joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403afd
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
add esi, eax
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esi*4 + 4]
push eax
mov ecx, dword [edi]
mov dword [esp + 0x24], ecx
call fcn.00401139
mov ebp, eax
mov dword [ebx], esi
mov dword [edi], ebp
xor esi, esi
mov edi, dword [esp + 0x1c]
pop ecx
test edi, edi
jle 0x403b63
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x403b5e
cmp byte [eax + 1], 0x4a
jne 0x403b5e
add eax, 2
je 0x403b58
push eax
call fcn.004011c9
pop ecx
mov dword [ebp], eax
add ebp, 4
inc esi
cmp esi, edi
jl 0x403b3e
mov ebx, dword [esp + 0x10]
xor eax, eax
test ebx, ebx
jle 0x403b96
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + eax*4]
cmp byte [ecx], 0x2d
jne 0x403b91
cmp byte [ecx + 1], 0x4a
jne 0x403b91
add ecx, 2
cmp byte [ecx], 0
je 0x403c42
mov dword [ebp], ecx
add ebp, 4
inc eax
cmp eax, ebx
jl 0x403b71
xor esi, esi
test edi, edi
jle 0x403bc4
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x403bae
cmp byte [eax + 1], 0x4a
je 0x403bbb
push eax
call fcn.004011c9
mov dword [ebp], eax
add ebp, 4
pop ecx
inc esi
cmp esi, edi
jl 0x403ba0
mov ebx, dword [esp + 0x10]
xor esi, esi
test ebx, ebx
jle 0x403c38
mov eax, dword [esp + 0x20]
mov edi, dword [eax + esi*4]
cmp byte [edi], 0x2d
jne 0x403c2d
mov al, byte [edi + 1]
cmp al, 0x4a
je 0x403c33
cmp byte [0x433ab9], 0
je 0x403c2d
cmp al, 0x63
jne 0x403c2d
push 0x426530
push edi
call fcn.00414220
pop ecx
pop ecx
test eax, eax
je 0x403c0c
push str._classpath
push edi
call fcn.00414220
pop ecx
pop ecx
test eax, eax
jne 0x403c2d
lea eax, [ebx - 1]
cmp esi, eax
jge 0x403c2d
mov eax, dword [esp + 0x20]
mov dword [ebp], edi
push dword [eax + esi*4 + 4]
call fcn.00406a99
mov dword [ebp + 4], eax
add ebp, 8
pop ecx
inc esi
jmp 0x403c33
mov dword [ebp], edi
add ebp, 4
inc esi
cmp esi, ebx
jl 0x403bca
and dword [ebp], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Error:_The__J_option_should_not_be_followed_by_a_space.
call fcn.00405ae7
pop ecx
push 1
call fcn.0040f2a7
int3
Function at 0x404337
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.00414518
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x4044aa
jg 0x404366
test esi, esi
jb 0x4044aa
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175ef
add esp, 0xc
test eax, eax
js 0x4044aa
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x4043c8
push edi
call fcn.004048b9
pop ecx
test eax, eax
je 0x4043bf
push ebx
push esi
push edi
push ebp
call fcn.004044fc
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x4044af
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.00414518
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x4044aa
jg 0x4043f1
cmp ebp, ebx
jb 0x4044aa
mov ecx, 0x10015
cmp eax, ebx
jg 0x404406
jl 0x404400
cmp ebp, ecx
jae 0x404406
mov esi, ebp
mov ecx, eax
jmp 0x40440a
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.00414518
add esp, 0x10
cmp edx, ebx
jl 0x4044aa
jg 0x404430
cmp eax, ebx
jb 0x4044aa
push 0x10015
call fcn.0040ef93
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4044aa
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175ef
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x4044a3
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40449f
cmp byte [esi], 0x50
jne 0x40449e
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40449e
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x4044b6
dec esi
cmp esi, ebx
jae 0x40445f
push ebx
call fcn.0040ef78
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a020
push ebx
call fcn.0040ef78
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.004048b9
add esp, 0x14
test eax, eax
je 0x4044f6
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.004044fc
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x4044af
Function at 0x4044fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, 0x14
push ebx
push esi
push edi
push 0
sbb eax, 0
push eax
push ecx
push dword [ebp + 8]
call fcn.00414518
mov ebx, edx
add esp, 0x10
mov edi, eax
test ebx, ebx
jl 0x40456c
jg 0x40452b
test edi, edi
jb 0x40456c
mov esi, dword [ebp + 0xc]
push 0x14
push esi
push dword [ebp + 8]
call fcn.004175ef
add esp, 0xc
test eax, eax
js 0x40456c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x7064b50
jne 0x40456c
mov eax, edi
mov edx, ebx
jmp 0x404571
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x404929
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 4], 0xffffffff
je 0x404a56
cmp dword [esi], 0xffffffff
je 0x404a56
push 0
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp + 8]
call fcn.00414518
add esp, 0x10
test edx, edx
jl 0x404a56
jg 0x40496d
test eax, eax
jb 0x404a56
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.0040ef93
mov edi, eax
pop ecx
test edi, edi
je 0x404a56
mov ebx, dword [esi + 4]
push ebx
push edi
push dword [ebp + 8]
call fcn.004175ef
add esp, 0xc
cmp eax, ebx
jne 0x404a4f
cmp dword [esi + 0x10], 0
jne 0x4049b7
mov ecx, dword [ebp + 0x10]
mov byte [ebx + edi], 0
test ecx, ecx
je 0x4049b0
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov eax, edi
jmp 0x404a58
cmp dword [esi + 0x10], 8
jne 0x404a4f
xor eax, eax
mov dword [ebp - 0x38], edi
push 0x38
push str.1.2.13
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x34], ebx
call fcn.004082aa
add esp, 0x10
test eax, eax
js 0x404a4f
mov eax, dword [esi]
inc eax
push eax
call fcn.0040ef93
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404a4f
mov ecx, dword [esi]
lea eax, [ebp - 0x38]
push 1
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ecx
call fcn.00406d12
pop ecx
pop ecx
push edi
test eax, eax
jns 0x404a23
call fcn.0040ef78
push ebx
call fcn.0040ef78
pop ecx
jmp 0x404a55
mov eax, dword [esi]
mov byte [ebx + eax], 0
call fcn.0040ef78
lea eax, [ebp - 0x38]
push eax
call fcn.0040826a
pop ecx
pop ecx
test eax, eax
jns 0x404a40
push ebx
jmp 0x404a50
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x404a4b
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, ebx
jmp 0x404a58
push edi
call fcn.0040ef78
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c71
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 0x10000
push dword [esp + 0x28]
mov dword [esp + 0x14], ebx
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.004149c6
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x404cbd
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.004149c6
add esp, 0x18
mov esi, eax
cmp dword [0x433020], ebx
je 0x404d64
push ebp
push edi
push str.J2D_D3D
call fcn.0040ed6c
mov ebp, str.false
pop ecx
test eax, eax
je 0x404cf2
push ebp
push eax
call fcn.0041643d
neg eax
pop ecx
sbb eax, eax
and dword [0x433020], eax
pop ecx
push str.J2D_D3D_PRELOAD
call fcn.0040ed6c
mov edi, eax
pop ecx
test edi, edi
je 0x404d1e
push ebp
push edi
call fcn.0041643d
pop ecx
neg eax
pop ecx
sbb ecx, ecx
and ecx, dword [0x433020]
mov dword [0x433020], ecx
jmp 0x404d24
mov ecx, dword [0x433020]
test ecx, ecx
jns 0x404d55
mov dword [0x433020], ebx
test edi, edi
je 0x404d62
push str.true
push edi
call fcn.0041643d
xor edx, edx
pop ecx
inc edx
test eax, eax
pop ecx
mov ecx, dword [0x433020]
cmove ecx, edx
mov dword [0x433020], ecx
test ecx, ecx
je 0x404d62
push str.preloadD3D
call fcn.00404b22
pop ecx
pop edi
pop ebp
test esi, esi
je 0x404d86
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404d92
push dword [esp + 0x20]
call dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [0x433b10], 0
pop esi
pop ebx
je 0x404da8
mov eax, dword [0x433b2c]
test eax, eax
je 0x404da8
call eax
mov eax, dword [esp]
pop ecx
pop ecx
ret
Function at 0x40509c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
mov ebp, dword [esp + 0xc]
inc eax
push esi
mov ebx, dword [ebx]
mov esi, eax
push edi
push 0x20
pop edi
cmp dword [ebp], eax
jle 0x405134
push str._J_d64
push dword [ebx + esi*4]
call fcn.00414220
pop ecx
pop ecx
test eax, eax
je 0x405122
push str._d64
push dword [ebx + esi*4]
call fcn.00414220
pop ecx
pop ecx
test eax, eax
je 0x405122
push str._J_d32
push dword [ebx + esi*4]
call fcn.00414220
pop ecx
pop ecx
test eax, eax
je 0x40511e
push str._d32
push dword [ebx + esi*4]
call fcn.00414220
pop ecx
pop ecx
test eax, eax
je 0x40511e
call fcn.00401d69
test al, al
je 0x405114
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x405125
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x40512b
jmp 0x405125
push 0x20
jmp 0x405124
push 0x40
pop edi
inc esi
cmp esi, dword [ebp]
jl 0x4050b7
cmp edi, 0x20
jne 0x405295
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00405702
pop ecx
pop ecx
test al, al
jne 0x405159
push str.Error:_Could_not_find_Java_SE_Runtime_Environment.
call fcn.00405ae7
pop ecx
push 2
jmp 0x4052a4
mov eax, 0x42735c
push eax
push str.i386
push eax
push eax
push dword [esp + 0x2c]
push str._s_slib_s_s_sjvm.cfg
push dword [esp + 0x48]
push dword [esp + 0x48]
call fcn.00405cca
push 0
push dword [esp + 0x50]
call fcn.00402f15
add esp, 0x28
cmp eax, 1
jge 0x40519e
push str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call fcn.00405ae7
jmp 0x4052a1
mov ebx, dword [esp + 0x18]
push 0
push ebx
push ebp
call fcn.004017cb
mov esi, eax
push str.ERROR
push esi
call fcn.00414220
add esp, 0x14
test eax, eax
jne 0x4051d1
push str.Error:_could_not_determine_JVM_type.
call fcn.00405ae7
pop ecx
push 4
jmp 0x4052a4
push dword [esp + 0x28]
mov edi, dword [esp + 0x28]
push edi
push esi
push dword [esp + 0x28]
mov byte [edi], 0
call fcn.004057fe
add esp, 0x10
test al, al
jne 0x4051ff
push edi
push esi
push str.Error:_missing___s_JVM_at___s._nPlease_install_or_use_the_JRE_or_JDK_that_contains_these_missing_components.
call fcn.00405ae7
add esp, 0xc
jmp 0x4051ca
mov edi, dword [ebx]
xor esi, esi
cmp dword [ebp], esi
jle 0x405290
mov ecx, dword [0x433020]
test ecx, ecx
jns 0x40523b
push dword [edi + esi*4]
push str._Dsun.awt.warmup
call fcn.004056c0
xor ebx, ebx
pop ecx
inc ebx
pop ecx
mov ecx, dword [0x433020]
cmp eax, ebx
cmove ecx, ebx
mov dword [0x433020], ecx
jmp 0x40523e
xor ebx, ebx
inc ebx
test ecx, ecx
je 0x405281
push dword [edi + esi*4]
push str._Dsun.java2d.noddraw
call fcn.004056c0
pop ecx
pop ecx
cmp eax, ebx
je 0x405289
push dword [edi + esi*4]
push str._Dsun.java2d.d3d
call fcn.004056c0
pop ecx
pop ecx
test eax, eax
je 0x405289
push dword [edi + esi*4]
push str._Dsun.java2d.opengl
call fcn.004056c0
pop ecx
pop ecx
cmp eax, ebx
je 0x405289
mov ecx, dword [0x433020]
inc esi
cmp esi, dword [ebp]
jl 0x405212
jmp 0x405290
and dword [0x433020], 0
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push str.Error:_This_Java_instance_does_not_support_a__d_bit_JVM._nPlease_install_the_desired_version.
call fcn.00405ae7
pop ecx
pop ecx
push 1
call fcn.0040f2a7
int3
Function at 0x405f9c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x433034]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xa0]
xor esi, esi
push 0x104
mov dword [ebp - 0x7c], eax
xor ebx, ebx
lea eax, [ebp - 0x74]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x406069
mov eax, dword [ebp - 0x7c]
inc ebx
push dword [eax + 8]
lea eax, [ebp - 0x74]
push eax
call fcn.00406392
pop ecx
pop ecx
test eax, eax
je 0x406023
test esi, esi
je 0x406017
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00406405
pop ecx
pop ecx
test eax, eax
jle 0x406023
push esi
call fcn.0040115b
pop ecx
lea eax, [ebp - 0x74]
push eax
call fcn.004011c9
pop ecx
mov esi, eax
push 0x104
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x405fe6
test esi, esi
je 0x406069
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
push 0x20019
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
test eax, eax
je 0x406083
call fcn.0040115b
pop ecx
cmp dword [ebp - 0x78], ebx
je 0x406069
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040973e
add ebp, 0x94
leave
ret
call fcn.0040115b
pop ecx
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x104
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push str.JavaHome
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40605b
cmp dword [ebp - 0x78], ebx
je 0x4060ba
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x74]
push eax
call fcn.004011c9
pop ecx
jmp 0x40606b
Function at 0x406afc
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push ecx
push ebx
push esi
push 0x10
call fcn.004069c5
mov esi, eax
push 8
mov dword [esp + 0x10], esi
call fcn.00401139
pop ecx
pop ecx
push 0x433b38
push dword [esp + 0x18]
mov ebx, eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x406b45
push ebx
call fcn.0040115b
push esi
call fcn.00406918
pop ecx
pop ecx
xor eax, eax
jmp 0x406c40
push ebp
mov dword [ebx], eax
mov dword [ebx + 4], 0x433b64
push edi
mov ebp, dword [ebx + 4]
test ebp, ebp
je 0x406b5d
and dword [ebx + 4], 0
jmp 0x406b7a
push 0x433b38
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
sbb ebp, ebp
and ebp, 0x433b64
je 0x406c24
push ebp
call fcn.0040ee70
pop ecx
cmp eax, 4
jl 0x406b50
cmp byte [eax + ebp - 4], 0x2e
jne 0x406b50
lea edi, [eax - 3]
add edi, ebp
push 0x427a90
push edi
call fcn.00414220
pop ecx
pop ecx
test eax, eax
je 0x406bb4
push 0x427a94
push edi
call fcn.00414220
pop ecx
pop ecx
test eax, eax
jne 0x406b50
push 0x3b
push ebp
call fcn.0040bd80
pop ecx
pop ecx
test eax, eax
jne 0x406b50
push dword [esp + 0x1c]
call fcn.0040ee70
push ebp
mov edi, eax
call fcn.0040ee70
mov esi, eax
lea ecx, [esi + edi]
push ecx
call fcn.00401139
lea ecx, [edi - 1]
mov ebx, eax
push ecx
push dword [esp + 0x2c]
push ebx
call fcn.0040a020
lea ecx, [esi + 1]
push ecx
lea eax, [edi - 1]
add eax, ebx
push ebp
push eax
call fcn.0040a020
mov esi, dword [esp + 0x34]
mov eax, dword [esi + 4]
inc eax
push eax
push esi
call fcn.004067e4
mov ecx, dword [esi + 4]
add esp, 0x2c
mov eax, dword [esi]
mov dword [eax + ecx*4], ebx
inc dword [esi + 4]
mov ebx, dword [esp + 0x14]
jmp 0x406b50
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040115b
push ebx
call fcn.0040115b
pop ecx
pop ecx
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
pop ecx
pop ecx
ret
Function at 0x408a7f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4285e0]
sub edx, 1
jne 0x408a86
ret

Function at 0x409cec
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409d2b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409d2b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409d2b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409d2b
cmp dword [ecx + 0x74], 0xe
jbe 0x409d2b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41bcc0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b813

Function at 0x422109
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421f7f

Function at 0x425910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42593d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42593d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403634
Capabilities:
Query environment variable

Disassembly:
jmp 0x4f0a42
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4f0a56
xor edi, edi
jmp 0x4f0a9a
push ebx
push esi
call fcn.004f093b
push 0x40
mov ebx, eax
push 0x53b6e0
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.00405330
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4f0a87
push ebx
push esi
push edi
call fcn.00405542
add esp, 0xc
push 2
push 0
call fcn.00404d13
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x404e6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x507f80
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x553a20], 1
jge 0x507fef
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x507fc5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x507fc5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x507fa2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x507fdb
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x507fe2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5080df
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5080b0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5080a5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x508099
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5080a0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5080df
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5080da
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5080c3
mov eax, dword [ebx + 8]
jmp 0x5080df
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5080d1
xor eax, eax
jmp 0x5080df
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x50800f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x404870
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
cmp eax, edx
mov dword [0x4120e8], eax
cmovb eax, edx
mov dword [0x4120e4], ecx
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
mov dword [0x4120e0], eax
je 0x4048a4
add esp, 0x1c
ret
mov dword [esp + 0x28], str.out_of_memory
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 1
add esp, 0x1c
jmp fcn.00409570
Function at 0x405650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
and ebp, 0x7f
cmp dword [0x412064], 2
jg 0x405770
lea edx, [esp + 0x16]
mov eax, ebp
mov byte [esp + 0x12], 0x2a
mov byte [esp + 0x13], 0x2a
mov byte [esp + 0x14], 0x18
lea ebp, [esp + 0x18]
mov byte [esp + 0x15], 0x42
lea edi, [esi + 4]
call fcn.00404cd0
movzx ebx, word [esp + 0x50]
mov dword [0x414574], 0
and ebx, 0x7f
xor bx, word [0x40c440]
movsx eax, byte [esi]
mov edx, ebp
add esi, 1
add ebp, 2
call fcn.00404cd0
movzx eax, byte [esi - 1]
mov edx, ebx
movzx ebx, bh
shl edx, 8
or eax, edx
xor ax, word [ebx + ebx + 0x40c440]
cmp esi, edi
movzx ebx, ax
jne 0x4056ae
movzx eax, bh
shl ebx, 8
lea edx, [esp + 0x20]
movzx eax, word [eax + eax + 0x40c440]
xor ebx, eax
movzx eax, bh
shl ebx, 8
xor bx, word [eax + eax + 0x40c440]
movzx eax, bh
call fcn.00404cd0
lea edx, [esp + 0x22]
movzx eax, bx
call fcn.00404cd0
cmp dword [esp + 0x50], 3
mov byte [esp + 0x24], 0xd
mov byte [esp + 0x25], 0x8a
je 0x405763
cmp dword [esp + 0x50], 8
je 0x405763
mov byte [esp + 0x26], 0x11
mov ebx, 0x15
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
lea eax, [esp + 0x12]
mov dword [esp + 8], ebx
mov dword [esp], 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_write
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x14
jmp 0x405733
movzx edi, byte [esi + 3]
movzx eax, byte [esi + 2]
mov ebx, dword [ebp*4 + 0x40f3cc]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.zshhdr:__s__lx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x40566f