joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x4c3350
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x4ce494]
test eax, eax
jne 0x4c3374
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x7facde30
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce494], eax
call eax
mov ebx, eax
mov eax, dword [0x4cdd18]
test eax, eax
jne 0x4c339c
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x9ff0609c
mov ecx, eax
call fcn.004c3e60
mov dword [0x4cdd18], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x4c3452
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x4c3442
cmp ebx, 8
jb 0x4c3427
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x4c33e6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x4c3427
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x4c3400
cmp edx, ebx
jae 0x4c3442
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x4c3430
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4c3450
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c34c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x4c34e9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x4ce494]
test eax, eax
jne 0x4c350d
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x7facde30
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce494], eax
call eax
mov edi, eax
mov eax, dword [0x4cdd18]
test eax, eax
jne 0x4c3535
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x9ff0609c
mov ecx, eax
call fcn.004c3e60
mov dword [0x4cdd18], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4c35b5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x4c35aa
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x4c3570
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4c35c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x4c35ea
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x4ce494]
test eax, eax
jne 0x4c360e
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x7facde30
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce494], eax
call eax
mov edi, eax
mov eax, dword [0x4cdd18]
test eax, eax
jne 0x4c3636
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x9ff0609c
mov ecx, eax
call fcn.004c3e60
mov dword [0x4cdd18], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x4c36a2
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x4c369a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x4c3670
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4c3bb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0x4090
or dword [esp], 0x31656b5b
imul eax, dword [esp], 0x51
push ebx
mov ebx, ecx
mov dword [esp + 4], eax
mov eax, 0xb02c0b03
mov edx, dword [esp + 4]
mul edx
shr edx, 6
mov dword [esp + 4], edx
shl dword [esp + 4], 0x10
or dword [esp + 4], 0xecb0ddf8
add dword [esp + 4], 0x637e
xor dword [esp + 4], 0xeef54176
mov dword [esp + 8], 0x5ef
add dword [esp + 8], 0x6fab
or dword [esp + 8], 0x1ac9183b
shl dword [esp + 8], 8
shr dword [esp + 8], 2
xor dword [esp + 8], 0x325f6ec6
mov dword [esp + 8], 0xc1f4
add dword [esp + 8], 0x1c7b
or dword [esp + 8], 0x28c630b6
add dword [esp + 8], 0xffff17a2
shl dword [esp + 8], 0xb
xor dword [esp + 8], 0x30b50810
cmp byte [ebx], 0
je 0x4c3cf3
push esi
push edi
lea ecx, [ecx]
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0x5ef
add dword [esp + 0x10], 0x6fab
or dword [esp + 0x10], 0x1ac9183b
shl dword [esp + 0x10], 8
shr dword [esp + 0x10], 2
xor dword [esp + 0x10], 0x325f6ec6
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0xc1f4
add dword [esp + 0x10], 0x1c7b
or dword [esp + 0x10], 0x28c630b6
add dword [esp + 0x10], 0xffff17a2
shl dword [esp + 0x10], 0xb
xor dword [esp + 0x10], 0x30b50810
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x4c3c60
pop edi
pop esi
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret
Function at 0x4c3e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x4c3ebc
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.004c3bb0
xor eax, 0x3b993195
cmp eax, dword [esp + 0x10]
je 0x4c3ec6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x4c3ea0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x4c3ef4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x4c3ef4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x4c40b0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x4c40d6
cmp al, 0x2e
je 0x4c40d3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x4c40c3
jmp 0x4c40d6
mov byte [edx], 0
mov eax, dword [0x4ce470]
test eax, eax
jne 0x4c40fa
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0xcca18ea2
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce470], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4c4141
mov eax, dword [0x4ce2f4]
test eax, eax
jne 0x4c412b
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0xe4b28a79
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce2f4], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x4c4141
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.004c3bb0
xor eax, 0x3b993195
mov ecx, edi
mov edx, eax
call fcn.004c3e60
pop edi
pop esi
add esp, 0x104
ret
Function at 0x4c3f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x18], ebx
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x4c408d
mov esi, dword [ebp + 0x30]
mov dword [esp + 0x10], 0x4090
or dword [esp + 0x10], 0x31656b5b
imul eax, dword [esp + 0x10], 0x51
mov dword [esp + 0x10], eax
mov eax, 0xb02c0b03
mov ecx, dword [esp + 0x10]
mul ecx
shr edx, 6
mov dword [esp + 0x10], edx
shl dword [esp + 0x10], 0x10
or dword [esp + 0x10], 0xecb0ddf8
add dword [esp + 0x10], 0x637e
xor dword [esp + 0x10], 0xeef54176
mov dword [esp + 0x14], 0x5ef
add dword [esp + 0x14], 0x6fab
or dword [esp + 0x14], 0x1ac9183b
shl dword [esp + 0x14], 8
shr dword [esp + 0x14], 2
xor dword [esp + 0x14], 0x325f6ec6
mov dword [esp + 0x14], 0xc1f4
add dword [esp + 0x14], 0x1c7b
or dword [esp + 0x14], 0x28c630b6
add dword [esp + 0x14], 0xffff17a2
shl dword [esp + 0x14], 0xb
xor dword [esp + 0x14], 0x30b50810
cmp word [esi], 0
je 0x4c4073
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], 0x5ef
add dword [esp + 0x14], 0x6fab
or dword [esp + 0x14], 0x1ac9183b
shl dword [esp + 0x14], 8
shr dword [esp + 0x14], 2
xor dword [esp + 0x14], 0x325f6ec6
movzx ecx, byte [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0xc1f4
add dword [esp + 0x14], 0x1c7b
or dword [esp + 0x14], 0x28c630b6
add dword [esp + 0x14], 0xffff17a2
shl dword [esp + 0x14], 0xb
xor dword [esp + 0x14], 0x30b50810
shl edx, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [esi]
shl edi, cl
cmp eax, 0x41
jb 0x4c4052
cmp eax, 0x5a
ja 0x4c4052
add eax, 0x20
mov dword [esp + 0x10], eax
add esi, 2
add dword [esp + 0x10], edx
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebx
cmp word [esi], 0
jne 0x4c3fd1
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0x14d5ed60
cmp eax, dword [esp + 0x1c]
je 0x4c4097
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x4c3f25
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4c4370
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x4c450e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x4c450e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x4c450e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x4c450e
mov eax, dword [0x4ce2a4]
test eax, eax
jne 0x4c43db
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0x24897df
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce2a4], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x4c4505
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x4ce1e0]
test eax, eax
jne 0x4c443b
mov ecx, 0xc6fbcd74
call fcn.004c3f00
mov edx, 0x624eee2
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce1e0], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x4c44be
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x4ce1e0]
test eax, eax
jne 0x4c44a6
mov ecx, 0xc6fbcd74
call fcn.004c3f00
mov edx, 0x624eee2
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce1e0], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x4c4465
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.004c4640
mov edx, edi
mov ecx, ebx
call fcn.004c4550
pop esi
test eax, eax
jne 0x4c4505
mov eax, dword [0x4ce3cc]
test eax, eax
jne 0x4c44f9
mov ecx, 0x9bab0b12
call fcn.004c3f00
mov edx, 0xc16beec2
mov ecx, eax
call fcn.004c3e60
mov dword [0x4ce3cc], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x405c63
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405f2e
test bl, 8
mov dword [ebp - 8], eax
je 0x405ca2
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434788], eax
jmp 0x405e1f
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405cbc
test eax, eax
je 0x405dcd
test bl, 2
je 0x405dcd
mov esi, 0x42ea70
push edi
push esi
call fcn.00406557
cmp dword [ebp + 8], 0
je 0x405cdb
push 0x40a56c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405ce1
push edi
call fcn.00405e72
cmp word [edi], 0
jne 0x405cf1
cmp word [0x42ea70], 0x5c
jne 0x405cfc
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405dc2
cmp word [ebp - 0x22c], 0x2e
jne 0x405d46
cmp word [ebp - 0x22a], 0
je 0x405da5
cmp word [ebp - 0x22a], 0x2e
jne 0x405d46
cmp word [ebp - 0x228], 0
je 0x405da5
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406557
test byte [ebp - 0x258], 0x10
je 0x405d71
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405da5
push dword [ebp + 0xc]
push edi
call fcn.00405c63
jmp 0x405da5
push dword [ebp - 4]
push edi
call fcn.00405c1b
test eax, eax
jne 0x405d9d
cmp dword [ebp - 4], eax
je 0x405d95
push edi
push 0xfffffffffffffff1
call fcn.004055dc
push 0
push edi
call fcn.00406317
jmp 0x405da5
inc dword [0x434788]
jmp 0x405da5
push edi
push 0xfffffffffffffff2
call fcn.004055dc
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405d1e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405dcd
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405e1f
cmp dword [ebp - 8], esi
jne 0x405de1
inc dword [0x434788]
jmp 0x405e1f
push edi
call fcn.004068b4
test eax, eax
je 0x405e1f
push edi
call fcn.00405e26
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405c1b
test eax, eax
jne 0x405e17
cmp dword [ebp - 4], esi
je 0x405dd9
push edi
push 0xfffffffffffffff1
call fcn.004055dc
push esi
push edi
call fcn.00406317
jmp 0x405e1f
push edi
push 0xffffffffffffffe5
call fcn.004055dc
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__invalid_parameter
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret
Function at 0x4055d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6029e0
push eax
mov dword fs:[0], esp
sub esp, 0xc
xor eax, eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x164]
test edx, edx
jle 0x40561f
mov ecx, dword [esi + 0x104]
mov edi, dword [ecx]
cmp edi, eax
jne 0x405615
test edi, edi
jl 0x405636
cmp edi, 3
jle 0x405615
cmp edi, 0x11
jne 0x405636
inc ebx
add ecx, 4
cmp ebx, edx
mov eax, edi
jl 0x405601
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push ecx
mov dword [esi + 4], 1
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x6a1e40
call fcn.005eba4f
push ecx
mov dword [esp + 0x28], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x6a1e40
call fcn.005eba4f
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.00405800
mov ecx, dword [eax]
lea edx, [esi + 0x14]
push ecx
push str.Operators_must_be_separated_by_values._n_nThere_cant_be_two__s_operators_in_a_row.
push edx
mov dword [esp + 0x2c], 1
call fcn.005e7f5e
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.005eb9e1
mov eax, dword [esi + 0x118]
pop edi
mov ecx, dword [eax + ebx*4 - 4]
mov dword [esi + 0xc], ecx
mov edx, dword [esi + 0x12c]
mov eax, dword [esi + 0x118]
mov ecx, dword [edx + ebx*4]
mov edx, dword [eax + ebx*4]
lea eax, [ecx + edx - 1]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x10], eax
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x405800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x602a27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], 0
mov ebx, 1
mov dword [esp + 0x20], ebx
mov eax, dword [0x69cfe8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x20], 4
lea eax, [edi - 1]
cmp eax, 0x12
ja case.default.0x40584c
jmp dword [eax*4 + 0x4059cc]
push 0x673d3c
jmp 0x4058cf
push 0x673d38
jmp 0x4058cf
push 0x673d34
jmp 0x4058cf
push 0x673d30
jmp 0x4058cf
push 0x673d2c
jmp 0x4058cf
push 0x673d28
jmp 0x4058cf
push 0x673d24
jmp 0x4058cf
push 0x673d20
jmp 0x4058cf
push 0x673d1c
jmp 0x4058cf
push 0x673d18
jmp 0x4058cf
push 0x673d14
jmp 0x4058cf
push 0x673d10
jmp 0x4058cf
push 0x673d0c
jmp 0x4058cf
push 0x673d08
jmp 0x4058cf
push 0x673d04
jmp 0x4058cf
push 0x673d00
jmp 0x4058cf
push str.VALUE
jmp 0x4058cf
push str.UNKNOWN
lea ecx, [esp + 0x10]
call fcn.005ebb6a
mov eax, dword [esp + 0x30]
push 0x6a1e40
push eax
call fcn.005cf4d3
add esp, 8
test eax, eax
jne 0x405904
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.005eb756
mov dword [esp + 0x14], ebx
jmp 0x40597c
mov ecx, dword [esi + edi*4 + 0x20]
mov eax, ecx
and eax, 3
dec eax
je 0x405936
dec eax
jne 0x405968
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
push str.__s___s___s_
push edx
call fcn.005e7f5e
add esp, 0x14
jmp 0x405968
test cl, 4
je 0x40594c
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push str._s__s_
jmp 0x40595b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
push eax
push ecx
push str.__s__s
lea edx, [esp + 0x1c]
push edx
call fcn.005e7f5e
add esp, 0x10
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.005eb756
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.005eb9e1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.005eb9e1
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call fcn.005eb9e1
lea ecx, [esp + 0x34]
mov byte [esp + 0x20], 0
call fcn.005eb9e1
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x409020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x602eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x69cfe8]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
xor edi, edi
push 0x6a1e40
mov dword [esp + 0x1c], edi
call fcn.005ebb6a
lea ecx, [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x10], edi
push ecx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
call fcn.005e82e8
lea edx, [esp + 0xc]
push edx
call fcn.005e82e8
lea eax, [esp + 0xc]
push eax
call fcn.005e82e8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4090c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x602ed0
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
xor ebx, ebx
lea eax, [edi + 0x2c]
mov dword [esp + 0x18], ebx
push eax
push ecx
push edx
call fcn.005ebc76
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 1
call fcn.005ebb1a
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], bl
call fcn.005eb9e1
mov eax, dword [edi]
push 1
mov dword [esi + 8], eax
mov ecx, dword [edi + 0x1c]
push ebx
push ebx
push ecx
call fcn.005cf700
mov ecx, dword [edi + 0x20]
xor ebp, ebp
add eax, ecx
mov dword [esi + 0x30], ebx
adc edx, ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
lea edx, [esi + 0x18]
lea eax, [edi + 4]
push edx
push eax
mov dword [esi + 0x2c], ebx
call fcn.00409190
lea ecx, [esi + 0x1c]
lea edx, [edi + 0xc]
push ecx
push edx
call fcn.00409190
lea eax, [esi + 0x20]
add edi, 0x14
push eax
push edi
call fcn.00409190
mov ecx, dword [esp + 0x40]
add esp, 0x18
mov dword [esi], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.005eb9e1
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc