joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bea
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x75697965
mov byte [ecx + 4], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 4
jne 0x404c28
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404c54
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x6979455e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 5
jne 0x404c94
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404cc6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x6979655e
mov word [ecx + 4], 0x75
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 5
jne 0x404d06
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404d38
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.qtibkey]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x7569
mov byte [ecx + 0xa], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xa
jne 0x404d82
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404dae
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.DxhtQrnc]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x727364
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xb
jne 0x404df5
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x404e28
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.otelm.el]
vmovsd qword [ecx], xmm0
mov word [ecx + 8], 0x6d
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 9
jne 0x404e6e
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x404ea0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [0x439dda]
vmovsd qword [ecx + 0xd], xmm0
vmovups xmm0, xmmword [str.NuUom_pWidwNfRebthoo]
vmovups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0x14
jne 0x404eed
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x405eb9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov esi, dword [0x442070]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
mov ecx, esp
push ecx
push 0x40
mov dword [esp + 0x10], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x405f2c
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp + 4], ecx
je 0x405f33
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
mov edx, esp
je 0x405f54
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x405f54
mov eax, 0xa
jmp 0x405f8e
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
mov edx, esp
jne 0x405f4a
mov cl, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x405f54
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 4]
mov esi, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp + 4]
mov al, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405f96
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
test eax, eax
je 0x405fe6
mov esi, ecx
cmp dword [ecx + 8], 0
je 0x405fd7
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call ebp
test eax, eax
je 0x405fcf
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x405fb0
mov eax, dword [esi]
push eax
push 0
push dword [0x44206c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4094f0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.0040ac90
test al, al
je 0x409524
push 2
call dword [0x441e8c]
add esp, 4
push ebx
push edi
push esi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.00408db0
add esp, 0x14
pop esi
pop edi
pop ebx
jmp fcn.0040ad90

Function at 0x40a6a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x40a6b1
jmp dword [eax*4 + 0x43b2f0]
cmp dword [0x4420c4], 0
je 0x40a7b3
push 0x4420c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4420e0]
test edi, edi
je 0x40a7a8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a6fb
mov edi, dword [edi + 8]
test edi, edi
je 0x40a7a8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40a6f0
test esi, esi
je 0x40a6f0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40a6f0
cmp dword [0x4420c4], 0
jne 0x40a730
push 0x4420c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4420c4], 1
jmp case.default.0x40a6b1
call fcn.004084c0
jmp case.default.0x40a6b1
cmp dword [0x4420c4], 0
je case.default.0x40a6b1
push 0x4420c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4420e0]
test edi, edi
je 0x40a803
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a787
mov edi, dword [edi + 8]
test edi, edi
je 0x40a803
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40a780
test esi, esi
je 0x40a780
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40a780
push 0x4420c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4420c4]
cmp eax, 1
jne case.default.0x40a6b1
mov eax, dword [0x4420e0]
test eax, eax
je 0x40a7e2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.0042d33c
add esp, 4
mov eax, esi
test esi, esi
jne 0x40a7d0
mov dword [0x4420e0], 0
mov dword [0x4420c4], 0
push 0x4420c8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x40a6b1
push 0x4420c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a940
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x42e004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40a9a6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40a9a6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40a9a6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40a9a6
mov edx, dword [esp + 0xc]
sub edx, dword [0x42e004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40a996
add esi, 0x28
dec ecx
je 0x40a9a6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40a990
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40a990
mov eax, esi
pop esi
pop edi
ret
Function at 0x40abe0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp byte [0x443093], 1
jne 0x40abfe
cmp byte [0x443092], 0
jne 0x40ac1d
jmp 0x40ac38
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40ac38
push 2
call dword [0x441e8c]
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.0040acd0
add esp, 0x10
mov dword [esi], 0x43b4e0
mov dword [esi + 4], 0x443088
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.0040b8b0
xor eax, eax
pop esi
pop edi
ret

Function at 0x40ac90
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x443093], 1
jne 0x40aca4
cmp byte [0x443092], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x443092]
mov byte [0x443093], 1
ret

Function at 0x40acf0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x443093], 1
jne 0x40ad14
cmp byte [0x443092], 0
jne 0x40ad33
jmp 0x40ad4f
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40ad4f
push 2
call dword [0x441e8c]
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.0040acd0
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x40ad82
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ad90
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x443093], 1
jne 0x40adb7
cmp byte [0x443092], 0
jne 0x40add6
jmp 0x40adf2
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40adf2
push 2
call dword [0x441e8c]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.0040acd0
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
mov edi, 0xffffe672
test al, al
je 0x40ae82
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
push ebx
call edi
xor edi, edi
cmp ebx, 0xffffffff
jne 0x40ae82
mov eax, dword [esi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov eax, esp
mov ecx, esi
push eax
call ebx
mov eax, dword [esi]
mov ebx, dword [eax + 0x34]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0
call ebx
cmp dword [esp + 0x10], 0
je 0x40ae82
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0xfffffffffffffffe
call ebx
mov ebx, eax
add ebx, dword [esp + 0x10]
mov eax, dword [esi]
mov ebp, dword [eax + 0x10]
mov ecx, ebp
call dword [section..00cfg]
mov ecx, esi
push ebx
push 0xfffffffffffffffe
call ebp
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40ae90
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x443093], 1
jne 0x40aeaa
cmp byte [0x443092], 0
jne 0x40aec9
jmp 0x40aee3
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40aee3
push 2
call dword [0x441e8c]
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.0040acd0
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x40af00
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x443093], 1
jne 0x40af1a
cmp byte [0x443092], 0
jne 0x40af39
jmp 0x40af53
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40af53
push 2
call dword [0x441e8c]
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.0040acd0
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x40af70
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x443093], 1
jne 0x40af8f
cmp byte [0x443092], 0
jne 0x40afae
jmp 0x40afc9
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40afc9
push 2
call dword [0x441e8c]
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.0040acd0
add esp, 0x10
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x40aff0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x443093], 1
jne 0x40b00a
cmp byte [0x443092], 0
jne 0x40b029
jmp 0x40b043
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40b043
push 2
call dword [0x441e8c]
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.0040acd0
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x40b060
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x443093], 1
jne 0x40b084
cmp byte [0x443092], 0
jne 0x40b0a3
jmp 0x40b0bf
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443093], 1
test eax, eax
setne byte [0x443092]
je 0x40b0bf
push 2
call dword [0x441e8c]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.0040acd0
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40b560
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x443091], 1
jne 0x40b574
cmp byte [0x443090], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x443090]
mov byte [0x443091], 1
ret
Function at 0x40e770
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x101c
call fcn.00408ac4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x40e8d2
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x40e929
shr ecx, 2
cmp ecx, 2
mov eax, 1
cmovae eax, ecx
mov dword [esp + 0xc], eax
mov bl, 1
mov dword [esp + 0x10], ecx
jmp 0x40e7ea
mov edx, dword [esp + 0x14]
inc edx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setb bl
xor eax, eax
cmp edx, dword [esp + 0xc]
je 0x40e929
mov byte [esp + 3], bl
mov dword [esp + 0x14], edx
mov esi, dword [esp + edx*4 + 0x1c]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x1034]
mov dword [edx], esi
mov dword [esp + 8], esi
movzx esi, word [esi + eax + 6]
test esi, esi
je 0x40e7d0
add eax, dword [esp + 8]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ebx, ebx
jmp 0x40e836
add ebp, 0x28
dec esi
je 0x40e7d0
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 8]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40e870
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x40e8a0
test bl, 1
jne 0x40e8bf
jmp 0x40e830
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1030]
cmp eax, ecx
movzx eax, bl
mov ebx, eax
mov edx, 1
cmova ebx, edx
cmp edi, ecx
cmova ebx, eax
test bl, 1
jne 0x40e8bf
jmp 0x40e830
mov ecx, dword [esp + 0x1034]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
test bl, 1
je 0x40e830
mov eax, dword [esp + 4]
and al, 1
je 0x40e830
movzx eax, byte [esp + 3]
jmp 0x40e929
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x443091], 1
jne 0x40e8ee
cmp byte [0x443090], 0
jne 0x40e90d
jmp 0x40e927
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x443091], 1
test eax, eax
setne byte [0x443090]
je 0x40e927
push 2
call dword [0x441e8c]
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.0040acd0
add esp, 0xc
xor eax, eax
and al, 1
add esp, 0x101c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x41e557
Capabilities:
Delete file

Disassembly:
mov eax, 0x4470af
call fcn.00420850
sub esp, 0x1dc
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
call fcn.0041e800
test al, 0x10
pop ecx
je 0x41e6d9
push 1
lea eax, [ebp + 8]
pop ebx
push 0x45460c
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041e787
add esp, 0xc
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], bl
push ecx
mov ecx, eax
call fcn.004049fb
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.004014d4
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0xffffffff
je 0x41e680
test ebx, ebx
je 0x41e675
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x1bc]
push 0x4545e0
push eax
call ebx
test eax, eax
je 0x41e660
lea eax, [ebp - 0x1bc]
push 0x4545dc
push eax
call ebx
test eax, eax
je 0x41e660
lea eax, [ebp - 0x11]
push 0
push eax
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x449500
mov dword [ebp - 0x20], 0x4494f8
call fcn.00404613
sub esp, 0x28
lea ecx, [ebp - 0x40]
mov eax, esp
mov dword [ebp - 0x18], esp
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov byte [ebp - 4], 4
call fcn.0041e70e
add esp, 0xc
call fcn.0041e557
add esp, 0x28
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.004014d4
lea eax, [ebp - 0x1e8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebx, eax
jmp 0x41e5da
test esi, esi
je 0x41e680
push edi
call esi
or dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004049fb
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41e6af
lea eax, [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0x60]
call fcn.00409ee8
lea eax, [ebp - 0x60]
push 0x44cb30
push eax
call fcn.00421735
cmp dword [ebp - 0x10], 0xffffffff
je 0x41e6be
test esi, esi
je 0x41e6be
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014d4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea ecx, [ebp + 8]
call fcn.004049fb
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41e6be
lea eax, [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0xa8]
call fcn.00409ee8
lea eax, [ebp - 0xa8]
push 0x44cb30
push eax
call fcn.00421735

Function at 0x41e800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov ecx, dword [ebp + 8]
call fcn.004049fb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41e835
push 1
lea ecx, [ebp - 0x48]
push dword [ebp + 8]
call fcn.00409ee8
lea eax, [ebp - 0x48]
push 0x44cb30
push eax
call fcn.00421735
leave
ret