joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401571
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x41d040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x472e50]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4015d8
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00401803
lea ecx, [esp + 0x1c]
call fcn.0040133b
cmp eax, dword [esp + 0x14]
je 0x4015f0
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00401834
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x4015a8
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004025da
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00401834
jmp 0x4015da

Function at 0x401673
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
sub cx, 0x1f9
mul edi
dec cx
mul di
mul ebx
sub ax, 0x22b
or edi, ebx
shr cx, 2
rcl eax, 0x6e
rol ax, 0x19
rcl cx, 0xcb
mul si
mov si, 0x1b0
rcr esi, 0xed
inc si
dec dx
movsx ebx, si
movsx ecx, si
rcl cx, 0x33
mov edx, esi
shr ax, 0xb9
dec cx
ja 0x4016cf
test edx, 0x43
ja 0x4016f0
dec bx
imul eax
jmp 0x4016df
rol bx, 0x64
sub di, cx
ror esi, 0x18
ror ecx, 0xef
movsx ebx, bx
rcl eax, 0x5b
mul esi
jae 0x4016f0
inc ax
movsx ecx, si
rcr ebx, 0x8e
jmp 0x40170b
and ecx, 0x33b
ror edx, 0x56
rcr di, 0xc6
or esi, 0x389
movzx edi, ax
movsx edi, si
imul edx
mul cx
ror ax, 0x4e
sub ebx, 0xb9
rcl cx, 0x60
jb 0x40172a
imul si
mul eax
inc esi
xor bx, dx
inc ebx
jmp 0x40173c
mul eax
add eax, edi
mov ax, 0x2a4
mul ebx
ror edi, 0xfc
xor di, 0xdb
movsx ecx, di
dec bx
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x472e50], eax
push 0x27
mov esi, 0x471b80
mov edx, 0x547
push 0x41d950
mov ecx, esi
call fcn.00401134
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.00401571
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x4017ed
push 4
call fcn.004025e8
pop ecx
lea ecx, [ebp - 8]
xor esi, esi
push ecx
push esi
push eax
push 0x401a9a
push esi
push esi
mov dword [eax], 0x40160e
call fcn.004059fb
add esp, 0x18
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4017e6
cmp dword [ebp - 8], esi
je 0x4017f6
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [ebp - 8], eax
jne 0x4017cf
push 5
jmp 0x4017f8
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004022f8
add esp, 0xc
test eax, eax
je 0x4017ed
push 2
jmp 0x4017f8
mov dword [ebp - 8], esi
push 6
jmp 0x4017f8
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
push 1
call fcn.00402015
int3
Function at 0x484ce6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x484a08
or edx, edx
mov edx, edx
sub edx, 0x6ba2c024
call fcn.00484d2b
or edx, edx
xor dword [esi], ecx
sub edi, 0x5c3305fc
mov edx, 0xb7f2af64
add esi, 2
mov edx, edi
cmp esi, ebx
jl fcn.00484ce6
add edi, 0x3d3ea237
mov edi, edx
ret

Function at 0x401020
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], 0x22
jne 0x4010b0
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x401053
cmp ax, 0x22
je 0x401059
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401041
cmp word [esi], 0x22
jne 0x40105c
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x401076
cmp ax, 0x20
ja 0x401076
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401064
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
movzx eax, word [ebp - 0x14]
jne 0x401096
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp word [esi], 0x20
jbe 0x40105c
add esi, 2
jmp 0x4010b0
Function at 0x404476
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 4
pop edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push 0x2000000
push 0
push 0x401e58
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x4044e1
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x401e4c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4044e1
cmp dword [ebp - 8], edi
jne 0x4044e1
mov eax, dword [ebp - 0x10]
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x4044dc
Function at 0x4056ae
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x1a
mov edi, ecx
mov ecx, dword [edx + 0x20]
pop eax
mov word [ebp - 4], ax
test ecx, ecx
je 0x4056e1
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x41965f
inc dword [0x42d56c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, edx
jmp 0x4056c7
call fcn.004284d3
test eax, eax
je 0x41968d
mov ecx, esi
call fcn.00410178
test eax, eax
jne 0x41968d
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test edi, edi
je 0x4196cd
test byte [edi + 0x1c], 0x80
jne 0x4196cd
mov ecx, esi
call fcn.00410178
test eax, eax
jne 0x4196cd
mov eax, dword [0x42d55c]
cmp eax, 3
je 0x4196cd
cmp dword [ebp + 0xc], 0
je 0x4196cd
cmp eax, 2
je 0x4196cd
push dword [ebp + 0xc]
push 0
push 0
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
mov ecx, esi
call fcn.0040db92
jmp 0x4056d3

Function at 0x405712
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push eax
push edi
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [0x42d5cc], eax
push ebx
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x41974a
mov ecx, dword [edi]
test ecx, ecx
je 0x4196fe
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
test eax, 0xc000
je 0x40577c
mov ecx, 0x8002
and eax, ecx
cmp eax, ecx
je 0x419722
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp ecx, 2
jb 0x40578b
mov ecx, 0xfeff
cmp word [ebx], cx
je 0x405795
or eax, 0x8000
mov dword [edx + 0x1c], eax
jmp 0x405761
or eax, 0x4000
jmp 0x405790
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e3
je 0x41974a
mov ecx, dword [edi]
test ecx, ecx
jne 0x405754
and dword [0x443cf0], ecx
xor eax, eax
jmp 0x405773
mov esi, dword [edi]
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, ebx
push edi
inc ecx
call fcn.00426cef
cmp esi, dword [edi]
je 0x405770
mov dword [0x42d5cc], 1
jmp 0x405770
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, esi
mov dword [0x443cf0], eax
call fcn.0040db92
mov ecx, dword [ebp + 0x14]
call fcn.00410178
mov ecx, dword [ebp + 0x14]
mov esi, eax
call fcn.0040db92
test esi, esi
jne 0x41977b
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ecx, dword [0x443cf0]
xor edx, edx
inc edx
call fcn.004285e9
int3
Function at 0x4083f2
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
test edx, 0x400
jne 0x42036d
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
test eax, eax
js 0x42036d
cmp word [ebp - 0x24], di
ja 0x420353
mov eax, edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 0x5040
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push 4
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x18
push eax
push 0x10000
lea eax, [ebp - 4]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x42036d
mov ecx, dword [ebp - 4]
call fcn.004084be
test eax, eax
jne 0x42035e
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x42036d
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
jmp 0x40843b
mov ecx, dword [ebp - 4]
call fcn.00429ab4
mov esi, eax
jmp 0x4084a4
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x4084b5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x4084b5
Function at 0x408885
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x10]
mov edi, ecx
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 4
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
cmp eax, 3
je 0x420633
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
je 0x420650
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00416fd0
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0xa], 0x3a
jne 0x4088b7
cmp word [ebp - 8], 0x5c
jne 0x4088b7
xor eax, eax
jmp 0x4088c8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x4088c6
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4088c6
test al, 1
je 0x4088c6
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
je 0x4088c6
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
je 0x42069e
xor esi, esi
jmp 0x4088c6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
jmp 0x4088c6
Function at 0x40ad44
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x47c
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x478], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x10], esi
push edi
test esi, esi
je 0x40aeac
mov eax, 0x104
mov byte [esp + 0x224], 1
push eax
xor edi, edi
mov dword [esp + 0x22c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x224], edi
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x24]
add esp, 0xc
cmp byte [esp + 0x224], al
sete al
dec eax
and eax, 0xfdc6
add eax, 0x208
push eax
call fcn.00410c70
test eax, eax
js 0x40ae61
mov eax, dword [esp + 0x220]
test eax, eax
je 0x42122a
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x230]
mov ecx, esi
call fcn.004122c0
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
mov ebx, eax
test ebx, ebx
je 0x40ae5f
mov esi, dword [esp + 0x220]
test esi, esi
je 0x421233
push 4
push 0x4025f8
push esi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x42123c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4212a4
cmp word [eax], di
je 0x4212a4
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea eax, [esp + 0x234]
mov ecx, fcn.00416a00
push eax
push edi
push 0x37
call fcn.004168ba
mov ecx, dword [esp + 0x14]
movzx ebx, al
call fcn.0040cd27
test ebx, ebx
je 0x40ae86
mov edi, ebx
push dword [esp + 0x220]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, edi
mov ecx, dword [esp + 0x484]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416fd0
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 2]
push 0x5c
pop ecx
cmp ax, cx
je 0x42128c
cmp eax, 0x3a
jne 0x40ae5f
cmp word [esi + 4], cx
jne 0x40ae5f
cmp word [esi + 6], di
jne 0x40ae5f
jmp 0x42128c
xor eax, eax
jmp 0x40ae71
lea eax, [esp + 0x18]
jmp 0x40add5
lea esi, [esp + 0x18]
jmp 0x40ae05
mov ebx, dword [esp + 0x14]
add esi, 8
push esi
push ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x421275
cmp eax, ebx
jbe 0x421275
movzx esi, word [eax]
xor ecx, ecx
push ebx
mov word [eax], cx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
mov word [ecx], si
jmp 0x42127c
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ae61
mov edi, eax
jmp 0x40ae61
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40ae5f
xor ebx, ebx
inc ebx
jmp 0x40ae5f
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jmp 0x40ae5f
Function at 0x40b2b0
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x21c]
push esi
xor eax, eax
mov dword [ebp - 0x224], ebx
push edi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], eax
call fcn.0040b42e
test eax, eax
js 0x42133e
mov eax, dword [ebp - 0x21c]
cmp eax, 3
jae 0x42139c
test eax, eax
jne 0x42134c
inc eax
mov edi, eax
mov dword [ebp - 0x220], eax
push 0x40002748
mov dword [ebp - 0x22c], edi
call fcn.0040b3fc
mov dword [ebp - 0x218], eax
pop ecx
test eax, eax
je 0x42138b
mov ebx, eax
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x40b338
sub ebx, ecx
sar ebx, 1
cmp ebx, 0x104
jae 0x40b3c8
mov ecx, 0x208
call fcn.004100b0
mov esi, eax
mov dword [ebp - 0x228], esi
test esi, esi
je 0x40b3c8
push dword [ebp - 0x218]
mov edx, 0x104
mov ecx, esi
call fcn.00411040
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x4213a4
cmp dword [eax + 0x3c], 0
je 0x40b3f6
push dword [eax + 0x3c]
mov edx, 0x104
mov ecx, esi
call fcn.004118c0
test eax, eax
jne 0x40b3bd
xor ebx, ebx
test esi, esi
je 0x40b3b1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov byte [0x42d59c], bl
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x220], eax
je 0x40b3c8
test esi, esi
je 0x40b3c8
mov ecx, esi
call fcn.00410040
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x40b3d9
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test edi, edi
jne 0x42138b
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fd0
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov edi, ecx
jmp 0x40b3bd
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test ebx, ebx
je 0x42142c
mov ecx, dword [ebx + 0x3c]
call fcn.0040def9
mov esi, eax
test esi, esi
je 0x40b3b1
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42136d
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jb 0x40b3a0
xor edi, edi
inc edi
xor eax, eax
push eax
push 8
call fcn.0040c5a2
pop ecx
pop ecx
jmp 0x40b3e1
add eax, 0xfffffff0
jmp 0x40b301
lea eax, [ebp - 0x214]
push 0x104
push eax
mov dword [ebp - 0x21c], eax
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
test eax, eax
je 0x40b3bd
push dword [ebp - 0x218]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x42140d
mov edi, dword [ebp - 0x218]
lea esi, [ebp - 0x214]
add ebx, ebx
add esi, ebx
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4213eb
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x228]
push dword [ebp - 0x21c]
mov edx, 0x104
mov ecx, esi
call fcn.004118c0
test eax, eax
jne 0x40b3bd
jmp 0x40b39e
xor ebx, ebx
mov esi, ebx
jmp 0x40b3a0
Function at 0x40b93b
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, dword [esi]
neg esi
sbb esi, esi
and dword [edi], 0
add esi, 3
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
test eax, eax
je 0x41a028
xor eax, eax
inc eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xb7
jne 0x41a072
push 0x400023d4
mov edx, 0x400023d3
mov ecx, ebx
call fcn.00429583
sub eax, 0
je 0x41a06a
dec eax
sub eax, 1
jne 0x41a057
mov eax, dword [ebp + 8]
and dword [eax], 0
or esi, 1
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
jmp 0x40b971
xor eax, eax
inc eax
jmp 0x40b973
xor eax, eax
jmp 0x40b973
Function at 0x40cea9
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x218]
xor edi, edi
mov dword [ebp - 8], esi
push esi
xor ebx, ebx
mov dword [ebp - 0x10], edi
push edi
inc ebx
push eax
mov byte [ebp - 0xc], bl
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x218]
add esp, 0xc
cmp byte [ebp - 0xc], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.00410c70
test eax, eax
js 0x41b419
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41b42a
push dword [ebp - 8]
push eax
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov esi, 0x401f94
mov ecx, esi
call fcn.0040cfbc
test eax, eax
je 0x41b435
mov esi, 0x4021d8
mov ecx, esi
call fcn.0040cfbc
test eax, eax
je 0x41b446
mov esi, 0x401fbc
mov ecx, esi
call fcn.0040cfbc
test eax, eax
je 0x40cfa7
mov ecx, 0x401fa0
call fcn.0040cfbc
test eax, eax
je 0x41b457
mov ecx, 0x401fb0
call fcn.0040cfbc
test eax, eax
jne 0x41b504
mov ecx, dword [0x443cb8]
test ecx, ecx
je 0x40cfb5
mov edx, ebx
call fcn.004133fc
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fd0
mov esp, ebp
pop ebp
ret
mov edx, 0x402620
mov ecx, esi
call fcn.00413a50
jmp 0x40cf57
mov ecx, 0x443ab0
jmp 0x40cf85
push edi
call fcn.00414b60
test eax, eax
je 0x41b419
push ebx
call dword [sym.imp.msvcrt.dll_exit]
lea eax, [ebp - 0x218]
jmp 0x40cf14
mov edx, 0x4024ac
mov ecx, esi
call fcn.00413a50
jmp 0x40cf33
mov edx, 0x403890
mov ecx, esi
call fcn.00413a50
jmp 0x40cf47
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x41b464
lea ecx, [ebp - 0x218]
push 0x2e
pop edx
call fcn.0040d7d4
test eax, eax
jne 0x41b4e8
push 0x4038de
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
mov ecx, dword [ebp - 0x10]
mov esi, ecx
test ecx, ecx
jne 0x41b48b
lea esi, [ebp - 0x218]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x41b48e
sub esi, edx
mov edi, ecx
sar esi, 1
test ecx, ecx
jne 0x41b4ab
lea edi, [ebp - 0x218]
mov ecx, edi
push 0x5c
pop edx
call fcn.00412349
lea ecx, [esi - 1]
lea ecx, [edi + ecx*2]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
je 0x41b4d1
test ecx, ecx
jne 0x41b4ca
lea ecx, [ebp - 0x218]
push 0x4038dc
jmp 0x41b4e0
test ecx, ecx
jne 0x41b4db
lea ecx, [ebp - 0x218]
push 0x4038de
mov edx, dword [ebp - 8]
call fcn.004118c0
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x41b4f5
lea edx, [ebp - 0x218]
mov ecx, 0x401fa0
call fcn.00413a50
jmp 0x40cf69
push 0x403ad4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40cf7b
mov dword [0x44852c], ebx
jmp 0x40cf7b
Function at 0x40cfbc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x42f830
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x42f830], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40cff2
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x443cc9], 0
je 0x40d0ab
push 0x40204c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40d0ef
push 0x402054
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40d0d5
push 0x402090
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40d10d
push 0x402078
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41b525
push 0x40206c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40d0ff
push 0x4020ac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40d0b2
push 0x401fcc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41b530
push 0x401fdc
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41b53c
xor eax, eax
jmp 0x40cfeb
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.004096a0
add eax, eax
cmp eax, 0x4000
jae 0x40d111
xor ecx, ecx
mov word [eax + 0x42f830], cx
jmp 0x40cfe9
push dword [0x43b8b0]
push 0x401f80
push ebx
push edi
call fcn.0041274c
add esp, 0x10
jmp 0x40cfe9
push 0
mov edx, ebx
mov ecx, edi
call fcn.004136cb
jmp 0x40cfe9
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00405aef
jmp 0x40d0be
push 2
jmp 0x40d0db
call fcn.0041711d
int3
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
jmp 0x40cfeb
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x40d0db
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
push dword [esp + 0xc]
jmp 0x40d0db
Function at 0x41100c
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x411026
cmp dword [0x443cc4], 0
je 0x41102d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x443ccc], 0
jne 0x411026
jmp 0x41cdc5
mov ecx, 0x20c
call fcn.004100b0
mov edi, eax
test edi, edi
je 0x411026
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
mov edx, eax
test edx, edx
je 0x411026
and dword [ebp - 8], 0
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41cdf8
mov eax, dword [0x42d570]
sub ecx, esi
sar ecx, 1
add edx, 0xa
add eax, ecx
mov ecx, edi
add eax, edx
mov dword [ebp - 4], eax
lea edx, [eax + eax]
call fcn.00410100
mov esi, eax
test esi, esi
je 0x41ce87
cmp byte [0x42d59c], 0
mov edi, esi
mov edx, dword [ebp - 4]
je 0x41ce47
mov eax, dword [0x42d570]
sub edx, eax
push ebx
lea ecx, [esi + eax*2]
call fcn.00411040
jmp 0x41ce80
push 0x403d7c
mov ecx, esi
call fcn.004118c0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41ce58
sub ecx, edx
mov edx, dword [ebp - 4]
sar ecx, 1
mov dword [0x42d570], ecx
mov ecx, esi
push ebx
call fcn.004118c0
mov byte [0x42d59c], 1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov ecx, edi
call fcn.00410040
jmp 0x411026