joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460af9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004617b1
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00460c59
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x460c43
test ebx, ebx
jl 0x460be7
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd16f5d
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x460c08
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x460bfa
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004625c9
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004625c9
add esp, 8
mov ebx, 0x80070057
jmp 0x460be7
Function at 0x477af9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004787b1
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00477c59
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x477c43
test ebx, ebx
jl 0x477be7
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2df5d
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x477c08
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x477bfa
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004795c9
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004795c9
add esp, 8
mov ebx, 0x80070057
jmp 0x477be7
Function at 0x48f7b9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00490471
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048f919
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48f903
test ebx, ebx
jl 0x48f8a7
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd45c1d
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48f8c8
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48f8ba
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00491289
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00491289
add esp, 8
mov ebx, 0x80070057
jmp 0x48f8a7
Function at 0x4a6879
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a7531
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a69d9
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a69c3
test ebx, ebx
jl 0x4a6967
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5ccdd
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a6988
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a697a
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a8349
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a8349
add esp, 8
mov ebx, 0x80070057
jmp 0x4a6967
Function at 0x4ba925
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3360
cmp edx, dword [eax]
je 0x4ba947
add eax, 8
inc ecx
cmp eax, 0x4c33f0
jl 0x4ba938
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3360]
jne 0x4baa75
mov eax, dword [0x4c7cec]
cmp eax, 1
je 0x4baa4f
test eax, eax
jne 0x4ba978
cmp dword [0x4c328c], 1
je 0x4baa4f
cmp edx, 0xfc
je 0x4baa75
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba9af
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb310
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb7a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9f2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb7a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb64
push edi
call fcn.004bd670
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb310
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb320
lea eax, [ebp - 0xa0]
push 0x4bfb44
push eax
call fcn.004bb320
push dword [esi + 0x4c3364]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb320
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd5e4
add esp, 0x2c
pop edi
jmp 0x4baa75
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3364]
push 0
push eax
push dword [esi]
call fcn.004bb7a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4010f0
Capabilities:
Parse pe header

Disassembly:
jmp 0x4022d2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402312
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402312
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402312
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402312
cmp dword [ecx + 0x74], 0xe
jbe 0x402312
cmp dword [ecx + 0xe8], 0
je 0x402312
mov al, 1
ret
xor al, al
ret

Function at 0x40119f
Capabilities:
Terminate process

Disassembly:
jmp 0x401ad9
push 0x14
push 0x405430
call fcn.004010a5
push 1
call fcn.004010a0
pop ecx
test al, al
je 0x4019f1
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004011c2
mov byte [ebp - 0x24], al
mov eax, dword [0x406130]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4019f1
test eax, eax
jne 0x40190f
mov dword [0x406130], ecx
push 0x404618
push 0x40430c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4018f2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4019e1
push 0x404208
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x406130], 2
jmp 0x401914
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00401050
pop ecx
call fcn.004010d7
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x401945
push esi
call fcn.004010eb
pop ecx
test al, al
je 0x401945
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.0040112c
mov esi, eax
cmp dword [esi], edi
je 0x401963
push esi
call fcn.004010eb
pop ecx
test al, al
je 0x401963
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call fcn.00401159
add esp, 0xc
mov esi, eax
call fcn.004010f0
test al, al
je 0x4019f8
test bl, bl
jne 0x401996
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00401131
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4019e1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00401177
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.0040116d
jmp 0x401885

Function at 0x4016f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push eax
push str.Usage:_n_s_play__mkv_file___dest_ip___dest_port__n_s_record__mkv_file__local_port_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.004010e1
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10012bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10012c07
pop dword [ebp - 0x3c]
mov eax, 0x9cc0ec1c
sub eax, 0x8cbfc015
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xee5efc21
sub dword [ebp - 0x4c], 0xa00cb6d6
mov dword [ebp - 0x48], 0x4ad06b4e
add dword [ebp - 0x48], 0xe762e0f7
mov dword [ebp - 0x44], 0x6daa5487
sub dword [ebp - 0x44], 0x215e1059
mov dword [ebp - 0x40], 0x84a98f12
sub dword [ebp - 0x40], 0x84a98f12
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x71d5c47e
add dword [ebp - 0x4c], 0x29ca4d8
mov dword [ebp - 0x48], 0x4d80f8c3
sub dword [ebp - 0x48], 0xc14974e
mov dword [ebp - 0x44], 0x63307237
add dword [ebp - 0x44], 0x3efa35
mov dword [ebp - 0x40], 0x369329cd
sub dword [ebp - 0x40], 0x369329cd
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x315ca92a
sub eax, 0x215aa92a
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c832
push 0
call eax
mov ecx, 0xdbd19ae0
sub ecx, 0xdbd15410
mov edx, eax
mov esi, 0x41f76088
sub esi, 0x31f4a488
add esi, dword [ebp - 0x3c]
mov ebx, 0xc2738b8c
sub ebx, 0x2378bdd2
mov dword [ebp - 0x34], 0x4be62a57
mov edi, dword [esi]
add dword [ebp - 0x28], esi
sub edi, ebx
xor dword [ebp - 0x14], edi
mov dword [edx], edi
xor dword [ebp - 0x2c], 0xb23bb3c1
add edx, 0x580e61fd
add edx, 0xa7f19e07
add esi, 4
loop 0x10012d24
add eax, 0x10e13
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x2e020040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2e02004f
pop dword [ebp - 0x48]
mov eax, 0xd93204f7
add eax, 0x54cffb58
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x501b1681
add dword [ebp - 0x58], 0xfe372eca
mov dword [ebp - 0x54], 0xa97d5701
add dword [ebp - 0x54], 0x88b5f544
mov dword [ebp - 0x50], 0x9eb08a4e
add dword [ebp - 0x50], 0xad9bb9e0
mov dword [ebp - 0x4c], 0xbcbe4e82
add dword [ebp - 0x4c], 0x4341b17e
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xac05061a
add dword [ebp - 0x58], 0xc86d633c
mov dword [ebp - 0x54], 0x12563226
sub dword [ebp - 0x54], 0xd0e9d0b1
mov dword [ebp - 0x50], 0x6a3f18ec
add dword [ebp - 0x50], 0xf9305380
mov dword [ebp - 0x4c], 0x46022478
add dword [ebp - 0x4c], 0xb9fddb88
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3f702
push 0
call eax
mov ecx, 0x39a5ed84
sub ecx, 0x39a5abae
mov edx, eax
mov edi, 0x2e056e00
add edi, dword [ebp - 0x48]
mov esi, 0x40e6a9f0
sub esi, 0x3ac64ccc
mov dword [ebp - 0x3c], 0x5d04acfd
mov ebx, dword [edi]
xor dword [ebp - 0x28], esi
add ebx, esi
sub dword [ebp - 0x24], edi
mov dword [edx], ebx
sub dword [ebp - 0x24], 0xaa2d9a64
add edx, 0x77fabdae
add edx, 0x88054256
add edi, 0x952b9ca0
sub edi, 0x952b9c9c
loop 0x2e020161
add eax, 0x2d4aec0e
add eax, 0xd2b60e1d
mov ebx, eax
add eax, 0x3e08becb
add eax, 0xc1f7413a
mov ecx, 0x37be1c98
add ecx, 0xf641e368
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4013d1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42d0cc], 1
mov dword [0x42d0d0], 1
mov dword [0x42d0d4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401412
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401435
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401457
cmp eax, 0x20b
je 0x40147c
jmp 0x4014a7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401469
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014ac
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401494
mov eax, 0
jmp 0x4014ac
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014ac
mov eax, 0
leave
ret
Function at 0x40d9c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x41e060]
test eax, eax
je 0x40d9f9
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x40da10
mov eax, dword [0x41e060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp byte [0x429080], 0
jne 0x40da30
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x41e060]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x40d9e8
mov edx, 0x414
lea edi, [esp + 0x12]
mov dword [esp + 0x12], 0
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x16], 3
mov ebx, 0x14
mov dword [esp + 0x1a], 0x42b0c0
mov dword [esp + 0x1e], 0x41716c
mov word [esp + 0x22], dx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41716c
mov dword [esp], edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
jmp 0x40db03
test al, 0x10
je 0x40da02
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x414
sub esp, 4
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 3
mov dword [esp + 0x1a], 0x42b0c0
mov dword [esp + 0x1e], 0x41716c
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x41716c
mov dword [esp], edi
call esi
sub esp, 4
sub ebx, 1
je 0x40da02
mov dword [esp], 0x42b0c0
call ebp
sub esp, 4
cmp eax, 0xffffffff
jne 0x40da98
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40eaa0
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Read file on windows
Set environment variable
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x3c
call fcn.00408770
test al, al
je 0x40ec20
mov dword [esp + 4], 1
mov dword [esp], 0x40db20
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
test eax, eax
je 0x40eb50
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x4290a0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
je 0x415ecf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x4290a0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x42b0a0], eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x40ebb8
add esp, 0x3c
jmp fcn.0040db50
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
mov dword [esp], str.Error__failed_to_register_signal_handler.
call sub.msvcrt.dll_puts
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_puts
mov eax, 1
add esp, 0x3c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
sub esp, 0x1c
mov dword [esp], str.Error__failed_to_access_unpacked_executable.
call sub.msvcrt.dll_puts
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_puts
mov eax, 1
add esp, 0x3c
ret
mov dword [esp], 2
call dword [0x416058]
mov dword [esp + 8], str._TEMP_onefile__PID___TIME_
mov dword [esp + 4], str.Error__couldnt_runtime_expand_spec__ls._n
mov dword [esp], eax
call fcn.00401c00
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.IMAGEHLP.DLL_UnMapAndLoad]
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
jmp fcn.004015d0

Function at 0x40eeb8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00415344
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00415344
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
Function at 0x40fa8c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40faab
mov eax, 0
jmp 0x40faef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40face
mov eax, 0
jmp 0x40faef
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40faea
mov eax, 0
jmp 0x40faef
mov eax, 1
leave
ret

Function at 0x40faf1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40fb50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40fb48
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40fb48
mov eax, dword [ebp - 4]
jmp 0x40fb64
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40fb25
mov eax, 0
leave
ret