joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41df60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0041cc40
mov eax, dword [0x4dd394]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41dfd0
test byte [ebx + 0x20], 0xc
jne 0x41df90
mov eax, dword [0x534bdc]
test eax, eax
jne 0x41dfa0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.0041be40
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41dfc2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41dfc2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41dfe1
mov dword [esp], esi
call fcn.0041c180
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041cd00
mov ebx, eax
test eax, eax
jne 0x41df81
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41e001
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.0041c180
call fcn.0041de70
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41e090
mov dword [esp], eax
call fcn.0041bb80
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x41e0d0
call fcn.0041cc40
mov eax, dword [0x4dd394]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41e130
test edi, edi
je 0x41e0aa
call fcn.0041df60
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41e108
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041bc90
call fcn.0041df60
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0041cc40
mov eax, dword [0x4dd394]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41e120
call fcn.0041df60
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041df60
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0041cc40
mov eax, dword [0x4dd394]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x41e062
call fcn.0041cd00
mov ebx, eax
jmp 0x41e062
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41e07e
call fcn.0041cd00
jmp 0x41e0aa
call fcn.0041cd00
mov ebx, eax
jmp 0x41e05e
Function at 0x424920
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x4f]
sub esp, 0x6c
mov dword [ebp - 0x4f], 0xc1eb1542
mov dword [ebp - 0x4b], 0x7c90ec48
mov byte [ebp - 0x47], 0x42
mov al, byte [0x4dd8b8]
test al, al
jne 0x42497d
mov dword [esp], 0x4dd8b8
call fcn.004ceb90
test eax, eax
je 0x42497d
mov dword [esp], ebx
mov ecx, 0x4e0000
call fcn.0042e96c
push edx
mov dword [esp], 0x4cfd60
call fcn.004013f0
mov dword [esp], 0x4dd8b8
call fcn.004cec60
mov ecx, 0x4e0000
mov esi, 0x4dd0e0
mov edi, ebx
call fcn.0042e93c
mov dword [esp], 0x4e0000
call fcn.00422510
mov ecx, 0x37
mov dword [ebp - 0x53], 0x1de06e36
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4dd8b0]
test al, al
jne 0x4249e7
mov dword [esp], 0x4dd8b0
call fcn.004ceb90
test eax, eax
je 0x4249e7
mov dword [esp], ebx
mov ecx, 0x4dffc0
call fcn.0042e834
push eax
mov dword [esp], 0x4cfd98
call fcn.004013f0
mov dword [esp], 0x4dd8b0
call fcn.004cec60
mov ecx, 0x4dffc0
call fcn.0042e804
mov dword [esp], 0x4dffc0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x424a06
lea eax, [ebp - 0x53]
call eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x3000
mov dword [esp], 0xffffffff
neg eax
mov dword [esp + 0x14], edx
lea edx, [ebp + 0xc]
sbb eax, eax
mov dword [esp + 0xc], edx
and eax, 0xc
mov dword [esp + 8], eax
lea eax, [ebp + 8]
mov dword [esp + 4], eax
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov edx, eax
sub esp, 0x18
xor eax, eax
test edx, edx
js 0x424a4c
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x424bd8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x50]
sub esp, 0x5c
mov dword [ebp - 0x50], 0xc1eb1542
mov dword [ebp - 0x4c], 0x7c90ec48
mov byte [ebp - 0x48], 0x42
mov al, byte [0x4dda18]
test al, al
jne 0x424c35
mov dword [esp], 0x4dda18
call fcn.004ceb90
test eax, eax
je 0x424c35
mov dword [esp], ebx
mov ecx, 0x4e0820
call fcn.0042e96c
push ecx
mov dword [esp], 0x4cfe10
call fcn.004013f0
mov dword [esp], 0x4dda18
call fcn.004cec60
mov ecx, 0x4e0820
mov esi, 0x4dd0e0
mov edi, ebx
call fcn.0042e93c
mov dword [esp], 0x4e0820
call fcn.00422510
mov ecx, 0x37
mov dword [ebp - 0x54], 0x31f0763a
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4dda10]
test al, al
jne 0x424c9f
mov dword [esp], 0x4dda10
call fcn.004ceb90
test eax, eax
je 0x424c9f
mov dword [esp], ebx
mov ecx, 0x4e07e0
call fcn.0042e834
push edx
mov dword [esp], 0x4cfe48
call fcn.004013f0
mov dword [esp], 0x4dda10
call fcn.004cec60
mov ecx, 0x4e07e0
call fcn.0042e804
mov dword [esp], 0x4e07e0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x424cbe
lea eax, [ebp - 0x54]
call eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x8000
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42839c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x7c
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x6c], edx
mov edi, dword [ebx + eax + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x58], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x5c], eax
mov eax, dword [edi + 0x24]
xor edi, edi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
cmp edi, dword [eax + 0x18]
jae 0x4284b6
mov eax, dword [ebp - 0x5c]
add eax, ebx
mov ecx, dword [eax + edi*4]
add ecx, ebx
mov dword [esp], ecx
lea ecx, [ebp - 0x30]
call fcn.004bcc7c
lea ecx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call fcn.004bcc7c
push eax
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
test esi, esi
je 0x428484
test edx, edx
je 0x428481
mov al, byte [eax]
mov ecx, 1
sub ecx, esi
mov byte [ebp - 0x61], al
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x50], eax
add eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x50]
cmp edx, esi
jb 0x428481
mov ecx, dword [ebp - 0x70]
add edx, ecx
je 0x428481
mov dword [esp + 8], edx
movsx edx, byte [ebp - 0x61]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memchr
mov edx, eax
test eax, eax
je 0x428481
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x54]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x74], edx
call sub.msvcrt.dll_memcmp
mov edx, dword [ebp - 0x74]
test eax, eax
jne 0x428477
mov eax, dword [ebp - 0x50]
mov esi, edx
sub esi, eax
jmp 0x428484
lea eax, [edx + 1]
mov edx, dword [ebp - 0x68]
sub edx, eax
jmp 0x42842c
or esi, 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004b8e40
lea ecx, [ebp - 0x30]
call fcn.004b8e40
inc esi
je 0x4284b0
lea eax, [edi + edi]
mov edi, dword [ebp - 0x60]
add eax, ebx
movzx eax, word [eax + edi]
mov edi, dword [ebp - 0x58]
lea eax, [ebx + eax*4]
add ebx, dword [eax + edi]
mov eax, ebx
jmp 0x4284cc
inc edi
jmp 0x4283ca
xor eax, eax
jmp 0x4284cc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4284d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x46c
mov dword [ebp - 0x468], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea edx, [eax + 0x14]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x45c], eax
mov edx, dword [ebp - 0x460]
cmp dword [ebp - 0x45c], edx
je 0x428669
lea edx, [ebp - 0x428]
xor eax, eax
mov ecx, 0x82
mov edi, edx
lea ebx, [ebp - 0x458]
lea esi, [ebp - 0x440]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x220]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x45c]
mov edi, dword [sym.imp.msvcrt.dll_wcscpy_s]
mov eax, dword [eax + 0x20]
mov dword [esp + 4], 0x104
mov dword [esp], edx
mov dword [esp + 8], eax
call edi
mov eax, dword [ebp - 0x468]
mov ecx, ebx
mov dword [esp], eax
call fcn.004bcc7c
push eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00424cf0
mov eax, dword [ebp - 0x440]
mov dword [esp + 4], 0x104
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call edi
mov ecx, esi
lea edi, [ebp - 0x428]
lea esi, [ebp - 0x220]
call fcn.004bd270
mov ecx, ebx
call fcn.004b8e40
mov ebx, dword [sym.imp.msvcrt.dll__wcslwr_s]
mov dword [esp], esi
mov dword [esp + 4], 0x104
call ebx
mov dword [esp], edi
mov dword [esp + 4], 0x104
call ebx
mov dword [esp], 0x4e3157
call sub.msvcrt.dll_atoi
mov dword [esp], edi
mov ebx, eax
call sub.msvcrt.dll_wcslen
mov dword [ebp - 0x464], eax
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x4e3157
mov esi, eax
call sub.msvcrt.dll_atoi
mov edi, eax
mov eax, dword [ebp - 0x464]
sub eax, esi
cmp eax, edi
jb 0x428653
mov dword [esp], 0x4e3157
call sub.msvcrt.dll_atoi
lea ecx, [edi + edi]
lea ecx, [ebp + ecx - 0x428]
cmp eax, esi
jae 0x42863c
mov dx, word [ebp + eax*2 - 0x220]
cmp word [ecx + eax*2], dx
jne 0x428650
inc eax
jmp 0x428627
cmp esi, eax
jne 0x428650
mov dword [esp], 0x4e3159
call sub.msvcrt.dll_atoi
mov ebx, eax
jmp 0x428653
inc edi
jmp 0x428605
mov eax, dword [ebp - 0x45c]
test ebx, ebx
je 0x428662
mov eax, dword [eax + 0x10]
jmp 0x428689
mov eax, dword [eax]
jmp 0x4284fb
xor eax, eax
jmp 0x428689
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4286d0
Capabilities:
Create directory

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x10
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x428708
call fcn.004b3ea0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
cmp edi, 0x11
je 0x428730
call fcn.004b3eb0
mov dword [ebx], edi
mov dword [ebx + 4], eax
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00489e40
cmp al, 2
jne 0x428715
xor eax, eax
jmp 0x428721
Function at 0x42b890
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call esi
sub esp, 0x18
mov ebx, eax
inc eax
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [0x4ded38], eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call esi
xor esi, esi
sub esp, 0x18
mov dword [esp + 4], 0x4ded3c
mov eax, dword [0x4ded38]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push edx
push edx
mov dword [0x4ded34], eax
mov eax, dword [0x4ded3c]
lea ebx, [eax*4]
cmp dword [0x4ded3c], esi
jle 0x42b979
xor edi, edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov eax, dword [0x4ded34]
mov eax, dword [eax + esi*4]
mov dword [esp], 0xfde9
inc esi
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
add ebx, eax
jmp 0x42b930
xor ecx, ecx
mov dword [esp + 4], ebx
xor edi, edi
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push esi
mov ecx, dword [0x4ded3c]
mov dword [0x4ded30], eax
lea edx, [ecx*4]
sub ebx, edx
lea esi, [eax + edx]
cmp dword [0x4ded3c], edi
jle 0x42b9f7
xor eax, eax
mov dword [esp + 0x14], ebx
xor edx, edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [0x4ded34]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], edx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [0x4ded30]
sub esp, 0x20
sub ebx, eax
mov dword [edx + edi*4], esi
add esi, eax
inc edi
jmp 0x42b9a3
mov dword [0x4ded2c], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42e35c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x5c706864
mov dword [ecx + 4], 0x64726473
mov dword [ecx + 8], 0x676e2760
mov ebp, esp
mov word [ecx + 0xc], 0x60
push esi
mov esi, 0xd
push ebx
mov ebx, 0xd
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xd], dl
inc ebx
cmp ebx, 0x1a
jne 0x42e385
pop ebx
pop esi
pop ebp
ret

Function at 0x42e39c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xb
push ebx
mov ebx, ecx
mov dword [ecx], 0x6b656364
mov dword [ecx + 4], 0x29766961
mov dword [ecx + 8], 0x66656c
mov ecx, 0xb
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 0xb], dl
inc ecx
cmp ecx, 0x16
jne 0x42e3c1
pop ebx
pop esi
pop ebp
ret

Function at 0x42e3d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x6c736567
mov dword [ecx + 4], 0x34366866
mov dword [ecx + 8], 0x66656c29
mov ebp, esp
mov byte [ecx + 0xc], 0
push esi
mov esi, 0xd
push ebx
mov ebx, 0xc
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xc], dl
inc ebx
cmp ebx, 0x18
jne 0x42e3ff
pop ebx
pop esi
pop ebp
ret

Function at 0x42e414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xb
push ebx
mov ebx, ecx
mov dword [ecx], 0x6d647e67
mov dword [ecx + 4], 0x69602d6e
mov word [ecx + 8], 0x6a
mov ecx, 9
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 9], dl
inc ecx
cmp ecx, 0x12
jne 0x42e438
pop ebx
pop esi
pop ebp
ret

Function at 0x42e44c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, str.oXMK
push ebx
mov ebx, ecx
mov ecx, 0x37
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x36
mov esi, 0x3b
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 0x36], dl
inc ecx
cmp ecx, 0x6c
jne 0x42e46c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42e484
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xb
push ebx
mov ebx, ecx
mov dword [ecx], 0x6a6c6877
mov dword [ecx + 4], 0x2972606a
mov dword [ecx + 8], 0x66656c
mov ecx, 0xb
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 0xb], dl
inc ecx
cmp ecx, 0x16
jne 0x42e4a9
pop ebx
pop esi
pop ebp
ret

Function at 0x42e4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x6168757b
mov dword [ecx + 4], 0x7e605b68
mov word [ecx + 8], 0x7c6e
mov ebp, esp
mov byte [ecx + 0xa], 0
push esi
mov esi, 0xb
push ebx
mov ebx, 0xa
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xa], dl
inc ebx
cmp ebx, 0x14
jne 0x42e4e6
pop ebx
pop esi
pop ebp
ret

Function at 0x42e4fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x7064737f
mov dword [ecx + 4], 0x622b3630
mov word [ecx + 8], 0x646b
mov ebp, esp
mov byte [ecx + 0xa], 0
push esi
mov esi, 0xb
push ebx
mov ebx, 0xa
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xa], dl
inc ebx
cmp ebx, 0x14
jne 0x42e522
pop ebx
pop esi
pop ebp
ret
Function at 0x42e550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x6e626a45
mov dword [ecx + 4], 0x65416e64
mov dword [ecx + 8], 0x6c296376
mov ebp, esp
mov word [ecx + 0xc], 0x6665
mov byte [ecx + 0xe], 0
push esi
mov esi, 0x11
push ebx
mov ebx, 0xe
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xe], dl
inc ebx
cmp ebx, 0x1c
jne 0x42e57d
pop ebx
pop esi
pop ebp
ret

Function at 0x42e594
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x40766447
mov dword [ecx + 4], 0x62747771
mov dword [ecx + 8], 0x795a7d66
mov ebp, esp
mov dword [ecx + 0xc], 0x7c6b6e63
mov word [ecx + 0x10], 0x63
push esi
mov esi, 0x11
push ebx
mov ebx, 0x11
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0x11], dl
inc ebx
cmp ebx, 0x22
jne 0x42e5c4
pop ebx
pop esi
pop ebp
ret

Function at 0x42e5d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x61757d4d
mov dword [ecx + 4], 0x76536775
mov dword [ecx + 8], 0x7b62656a
mov ebp, esp
mov word [ecx + 0xc], 0x5d7a
mov byte [ecx + 0xe], 0
push esi
mov esi, 0x11
push ebx
mov ebx, 0xe
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xe], dl
inc ebx
cmp ebx, 0x1c
jne 0x42e605
pop ebx
pop esi
pop ebp
ret

Function at 0x42e61c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xb
push ebx
mov ebx, ecx
mov dword [ecx], 0x666b6353
mov dword [ecx + 4], 0x296a6940
mov dword [ecx + 8], 0x66656c
mov ecx, 0xb
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 0xb], dl
inc ecx
cmp ecx, 0x16
jne 0x42e641
pop ebx
pop esi
pop ebp
ret

Function at 0x42e6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, str.Ynwq_v
push ebx
mov ebx, ecx
mov ecx, 0xf
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3b
mov esi, 0x3b
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 0x3b], dl
inc ecx
cmp ecx, 0x76
jne 0x42e6c0
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42e6d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x7673695a
mov dword [ecx + 4], 0x47696576
mov dword [ecx + 8], 0x6966646b
mov ebp, esp
mov byte [ecx + 0xc], 0
push esi
mov esi, 0xd
push ebx
mov ebx, 0xc
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0xc], dl
inc ebx
cmp ebx, 0x18
jne 0x42e6ff
pop ebx
pop esi
pop ebp
ret

Function at 0x42e714
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov dword [ecx], 0x6e43615a
mov dword [ecx + 4], 0x5273636c
mov dword [ecx + 8], 0x4770636c
mov ebp, esp
mov dword [ecx + 0xc], 0x6f6e596f
mov dword [ecx + 0x10], 0x7e606779
mov byte [ecx + 0x14], 0
push esi
mov esi, 0x17
push ebx
mov ebx, 0x14
mov eax, ebx
xor edx, edx
div esi
xor byte [ecx + ebx - 0x14], dl
inc ebx
cmp ebx, 0x28
jne 0x42e749
pop ebx
pop esi
pop ebp
ret
Function at 0x42e760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0xb
push ebx
mov ebx, ecx
mov dword [ecx], 0x5c6b7161
mov dword [ecx + 4], 0x29616a68
mov dword [ecx + 8], 0x66656c
mov ecx, 0xb
mov eax, ecx
xor edx, edx
div esi
xor byte [ebx + ecx - 0xb], dl
inc ecx
cmp ecx, 0x16
jne 0x42e785
pop ebx
pop esi
pop ebp
ret

Function at 0x42eec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4e37f9
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4e385d]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040bc10
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004d21e4
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4defa8], 0
jne 0x42efe6
mov byte [0x4defa8], 1
call fcn.004ce980
test eax, eax
je 0x42efb4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040ab00
mov dword [esp], 2
mov esi, dword [fcn.0041a110]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x42efa4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4e33c9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4d20d4
jmp 0x4d20cc
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x42ef6a
mov dword [esp], 2
call dword [0x4dd380]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4d20c7
mov dword [esp], 2
call dword [0x4dd380]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x4ec620
call fcn.004c7dd0
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.004ce6f0
add esp, 0x18
pop ebx
ret
Function at 0x489bf0
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], ebx
call fcn.00486b20
test al, al
je 0x489c4b
cmp al, 0xff
je 0x489c58
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00489e40
cmp al, 2
je 0x489c70
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x489c82
mov eax, dword [ebx]
test eax, eax
jne 0x489c4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004b3ea0
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.004b3ea0
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x489c4b
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
je 0x489c21
call fcn.004b3ea0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret

Function at 0x489cf0
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00489e40
cmp al, 0xff
je 0x489d58
mov ecx, dword [ebx]
test ecx, ecx
jne 0x489d4e
test al, al
jne 0x489d70
mov dword [esp + 8], 3
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x489dc0
call fcn.004b3ea0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.004b3ea0
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x489d1c
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.00489e40
mov edx, dword [ebx]
test edx, edx
jne 0x489d4e
mov ecx, dword [esp + 0x1c]
cmp cl, 2
je 0x489da8
cmp al, 2
jne 0x489d1c
call fcn.004b3eb0
mov dword [ebx], 0x14
mov dword [ebx + 4], eax
jmp 0x489d4e
cmp al, 2
je 0x489d1c
call fcn.004b3eb0
mov dword [ebx], 0x15
mov dword [ebx + 4], eax
jmp 0x489d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x489df0
call edi
mov dword [eax], 5
call fcn.004b3eb0
mov esi, eax
call edi
mov eax, dword [eax]
mov dword [ebx + 4], esi
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call edi
mov dword [eax], 0xd
jmp 0x489dd9