joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x38], 0x211
mov dword [ebp - 0x3c], 0x45
mov dword [ebp - 0x40], 0x3c0
mov dword [ebp - 0x44], 0xe7
mov dword [ebp - 0x2c], 0xae
mov dword [ebp - 0x10], 0x29a
mov dword [ebp - 0x48], 0x37
mov dword [ebp - 8], 0x19d
mov dword [ebp - 0x4c], 0xc5
mov dword [ebp - 0x34], 0x353
mov dword [ebp - 0x50], 0x1eb
mov dword [ebp - 0x54], 0xc
mov dword [ebp - 0x28], 0x2f3
mov dword [ebp - 0x18], 0x30a
mov dword [ebp - 0x58], 0x1c2
mov dword [ebp - 0x24], 0x2e2
mov dword [ebp - 0x14], 0x21e
mov dword [ebp - 0x5c], 0x2ba
mov dword [ebp - 0x60], 0x7a
mov dword [ebp - 0x64], 0x6e
mov dword [ebp - 0x68], 0x3b1
mov dword [ebp - 0x6c], 0x3b3
mov dword [ebp - 4], 0
jmp 0x40ef02
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x189aa
cmp dword [ebp - 4], ecx
jge 0x40ef71
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x20]
jge 0x40ef6f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jge 0x40ef3e
mov dword [ebp - 0xc], 1
jmp 0x40ef45
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0x2c]
or ecx, dword [ebp - 0xc]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x30], 0
je 0x40ef69
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x40eef9
mov ecx, dword [ebp - 0x14]
sub ecx, 0x173
push ecx
mov edx, dword [ebp + 0x10]
sub edx, 0x1c2
push edx
mov eax, dword [ebp - 0x34]
sub eax, 0x191
push eax
call fcn.0040b5a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x412540
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x2c], 0x86
mov dword [ebp - 0x3c], 0x5f
mov dword [ebp - 0x20], 0x282
mov dword [ebp - 0x40], 0x30f
mov dword [ebp - 0x24], 0x2f1
mov dword [ebp - 8], 0x215
mov dword [ebp - 0x44], 0x2fe
mov dword [ebp - 0x28], 0x1ba
mov dword [ebp - 0x48], 0x1b2
mov dword [ebp - 0x4c], 0xbe
mov dword [ebp - 0x50], 0x15c
mov dword [ebp - 0x10], 0x3e6
mov dword [ebp - 0x14], 0x1dd
mov dword [ebp - 0x38], 0x196
mov dword [ebp - 0x54], 0x275
mov dword [ebp - 0x58], 0x2bd
mov dword [ebp - 0x5c], 0x2e6
mov dword [ebp - 0x60], 0x357
mov dword [ebp - 0x64], 0x79
mov dword [ebp - 0x34], 0x38c
mov dword [ebp - 0x68], 0x340
mov dword [ebp - 0x30], 0x3cc
mov dword [ebp - 0x1c], 0x231
mov dword [ebp - 0x6c], 0x3d2
mov eax, dword [ebp - 0x1c]
sub eax, 0x144
push eax
mov ecx, dword [ebp + 0x1c]
sub ecx, 0x1a2
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x3e
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x63
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1a6
push ecx
mov edx, dword [ebp - 8]
sub edx, 0x5f
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x19
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x197
push ecx
call fcn.004089c0
add esp, 0x20
mov dword [ebp - 4], 0
jmp 0x41264b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x38b
cmp dword [ebp - 4], eax
jge 0x412663
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jmp 0x412642
mov dword [ebp - 0xc], 0
jmp 0x412675
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x18]
sub eax, 0x188e4
cmp dword [ebp - 0xc], eax
jge 0x4126a7
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x14]
xor edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x1c]
jge 0x4126a5
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x41266c
mov dword [ebp - 0x18], 0
jmp 0x4126b9
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x195
cmp dword [ebp - 0x18], edx
jge 0x4126d2
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x4126b0
mov esp, ebp
pop ebp
ret
Function at 0x418f40
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x10], 0x226
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x1c], 0x9a
mov dword [ebp - 0x20], 0x2e0
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x24], 0x318
mov dword [ebp - 0x28], 0x1b3
mov dword [ebp - 0x2c], 0x76
mov dword [ebp - 0x30], 0x117
mov dword [ebp - 0x34], 0x1f7
mov dword [ebp - 8], 0x322
mov dword [ebp - 0x38], 0x96
mov dword [ebp - 0x3c], 0x288
mov dword [ebp - 0x40], 0x39f
mov dword [ebp - 0x44], 0x1c7
mov dword [ebp - 0x48], 0x272
mov dword [ebp - 0x4c], 0x281
mov dword [ebp - 0x50], 0x93
mov dword [ebp - 0x54], 0x69
mov dword [ebp - 0x58], 0x162
mov dword [ebp - 0x5c], 0xc9
mov dword [ebp - 4], 0
jmp 0x418ff2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
sub ecx, 0x18895
cmp dword [ebp - 4], ecx
jge 0x419011
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x418fe9
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov esp, ebp
pop ebp
ret
Function at 0x41d2b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x40], 0x222
mov dword [ebp - 0x10], 0x17e
mov dword [ebp - 0x54], 0x134
mov dword [ebp - 4], 0x221
mov dword [ebp - 0x48], 0x2bf
mov dword [ebp - 0x5c], 0x35d
mov dword [ebp - 0x28], 0xaa
mov dword [ebp - 0x60], 0x322
mov dword [ebp - 0x64], 0x243
mov dword [ebp - 0x68], 0x33c
mov dword [ebp - 0x2c], 0xf9
mov dword [ebp - 0x6c], 0xcb
mov dword [ebp - 0x3c], 0x92
mov dword [ebp - 0x58], 0xcf
mov dword [ebp - 0x70], 0x42
mov dword [ebp - 0xc], 0x31d
mov dword [ebp - 0x4c], 0x273
mov dword [ebp - 0x44], 0x34a
mov dword [ebp - 0x74], 0x1a1
mov dword [ebp - 0x78], 0x34a
mov dword [ebp - 0x30], 0x76
mov dword [ebp - 0x7c], 0x2aa
mov dword [ebp - 8], 0
jmp 0x41d362
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
sub ecx, 0x18962
cmp dword [ebp - 8], ecx
jge 0x41d462
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0x18]
add ecx, 1
mov dword [ebp + 0x18], ecx
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x38]
jge 0x41d45d
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x3c]
jge 0x41d3a6
mov dword [ebp - 0x14], 1
jmp 0x41d3ad
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x40]
jge 0x41d3be
mov dword [ebp - 0x18], 1
jmp 0x41d3c5
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x10]
jge 0x41d3d6
mov dword [ebp - 0x1c], 1
jmp 0x41d3dd
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x44]
or eax, dword [ebp - 0x1c]
je 0x41d457
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0xc]
jge 0x41d405
mov dword [ebp - 0x20], 1
jmp 0x41d40c
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0x20]
cmp eax, dword [ebp + 0x1c]
jge 0x41d41d
mov dword [ebp - 0x24], 1
jmp 0x41d424
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
and edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x4c]
xor edx, dword [ebp - 4]
or edx, dword [ebp - 0x24]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp + 0x18]
sub eax, 1
mov dword [ebp + 0x18], eax
cmp dword [ebp - 0x50], 0
je 0x41d457
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x41d359
mov edx, dword [ebp - 0x28]
add edx, 0x27f
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x1f0
push eax
mov ecx, dword [ebp + 0x14]
sub ecx, 0x107
push ecx
mov edx, dword [ebp - 0x54]
add edx, 0x1ee
push edx
mov eax, dword [ebp - 0x58]
add eax, 0x2a9
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x102
push ecx
call fcn.0040ad50
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x41f860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x28], 0x1fd
mov dword [ebp - 0x2c], 0x191
mov dword [ebp - 0x30], 0x213
mov dword [ebp - 0x14], 0x18c
mov dword [ebp - 0x34], 0x370
mov dword [ebp - 0x20], 0x222
mov dword [ebp - 0x38], 0xb8
mov dword [ebp - 0x3c], 0xad
mov dword [ebp - 0x40], 0x116
mov dword [ebp - 0x44], 0x256
mov dword [ebp - 0x48], 0x1db
mov dword [ebp - 0x24], 0x1c6
mov dword [ebp - 0x4c], 0x1e
mov dword [ebp - 0x50], 0x1f7
mov dword [ebp - 4], 0x182
mov dword [ebp - 0x1c], 0x2c5
mov dword [ebp - 0x54], 0x3ac
mov dword [ebp - 0x58], 0x36e
mov dword [ebp - 0x5c], 0x37a
mov dword [ebp - 0x60], 0x18a
mov dword [ebp - 0x64], 0x340
mov dword [ebp - 0x18], 0x21
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jge 0x41f911
mov dword [ebp - 0xc], 1
jmp 0x41f918
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp - 0x20]
jge 0x41f929
mov dword [ebp - 0x10], 1
jmp 0x41f930
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0xc]
or edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x14]
or edx, eax
je 0x41f949
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x41f95b
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x1882c
cmp dword [ebp - 8], eax
jge 0x41f979
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41f952
mov esp, ebp
pop ebp
ret

Function at 0x421190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x18], 0x27c
mov dword [ebp - 0x14], 0x1d2
mov dword [ebp - 0x1c], 0x38f
mov dword [ebp - 0x20], 0x28a
mov dword [ebp - 0x24], 0x307
mov dword [ebp - 0x28], 0x18a
mov dword [ebp - 0x2c], 0xd4
mov dword [ebp - 0x30], 0x46
mov dword [ebp - 0x34], 0xbb
mov dword [ebp - 0x38], 0x1e2
mov dword [ebp - 0x3c], 0x69
mov dword [ebp - 0x10], 0x13
mov dword [ebp - 0x40], 0x19
mov dword [ebp - 0x44], 0x6e
mov dword [ebp - 0x48], 0x396
mov dword [ebp - 4], 0x21d
mov dword [ebp - 0x4c], 0x121
mov dword [ebp - 0xc], 0x3a9
mov dword [ebp - 0x50], 0x32e
mov dword [ebp - 0x54], 0x341
mov dword [ebp - 0x58], 0x1f9
mov dword [ebp - 0x5c], 0x79
mov dword [ebp - 0x60], 0x352
mov dword [ebp - 0x64], 0x3f
mov eax, dword [ebp - 0x10]
add eax, 0x316
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 0x295
push ecx
mov edx, dword [ebp + 0xc]
sub edx, 0x42
push edx
mov eax, dword [ebp - 4]
add eax, 0x105
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1a6
push ecx
mov edx, dword [ebp + 0x18]
sub edx, 0x1aa
push edx
call fcn.0040ad50
add esp, 0x18
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x171
push ecx
call fcn.0041c1d0
add esp, 4
mov dword [ebp - 8], 0
jmp 0x4212aa
mov eax, dword [ebp + 0x10]
sub eax, 0x186f4
cmp dword [ebp - 8], eax
jge 0x4212cb
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4230b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x40], 0x5e
mov dword [ebp - 0x14], 0x83
mov dword [ebp - 0x48], 0x25a
mov dword [ebp - 0x30], 0x20f
mov dword [ebp - 0x4c], 0x155
mov dword [ebp - 0x50], 0x2c6
mov dword [ebp - 0x54], 0x2f3
mov dword [ebp - 0x58], 0x123
mov dword [ebp - 0x34], 0x373
mov dword [ebp - 0x10], 0x225
mov dword [ebp - 0x28], 0x2e5
mov dword [ebp - 0x2c], 0x93
mov dword [ebp - 0x5c], 0x36e
mov dword [ebp - 0x60], 0x14
mov dword [ebp - 0x64], 0x3a5
mov dword [ebp - 0x68], 0xbe
mov dword [ebp - 0xc], 0x34f
mov dword [ebp - 0x44], 0x325
mov dword [ebp - 0x6c], 0x21f
mov dword [ebp - 0x70], 0x14f
mov dword [ebp - 0x74], 0x3e8
mov dword [ebp - 0x1c], 0x27
mov dword [ebp - 0x78], 0x75
mov eax, dword [ebp - 0x28]
add eax, 0x76
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x159
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x76
push edx
mov eax, dword [ebp - 0x30]
add eax, 0xd1
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x75
push ecx
mov edx, dword [ebp + 0x10]
add edx, 0x206
push edx
mov eax, dword [ebp - 0x1c]
add eax, 0x2fe
push eax
mov ecx, dword [ebp + 0x20]
sub ecx, 0xc1
push ecx
call fcn.0041f350
add esp, 0x20
mov dword [ebp - 4], 0
jmp 0x4231b6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x82
cmp dword [ebp - 4], eax
jge 0x4231ce
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
jmp 0x4231ad
mov dword [ebp - 8], 0
jmp 0x4231e0
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
sub eax, 0x189c7
cmp dword [ebp - 8], eax
jge 0x42326c
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x3c]
jge 0x423213
mov dword [ebp - 0x18], 1
jmp 0x42321a
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x44]
jge 0x42322b
mov dword [ebp - 0x20], 1
jmp 0x423232
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x14]
jge 0x423243
mov dword [ebp - 0x24], 1
jmp 0x42324a
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x24]
je 0x423267
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4231d7
mov esp, ebp
pop ebp
ret
Function at 0x423660
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x34], 0x2d8
mov dword [ebp - 0x38], 0x36e
mov dword [ebp - 8], 0x2c0
mov dword [ebp - 0x3c], 0x38a
mov dword [ebp - 0x40], 0xd5
mov dword [ebp - 0x44], 0x1d3
mov dword [ebp - 0x48], 0x38e
mov dword [ebp - 0x4c], 0x308
mov dword [ebp - 0x24], 0x27d
mov dword [ebp - 0x20], 0x284
mov dword [ebp - 0x1c], 0x343
mov dword [ebp - 0x14], 0x199
mov dword [ebp - 0x50], 0x222
mov dword [ebp - 0x18], 0x28f
mov dword [ebp - 0x54], 0x30d
mov dword [ebp - 0x58], 0x6c
mov dword [ebp - 0x28], 0x32b
mov dword [ebp - 0x5c], 0x27d
mov dword [ebp - 0xc], 0x13
mov dword [ebp - 0x60], 0x359
mov dword [ebp - 0x2c], 0x334
mov dword [ebp - 0x64], 0x297
mov dword [ebp - 0x30], 0x3d3
mov dword [ebp - 0x10], 0x26d
mov eax, dword [ebp - 0xc]
add eax, 0x119
push eax
call fcn.0041bfe0
add esp, 4
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x18]
add edx, 0x252
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x9e
push eax
mov ecx, dword [ebp + 8]
sub ecx, 0xe9
push ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x76
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x254
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x138
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0xbe
push edx
mov eax, dword [ebp - 0x28]
sub eax, 0x17c
push eax
call fcn.0041fec0
add esp, 0x20
mov dword [ebp - 4], 0
jmp 0x42378c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x189d4
cmp dword [ebp - 4], edx
jge 0x4237b3
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x30]
jge 0x4237b1
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x423783
mov esp, ebp
pop ebp
ret
Function at 0x423e40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x40], 0xfb
mov dword [ebp - 0x10], 0x2e8
mov dword [ebp - 0x5c], 0x76
mov dword [ebp - 0x28], 0x15d
mov dword [ebp - 0x24], 0x216
mov dword [ebp - 0x34], 0x181
mov dword [ebp - 0x38], 0x36d
mov dword [ebp - 0x48], 0x2ac
mov dword [ebp - 0x44], 0x33c
mov dword [ebp - 0x4c], 0x2fd
mov dword [ebp - 0x60], 0x1af
mov dword [ebp - 0x64], 0x172
mov dword [ebp - 0x68], 0x26a
mov dword [ebp - 0x20], 0x1a0
mov dword [ebp - 0x6c], 0x29e
mov dword [ebp - 4], 0x346
mov dword [ebp - 0x70], 0x149
mov dword [ebp - 0x74], 0xc7
mov dword [ebp - 0x78], 0xcb
mov dword [ebp - 0x1c], 0x318
mov dword [ebp - 0x2c], 0x11f
mov dword [ebp - 0x7c], 0x25a
mov dword [ebp - 0x80], 0x326
mov dword [ebp - 0x30], 0x11b
mov dword [ebp - 0x3c], 0x1a
mov dword [ebp - 8], 0
jmp 0x423f0a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x18840
cmp dword [ebp - 8], ecx
jge 0x423f29
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x423f01
mov eax, dword [ebp + 0x18]
add eax, 0x171
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x2f6
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x9b
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x11
push eax
call fcn.0041d060
add esp, 0x10
mov ecx, dword [ebp + 0x24]
sub ecx, 0x119
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x77
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0x2d
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x19d
push ecx
call fcn.00407b80
add esp, 0x10
mov edx, dword [ebp + 8]
add edx, 0x149
push edx
mov eax, dword [ebp - 0x38]
sub eax, 0xde
push eax
mov ecx, dword [ebp + 0x24]
sub ecx, 0x24f
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x1e8
push edx
mov eax, dword [ebp - 0x40]
add eax, 0xaa
push eax
call fcn.00422000
add esp, 0x14
mov dword [ebp - 0xc], 0
jmp 0x423fc9
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x189dc
cmp dword [ebp - 0xc], edx
jge 0x424053
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x48]
jge 0x423fe8
mov dword [ebp - 0x14], 1
jmp 0x423fef
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x28]
cmp ecx, dword [ebp - 0x4c]
jge 0x424000
mov dword [ebp - 0x18], 1
jmp 0x424007
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
and edx, dword [ebp - 4]
or edx, dword [ebp - 0x18]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0x50], 0
je 0x42404e
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp + 0x20]
sub eax, 1
mov dword [ebp + 0x20], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x58]
jge 0x42404e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x423fc0
mov esp, ebp
pop ebp
ret
Function at 0x470570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x54], 0xfe
mov dword [ebp - 0x64], 0x217
mov dword [ebp - 0x68], 0x29a
mov dword [ebp - 0x34], 0x3a1
mov dword [ebp - 0x6c], 0x187
mov dword [ebp - 0x60], 0x380
mov dword [ebp - 0x48], 0x38f
mov dword [ebp - 0x70], 0x17a
mov dword [ebp - 0x74], 0x27f
mov dword [ebp - 4], 0x173
mov dword [ebp - 0x40], 0x131
mov dword [ebp - 0x3c], 0x28d
mov dword [ebp - 0x10], 0x287
mov dword [ebp - 0x2c], 0xb1
mov dword [ebp - 0x4c], 0x315
mov dword [ebp - 0x50], 0x232
mov dword [ebp - 0x78], 0x18c
mov dword [ebp - 0x7c], 0x2f
mov dword [ebp - 0x1c], 0x383
mov dword [ebp - 0x14], 0x88
mov dword [ebp - 0x24], 0x395
mov dword [ebp - 0x80], 0x360
mov dword [ebp - 0x84], 0x1df
mov dword [ebp - 0x88], 0x22f
mov dword [ebp - 0x58], 0x1e0
mov dword [ebp - 8], 0
jmp 0x470640
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x87
cmp dword [ebp - 8], ecx
jge 0x47065f
mov edx, dword [0x513240]
add edx, 1
mov dword [0x513240], edx
jmp 0x470637
mov eax, dword [0x513234]
cmp eax, dword [0x510034]
jge 0x470675
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
jmp 0x470687
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [0x513238]
sub eax, 0x1ba
cmp dword [ebp - 0xc], eax
jge 0x4706a1
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x47067e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x480688
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4806c7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4806c7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4806c7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4806c7
cmp dword [ecx + 0x74], 0xe
jbe 0x4806c7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x48cd44
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48cd83
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48cd83
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48cd83
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48cd83
cmp dword [ecx + 0x74], 0xe
jbe 0x48cd83
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4ac9c9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ac89d
Function at 0x4ad4c4
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x519180]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4ad50f
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004ad964
test al, al
jne 0x4ad509
sub edx, 2
cmp edx, edi
jne 0x4ad4ef
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4ad531
lea eax, [edi + 2]
cmp edx, eax
je 0x4ad531
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004ad18b
add esp, 0x10
jmp 0x4ad62b
push esi
lea ecx, [ebp - 0x255]
call fcn.004ad964
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ad574
push dword [ebp - 0x25c]
jmp 0x4ad521
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4ad5b1
cmp word [ebp - 0x226], 0
je 0x4ad5d2
cmp word [ebp - 0x226], ax
jne 0x4ad5b1
cmp word [ebp - 0x224], 0
je 0x4ad5d2
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004ad18b
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4ad61e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4ad58b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4ad606
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4ad62b
push 0x4acbdb
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004b8740
add esp, 0x10
jmp 0x4ad5fb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00480bf9
leave
ret