joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438de8
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8f8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x704], edx
mov dword [ebp - 0x708], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x438fbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov edi, 1
mov bl, 1
lea edx, [ebp - 0x704]
mov eax, dword [0x454da4]
call fcn.00427e90
mov eax, dword [ebp - 0x704]
push eax
lea eax, [ebp - 0x708]
mov edx, edi
add dl, 0x30
call fcn.004256f0
mov ecx, dword [ebp - 0x708]
lea eax, [ebp - 0x14]
pop edx
call fcn.004257e4
mov eax, dword [ebp - 0x14]
call fcn.00425998
push eax
push 0
push 4
call sub.KERNEL32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x438f78
push 0
push 0
push 0
push 4
push esi
call sub.KERNEL32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x438f72
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x438ea9
cmp eax, dword [esp]
pop edx
pop eax
jne 0x438f69
xor ebx, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x438f69
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x438f1d
imul eax, dword [ebp - 8], 0x8f
mov edx, dword [ebp - 0x10]
push esi
push edi
lea esi, [edx + eax*8 + 0xc]
lea edi, [ebp - 0x700]
mov ecx, 0x11e
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp word [ebp - 0x700], 0
jne 0x438f06
mov bl, 1
jmp 0x438f69
lea eax, [ebp - 0x700]
push eax
call sub.KERNEL32.dll_GetModuleHandleW
cmp eax, dword [ebp - 4]
jne 0x438f5d
mov byte [ebp - 9], 1
jmp 0x438f69
imul eax, dword [ebp - 8], 0x4e
mov edx, dword [ebp - 0x10]
push esi
push edi
lea esi, [edx + eax*8 + 0xc]
lea edi, [ebp - 0x288]
mov ecx, 0x9c
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp byte [ebp - 0x288], 0
jne 0x438f46
mov bl, 1
jmp 0x438f69
lea eax, [ebp - 0x288]
push eax
call sub.KERNEL32.dll_GetModuleHandleA
cmp eax, dword [ebp - 4]
jne 0x438f5d
mov byte [ebp - 9], 1
jmp 0x438f69
inc dword [ebp - 8]
dec dword [ebp - 0x18]
jne 0x438ecd
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_UnmapViewOfFile
push esi
call sub.KERNEL32.dll_CloseHandle
or bl, byte [ebp - 9]
jne 0x438f87
inc edi
cmp edi, 0xa
jne 0x438e1f
cmp byte [ebp - 9], 0
jne 0x438f97
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00438cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438fc4
lea eax, [ebp - 0x708]
mov edx, 2
call fcn.0042552c
lea eax, [ebp - 0x14]
call fcn.00425508
ret
Function at 0x4396e8
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x43973c
push esi
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x439725
test ebx, ebx
je 0x43971d
push ebx
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x43971d
push ebx
push esi
call sub.ADVAPI32.dll_EqualSid
test eax, eax
jne 0x439721
xor eax, eax
jmp 0x43973e
mov al, 1
jmp 0x43973e
test ebx, ebx
je 0x439737
push ebx
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x439737
xor eax, eax
jmp 0x43973e
mov al, 1
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret
Function at 0x439ee4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
push ebp
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00439c28
pop ecx
test al, al
jne 0x43a00c
push 0x104
lea eax, [ebp - 0x111]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.00439c28
pop ecx
test al, al
jne 0x43a00c
push 0x104
lea eax, [ebp - 0x111]
push eax
mov eax, dword [0x456658]
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x104
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [0x456658]
push eax
call sub.KERNEL32.dll_GetModuleFileNameW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
mov cl, 1
call fcn.00439c28
pop ecx
test al, al
jne 0x43a00c
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x31c]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.00439c28
pop ecx
test al, al
jne 0x43a00c
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x104
lea eax, [ebp - 0x31c]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push ebp
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x111]
xor ecx, ecx
call fcn.00439c28
pop ecx
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43a6a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 8], 0
je 0x43a6cf
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
push ebx
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x43a6e3
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
jne 0x43a6e7
xor eax, eax
jmp 0x43a6e9
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x43a858
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
je 0x43a8ef
push 2
lea ecx, [ebp - 2]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0043a678
test al, al
je 0x43a8ef
cmp word [ebp - 2], 0x5a4d
jne 0x43a8ef
push 4
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0043a678
test al, al
je 0x43a8ef
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0043a678
test al, al
je 0x43a8ef
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax], 0x4550
jne 0x43a8ef
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test byte [eax + 0x17], 0x20
je 0x43a8f3
xor eax, eax
jmp 0x43a8f5
mov al, 1
test al, al
je 0x43a912
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
movzx ecx, word [ebp - 2]
add edx, ecx
add edx, 0x78
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [ecx], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43c1d8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov byte [ebp - 1], 0
push ebx
mov eax, dword [esi]
push eax
call fcn.0042c9bc
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x149
push esi
push edi
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x43c326
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
mov eax, edi
add eax, 0x149
push eax
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x43c326
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
mov eax, edi
add eax, 0x149
mov edx, dword [ebp + 0xc]
add eax, dword [edx + 0xc]
push eax
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x43c326
cmp dword [esi + 0x20], 0
je 0x43c2a1
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x16]
push eax
mov eax, dword [esi + 0x20]
push eax
push ebx
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x43c326
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x16]
push eax
lea eax, [edi + 0x24]
push eax
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x43c326
mov byte [ebp - 1], 1
cmp dword [esi + 0x145], 0
je 0x43c326
lea eax, [ebp - 8]
push eax
push 5
lea eax, [ebp - 0x16]
push eax
mov eax, dword [esi + 0x145]
dec eax
push eax
push ebx
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x43c326
cmp byte [ebp - 0x16], 0xe8
jne 0x43c326
lea eax, [edi + 0x3c]
sub eax, dword [esi + 0x145]
sub eax, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
mov eax, dword [esi + 0x145]
push eax
push ebx
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x43c326
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x145]
push eax
push ebx
call sub.KERNEL32.dll_WriteProcessMemory
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 4
mov eax, dword [esi + 0x145]
push eax
push ebx
call sub.KERNEL32.dll_VirtualProtectEx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43cbe8
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
push 1
push 1
mov ecx, dword [ebp - 0x10]
xor edx, edx
call fcn.0043c334
mov ebx, eax
test bl, bl
je 0x43cc2d
test esi, 4
jne 0x43cc38
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_ResumeThread
jmp 0x43cc38
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e600
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x43e6dd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45525c], 0
jne 0x43e6a9
lea edx, [ebp - 8]
mov eax, dword [0x454de0]
call fcn.00427e90
push dword [ebp - 8]
lea edx, [ebp - 0xc]
mov eax, dword [0x454de8]
call fcn.00427e90
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00427b38
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00425858
mov eax, dword [ebp - 4]
call fcn.00425998
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x45525c], eax
mov eax, dword [0x45525c]
xor edx, edx
mov dword [eax], edx
push ebx
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x45525c], 0
je 0x43e6c0
mov eax, dword [0x45525c]
call fcn.0043e5f0
mov ebx, eax
jmp 0x43e6c2
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e6e4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0042552c
ret

Function at 0x43eeac
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x43ef51
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x150]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.00425700
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
xor ecx, ecx
call fcn.0043d360
mov ebx, eax
test bl, bl
je 0x43ef38
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ef58
lea eax, [ebp - 0x150]
call fcn.00425508
ret
Function at 0x43f17c
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x43f352
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x43f337
xor eax, eax
push ebp
push 0x43f330
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x43f319
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x43f313
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x454d40]
call fcn.00427e90
mov eax, dword [ebp - 0x24]
call fcn.00425998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x43f247
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x454d44]
call fcn.00427e90
mov eax, dword [ebp - 0x28]
call fcn.00425998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x43f27a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x454d48]
call fcn.00427e90
mov eax, dword [ebp - 0x2c]
call fcn.00425998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x43f2ad
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x43f2ff
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x43f2ca
cmp eax, dword [ebp - 0x10]
je 0x43f2fb
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x43f2df
cmp eax, dword [ebp - 0x18]
je 0x43f2fb
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x43f2f4
cmp eax, dword [ebp - 0x20]
je 0x43f2fb
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x43f2b7
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f337
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f359
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0042552c
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4062ca
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
nop
inc ecx
mov edi, ebx
xor edi, 0xffffffff
and edi, 0x1ba8a518
and ebx, 0xe4575ae7
or ebx, edi
pop ecx
xor ebx, ecx
mov esi, 4
sub esp, esi
mov esi, esp
mov edx, esi
mov dword [edx], ebx
mov ecx, 0x641227a1
mov ebx, 0x641227a1
xor ebx, ecx
xor ebx, esp
mov ecx, 0x26940a10
xor ecx, 0x26940a14
sub esp, ecx
mov dword [esp], ebx
mov esi, 0x7d6f3981
xor esi, 0x6c7a36ef
push esi
mov edi, 0x6759c3c0
xor edi, 0x32d46a7b
pop edx
xor edi, edx
mov esi, edi
add esp, 0xfffffffc
mov dword [esp], esi
mov edx, 0x5f5b8ca8
xor edx, 0xd12203d
mov ebx, 0x149c6683
xor ebx, 0x24d6c83
xor ebx, edx
pop ecx
xor ebx, ecx
mov edx, 0
xor edx, ebx
mov esi, 0xfffffffc
add esp, esi
mov dword [esp], edx
mov ebx, 0x4ce795e4
mov esi, 0x4ce7b0e4
xor esi, ebx
mov edi, 0x6799416b
xor edi, 0x6e8953ab
xor esi, edi
mov ecx, 0
xor ecx, esi
mov ebx, ecx
xor ebx, 0xffffffff
and ebx, 0xffffffff
and ecx, 0
or ecx, ebx
and ecx, 0x910a3c0
and esi, 0xf6ef5c3f
or esi, ecx
mov edi, esi
mov edx, edi
mov ebx, 0xfffffffc
add esp, ebx
mov dword [esp], edx
mov ecx, 0x74d3fb4
mov ebx, 0xa0fc0e2
xor ebx, ecx
mov edx, 0x7d259d25
xor ebx, edx
mov edx, 0x6d5a0dd0
mov ecx, 0x6b3d5a5d
xor ecx, edx
xor ebx, ecx
mov edx, 0xb949270
xor ebx, edx
xor ebx, 0x7dd4b78e
mov edi, 0xfffffffc
add esp, edi
mov esi, esp
mov dword [esi], ebx
call eax
pop eax
mov edx, 0x67a82631
mov edi, 0x8119902
xor edx, edi
push edx
mov edx, 0x6b7b73b8
mov ebx, 0x65c615db
xor ebx, edx
pop eax
xor ebx, eax
mov edx, ebx
push edx
mov edx, 0xca00045
mov eax, 0x22081aa8
xor edx, eax
push 0x22403d66
mov ecx, 0x6decfdfe
pop ebx
xor ecx, ebx
xor ecx, edx
pop esi
xor ecx, esi
mov esi, 0x4195c646
mov ebx, 0x17aab8d1
xor ebx, esi
mov esi, ebx
xor esi, 0xffffffff
and esi, 0x25db094b
and ebx, 0xda24f6b4
or ebx, esi
mov esi, 0x6d1a8c36
xor esi, 0x7880fe65
push 0x1d3a2580
mov edx, 0x7b0440e9
pop edi
xor edx, edi
xor edx, esi
xor edx, ebx
mov esi, 0x486080
mov eax, 0x73871a40
xor esi, eax
push esi
mov edi, 0xff07a2b
xor edi, 0x7ef28a39
push 0xd65b14c
mov esi, 0xfe8b74c
pop eax
xor esi, eax
xor edi, esi
pop ebx
xor edi, ebx
mov ebx, 0x216e2855
mov eax, 0x216e2855
xor eax, ebx
xor eax, ecx
mov ebx, 4
mov esi, 0
xor ebx, esi
sub esp, ebx
mov dword [esp], eax
mov esi, edi
mov eax, 0
xor eax, esi
mov ebx, eax
push ebx
xor ecx, ecx
mov cl, byte [edx]
add edi, ecx
mov cl, byte [edi]
pop edi
mov byte [edx], cl
push 0x41e214fe
mov esi, 0x42b2e2de
pop ebx
xor esi, ebx
mov ebx, 0x74cf70f1
mov eax, 0x8860792e
xor eax, ebx
xor esi, eax
add edx, esi
pop ecx
mov esi, 0xb7ff2a7
mov ebx, 0xf4800d58
xor esi, ebx
add ecx, esi
test ecx, ecx
jne 0x406492
mov eax, 0x35cdf973
xor eax, 0x164f0277
mov ebx, 0x7f9fd438
xor eax, ebx
mov esi, eax
mov ebx, esi
mov edx, ebx
xor edx, 0xffffffff
and edx, 0xffffffff
and ebx, 0
or ebx, edx
and ebx, 0x5c5d72fe
and eax, 0xa3a28d01
or eax, ebx
call eax
pop ecx
pop ecx
ret
Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x406ca4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dd0
add esp, 0x104
pop ebx
ret
Function at 0x40225e
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040240e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40235c
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4022ff
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x402342
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x402316
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x402331
test al, 0x40
je 0x402328
mov ecx, dword [edi + 0x20]
jmp 0x40232f
test al, 0x80
je 0x402342
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x402342
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4022ce
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret