joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40102a
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4171a4], 0
jne 0x401038
call section..text
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x401065
test cl, 7
je 0x401065
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
dec esi
inc ecx
jmp 0x401046
cmp esi, 8
jb 0x4010e9
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4171a0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4171a0]
dec edi
jne 0x40106f
xor edx, edx
test esi, esi
jbe 0x401109
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4171a0]
inc edx
cmp edx, esi
jb 0x4010f0
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x401515
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x40152f
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x401542
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x401555
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.004037cc
test eax, eax
je 0x40158e
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40158e
cmp word [eax], bx
je 0x40158e
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4015a2
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4015be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4015be
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x401624
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4015ee
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.00406562
pop ecx
pop ecx
jmp 0x4015f7
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x40160c
push dword [ebp + 8]
push eax
call fcn.00406440
pop ecx
pop ecx
jmp 0x40161a
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.00404e24
push dword [esi + 4]
mov ecx, esi
call fcn.00401329
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40162e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x401654
cmp dword [ebp + 0xc], esi
jbe 0x401649
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4016a4
mov ecx, edi
call fcn.004014cf
test al, al
je 0x40168a
cmp dword [ebp + 0xc], esi
jbe 0x40168a
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.0040162e
jmp 0x4016a7
cmp dword [edi + 0xc], 1
jne 0x40169f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x40169f
xor eax, eax
jmp 0x4016a7
or eax, 0xffffffff
jmp 0x4016a7
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x401846
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.004037cc
test eax, eax
je 0x401870
mov eax, dword [esp + 8]
test eax, eax
je 0x401870
cmp word [eax], 0
je 0x401870
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x40188d
cmp dword [esp + 4], 0
je 0x40188b
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40188b
xor eax, eax
inc eax
jmp 0x40188d
xor eax, eax
ret 8

Function at 0x40189e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.004037cc
test eax, eax
je 0x4018c3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4018c3
cmp word [eax], 0
je 0x4018c3
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4018d5
cmp dword [ebp + 8], 0
je 0x4018dc
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x4018de
xor al, al
pop ebp
ret 0xc

Function at 0x401a22
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.004037cc
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x401a48
cmp esi, ebx
je 0x401a48
cmp word [esi], bx
je 0x401a48
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x401a57
cmp dword [ebp + 8], ebx
je 0x401a85
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x401a70
cmp byte [ebp + 0x10], bl
je 0x401a6c
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.0040189e
xor eax, eax
jmp 0x401a88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x401a85
cmp eax, 3
je 0x401a85
xor eax, eax
inc eax
jmp 0x401a88
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x401fab
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0xfa8]
mov eax, 0x1028
call fcn.00406900
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp + 0xfa4], eax
mov ecx, dword [ebp + 0xfb4]
mov eax, dword [ebp + 0xfb0]
push esi
mov esi, 0x400
push esi
lea edx, [ebp + 0x7a4]
push edx
push ecx
push eax
call fcn.0040388f
lea eax, [ebp + 0x7a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402001
xor al, al
jmp 0x402054
push esi
lea eax, [ebp + 0x7a4]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00404dd0
lea eax, [ebp - 0x60]
push eax
call fcn.0040709b
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x5e], cx
push ecx
lea eax, [ebp - 0x80]
push eax
call fcn.00407300
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0xfa4]
xor ecx, ebp
pop esi
call fcn.004068ab
add ebp, 0xfa8
leave
ret 8
Function at 0x403a06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 8]
push eax
push 1
push 0
push str.SoftwareWinRARPaths
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403a59
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x412280
push dword [ebp + 8]
mov dword [ebp - 4], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x403a6b
push esi
push 0
call fcn.00401846
test al, al
jne 0x403a71
push esi
call fcn.00403977
pop esi
leave
ret 4

Function at 0x403a9f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x530]
sub esp, 0x5b0
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp + 0x52c], eax
mov eax, dword [ebp + 0x53c]
mov ecx, dword [ebp + 0x538]
push edi
xor edi, edi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], eax
cmp word [eax], di
je 0x403b84
lea edx, [ebp - 0x68]
push edx
push 0x20019
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b84
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x39c]
push eax
mov dword [ebp - 0x70], edi
push edi
jmp 0x403b55
lea eax, [ebp + 0x39c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x64]
push str._s_s
push 0x200
push eax
call fcn.00402123
add esp, 0x14
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
call fcn.00403a9f
inc dword [ebp - 0x70]
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x39c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], 0xc8
call esi
test eax, eax
je 0x403b11
push dword [ebp - 0x68]
call fcn.00403a76
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
test eax, eax
jne 0x403b84
inc dword [0x417ff4]
mov ecx, dword [ebp + 0x52c]
xor ecx, ebp
pop edi
call fcn.004068ab
add ebp, 0x530
leave
ret 8

Function at 0x403c39
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push esi
call fcn.00403b9c
test al, al
je 0x403ca5
lea eax, [ebp - 0x408]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ca5
push edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x408]
call fcn.00403a76
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004068ab
leave
ret 0xc
Function at 0x403ed3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.00403de0
mov esi, eax
xor bl, bl
test esi, esi
je 0x403f1c
mov eax, dword [ebp + 0x1c]
add eax, eax
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
neg ebx
sbb bl, bl
push esi
inc bl
call fcn.00403a76
test bl, bl
jne 0x403f29
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406562
pop ecx
pop ecx
pop esi
mov al, bl
pop ebx
pop ebp
ret 0x18
Function at 0x404a83
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00406900
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, esi
je 0x404ab0
push dword [ebp + 0x10]
push esi
push edi
call fcn.00404dd0
lea eax, [ebp - 0x1008]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404b84
push esi
call fcn.0040709b
pop ecx
mov ecx, 0x3ff
sub ecx, eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1010]
push eax
push 0
push str.LanguageFolder
push dword [ebp - 0x1008]
add ecx, ecx
mov dword [ebp - 0x100c], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404b78
mov word [ebp - 0x804], ax
push 0x400
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x804]
push eax
call fcn.00403866
push esi
call fcn.0040390f
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00406538
pop ecx
pop ecx
lea eax, [ebp - 0x804]
push eax
push 0
call fcn.00401846
test al, al
je 0x404b78
push dword [ebp + 0x10]
lea eax, [ebp - 0x804]
push eax
push edi
call fcn.00404dd0
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004068ab
leave
ret 0xc

Function at 0x404c15
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x898]
sub esp, 0x918
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp + 0x894], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x8a4]
mov esi, ecx
call fcn.00404a60
mov ebx, 0x400
lea eax, [ebp + 0x94]
test edi, edi
je 0x404c5a
push edi
push eax
call fcn.00406562
pop ecx
pop ecx
jmp 0x404c64
push ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.rarlng.dll
lea eax, [ebp + 0x94]
push eax
call fcn.0040390f
push eax
call fcn.00406562
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x94]
push eax
push eax
call fcn.00404a83
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x70], 2
jne 0x404cc3
cmp dword [ebp - 0x7c], 5
ja 0x404cb0
jne 0x404cc3
cmp dword [ebp - 0x78], 1
jbe 0x404cc3
push 2
push 0
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x404cd0
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x417fb8], eax
setne al
pop edi
mov byte [esi], al
pop esi
test al, al
mov eax, dword [ebp + 0x8a0]
pop ebx
jne 0x404cee
mov dword [0x417fb8], eax
mov ecx, dword [ebp + 0x894]
xor ecx, ebp
mov dword [0x417fb4], eax
call fcn.004068ab
add ebp, 0x898
leave
ret 8
Function at 0x405365
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0x10]
call fcn.0040709b
mov esi, eax
inc esi
lea eax, [esi + esi + 2]
push eax
call fcn.004066c3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4053ad
push esi
push edi
push dword [esp + 0x18]
call fcn.00404e24
push dword [esp + 0xc]
push edi
call fcn.00406820
pop ecx
push eax
push 1
push edi
call fcn.004075c8
push edi
call fcn.00406786
add esp, 0x14
pop edi
pop esi
ret 8
Function at 0x4063a7
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x4068ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4161a0]
jne 0x4068b5
repz ret
jmp fcn.00409f2b

Function at 0x409a0e
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4162f0]
je 0x409a29
inc edi
cmp edi, 0x17
jb 0x409a1a
cmp edi, 0x17
jae 0x409ba9
push ebp
push 3
call fcn.0040ec0d
pop ecx
cmp eax, 1
je 0x409b75
push 3
call fcn.0040ec0d
pop ecx
test eax, eax
jne 0x409a5d
cmp dword [0x4161c0], 1
je 0x409b75
cmp ebx, 0xfc
je 0x409ba8
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x41b2e8
push ebp
call fcn.0040e1f9
add esp, 0xc
test eax, eax
je 0x409a93
push esi
push esi
push esi
push esi
push esi
call fcn.00409dfe
add esp, 0x14
push 0x104
mov esi, 0x41b301
push esi
push 0
mov byte [0x41b405], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409ad7
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040e1f9
add esp, 0xc
test eax, eax
je 0x409ad7
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00409dfe
add esp, 0x14
push esi
call fcn.00406820
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x409b1c
push esi
call fcn.00406820
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x41b5fc
push 0x413064
sub ecx, eax
push ecx
push eax
call fcn.0040eb5a
add esp, 0x14
test eax, eax
je 0x409b1c
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00409dfe
add esp, 0x14
jmp 0x409b1e
xor esi, esi
push 0x413060
push ebx
push ebp
call fcn.0040eae9
add esp, 0xc
test eax, eax
je 0x409b3e
push esi
push esi
push esi
push esi
push esi
call fcn.00409dfe
add esp, 0x14
push dword [edi*8 + 0x4162f4]
push ebx
push ebp
call fcn.0040eae9
add esp, 0xc
test eax, eax
je 0x409b60
push esi
push esi
push esi
push esi
push esi
call fcn.00409dfe
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040e982
add esp, 0xc
jmp 0x409ba8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x409ba8
cmp ebp, 0xffffffff
je 0x409ba8
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4162f4]
push dword [esi]
call fcn.00406820
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x409dfe
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
and dword [ebp - 0x80], 0
push ebx
push 0x4c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00407300
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov eax, dword [ebp + 0x2ac]
lea ecx, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x9c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp + 0x8c], ecx
mov dword [ebp - 0x80], 0xc0000417
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x409edd
test ebx, ebx
jne 0x409edd
push 2
call fcn.0040f0c5
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
pop ebx
call fcn.004068ab
add ebp, 0x2a8
leave
ret

Function at 0x409f05
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x41b604]
call fcn.0040ae63
pop ecx
test eax, eax
je 0x409f1b
pop ebp
jmp eax
push 2
call fcn.0040f0c5
pop ecx
pop ebp
jmp fcn.00409dfe
Function at 0x40d72a
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x40d753
call fcn.00409c22
push edi
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
call fcn.00409f05
add esp, 0x14
jmp 0x40d84a
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x40d84a
test al, 0x40
jne 0x40d84a
test al, 2
je 0x40d775
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x40d84a
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
jne 0x40d78b
push esi
call fcn.0040edef
pop ecx
jmp 0x40d790
mov eax, dword [esi + 8]
mov dword [esi], eax
push dword [esi + 0x18]
push dword [esi + 8]
push esi
call fcn.0040b726
pop ecx
push eax
call fcn.0041035c
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, edi
je 0x40d83a
cmp eax, 0xffffffff
je 0x40d83a
test byte [esi + 0xc], 0x82
jne 0x40d80f
push esi
call fcn.0040b726
pop ecx
cmp eax, 0xffffffff
je 0x40d7fa
push esi
call fcn.0040b726
pop ecx
cmp eax, 0xfffffffe
je 0x40d7fa
push esi
call fcn.0040b726
sar eax, 5
push esi
lea edi, [eax*4 + 0x41cc20]
call fcn.0040b726
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
jmp 0x40d7ff
mov eax, 0x416520
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x40d80f
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x40d82d
mov eax, dword [esi + 0xc]
test al, 8
je 0x40d82d
test eax, 0x400
jne 0x40d82d
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x40d84d
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], edi
or eax, 0xffffffff
pop edi
pop esi
ret
Function at 0x40dfe4
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x41ba98]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
push 2
pop ebp
cmp eax, ebx
jne 0x40e02d
call edi
mov esi, eax
cmp esi, ebx
je 0x40e014
mov dword [0x41ba98], 1
jmp 0x40e036
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40e028
mov eax, ebp
mov dword [0x41ba98], eax
jmp 0x40e02d
mov eax, dword [0x41ba98]
cmp eax, 1
jne 0x40e0ba
cmp esi, ebx
jne 0x40e049
call edi
mov esi, eax
cmp esi, ebx
jne 0x40e049
xor eax, eax
jmp 0x40e112
mov eax, esi
cmp word [esi], bx
je 0x40e05e
add eax, ebp
cmp word [eax], bx
jne 0x40e050
add eax, ebp
cmp word [eax], bx
jne 0x40e050
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x40e0af
push ebp
call fcn.0040a367
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x40e0af
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x40e0ab
push dword [esp + 0x10]
call fcn.00406786
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x40e112
cmp eax, ebp
je 0x40e0c2
cmp eax, ebx
jne 0x40e042
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x40e042
cmp byte [esi], bl
je 0x40e0e0
inc eax
cmp byte [eax], bl
jne 0x40e0d6
inc eax
cmp byte [eax], bl
jne 0x40e0d6
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.0040a367
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x40e0fe
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x40e042
push ebp
push esi
push edi
call fcn.00407810
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x40e5d0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40e5e1
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40e5de
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
ret

Function at 0x40e600
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x40e63a
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40e632
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40e63c
inc edx
add eax, 0x28
cmp edx, esi
jb 0x40e622
xor eax, eax
pop edi
pop esi
pop ebx
ret