joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b70
Capabilities:
Parse credit card information

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
movzx eax, dl
sub esp, 0x2c
movzx edx, byte [esi]
mov byte [esp + 0x17], al
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov dword [esp + 0x1c], eax
cmp dl, 9
je 0x401c82
cmp dl, 0x20
je 0x401c82
cmp dl, 0x21
je 0x401d43
and edx, 0xfffffffd
cmp dl, 0x2c
jne 0x401bbc
add esi, 1
mov byte [esp + 0x16], 1
mov ebx, esi
jmp 0x401bc3
add ebx, 1
movzx eax, byte [ebx]
movzx edx, al
test word [edx + edx + 0x4d0720], 0x204
jne 0x401bc0
lea edx, [eax - 0x2b]
cmp dl, 3
jbe 0x401bc0
cmp al, 0x3d
je 0x401bc0
cmp al, 0x40
je 0x401bc0
cmp al, 0x2a
mov edi, ebx
je 0x401d66
cmp al, 0x20
jne 0x401d7a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401bf7
cmp al, 0x20
je 0x401bf7
cmp byte [esp + 0x16], 0
jne 0x401c71
mov eax, dword [0x4d70e0]
test eax, eax
jle 0x401c71
mov ebp, dword [0x4d70e4]
shl eax, 4
sub edi, esi
mov dword [esp + 0x18], ebx
add eax, ebp
mov ebx, ebp
mov dword [esp + 0x10], eax
mov ebp, esi
nop
mov esi, dword [ebx]
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x401c64
cmp byte [esp + 0x15], 0
jne 0x401c53
cmp byte [esi + edi], 0
jne 0x401c64
cmp byte [ebx + 0xc], 0
jne 0x401c60
cmp byte [esp + 0x17], 0
je 0x401c64
mov byte [ebx + 0xd], 1
add ebx, 0x10
cmp ebx, dword [esp + 0x10]
jne 0x401c30
mov ebx, dword [esp + 0x18]
movzx ecx, byte [ebx]
test cl, cl
jne 0x401c8e
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [esi + 1]
add esi, 1
jmp 0x401b91
movzx edx, byte [ebx + 1]
lea eax, [ebx + 1]
test dl, dl
je 0x401ccc
cmp cl, 0x26
je 0x401cd8
cmp cl, 0x7c
je 0x401cd8
cmp cl, 0x3a
jne 0x401ccc
cmp dl, 0x3b
je 0x401cc8
test dl, dl
nop
je 0x401cc8
cmp dl, 0x7d
je 0x401cdf
cmp dl, 0x25
je 0x401d03
movzx edx, byte [eax + 1]
add eax, 1
cmp dl, 0x3b
jne 0x401cad
test dl, dl
jne 0x401cdf
mov ebx, eax
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
jmp 0x401b91
movzx edx, byte [eax + 1]
lea esi, [eax + 1]
test dl, dl
je 0x401da5
cmp byte [eax], 0x3b
je 0x401b91
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [eax + 1]
lea ecx, [eax + 1]
cmp dl, 0x3c
je 0x401d1d
cmp dl, 0x7b
je 0x401d1d
cmp dl, 0x57
je 0x401d31
mov eax, ecx
jmp 0x401ca8
mov edx, dword [esp + 0x1c]
add eax, 2
call fcn.00401b70
movzx edx, byte [eax]
jmp 0x401ca8
cmp byte [eax + 2], 0x7b
je 0x401d87
mov eax, ecx
mov edx, 0x57
jmp 0x401ca8
movzx edx, byte [esi + 1]
lea eax, [esi + 1]
mov esi, eax
cmp dl, 0x20
jne 0x401d9b
add esi, 1
movzx edx, byte [esi]
cmp dl, 9
je 0x401d51
cmp dl, 0x20
je 0x401d51
jmp 0x401bac
movzx eax, byte [edi + 1]
add ebx, 1
mov byte [esp + 0x15], 1
cmp al, 0x20
je 0x401bf7
cmp al, 9
je 0x401bf7
jmp 0x401c05
mov edx, dword [esp + 0x1c]
add eax, 3
call fcn.00401b70
movzx edx, byte [eax]
jmp 0x401ca8
cmp dl, 9
je 0x401d51
jmp 0x401bac
mov eax, esi
mov ebx, eax
jmp 0x401cce
Function at 0x4028c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x9c
mov dword [esp], 0x2000
call fcn.00452ed0
mov dword [esp], ebx
mov dword [esp + 4], 0
mov ebp, eax
call sub.msvcrt.dll__open_1
mov dword [esp + 4], 0
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll__open_1
mov dword [esp + 0x18], eax
shr eax, 0x1f
test al, al
jne 0x402912
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x402940
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll__close_1
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__close_1
xor eax, eax
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x30]
mov esi, dword [sym.imp.msvcrt.dll__fstati64]
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
test eax, eax
js 0x402912
lea eax, [esp + 0x60]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call esi
test eax, eax
js 0x402912
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
xor edx, edi
xor eax, esi
or edx, eax
jne 0x402912
mov eax, edi
or eax, esi
je 0x402a52
lea eax, [ebp + 0x1000]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ebx
cmp esi, 0x1000
mov ebp, esi
jg 0x4029e0
mov ebx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll__read_1
cmp eax, ebp
je 0x402a00
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
jmp 0x402912
mov ebp, 0x1000
mov ebx, 0x1000
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x24], 0
jmp 0x4029b4
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__read_1
cmp ebp, eax
jne 0x4029d0
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4029d0
sub esi, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
mov eax, edi
or eax, esi
jne 0x4029a0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll__close_1
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__close_1
mov eax, 1
jmp 0x402930
Function at 0x404fd0
Capabilities:
Query environment variable

Disassembly:
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
cmp byte [edi + 1], 0
mov esi, eax
je 0x40500c
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.env_manager::getenv___s______s_n
add eax, 0x40
mov dword [esp], eax
call fcn.0047d600
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop edi
ret 4
Function at 0x4050e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
cmp byte [ecx + 1], 0
mov edi, dword [esp + 0x40]
jne 0x405265
mov eax, dword [0x4d9094]
test eax, eax
jne 0x405244
cmp byte [esi], 0
je 0x405232
mov dword [esp + 4], 0x3d
mov dword [esp], edi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x405317
sub eax, edi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00459730
mov dword [esp], eax
mov dword [esp + 0x14], eax
call sub.msvcrt.dll_getenv
cmp byte [esi + 1], 0
mov ebx, eax
jne 0x405286
test ebx, ebx
mov dword [esp + 0x10], 0
je 0x405163
mov dword [esp], ebx
call fcn.00452fa0
mov dword [esp + 0x10], eax
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x405306
mov ebp, dword [ebx]
mov edx, dword [ebx + 4]
and ebp, 0x7fffffff
cmp ebp, edx
jne 0x40521b
cmp byte [ebx + 3], 0
jns 0x4052a7
mov dword [esi + 4], 0
lea eax, [ebp + 1]
mov byte [esp + 0x1f], 1
cmp eax, 4
mov edx, 4
cmovae edx, eax
lea eax, [edx*8 + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [esp + 0x18], edx
call fcn.00452f50
mov edx, dword [esp + 0x18]
mov ecx, edx
and ecx, 0x7fffffff
mov edx, dword [eax]
mov dword [esi + 4], eax
mov dword [eax + 4], 0
and edx, 0x80000000
or edx, ecx
mov dword [eax], edx
shr edx, 0x18
and edx, 0x7f
cmp byte [esp + 0x1f], 0
mov byte [eax + 3], dl
je 0x405333
lea edx, [ebp*8]
add eax, 8
add ebx, 8
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov ebx, dword [esi + 4]
mov edx, ebp
mov dword [ebx + 4], ebp
mov ecx, dword [esp + 0x14]
lea eax, [edx + 1]
mov dword [ebx + 4], eax
lea eax, [ebx + edx*8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov dword [esp], edi
call sub.msvcrt.dll__putenv
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x4894d8
add eax, 0x40
mov dword [esp], eax
call fcn.004244d0
jmp 0x405104
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], str.env_manager::xput___s__n
add eax, 0x40
mov dword [esp], eax
call fcn.0047d600
jmp 0x4050f7
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.saving_old_value:__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.0047d600
jmp 0x40514b
add ebp, 1
mov dword [esp + 4], ebp
mov eax, dword [ebx]
and eax, 0x7fffffff
mov dword [esp], eax
call fcn.0041f4c0
mov ebp, eax
lea edx, [eax*8 + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x40533c
mov ebx, dword [eax + 4]
mov dword [esp + 4], edx
and ebp, 0x7fffffff
mov dword [esp], eax
call fcn.00452f50
mov edx, dword [eax]
mov dword [esi + 4], eax
mov dword [eax + 4], ebx
and edx, 0x80000000
or edx, ebp
mov dword [eax], edx
shr edx, 0x18
and edx, 0x7f
mov byte [eax + 3], dl
mov edx, ebx
mov ebx, eax
jmp 0x40521b
mov byte [esp + 0x1f], 0
xor ebp, ebp
mov eax, 1
jmp 0x40519a
mov dword [esp + 8], str.xput
mov dword [esp + 4], 0x7c
mov dword [esp], str..._.._gcc_gcc_gcc.c
call fcn.00424560
mov ebx, eax
xor edx, edx
jmp 0x40521b
xor ebx, ebx
jmp 0x4052d0
Function at 0x4072d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0x425be0
mov dword [esp + 0xc], 0x425ba0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x4d71c0
call fcn.00459280
mov eax, dword [0x4d71cc]
mov edx, dword [0x4d71d0]
sub edx, eax
cmp edx, 0xb
jbe 0x4073d0
mov dword [eax], 0x4c4c4f43
mov dword [eax + 4], 0x5f544345
mov dword [eax + 8], 0x3d434347
mov eax, dword [0x4d71cc]
mov dword [esp], esi
lea edi, [eax + 0xc]
mov dword [0x4d71cc], edi
call sub.msvcrt.dll_strlen
lea ebx, [eax + 1]
mov eax, dword [0x4d71d0]
sub eax, edi
cmp ebx, eax
ja 0x4073f0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_memcpy
mov eax, dword [0x4d71cc]
mov ecx, dword [0x4d71c8]
add eax, ebx
cmp eax, ecx
je 0x407410
mov edx, dword [0x4d71d8]
mov ebx, dword [0x4d71c4]
add eax, edx
not edx
and eax, edx
mov edx, dword [0x4d71d0]
mov esi, eax
sub esi, ebx
mov dword [0x4d71cc], eax
mov edi, edx
sub edi, ebx
cmp esi, edi
jbe 0x4073b0
mov dword [0x4d71cc], edx
mov eax, edx
mov dword [ebp + 8], ecx
mov ecx, 0x4d7268
mov dword [0x4d71c8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004050e0
mov dword [esp + 4], 0xc
mov dword [esp], 0x4d71c0
call fcn.004592e0
mov eax, dword [0x4d71cc]
jmp 0x40731e
mov dword [esp + 4], ebx
mov dword [esp], 0x4d71c0
call fcn.004592e0
mov edi, dword [0x4d71cc]
jmp 0x40735a
or byte [0x4d71e8], 2
jmp 0x40737f
Function at 0x41f0a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
movzx eax, byte [eax]
cmp al, 0x24
mov byte [ebp - 0x20], al
jne 0x41f21b
movzx eax, byte [esi + 1]
lea ecx, [esi + 1]
test al, al
je 0x41f180
cmp al, 0x2f
je 0x41f180
cmp al, 0x5c
je 0x41f180
lea edx, [esi + 2]
xor eax, eax
movzx ebx, byte [edx]
add eax, 1
mov edi, eax
mov dword [ebp - 0x1c], edx
test bl, bl
jne 0x41f1a0
mov ebx, eax
lea eax, [eax + 1]
add eax, 0x1e
mov edi, 0x10
xor edx, edx
div edi
shl eax, 4
call fcn.00470cf0
sub esp, eax
lea edi, [esp + 0x1b]
and edi, 0xfffffff0
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.msvcrt.dll_strncpy
cmp byte [ebp - 0x20], 0x40
mov byte [edi + ebx], 0
je 0x41f1c0
mov dword [esp], edi
call sub.msvcrt.dll_getenv
mov edx, str._home_jenkins_mingw32_workspace_avr_gcc_staging_label_Ubuntu14.04x64_mingw32_objdir
test eax, eax
cmove eax, edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004530c0
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_free
movzx eax, byte [ebx]
cmp al, 0x24
mov byte [ebp - 0x20], al
jne 0x41f190
mov esi, ebx
movzx eax, byte [esi + 1]
lea ecx, [esi + 1]
test al, al
jne 0x41f0c8
nop
mov dword [ebp - 0x1c], ecx
mov eax, 1
xor ebx, ebx
jmp 0x41f0f5
cmp al, 0x40
je 0x41f16d
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add edx, 1
cmp bl, 0x5c
je 0x41f1b1
cmp bl, 0x2f
jne 0x41f0dd
mov ebx, edi
add eax, 1
jmp 0x41f0f5
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], str._ROOT
call fcn.004530c0
mov dword [esp], eax
mov edi, eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x41f1f9
mov dword [esp], edi
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
jmp 0x41f142
mov eax, dword [str._home_jenkins_mingw32_workspace_avr_gcc_staging_label_Ubuntu14.04x64_mingw32_objdir]
mov dword [esp], edi
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
mov edx, str._home_jenkins_mingw32_workspace_avr_gcc_staging_label_Ubuntu14.04x64_mingw32_objdir
test eax, eax
cmove eax, edx
jmp 0x41f142
cmp al, 0x40
je 0x41f0b9
lea esp, [ebp - 0xc]
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4213a0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4213c3
cmp eax, dword [ebx + 0x10]
je 0x4213c3
sub eax, 1
cmp dword [ebx + 0x18], eax
jae 0x4213c3
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x4213bb
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x4213bb
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
cmp ecx, edx
je 0x4213f2
mov eax, dword [ebx + 0xc]
mov esi, ecx
jmp 0x421417
lea eax, [ecx + ecx]
test ecx, ecx
mov esi, 0x1000
cmovne esi, eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00452f50
mov edx, dword [ebx + 0x14]
mov dword [ebx + 0x10], esi
mov dword [ebx + 0xc], eax
mov ecx, dword [ebx + 8]
sub esi, edx
add edx, eax
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], ecx
call sub.msvcrt.dll_fread
mov esi, eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
mov edx, eax
xor eax, eax
test edx, edx
jne 0x4213bd
add dword [ebx + 0x14], esi
test esi, esi
setne al
jmp 0x4213bd

Function at 0x423cb0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, 0x7fffffff
sub esp, 0x18
mov dword [esp], str.COLUMNS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x423cd6
mov dword [esp], eax
call fcn.0047d0f0
test eax, eax
cmovg ebx, eax
add esp, 0x18
mov eax, ebx
pop ebx
ret
Function at 0x45c0f0
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x45c10f
mov edx, dword [ebx + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x45c125
mov edx, dword [ebx + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x45c134
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x45c143
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x45c1e0
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x45c1d0
mov eax, dword [ebx + 0x20]
xor esi, esi
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x45c1af
nop
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
add esi, 1
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebx + 0x3c], esi
jg 0x45c180
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x45c1be
mov dword [esp], ebx
call eax
mov dword [esp + 0x30], ebx
add esp, 0x24
pop ebx
pop esi
jmp sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x45c155
and dword [ebx], 0xfffffffe
mov edx, 1
lea eax, [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x18]
mov eax, ebx
call fcn.0045b490
jmp 0x45c14e
Function at 0x470000
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00470060
Function at 0x4709f0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x470a28
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x470a1e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x470a2a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x470a10
xor eax, eax
pop ebx
pop esi
ret

Function at 0x474850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4749fe
cmp byte [ebx], 0
je 0x4749c8
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4749e0
test al, 0x10
je 0x4749c8
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4748b4
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x4749ef
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x474943
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x474943
cmp al, 0x5c
je 0x474943
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x474945
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4749c0
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4749c0
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4749c0
Function at 0x100dd1ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100dd024

Function at 0x40c6a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c6c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c6b8
mov eax, 1
add ebx, ebx
jne 0x40c6db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c6d0
jne 0x40c6ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6d0
xor ecx, ecx
sub eax, 3
jb 0x40c700
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c772
mov ebp, eax
add ebx, ebx
jne 0x40c70b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c718
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c73c
inc ecx
add ebx, ebx
jne 0x40c728
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c71d
jne 0x40c739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c71d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c75c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c74d
jmp 0x40c6be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c75c
add edi, ecx
jmp 0x40c6be
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c7c4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c779
mov ecx, edi
jns 0x40c7a8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c7be
mov dword [ebx], eax
add ebx, 4
jmp 0x40c796
call dword [esi + 0xc05c]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c7f8
sub esp, 0xffffff80
jmp 0x40a94c