joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c8a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movaps xmm0, xmmword [0x497be0]
push ebx
push esi
mov esi, ecx
mov ebx, 0x400
push edi
mov edi, 0xc
mov eax, dword [esi + 0x78]
lea edx, [esi + 0x1e54]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x201c]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1e1c], xmm0
movups xmmword [esi + 0x1e2c], xmm0
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x43c950
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x43c941
mov eax, 0x4000400
lea edi, [esi + 0x219c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x239c]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x98]
mov eax, 0x300
add ecx, dword [esi + 0x94]
shl eax, cl
test eax, eax
je 0x43c9c2
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x249c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x269c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x289c]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2a9c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbca4]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x43ca14
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x98]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shl eax, cl
mov ecx, dword [esi + 0x94]
shr edx, cl
sub eax, edx
pop edi
mov dword [esi + 0x48], eax
pop esi
pop ebx
ret
Function at 0x44a890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x44a8bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x44a8de
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x44a8e0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x44a965
jg 0x44a8f5
test esi, esi
je 0x44a965
test ecx, ecx
jl 0x44a948
jg 0x44a8ff
test eax, eax
je 0x44a948
cmp edi, ecx
jg 0x44a913
jl 0x44a909
cmp esi, eax
jae 0x44a913
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x44a965
jg 0x44a94b
test esi, esi
je 0x44a965
jmp 0x44a94b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x44a965
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44a980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x44a9ac
jl 0x44a9a0
test esi, esi
jne 0x44a9ac
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x44a9c5
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x44a9fd
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x44a9fd
cmp eax, dword [ebp + 0xc]
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x44aa80
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x44aa26
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x44aa6c
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x44aa93
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x44aa40
test edx, edx
je 0x44aa80
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44ae00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x44ae30
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x44ae60
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x44ae60
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x44af36
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x44ae89
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x44ae95
movsx eax, bl
jmp 0x44aecd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x44aef7
sub eax, 1
je 0x44aef7
sub eax, 2
jne 0x44af36
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44af15
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x44af36
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x44af36
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004598cb
mov esp, ebp
pop ebp
ret 4
Function at 0x44c260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x44c31c
cmp byte [esi + 0x3d], 0
je 0x44c31c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x44c30a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x44c2d1
sub eax, 1
je 0x44c2d5
sub eax, 2
jne 0x44c30a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44c2f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x44c30a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004598cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004598cb
mov esp, ebp
pop ebp
ret
Function at 0x41548c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x415588
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41555b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 8], 0
jmp 0x4154e3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x24ce
jge 0x415559
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cdq
idiv ecx
mov ecx, dword [ebp - 0x14]
imul ecx, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 1], 0xc1
mov byte [ebp - 2], 0xc2
movzx eax, byte [ebp - 1]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
add ecx, eax
movzx eax, byte [ebp - 2]
imul eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x38]
xor ecx, dword [eax]
mov eax, ecx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push 0
push 0x5966
lea eax, [ebp - 0x44]
push eax
push 0x7dc8
call fcn.00421bad
add esp, 0x10
jmp 0x4154dc
jmp 0x415586
and dword [ebp - 0xc], 0
jmp 0x415568
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7be2
jge 0x415586
lea eax, [ebp - 0xc]
push eax
push 0
push 0x6dff
call fcn.00422dfb
add esp, 0xc
jmp 0x415561
jmp 0x4155a5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push 0x6b01
push dword [ebp - 0x3c]
push 0x77ee
push 0
call fcn.00421a44
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x431885
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
jmp 0x40c479
jmp 0x4325d9
push eax
push 0x20d0
pop eax
shl eax, 0x29
sar eax, 0x2e
shl eax, 0xc5
inc eax
sar eax, 0x82
dec eax
push 0x15923
pop eax
add eax, 0x2e0af
dec eax
shl eax, 0xf8
sub eax, 0x7df74
add eax, 0x31517
sub eax, 0xe407
push 0x170b5
pop eax
shr eax, 0
inc eax
shl eax, 8
dec eax
shr eax, 0x11
sar eax, 0xda
push 0x16d38
pop eax
shr eax, 4
shl eax, 0xde
sar eax, 0xbc
inc eax
dec eax
shl eax, 0x26
push 0x1686e
pop eax
dec eax
dec eax
sub eax, 0xcf64
xor eax, 0x692bc
dec eax
sar eax, 0xd2
push 0xc783
pop eax
inc eax
inc eax
xor eax, 0x3c5a5
dec eax
sar eax, 0x25
inc eax
pop eax
jmp 0x430bba
push eax
push 0x5c48
pop eax
shl eax, 0xfc
inc eax
shr eax, 0x1d
add eax, 0xedc44
push 0x5616
pop eax
sub eax, 0x28320
add eax, 0x13f4
add eax, 0x43cc5
shr eax, 0xd8
push 0xf744
pop eax
shr eax, 0xa8
xor eax, 0x26522
add eax, 0x7f360
xor eax, 0xa0c91
push 0x5d79
pop eax
inc eax
inc eax
shl eax, 0x58
sub eax, 0x41c23
pop eax
jmp 0x43093e
push eax
push 0x14ce5
pop eax
xor eax, 0x71a64
inc eax
push 0x9a99
pop eax
dec eax
shl eax, 0x83
pop eax
jmp 0x42f7da
push eax
push 0x3330
pop eax
inc eax
sar eax, 0x14
shr eax, 0x97
inc eax
shl eax, 0xbf
sar eax, 0xc0
shr eax, 0xa3
push 0xf2f2
pop eax
sar eax, 0x1a
xor eax, 0xcbb59
dec eax
inc eax
inc eax
sub eax, 0xe886e
dec eax
push 0x5d87
pop eax
shl eax, 0xca
sub eax, 0xc550c
sub eax, 0x7af66
sar eax, 0xc5
dec eax
shr eax, 0x27
sub eax, 0xba97d
push 0xec3e
pop eax
inc eax
xor eax, 0x9b5a1
add eax, 0x377ec
xor eax, 0x66252
inc eax
dec eax
sar eax, 0x12
push 0xfd17
pop eax
shl eax, 0xef
xor eax, 0x9f358
shr eax, 0x99
inc eax
shr eax, 0x4a
inc eax
shr eax, 0xb6
push 0xbd6b
pop eax
xor eax, 0x48b47
shl eax, 0xee
dec eax
shl eax, 2
shl eax, 0xc
shr eax, 2
sar eax, 0xc
push 0x8c86
pop eax
inc eax
shl eax, 0xcd
dec eax
inc eax
sar eax, 0xb6
shr eax, 0xfa
shl eax, 0xb5
pop eax
jmp 0x4280b7
jmp 0x42fd8d
jmp 0x4299f0
jmp 0x40ba20
jmp 0x426845
jmp 0x429f5a
jmp 0x48515a
push eax
push 0xb93a
pop eax
inc eax
shl eax, 0xba
shr eax, 0xde
inc eax
shr eax, 0x61
dec eax
push 0x5436
pop eax
add eax, 0xb04b7
dec eax
inc eax
add eax, 0xe99d4
dec eax
sar eax, 0x6e
push 0x15d04
pop eax
sub eax, 0x280c6
sub eax, 0x3642c
add eax, 0x93f4f
shl eax, 0
shl eax, 0x1a
inc eax
push 0x11007
pop eax
add eax, 0x2b5ab
sub eax, 0x76bda
dec eax
sub eax, 0xd529e
inc eax
sar eax, 0xb0
push 0x7fe0
pop eax
inc eax
sar eax, 0x1f
inc eax
xor eax, 0xf24aa
sub eax, 0x9b6ec
inc eax
push 0xdfb1
pop eax
inc eax
sar eax, 0x99
xor eax, 0x57d1a
add eax, 0x525a0500
or dword [eax], eax
push eax
push 0x11a9e
pop eax
xor eax, 0xd3846
dec eax
shr eax, 0x96
push 0x6716
pop eax
add eax, 0xb174d
shl eax, 0x33
xor eax, 0x9f62b
push 0x1191f
pop eax
shr eax, 0xc7
sub eax, 0xeb1ca
sar eax, 0x9d
pop eax
jmp 0x4285a7
jmp 0x432722
Function at 0x4333c8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 7
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x40], 0x5f43260
mov dword [ebp - 0x10], 0
jmp 0x4333fa
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x43340d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0x26bdde0b
jmp 0x4333f3
mov dword [ebp - 0x14], 1
jmp 0x43341d
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x43354e
mov dword [ebp - 0x18], 0
jmp 0x433437
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x43344a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x34], 0x97341720
jmp 0x433430
mov dword [ebp - 8], 0x6210b999
mov dword [ebp - 8], 0
jmp 0x433461
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jg 0x433549
mov dword [ebp - 0xc], 0x5b7f37c0
mov dword [ebp - 0x20], 0xb9e9d60a
mov dword [ebp - 0xc], 0
jmp 0x433489
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x433544
mov dword [ebp - 0x28], 0x7a329ef
mov dword [ebp - 0x1c], 1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4334b3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x20], eax
jle 0x4334d1
mov dword [ebp - 0x24], 1
jmp 0x4334d5
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1c], eax
je 0x4334e6
mov dword [ebp - 0x2c], 1
jmp 0x4334ea
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, 0xfce2949f
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jle 0x433506
mov dword [ebp - 0x30], 1
jmp 0x43350a
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x34]
cmp dword [ebp + eax - 0x48], ecx
je 0x43352f
mov dword [ebp - 0x38], 1
jmp 0x433533
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
jmp 0x433482
jmp 0x43345a
jmp 0x433416
push dword [ebp + 8]
push 0
push 0x7530
push 0x47a2
push 0x6f2b
push 0x32cc
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push 1
push 0x5972
push dword [ebp + 0x18]
call fcn.0043c7d0
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x436e88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x436ef9
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x436ed9
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0x6dec
push 0x5159
push 0x6db0
push 0x7dc2
push 0x6a41
call fcn.00438ca6
add esp, 0x1c
jmp 0x436ef7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x436ef7
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x436f1b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 0xc48
push 0
push 0x54be
push dword [ebp - 0x18]
push 0x43c1
call fcn.00437be1
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x43962a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4396a3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x439697
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x4396a1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x4396cf
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
push dword [eax]
push dword [ebp - 0x24]
push 0x7146
push 0
push dword [ebp - 0x28]
call fcn.004396d3
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x44031b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44037d
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x440372
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 0x34], eax
jmp 0x440378
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x440403
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4403e7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
push dword [eax]
push dword [ebp - 0x40]
push 0x64b9
push 0
mov eax, dword [ebp - 0x44]
push dword [eax]
call fcn.004396d3
add esp, 0x14
jmp 0x440403
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x440403
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret