joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41004e1a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push esi
push edi
push ebx
sub esp, 0x334
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edi, dword [edi]
mov esi, dword [edi + 0x30]
movzx eax, word [esi]
test eax, eax
je 0x41004ff5
xor eax, eax
inc eax
movzx edx, word [esi + eax*4 - 2]
lea ecx, [eax + eax]
lea ebx, [eax + eax - 1]
test edx, edx
je 0x41004e62
movzx edx, word [esi + eax*4]
mov ebx, ecx
test edx, edx
jne 0x41004e47
test ebx, ebx
jbe 0x41004e35
mov eax, ebx
xor ecx, ecx
xor edx, edx
shr eax, 1
je 0x41004ec4
mov dword [esp], ebx
mov dword [esp + 4], edi
movzx ebx, word [esi + edx*4]
cmp ebx, 0x41
jl 0x41004e89
cmp ebx, 0x5a
lea edi, [ebx + 0x20]
cmovle ebx, edi
imul ecx, ecx, 0x1003f
movzx ebx, bx
add ecx, ebx
movzx ebx, word [esi + edx*4 + 2]
cmp ebx, 0x41
jl 0x41004ea7
cmp ebx, 0x5a
lea edi, [ebx + 0x20]
cmovle ebx, edi
imul ecx, ecx, 0x1003f
inc edx
movzx ebx, bx
add ecx, ebx
cmp edx, eax
jb 0x41004e77
mov ebx, dword [esp]
shl edx, 1
mov edi, dword [esp + 4]
cmp edx, ebx
jae 0x41004ee1
movzx edx, word [esi + edx*2]
cmp edx, 0x41
jl 0x41004ed6
cmp edx, 0x5a
lea eax, [edx + 0x20]
cmovle edx, eax
imul ecx, ecx, 0x1003f
movzx eax, dx
add ecx, eax
cmp ecx, 0x3f723c1a
jne 0x41004e35
mov ebx, dword [edi + 0x18]
mov edx, dword [ebx + 0x158e69]
mov ecx, dword [ebx + 0x158e6d]
test edx, edx
jbe 0x41004fbe
invalid
add byte [eax], al
invalid
cmp edx, 6
ja 0x41004f0e
lea eax, [esp]
jmp 0x41004f2c
lea esi, [ebx + 0x158e71]
neg esi
lea eax, [esp]
add esi, eax
lea edi, [edx*4]
cmp esi, edi
jge 0x41004f7e
neg esi
cmp esi, edi
jge 0x41004f7e
mov esi, edx
shr esi, 1
je 0x41004feb
mov dword [esp + 0x30c], edx
xor edi, edi
mov edx, dword [ebx + edi*8 + 0x158e71]
add edx, ecx
mov dword [esp + edi*8], edx
mov edx, dword [ebx + edi*8 + 0x158e75]
add edx, ecx
mov dword [esp + edi*8 + 4], edx
inc edi
cmp edi, esi
jb 0x41004f3f
mov edx, dword [esp + 0x30c]
lea esi, [edi + edi + 1]
lea edi, [esi - 1]
cmp edx, edi
jbe 0x41004fc1
mov edx, dword [ebx + esi*4 + 0x158e6d]
add ecx, edx
mov dword [esp + esi*4 - 4], ecx
jmp 0x41004fc1
movd xmm0, ecx
mov esi, edx
pshufd xmm0, xmm0, 0
xor edi, edi
and esi, 0xfffffffc
movdqu xmm1, xmmword [ebx + edi*4 + 0x158e71]
paddd xmm1, xmm0
movdqu xmmword [esp + edi*4], xmm1
add edi, 4
cmp edi, esi
jb 0x41004f8e
cmp esi, edx
jae 0x41004fc1
mov edi, dword [ebx + esi*4 + 0x158e71]
add edi, ecx
mov dword [esp + esi*4], edi
inc esi
cmp esi, edx
jb 0x41004fab
jmp 0x41004fc1
lea eax, [esp]
mov dword [esp + 0x310], eax
mov eax, dword [eax + 0x2c]
invalid
pushfd
and al, 0xc
invalid
Function at 0x410053a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411472df
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x411bade8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CPostScriptDriver.0
cmp dword [esi + 0x88], 0
mov dword [ebp - 4], 3
je 0x41005457
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [esp]
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 8]
push eax
call edi
push eax
mov eax, dword [esi + 0x80]
mov ecx, dword [eax + 8]
push ecx
push str.Delete_File___s____d
push 0x1000001
push 0xde
push str.PostScriptDriver.cpp
call fcn.41002c10
add esp, 0x18
lea edx, [ebp - 0x10]
push edx
lea ecx, [esi + 0x7c]
call fcn.41041d14
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4100544e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0x88], 0
jne 0x410053f0
mov eax, dword [esi + 0x98]
sub eax, 0x10
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4100547d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 1
call fcn.41041cc9
lea ecx, [esi + 0x18]
call fcn.41004fb0
lea ecx, [esi + 8]
call fcn.41004fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403e59
pop dword [ebp - 0x3c]
mov eax, 0x6d254165
sub eax, 0x6ce5030c
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x5a351b7a
add dword [ebp - 0x4c], 0xf41d29d1
mov dword [ebp - 0x48], 0x1252bb01
add dword [ebp - 0x48], 0x1fe09144
mov dword [ebp - 0x44], 0x82e05279
sub dword [ebp - 0x44], 0x36940e4b
mov dword [ebp - 0x40], 0x7d7c232e
sub dword [ebp - 0x40], 0x7d7c232e
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x20c49fe1
sub eax, 0x20842f7d
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xe5d33cee
sub dword [ebp - 0x4c], 0x7160d398
mov dword [ebp - 0x48], 0x9c9af779
add dword [ebp - 0x48], 0xa4d169fc
mov dword [ebp - 0x44], 0x46142e41
add dword [ebp - 0x44], 0x1d5b3e2b
mov dword [ebp - 0x40], 0x17c87972
add dword [ebp - 0x40], 0xe837868e
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa0e0d2b0
add eax, 0x5f5f9df8
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34cd1
push 0
call eax
mov ecx, 0xe9147114
add ecx, 0x16ebcf23
xor edi, edi
add edi, eax
mov ebx, 0xfa6f4413
add ebx, 0x5d1bbed
add ebx, dword [ebp - 0x3c]
mov esi, 0xd302192f
sub esi, 0xb7a2e1b8
mov edx, dword [ebx]
sub dword [ebp - 8], 0xee5804db
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 0x1c], ebx
add edi, 4
add ebx, 4
loop 0x403f7d
add eax, 0xf3af
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1e3372ba
sub ecx, 0x1df372ba
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebp
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x44a9c3
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a942
mov edx, dword [0x651d44]
push 0x651a78

Function at 0x494278
Capabilities:
Encode data using xor

Disassembly:
call 0x25710b7b
stc
sbb al, 0xfb
add ebx, edi
cdq
dec edx
mov bh, 0x13
cmp byte [ebx - 0x12e3ca3a], ah
invalid

Function at 0x53492e
Capabilities:
Encode data using xor

Disassembly:
push esi
or byte [esi + 0x79], bl
push ebx
fsubr dword [ecx + 0x6a]
test al, 0x29
aad 0x68
cmpsd dword [esi], dword es:[edi]
lcall 0xfb0c, 0xd3dac350
out 0xc4, al
cmp al, 0xc0
sbb dword [esi + 0x1d], edx
in al, dx
xchg ebp, eax
in eax, dx
js 0x5349a6
sbb byte [edx + 0x3338463d], bh
inc esi
cmp byte [ebx], dh
push eax
insb byte es:[edi], dx
sub edx, ebx
das
stc
mov ecx, 0x6b581ce4
stosd dword es:[edi], eax
mov ebx, 0x2075b80a
xor bl, byte [edi]
ja 0x534952
push 0x4ac838f8
fcom st(0)
cmp al, 0xdb
test eax, 0x582c7851
leave
push 0xaf91e7cd
sub esi, edx
dec edi
and eax, dword [eax]
push cs
xor al, 0x58
adc byte [ecx + edi*8 - 0x18], 0xe5
cli
imul edx, ebp, 0xe851680a
cmp byte [edx], bh
mov ebx, 0xc9184a83
insb byte es:[edi], dx
sbb al, 0xc8
mov ch, 0x89
cmpsd dword fs:[esi], dword es:[edi]
push es
add byte [ebx - 0x6bae1e8f], dl
xchg esp, eax
mov bh, 0xfc
enter 0xffffffffffffb84a, 0x78
sar byte [edx], 1
clc
mov dword [edi - 0x61], edi
mov ebx, 0xc88051c6
cdq
push ebp
int3

Function at 0x57e2fe
Capabilities:
Encode data using xor

Disassembly:
push ss
xor byte [ebx], ah
sal byte [ebx - 0x4b], 0xd
push ds
and ah, byte [esi]
sbb eax, 0x2dcaca48
mov bl, 0x38
invalid

Function at 0x5c96f5
Capabilities:
Encode data using xor

Disassembly:
cld
pop ebp
enter 0xffffffffffff93c8, 0xffffffffffffffc6
push esi
pushal
imul byte [edx]
or edx, dword [ebx]
js 0x5c971b
mov eax, 0x4f3d48f2
ret
adc al, 0x9b
and ebx, ecx
insb byte es:[edi], dx
adc bh, byte [edx - 0x799410c8]
invalid
Function at 0x5c9a06
Capabilities:
Encode data using xor

Disassembly:
pushfd
push esi
or bl, byte [eax - 0x5e]
xor ah, ch
fsincos
or eax, 0xeca6c533
adc ebx, dword [esi - 0x2d]
mov dh, 0x9d
or eax, 0xa84e19b6
dec esi
shr byte [edi], cl
popfd
stosb byte es:[edi], al
cwde
imul edi, dword [ecx], 0x5f
out 0xcb, al
leave
stosb byte es:[edi], al
add al, 0xcf
xchg ecx, eax
jp 0x5c99c2
xchg esp, eax
dec esi
sahf
sbb byte [ebx + 0x27679c27], bh
wait
ret
rol cl, 0x98
jbe 0x5c9a50
xchg ebp, eax
jnp 0x5c9a19
mov ebx, 0x27962ac0
push ebx
aaa
xor al, bl
call dword [ebp - 0x34]
xchg esi, eax
add eax, 0x9d00b379
jno 0x5c99c2
push ss
iretd
jns 0x5c9ab5
test byte [ebp - 0x4e032315], al
cli
out 0x2e, eax
insd dword es:[edi], dx
mov esi, 0x1cde053b
rol byte [esi - 0x508028ff], 0
aad 0x92
add edi, edx
jg 0x5c9a03
add ch, dl
xchg edx, eax
cwde
add ebp, dword [ecx + 0x47]
mov al, byte [0x5b5d8443]
mov byte [esi - 0x43], dl
lds ecx, [ebx]
outsd dx, dword [esi]
cwde
push esp
xchg ecx, eax
loop 0x5c9a3d
cmp edi, esp
cwde
jbe 0x5c9a87
lodsb al, byte [esi]
mov edi, 0x3176f3e2
cmp edi, dword [eax]
dec eax
mov dword [0x74cd62bc], eax
ret
jb 0x5c9a50
sub edi, ecx
cmp esp, edx
cwde
inc ebp
int 0x89
lodsb al, byte [esi]
insd dword es:[edi], dx
adc ecx, dword [ecx]
cmp cl, al
jg 0x5c9ad1
fnstenv [edi]
push edx
lahf
outsd dx, dword [esi]
std
ret 0x8fc1
inc ebp
pop es
xchg ecx, eax
push ss
mov ecx, 0x544ca8f3
jno 0x5c9b18
jae 0x5c9ac3
aaa
aaa
bound ebp, qword [eax + 0x3cb548c7]
push ebx
xchg ebx, esi
inc ecx
test dword [eax], 0xc7d28b13
mov ah, 0x9d
jbe 0x5c9a9f
mov edx, edx
invalid
popal
test al, 0x52
inc ebx
stc
insb byte es:[edi], dx
push esi
ret
Function at 0x5d0139
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x65e3634d
xor dword [ebx + edx*2 + 0x7de854a8], ebx
arpl word [ebx], dx
cmp ebp, edx
invalid
fsubr dword [eax + 0x18]
inc ebx
rcl byte [eax - 0x58], cl
ja 0x5d01b7
mov cl, 0x45
mov bl, 0x4f
mov bl, 0x77
test al, bh
adc esi, esp
jecxz 0x5d00f1
or dword [edi + 0x5c79bec3], 0xffffff90
sal dword [edx], cl
push cs
or dword [ecx + edx*4 - 0x7ba0808d], 0xa3b04a94
enter 0x3888, 0xffffffffffffffe3
add cl, 0xae
rcl byte [edx + 0x33542c92]
shr byte [ebp + ebp*4 + 0x69], 1
push ss
stosd dword es:[edi], eax
and ch, bl
push edx
js 0x5d0155
and ecx, dword [edi - 0x68]
jno 0x5d0140
and ah, byte [eax + 0x12]
and al, 0xf8
fsub dword [edx - 0x217f0acf]
and al, 0xe3
lahf
xchg ebp, eax
jns 0x5d01a1
jns 0x5d0212
clc
inc edx
pop es
ror ah, 0x7c
cmp byte [ebp + 0x6e3dbfd0], bh
mov cl, 0x76
xor eax, 0x98db4efe
movsb byte es:[edi], byte [esi]
mov bl, 0xd3
xor al, 0x93
cmp bh, ch
in eax, dx
and byte [ecx], cl
lodsd eax, dword [esi]
jae 0x5d01eb
in eax, dx
xor esp, dword [eax - 0x7bff857]
pop es
inc eax
clc
sbb esp, dword [esi + 0x63]
invalid
arpl word [edi], cx
jae 0x5d01d8
invalid
pop ecx
mov edi, 0xc584f138
sbb dl, byte [esi + 0x1e]
std
or dword [edx + 0x3eb863a7], ebx
xlatb
mov esi, dword [ebx + ebp*4 - 0x22de4c5b]
sar bh, cl
rcl byte [ebx], cl
mov al, byte [0x82ec0b39]
mov bl, 0x8c
salc
inc esp
jo 0x5d01c7
sbb byte [esi], bl
jge 0x5d01bb
adc ah, byte [edx]
aas
jl 0x5d01ee
popfd
mov bh, 0x7b
mov eax, dword [0x77e422ec]
push ss
test eax, 0xc82233a9
push edi
stosb byte es:[edi], al
pop esp
sub al, 0x97
ljmp 0xd1e4
inc ebx
sbb byte [0x6288822a], al
mov esi, dword [edi + 0x2b583a4]
dec edi
add dword [edi], 0xffffffa5
inc esi
cmpsd dword [esi], dword es:[edi]
les edi, [ebp - 0x45]
aad 0x28
mov word [ebx], es
pop ebp
sbb esp, dword [edi + 0x3800d7b6]
call 0xfaea23fe
dec ebx
mov edx, 0x8d519953
inc ecx
mov byte [esi + 0x51], dh
ljmp 0x2b82

Function at 0x64d880
Capabilities:
Encode data using xor

Disassembly:
fbld tbyte [edi]
mov dword [edx], edi
xchg byte [edx + eax*8 - 0x5b69ffea], al
push 0x3c
mov byte [0x22d2be84], al
xor al, ah
xchg edi, eax
xor al, byte [ecx]
cmc
dec edx
bound edx, qword [eax]
jb fcn.0064d880
fisttp word [edi + 0x30]
sti
sub esp, esi
test dword [edx], 0x7c121e06
or ah, byte [ebp + 0x19285a55]
lds edi, [edx + 0x73]
mov esp, 0x15d49142
adc al, 0x1c
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x406420
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x8103ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046dc
call fcn.00407081
push 4
mov dword [esp + 0x18], 0
call fcn.00407e40
mov edi, eax
add esp, 4
test edi, edi
je 0x406494
push ebx
call fcn.00406f59
mov dword [edi], eax
call fcn.00406d18
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407042
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406488
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040706a
pop ebx
jmp 0x406496
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4088b1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x813658]
jne 0x4088bb
repz ret
jmp fcn.0040d30c
Function at 0x412ee1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x813658]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040be76
and dword [ebp - 0x14], 0
cmp dword [0x8163d8], 0
mov dword [ebp - 0x18], eax
jne 0x412f94
push 0x404080
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41303c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404074
push ebx
call edi
test eax, eax
je 0x41303c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404064
push ebx
mov dword [0x8163d8], eax
call edi
push eax
call esi
push 0x404050
push ebx
mov dword [0x8163dc], eax
call edi
push eax
call esi
push 0x404034
push ebx
mov dword [0x8163e0], eax
call edi
push eax
call esi
mov dword [0x8163e8], eax
test eax, eax
je 0x412f94
push 0x40401c
push ebx
call edi
push eax
call esi
mov dword [0x8163e4], eax
mov eax, dword [0x8163e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412fed
cmp dword [0x8163e8], ecx
je 0x412fed
push eax
call esi
push dword [0x8163e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412fed
test ebx, ebx
je 0x412fed
call edi
test eax, eax
je 0x412fe4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x412fe4
test byte [ebp - 8], 1
jne 0x412fed
or dword [ebp + 0x10], 0x200000
jmp 0x413020
mov eax, dword [0x8163dc]
cmp eax, dword [ebp - 0x18]
je 0x413020
push eax
call esi
test eax, eax
je 0x413020
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413020
mov eax, dword [0x8163e0]
cmp eax, dword [ebp - 0x18]
je 0x413020
push eax
call esi
test eax, eax
je 0x413020
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8163d8]
call esi
test eax, eax
je 0x41303c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41303e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088b1
leave
ret
Function at 0x80edf0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0xb9b120], 0x37
jne 0x80ee9c
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea ecx, [esp + 0x410]
push ecx
push 0
push 0x404128
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x404180
push 0x4041c4
push 0x404208
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov edx, dword [0xb9b124]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x81b184]
mov byte [edx + esi], cl
add esp, 0x80c
ret
Function at 0x80f0b0
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb9b120]
sub esp, 0x484
push ebx
mov ebx, dword [0x81b184]
push ebp
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x80f2a1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
jmp 0x80f0e6
mov ebx, dword [esp + 0x20]
xor esi, esi
cmp dword [0xb9b120], 0x1c
jne 0x80f0fd
lea eax, [esp + 0x40]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [ebx + 4]
mov edx, dword [str.ywl]
mov eax, dword [0x81470c]
mov edi, dword [ebx]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x814710]
mov dword [esp + 0x34], edx
mov edx, dword [0x814714]
mov ebx, 0xc6ef3720
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x24], 0x20
jmp 0x80f142
xor esi, esi
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x2c]
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x3c]
lea edx, [ebx + edi]
xor ecx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov dword [0xb9a0a4], esi
mov eax, dword [esp + 0x1c]
add dword [0xb9a0a4], eax
mov eax, dword [0xb9a0a4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x38]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
shl edx, 4
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x34]
add dword [esp + 0x14], eax
cmp dword [0xb9b120], 0x1be
mov eax, dword [esp + 0x18]
lea ebp, [ebx + eax]
jne 0x80f1d6
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov esi, dword [esp + 0x18]
shr esi, 5
add esi, dword [esp + 0x30]
cmp dword [0xb9b120], 0x979
mov dword [0xb9a0a8], 0xff6b3619
mov dword [0xb9a0ac], 0xffffffff
jne 0x80f225
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
push 0
lea edx, [esp + 0x94]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [esp + 0x14]
xor esi, ebp
xor eax, esi
sub edi, eax
add ebx, 0x61c88647
dec dword [esp + 0x24]
mov dword [esp + 0x14], eax
jne 0x80f140
cmp dword [0xb9b120], 0x8d4
jne 0x80f25a
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], ecx
cmp dword [0xb9b120], 0x17
jne 0x80f290
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x90]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x20], esi
jne 0x80f0e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x484
ret
Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebp
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x44a9c3
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a942
mov edx, dword [0x651d44]
push 0x651a78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, ebx
or eax, 0x8001
push eax
call edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push ebx
mov dword [0xa51fa4], 6
or esi, 0xffffffff
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret 4

Function at 0x45aee0
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [edx + ebx*2 + 0x7776fee2]
cwde
in al, dx
call 0xb16fef77
in al, 0xc
enter 0x4aad, 0x24
in al, 0xf3
rcr dword [eax - 0x11], 1
mov edi, dword [eax - 0x227a614e]
test al, 0xa6
mov ebp, 0x58d696ec
sbb byte [ecx + 0x25], cl
add ebp, dword [eax - 0x5c]
xchg dword [edx - 0x76], edx
leave
invalid

Function at 0x4cfd80
Capabilities:
Encode data using xor

Disassembly:
aaa
imul esp, dword [ecx - 0x2ad9d6d9], 0x5d
aam 0x56
enter 0x2818, 0x37
inc ebx
fadd qword [edx - 0x35]
push es
inc esp
mov esp, 0xf09ea6eb
mov ebx, 0xa0ffb397
invalid

Function at 0x4d39b7
Capabilities:
Encode data using xor

Disassembly:
dec byte [ebx]
mulps xmm4, xmm3
arpl di, dx
cmp dword [edx + 0x1356e389], esi
cmpsd dword [esi], dword es:[edi]
add esi, dword [eax + 0x96f2d33]
or dword [edi - 0x2a], ebx
adc ch, byte [esi - 0x7a004a31]
mov edx, 0x3a91f59
call 0x1975c5d3
pop edi
sub dword [ebx - 7], eax
jmp 0x4d3954
aad 0x14
imul edx, dword [edi + 0x79], 0x212f89af
pop ds
and dword [edi], ebx
test eax, 0x6d3f290f
mov ecx, dword [eax]
fild qword [ecx]
dec edi
xor eax, 0x199b4c0d
xchg ebx, eax
in eax, 0x45
loope 0x4d39bf
leave
insd dword es:[edi], dx
aad 0xdf
insd dword es:[edi], dx
jge 0x4d3978
mov edi, ebp
cdq
adc esp, dword [esi + 0x49bab463]
pop ds
mov bl, byte [ecx + 0x7fb948fd]
pop ecx
outsd dx, dword [esi]
adc eax, 0xf98b23a3
dec ecx
push 0x75
scasb al, byte es:[edi]
imul ecx, edi, 0xae42f36c
cmc
lahf
imul ecx, dword [edi], 0x5f65f275
invalid