joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59f282
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0059f1fe
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x59f3f1
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x59f3f1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x59f3a6
jg 0x59f2de
test eax, eax
je 0x59f39c
push 1
push 0x1000
call fcn.0059ba73
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x59f301
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x59f393
push 0x8000
push ebx
call fcn.00598f20
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x59f32a
jg 0x59f325
cmp ecx, 0x1000
jb 0x59f32a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0059b106
add esp, 0x10
cmp eax, 0xffffffff
je 0x59f36f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x59f325
jl 0x59f356
test ecx, ecx
jne 0x59f317
push dword [ebp - 0xc]
push ebx
call fcn.00598f20
push esi
call fcn.0059bad0
add esp, 0xc
xor ebx, ebx
jmp 0x59f3ff
cmp byte [edi + 0x24], 0
je 0x59f386
cmp dword [edi + 0x20], 5
jne 0x59f386
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x59f391
mov ebx, dword [edi + 0x18]
jmp 0x59f393
xor ebx, ebx
push esi
call fcn.0059bad0
pop ecx
jmp 0x59f3ff
test ecx, ecx
jg 0x59f368
jl 0x59f3a6
test eax, eax
jae 0x59f368
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00597d64
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x59f3c6
cmp byte [edi + 0x1c], 0
je 0x59f368
jmp 0x59f3f7
push ebx
call fcn.0059f194
pop ecx
push eax
call dword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
jne 0x59f368
call dword [sym.imp.kernel32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x59f3ff
cmp byte [edi + 0x1c], 0
je 0x59f3fc
mov ebx, dword [edi + 0x18]
jmp 0x59f3ff
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00597d64
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5a2bed
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5a2c8a
push ebx
push esi
call fcn.005a2bb6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0059d30f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5a2c37
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5a2c89
push edi
push eax
call fcn.0059bb0a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5a2c57
call fcn.0059bad0
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5a2c88
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0059d30f
add esp, 0x20
test eax, eax
jne 0x5a2c76
push edi
call fcn.0059bad0
jmp 0x5a2c7e
push ebx
call fcn.0059bad0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5a2c8d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5a2c9e
pop esi
ret
push ebx
push edi
push esi
call fcn.005a2bb6
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0059bb0a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5a2cc6
push ebx
push esi
push edi
call fcn.005885b0
add esp, 0xc
push 0
call fcn.0059bad0
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x5a3421
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a2f3c

Function at 0x5a6c69
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x636510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x5a6cac
call fcn.0058d0f2
mov dword [eax], 0xf
call fcn.0058d105
mov dword [eax], 0xd
call fcn.0059bde6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058774b
leave
ret
test eax, eax
jne 0x5a6cb3
inc eax
jmp 0x5a6ca0
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x5a6c9e
xor eax, eax
cmp ecx, 1
setne al
jmp 0x5a6ca0

Function at 0x5a99f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a9a1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a9a1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x5b0890
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [esp + 4]
push dword [esp + 0x44]
push edx
push eax
call fcn.00538520
add esp, 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x5b08e2
mov ecx, dword [0x60c108]
mov edx, dword [0x60c10c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 8]
mov dword [esi + 8], edx
mov dword [esi], 1
test ecx, ecx
je 0x5b0945
push 1
push ecx
push eax
call fcn.00452e30
add esp, 0x40
pop esi
pop edi
pop ebx
ret
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x5b094c
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x5b0945
push 1
push ebx
push edi
call fcn.00452e30
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x5b0939
jmp 0x5b0945

Function at 0x5b0a70
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x5b0aea
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x5b0b25
cmp dword [esp + 4], 0
je 0x5b0b0c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x5b0b48
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x637398]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x637398], edi
jne 0x5b0ad0
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x5b0b1c
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x5b0b8f
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x5b0b10
mov esi, dword [esp]
jmp 0x5b0b1c
mov esi, dword [edi]
jmp 0x5b0b1b
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x60d3b8
push 0x60d3ec
push eax
call fcn.005b0060
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x60d410
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x60d418
push eax
call fcn.005b1670
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x60d410
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.005b00c0
ud2
Function at 0x5b18b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x5b1901
cmp eax, 1
jne 0x5b1978
mov dword [esp], 0x61042b
jmp 0x5b1908
mov dword [esp], 0x61042d
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x5b1994
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x610490
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x546650
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x449390
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x449390
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x5b1a1a
mov edx, 7
mov dword [esp], str.matches_assertion_failed:___left__right___n__left:_____n_right:___:
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x5b191d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 8]
mov dword [esp + 0x38], 0x61046c
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], 0x546650
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x449390
lea esi, [esp + 0x50]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x449390
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], fcn.005409e0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.005b1670
add esp, 8
ud2
Function at 0x421d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xcc
mov ecx, dword [0x42d250]
test ecx, ecx
je 0x421d1e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x68], 0x41414141
mov eax, dword [0x428380]
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x41414141
mov dword [ebp - 0x60], 0x41414141
mov dword [ebp - 0x48], eax
mov eax, dword [0x428384]
mov dword [ebp - 0x5c], 0x41414141
mov dword [ebp - 0x58], 0x41414141
mov dword [ebp - 0x44], eax
mov eax, dword [0x428388]
mov dword [ebp - 0x54], 0x41414141
mov dword [ebp - 0x50], 0x41414141
mov dword [ebp - 0x40], eax
mov eax, dword [0x42838c]
mov dword [ebp - 0x4c], 0x41414141
mov dword [ebp - 0x3c], eax
mov eax, dword [0x428390]
mov dword [ebp - 0x38], eax
mov eax, dword [0x428394]
mov dword [ebp - 0x34], eax
mov eax, dword [0x428398]
mov dword [ebp - 0x30], eax
mov eax, dword [0x42839c]
mov dword [ebp - 0x2c], eax
movzx eax, word [0x4283a0]
mov word [ebp - 0x28], ax
mov dword [esp], esi
call dword [fcn.0042e404]
movzx eax, ax
sub esp, 4
test eax, eax
mov dword [ebp - 0xbc], eax
jne 0x421efc
mov dword [esp], 0x3c
call fcn.00422fd0
test eax, eax
mov ebx, eax
je 0x421f30
cld
mov edi, eax
mov eax, dword [ebp - 0xbc]
mov ecx, 0xf
rep stosd dword es:[edi], eax
mov dword [ebx + 4], fcn.00423070
mov ecx, 1
mov dword [ebx + 8], 0x421c50
mov eax, dword [0x42d220]
mov dword [ebx], 0x3c
mov edx, dword [0x42d224]
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x14], eax
mov eax, dword [0x4240f0]
mov dword [ebx + 0x18], edx
mov edx, dword [0x4240f4]
mov dword [ebx + 0x1c], eax
mov eax, dword [0x42d230]
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x30], 0xffffffff
mov dword [ebx + 0x2c], eax
mov edx, dword [0x4240fc]
mov eax, dword [0x4240f8]
mov dword [ebx + 0x38], edx
mov edx, 0x1f
mov dword [ebx + 0x34], eax
mov esi, esi
mov eax, ebx
and eax, ecx
cmp eax, 1
sbb eax, eax
and al, 0x20
add ecx, ecx
add al, 0x41
mov byte [edx + ebp - 0xb8], al
dec edx
jns 0x421e50
mov eax, dword [0x428380]
mov dword [ebp - 0x98], eax
mov eax, dword [0x428384]
mov dword [ebp - 0x94], eax
mov eax, dword [0x428388]
mov dword [ebp - 0x90], eax
mov eax, dword [0x42838c]
mov dword [ebp - 0x8c], eax
mov eax, dword [0x428390]
mov dword [ebp - 0x88], eax
mov eax, dword [0x428394]
mov dword [ebp - 0x84], eax
mov eax, dword [0x428398]
mov dword [ebp - 0x80], eax
mov eax, dword [0x42839c]
mov dword [ebp - 0x7c], eax
movzx eax, word [0x4283a0]
mov word [ebp - 0x78], ax
lea eax, [ebp - 0xb8]
mov dword [esp], eax
call dword [fcn.0042e3e0]
movzx edi, ax
sub esp, 4
test edi, edi
jne 0x421f21
xor edx, edx
test edx, edx
jne 0x421f03
mov dword [esp], ebx
call fcn.00422fc0
mov dword [esp], esi
call dword [fcn.0042e404]
sub esp, 4
movzx eax, ax
call fcn.00421c60
mov ebx, eax
mov dword [0x42d250], ebx
lea eax, [ebx + 4]
mov dword [0x42d240], eax
lea eax, [ebx + 8]
mov dword [0x42d260], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
call fcn.00421c60
cmp eax, ebx
mov edx, edi
jne 0x421edf
jmp 0x421ee1
call fcn.00423070
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4065b0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
add eax, 0xffff3fac
cmp eax, 0x170
ja case.0x4065cb.49237
movzx eax, byte [eax + 0x406a38]
jmp dword [eax*4 + 0x4068c0]
xor eax, eax
ret 4
mov eax, 1
ret 4
mov eax, 2
ret 4
mov eax, 3
ret 4
mov eax, 4
ret 4
mov eax, 5
ret 4
mov eax, 6
ret 4
mov eax, 7
ret 4
mov eax, 8
ret 4
mov eax, 9
ret 4
mov eax, 0xa
ret 4
mov eax, 0xb
ret 4
mov eax, 0xc
ret 4
mov eax, 0xd
ret 4
mov eax, 0xe
ret 4
mov eax, 0xf
ret 4
mov eax, 0x10
ret 4
mov eax, 0x11
ret 4
mov eax, 0x12
ret 4
mov eax, 0x13
ret 4
mov eax, 0x14
ret 4
mov eax, 0x15
ret 4
mov eax, 0x16
ret 4
mov eax, 0x17
ret 4
mov eax, 0x18
ret 4
mov eax, 0x19
ret 4
mov eax, 0x1a
ret 4
mov eax, 0x1b
ret 4
mov eax, 0x1c
ret 4
mov eax, 0x1d
ret 4
mov eax, 0x1e
ret 4
mov eax, 0x1f
ret 4
mov eax, 0x20
ret 4
mov eax, 0x21
ret 4
mov eax, 0x22
ret 4
mov eax, 0x23
ret 4
mov eax, 0x24
ret 4
mov eax, 0x25
ret 4
mov eax, 0x26
ret 4
mov eax, 0x27
ret 4
mov eax, 0x28
ret 4
mov eax, 0x29
ret 4
mov eax, 0x2a
ret 4
mov eax, 0x2b
ret 4
mov eax, 0x2c
ret 4
mov eax, 0x2d
ret 4
mov eax, 0x2e
ret 4
mov eax, 0x2f
ret 4
mov eax, 0x30
ret 4
mov eax, 0x31
ret 4
mov eax, 0x32
ret 4
mov eax, 0x33
ret 4
mov eax, 0x34
ret 4
mov eax, 0x35
ret 4
mov eax, 0x36
ret 4
mov eax, 0x37
ret 4
mov eax, 0x38
ret 4
mov eax, 0x39
ret 4
mov eax, 0x3a
ret 4
mov eax, 0x3b
ret 4
mov eax, 0x3c
ret 4
mov eax, 0x3d
ret 4
mov eax, 0x3e
ret 4
mov eax, 0x3f
ret 4
mov eax, 0x40
ret 4
mov eax, 0x41
ret 4
mov eax, 0x42
ret 4
mov eax, 0x43
ret 4
mov eax, 0x44
ret 4
mov eax, 0x45
ret 4
mov eax, 0x46
ret 4
mov eax, 0x47
ret 4
mov eax, 0x48
ret 4
mov eax, 0x49
ret 4
mov eax, 0x4a
ret 4
mov eax, 0x4b
ret 4
mov eax, 0x4c
ret 4
mov eax, 0x4d
ret 4
mov eax, 0x4e
ret 4
mov eax, 0x4f
ret 4
mov eax, 0x50
ret 4
mov eax, 0x51
ret 4
mov eax, 0x52
ret 4
mov eax, 0x53
ret 4
mov eax, 0x54
ret 4
mov eax, 0x55
ret 4
mov eax, 0x56
ret 4
mov eax, 0x57
ret 4
mov eax, 0x58
ret 4
mov eax, 0x59
ret 4
mov eax, 0x5a
ret 4
mov eax, 0x5b
ret 4
mov eax, 0x5c
ret 4
or eax, 0xffffffff
ret 4

Function at 0x408280
Capabilities:
Check os version
Create directory

Disassembly:
sub esp, 0x120
push ebx
lea eax, [esp + 4]
push eax
push 0x104
push esi
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
mov ebx, eax
test ebx, ebx
je 0x4082fd
push edi
xor eax, eax
mov ecx, 0x47
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x11c
call edi
test eax, eax
jne 0x4082d9
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x114
call edi
cmp dword [esp + 0x10], 5
pop edi
jb 0x4082e8
push 0x403828
jmp 0x4082ed
push 0x403820
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, ebx
pop ebx
add esp, 0x120
ret
Function at 0x408310
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 0x403880
lea eax, [esp + 0xc]
push eax
call ebx
mov esi, 0x419320
call fcn.00408280
push 0x403868
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
call esi
push 0x419320
lea ecx, [esp + 0xc]
push ecx
call esi
mov eax, dword [esp + 0x218]
cmp dword [eax], 0x4000
jne 0x4083b8
mov eax, dword [eax + 0xc]
sub eax, 2
jne 0x4083b8
push edi
push 0x104
xor eax, eax
mov ecx, 0x41
mov edi, 0x419528
push 0x419528
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x40384c
push 0x419528
call esi
lea edx, [esp + 0xc]
push edx
push 0x418320
call ebx
push 0
push 0x418320
push 0x403830
push 0x419528
push 1
call fcn.004085f4
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret 0x10
Function at 0x40841f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4038c0
call fcn.004094fc
mov edi, 0x94
mov eax, edi
call fcn.00409660
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x419758], ecx
mov eax, dword [esi + 4]
mov dword [0x419764], eax
mov edx, dword [esi + 8]
mov dword [0x419768], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x41975c], esi
cmp ecx, 2
je 0x40847f
or esi, 0x8000
mov dword [0x41975c], esi
shl eax, 8
add eax, edx
mov dword [0x419760], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4084ba
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4084ba
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4084d2
cmp eax, 0x20b
je 0x4084bf
mov dword [ebp - 0x1c], esi
jmp 0x4084e6
cmp dword [ecx + 0x84], 0xe
jbe 0x4084ba
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4084e0
cmp dword [ecx + 0x74], 0xe
jbe 0x4084ba
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004094a8
pop ecx
test eax, eax
jne 0x4084fa
push 0x1c
call fcn.004083fb
pop ecx
call fcn.0040939f
test eax, eax
jne 0x40850b
push 0x10
call fcn.004083fb
pop ecx
call fcn.00409139
mov dword [ebp - 4], esi
call fcn.00408f3b
test eax, eax
jge 0x408524
push 0x1b
call fcn.004083d6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41c074], eax
call fcn.00408e19
mov dword [0x419748], eax
call fcn.00408d77
test eax, eax
jge 0x40854a
push 8
call fcn.004083d6
pop ecx
call fcn.00408b44
test eax, eax
jge 0x40855b
push 9
call fcn.004083d6
pop ecx
push 1
call fcn.00408666
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x408571
push eax
call fcn.004083d6
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00408ae7
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x408592
movzx eax, word [ebp - 0x40]
jmp 0x408595
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040dad0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4085b3
push edi
call fcn.00408793
call fcn.004087b5
jmp 0x4085e5
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00409537
ret
Function at 0x4086d0
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4038e8
call fcn.004094fc
push 8
call fcn.00409986
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x419798], esi
jne 0x408704
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x419794], esi
mov al, byte [ebp + 0x10]
mov byte [0x419790], al
cmp dword [ebp + 0xc], edi
jne 0x40874e
cmp dword [0x41c068], edi
je 0x40873e
mov eax, dword [0x41c064]
sub eax, 4
mov dword [0x41c064], eax
cmp eax, dword [0x41c068]
jb 0x40873e
mov eax, dword [eax]
cmp eax, edi
je 0x40871f
call eax
jmp 0x40871f
push 0x416020
mov eax, 0x41601c
call fcn.0040864e
pop ecx
push 0x416028
mov eax, 0x416024
call fcn.0040864e
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x40877f
cmp dword [ebp + 0x10], edi
jne 0x40878d
mov dword [0x419798], esi
push dword [ebp + 8]
call fcn.0040860c
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x40878c
push 8
call fcn.004098d1
pop ecx
ret
call fcn.00409537
ret

Function at 0x4087d3
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x417b30]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4178a8]
je 0x408808
inc eax
cmp eax, 0x13
jb 0x4087f9
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4178a8]
jne 0x40892e
mov eax, dword [0x419750]
cmp eax, 1
je 0x408906
cmp eax, edx
jne 0x408838
cmp dword [0x4178a4], 1
je 0x408906
cmp ecx, 0xfc
je 0x40892e
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40886e
lea eax, [ebp - 0x80]
push 0x403ce4
push eax
call fcn.00409bb0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00409de0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4088a2
mov eax, edi
push eax
call fcn.00409de0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x403ce0
push edi
call fcn.00409cb0
add esp, 0x10
push edi
call fcn.00409de0
push dword [esi + 0x4178ac]
mov ebx, eax
call fcn.00409de0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00409660
mov ebx, esp
push 0x403cc4
push ebx
call fcn.00409bb0
push edi
push ebx
call fcn.00409bc0
push 0x403cc0
push ebx
call fcn.00409bc0
push dword [esi + 0x4178ac]
push ebx
call fcn.00409bc0
push 0x12010
push 0x403c98
push ebx
call fcn.00409aa9
add esp, 0x2c
jmp 0x40892e
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4178ac]
push dword [esi]
call fcn.00409de0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00409e9c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x409aa9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x419a10], ebx
push esi
push edi
jne 0x409b29
push 0x403e30
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x409b64
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e24
push edi
call esi
test eax, eax
mov dword [0x419a10], eax
je 0x409b64
push 0x403e14
push edi
call esi
push 0x403e00
push edi
mov dword [0x419a14], eax
call esi
cmp dword [0x419758], 2
mov dword [0x419a18], eax
jne 0x409b29
push 0x403de4
push edi
call esi
test eax, eax
mov dword [0x419a20], eax
je 0x409b29
push 0x403dcc
push edi
call esi
mov dword [0x419a1c], eax
mov eax, dword [0x419a1c]
test eax, eax
je 0x409b6e
call eax
test eax, eax
je 0x409b55
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x419a20]
test eax, eax
je 0x409b55
test byte [ebp - 8], 1
jne 0x409b6e
cmp dword [0x419764], 4
jb 0x409b68
or byte [ebp + 0x12], 0x20
jmp 0x409b8d
xor eax, eax
jmp 0x409b9d
or byte [ebp + 0x12], 4
jmp 0x409b8d
mov eax, dword [0x419a14]
test eax, eax
je 0x409b8d
call eax
mov ebx, eax
test ebx, ebx
je 0x409b8d
mov eax, dword [0x419a18]
test eax, eax
je 0x409b8d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x419a10]
pop edi
pop esi
pop ebx
leave
ret