eax
jg 0x404aa7
jl 0x404aa1
cmp edi, esi
jae 0x404aa7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00409730
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x404af9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x404b0f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x404a80
jl 0x404b0f
test edi, edi
jne 0x404a80
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x404b48
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x404b4a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x404bc8
jg 0x404b5d
test esi, esi
je 0x404bc8
test eax, eax
jl 0x404bac
jg 0x404b67
test ebx, ebx
je 0x404bac
cmp edi, eax
jg 0x404b77
jl 0x404b71
cmp esi, ebx
jae 0x404b77
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00409730
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x404bc8
jg 0x404baf
test esi, esi
je 0x404bc8
jmp 0x404baf
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x404bc8
push eax
push esi
push 1
push edx
call fcn.0040d626
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404be0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x404c12
jl 0x404c05
test ecx, ecx
jne 0x404c12
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404cd2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.004063c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404c7e
jg 0x404c3d
test esi, esi
je 0x404c7e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x404c55
mov eax, dword [esp + 0x10]
jl 0x404c4f
cmp eax, esi
jae 0x404c55
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00409730
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x404c9f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x404cbb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x404c24
jl 0x404cbb
test ecx, ecx
jne 0x404c24
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x404d11
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x404d11
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00409730
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x404d80
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x404d37
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x404d69
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040dc7d
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x404d94
cmp edi, eax
ja 0x404d45
test ecx, ecx
je 0x404d80
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040dc7d
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x439008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x405130
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40516c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40516c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405254
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x405194
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4051c7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040c50e
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x405227
sub eax, 1
je 0x405227
sub eax, 2
jne 0x405254
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0040c50e
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405244
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040d626
add esp, 0x10
cmp edi, eax
jne 0x405254
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x405157
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407330
mov esp, ebp
pop ebp
ret 4
Function at 0x4060d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x439008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40618a
cmp byte [esi + 0x3d], 0
je 0x40618a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x406178
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x406140
sub eax, 1
je 0x406144
sub eax, 2
jne 0x406178
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406161
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040d626
add esp, 0x10
cmp edi, eax
jne 0x406178
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407330
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00407330
mov esp, ebp
pop ebp
ret

Function at 0x4067a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4290d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x439008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00407540
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040831e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4195dd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419453

Function at 0x41e5bc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e10f

Function at 0x438ca9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x438a14
sub eax, edx
call fcn.00438ccc
dec eax
xor dword [ecx], esi
add edx, 1
inc ecx
inc edx
cmp ecx, ebx
jne fcn.00438ca9
mov edx, edx
or eax, eax
dec eax
ret
Function at 0x4011c7
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13a4
call fcn.00447310
mov eax, dword [0x479060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x13a4], eax
mov esi, ebx
push edi
mov edi, ecx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4011f3
sub esi, ecx
cmp esi, 0x139c
jb 0x401219
push 0x9d
mov edx, 0x475cf8
mov ecx, str.Assertion_failed__tcslen_pMsgFormat____sizeof_pTempBuffer_
call fcn.004013ec
pop ecx
xor esi, esi
cmp edi, 2
jne 0x401254
push dword [0x47c1dc]
lea eax, [ebp - 0x13a0]
push dword [0x47c1d8]
push str._s___d__:
push 0x139b
push eax
call fcn.0040153d
mov esi, eax
add esp, 0x14
cmp esi, 0xffffffff
jne 0x401254
push 2
pop eax
jmp 0x401327
push dword [ebp - 0x13a4]
mov eax, 0x139b
push 0
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x13a0]
add eax, esi
push eax
call fcn.0040150b
add esp, 0x14
cmp eax, 0xffffffff
je 0x40124c
add esi, eax
cmp esi, 0x139c
jb 0x40129a
push 0xb5
mov edx, 0x475cf8
mov ecx, str.Assertion_failed_len__sizeof_pMsgFormat____sizeof_pTempBuffer_
call fcn.004013ec
pop ecx
cmp edi, 2
jne 0x4012c3
lea eax, [ebp - 0x13a0]
add eax, esi
push 0x475e2c
push eax
call fcn.004014f0
pop ecx
add esi, eax
lea eax, [ebp - 0x13a0]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 0x139b
jb 0x4012e0
push 0xc1
mov edx, 0x475cf8
mov ecx, str.Assertion_failed__uint32_t_len____sizeof_pTempBuffer____sizeof_pTempBuffer_0_____1_
call fcn.004013ec
pop ecx
lea eax, [ebp - 0x13a0]
push eax
push 0x475d40
call fcn.0040155f
pop ecx
xor ebx, ebx
pop ecx
cmp edi, 2
je 0x401301
cmp edi, 3
sete bl
inc ebx
mov eax, ebx
sub eax, 0
je 0x40131f
dec eax
sub eax, 1
jne 0x401325
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x401325
cmp edi, 2
je 0x401325
int3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004465ce
mov esp, ebp
pop ebp
ret