joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100027b9
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x10057b68]
mov eax, 0x40
mov eax, dword [0x10057c28]
cmp dword [0x10057e94], eax
ja 0x100027f4
mov edi, dword [0x10057b84]
sub eax, edi
mov edi, dword [0x10057b2c]
mov dword [0x10057b6c], eax
mov dword [0x10057e60], edx
mov dword [0x10057d28], eax
mov edi, dword [0x10057d14]
mov esi, dword [0x10057eb0]
mov ecx, dword [0x10057c08]
add ecx, eax
mov ecx, dword [0x10057cd0]
mov ax, 0x7d
cmp edi, dword [0x10057d20]
ja 0x10002833
mov eax, dword [0x10057e4c]
mov ax, 0x10
mov eax, dword [0x10057b2c]
add eax, edx
mov dword [0x10057ee0], eax
mov dword [0x10057b2c], eax
mov eax, dword [0x10057ef8]
mov esi, 2
push esi
call sub.kernel32.dll_DeleteFileA
mov ecx, dword [0x10057da0]
mov eax, 4
mov eax, dword [0x10057c84]
cmp eax, dword [0x10057c88]
jb 0x1000286f
mov esi, dword [0x10057df0]
mov dword [0x10057e2c], eax
mov edi, dword [0x10057cec]
sub edx, eax
mov dword [0x10057bb4], edx
mov esi, dword [0x10057cf8]
mov eax, 0xac
mov edx, dword [0x10057cf0]
cmp dword [0x10057d74], 0x20
jl 0x100028ad
mov ecx, dword [0x10057b2c]
mov edx, dword [0x10057e94]
mov di, 0x10
mov di, 0x8c
mov dword [0x10057c34], eax
mov eax, dword [0x10057bd8]
mov dword [0x10057b2c], edi
mov ecx, dword [0x10057b38]
ret 0xc
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401083
jmp 0x401030
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm0, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm3, mm4
punpckhwd mm5, mm6
movq qword [edi - 0x10], mm0
paddd mm3, mm5
add esi, 8
movq qword [edi - 8], mm3
sub eax, 4
jge 0x401030
add eax, 4
jle 0x4010b6
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x401089
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x4072be
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid

Function at 0x40d76b
Capabilities:
Encode data using xor

Disassembly:
dec dword [edi - 0x22]
dec esi
mov ecx, 0xc575db4b
inc esi
salc
inc esi
xor dword [ecx - 0x2f], eax
inc eax
invalid
inc eax
inc ebx
rol dword [ebx + 0x32], cl
inc edx
fisttp qword [esi + edi*8 + 0x4e]
fimul word [eax - 0x45]
dec ebx
fisttp dword [edx - 6]
xor al, byte [edx - 0x23]
dec esp
dec byte [esi - 0x22]
dec eax
mov ebx, 0xfa4adb4b
jne 0x40d754
inc ebp
xor al, 0x44
xlatb
inc edi
test byte [ecx - 0x30], 0x40
mov bl, 0x42
fisttp qword [ebp - 4]
dec esp
fimul word [ecx + 0x39]
dec eax
fmul dword [ebx - 5]
dec edx
fimul dword [edx - 0x46]
jne 0x40d770
inc esp
hlt

Function at 0x41e40e
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid
Function at 0x43549e
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid

Function at 0x43b079
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x20
lahf
mov eax, dword [0x9c2fab78]
rsqrtps xmm2, xmmword [edx]
mov al, byte [ecx + 0x2a]
jge 0x43b002
adc cl, byte [edx - 0x7e82d5bf]
add byte [eax + 0x44], dl
das
ror byte [edi + 0x5c], 0xfe
xor edx, esp
pop edx
add esp, edx
cmpsb byte [esi], byte es:[edi]
and edx, dword [ecx + 0x36fd121]
loopne 0x43b07b
sub eax, 0x32b0b5d9
dec edx
and byte [eax - 4], 0x8f
push es
mov bl, 0xc0
and bl, byte ss:[esi - 0x70]
pop esi
nop
sub byte [ebp + 0xf3f3aef], ch
call 0xbf37d484
aad 0xb1
jb 0x43b137
dec esp
aam 0x8f
jl 0x43b10d
outsb dx, byte [esi]
invalid
out dx, eax
scasb al, byte es:[edi]
xchg edx, eax
dec ebp
invalid
jno 0x43b128
popfd
je 0x43b0a8
sar byte [ecx], 0xfe
add dh, bh
invalid
out dx, al
test al, 0x89
test dword [esi + 0x74], edi
pop esi
jo 0x43b18f
rcr edi, 0xa3
dec esp
mov word [esi + 0x79], cs
sub ebp, dword [ecx + 0x52]
test al, 0x25
jg 0x43b16f
imul edx, dword [edx - 0x58], 0x7e417f25
mov edi, 0x9affec82
call 0x7e8399f1
int3
jle 0x43b0ef
sub ah, 0xff
lcall 0xcc7e, 0x3fe8b8e8
aas
jle 0x43b106
loop 0x43b1b8
adc bl, byte [edi - 0x6a1b7ad]
scasd eax, dword es:[edi]
inc ebx
cmc
xor ebp, edi
xchg ecx, eax
jle 0x43b199
pop esi
mov ebp, 0xd37f7367
jb int.0043b1a5
jle 0x43b117
sar byte [edx - 0x7b], cl
cmp ebx, dword [esi]
cwde
pushal
je 0x43b1c1
retf
cmp dl, 0x51
xchg ecx, eax
pop ebp
add bh, ah
std
scasd eax, dword es:[edi]
lea edi, [edi - 0x62]
pop esi
aas
or dword [edi + 0x6e], edi
xor bh, byte [ebp - 0x58]
sub al, 0x87
and al, 0xeb
pushal
in eax, dx
invalid
push edx
sbb al, 0x96
invalid
outsd dx, dword [esi]
inc ecx
invalid
fmul qword [ecx + 0x59]

Function at 0x44c0de
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid
Function at 0x462d3e
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid

Function at 0x46b5db
Capabilities:
Encode data using xor

Disassembly:
popal
add edx, dword [ecx - 0x1e6f9191]
mov edi, dword [0x459cb79d]
popfd
mov bh, 0x9c
inc ebp
pushfd
inc ebp
xor edx, ebx
fdiv qword [0x5745e402]
sub eax, esp
jo 0x46b5dd
mov ebp, 0x223a026a
fmul dword [eax]
fdivrp st(2)
add dword [ebx + eax*4 - 0x264df9f9], 0xffffff86
pop ebx
push ebx
and eax, 0xd4267157
stosd dword es:[edi], eax
call [ebx - 0x4a9add66]
mov dh, 0x53
xchg dword [ecx + edi], ebx
sahf
std
jp 0x46b5d2
test al, 0x13
mov ah, 0x39
stosd dword es:[edi], eax
xchg esi, eax
les edi, [edx + 0x64]
push 0x1d
adc dword [ebp - 0x78], ebx
retf 0x95ef

Function at 0x479d3e
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid

Function at 0x491ace
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid
Function at 0x605e5b
Capabilities:
Encode data using xor

Disassembly:
mov byte [eax + 0x7f83568b], ch
dec edi
cmp eax, ebp
push 0x58cdb22f
or byte [ecx + ebp + 0x6b], dl
adc dword [0x953821d6], 0xa3e8a4ee
insb byte es:[edi], dx
pop edi
sub eax, 0x799957b3
aad 0x92
dec ecx
mov edx, 0x31058891
test al, 0x89
ja 0x605e3a
invalid

Function at 0x616fde
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [ecx], 0x82438e89
add byte [eax], al
mov dword [eax], eax
add byte [edx - 0x71770000], al
xchg edi, eax
add dword [eax], eax
add byte [ecx + 0x824f8e], cl
add byte [eax], al
mov ss, word [ebx - 0x7e]
add byte [eax], al
xor eax, dword [ecx]
push edi
add byte [eax], 0
mov dword [esi + 0x5b], ecx
mov dword [esi + 0x171825f], ecx
mov dword [esi + 0x8263], ecx
mov dword [eax], eax
add byte [edx - 0x71770000], al
out dx, al
add dword [eax], eax
add byte [ecx + 0x826f8e], cl
add byte [eax], al
invalid

Function at 0x6294a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632378
cmp edx, dword [eax]
je 0x6294c7
add eax, 8
inc ecx
cmp eax, 0x632408
jl 0x6294b8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632378]
jne 0x6295f5
mov eax, dword [0x63bd00]
cmp eax, 1
je 0x6295cf
test eax, eax
jne 0x6294f8
cmp dword [0x6322a4], 1
je 0x6295cf
cmp edx, 0xfc
je 0x6295f5
int1
add byte [eax], al
invalid
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62952f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629e90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a2c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629572
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a2c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ec1c
push edi
call fcn.0062be60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629e90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629ea0
lea eax, [ebp - 0xa0]
push 0x62ebfc
push eax
call fcn.00629ea0
push dword [esi + 0x63237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629ea0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062bdd4
add esp, 0x2c
pop edi
jmp 0x6295f5
lea eax, [ebp + 8]
lea esi, [esi + 0x63237c]
push 0
push eax
push dword [esi]
call fcn.0062a2c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40100f
Capabilities:
Terminate process

Disassembly:
jmp 0x40e777
cmp dword [esp + 4], 0
mov edx, str.error_unpacking_archive
cmovne edx, dword [esp + 4]
cmp byte [edx], 0x40
lea eax, [edx + 1]
cmovne eax, edx
push eax
push 0x426318
push dword [ecx + 0x68]
call fcn.0040152d
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x401041
Capabilities:
Terminate process

Disassembly:
jmp 0x41a26b
push 0x14
push 0x4271f0
call fcn.00401226
push 1
call fcn.0040164f
pop ecx
test al, al
je 0x41a183
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004016ea
mov byte [ebp - 0x24], al
mov eax, dword [0x42978c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41a183
test eax, eax
jne 0x41a0a1
mov dword [0x42978c], ecx
push 0x41d618
push 0x41d30c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41a084
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41a173
push 0x41d208
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x42978c], 2
jmp 0x41a0a6
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004013ac
pop ecx
call fcn.004010d7
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41a0d7
push esi
call fcn.004012e9
pop ecx
test al, al
je 0x41a0d7
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.00401078
mov esi, eax
cmp dword [esi], edi
je 0x41a0f5
push esi
call fcn.004012e9
pop ecx
test al, al
je 0x41a0f5
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov edi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
push edi
push esi
push dword [eax]
call fcn.004016db
add esp, 0xc
mov esi, eax
call fcn.00401735
test al, al
je 0x41a18a
test bl, bl
jne 0x41a128
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.004013c0
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41a173
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0040144c
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004018ac
jmp 0x41a017
Function at 0x4013ca
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x419b36
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jle 0x419b66
push ebx
mov ebx, dword [esp + 0x10]
push dword [edi]
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
jle 0x419b6b
add dword [edi + 0x20], eax
sub esi, eax
add ebx, eax
test esi, esi
jg 0x419b47
pop ebx
pop edi
pop esi
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
mov eax, dword [edi + 0x30]
push str.Error:_write_on_output_file_failed_err_d_n
push dword [eax + 0x68]
call fcn.0040152d
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x401735
Capabilities:
Parse pe header

Disassembly:
jmp 0x41ada6
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41ade5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ade5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ade5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41ade5
cmp dword [ecx + 0x74], 0xe
jbe 0x41ade5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4017a8
Capabilities:
Terminate process

Disassembly:
jmp 0x4195c0
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4195fe
push 0x426410
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [esi], eax
pop ecx
pop ecx
test eax, eax
jne 0x4195fe
push dword [esp + 8]
mov eax, dword [esi + 0x30]
push str.Error:_Could_not_open_jar_file:__s_n
push dword [eax + 0x68]
call fcn.0040152d
add esp, 0xc
push 3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop esi
ret 4
Function at 0x402624
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x41db30]
sub edx, 1
jne 0x40262b
ret
Function at 0x40daff
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push str.UNPACK200_FLAGS
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
pop ecx
test eax, eax
je 0x40db56
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov dword [esp], 0x425174
push eax
jmp 0x40db4c
push 4
lea ecx, [ebp - 0xc]
call fcn.00401357
push 0x425174
push ebx
mov dword [eax], esi
call edi
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40db3a
mov eax, dword [ebp - 8]
or edx, 0xffffffff
mov ebx, dword [ebp + 8]
shr eax, 2
inc eax
add eax, ebx
mov ecx, eax
shl ecx, 2
cmp eax, 0x1fffffff
cmova ecx, edx
push ecx
call fcn.0040159b
mov esi, eax
xor edx, edx
test dword [ebp - 8], 0xfffffffc
pop ecx
mov dword [ebp + 8], esi
jbe 0x40db9f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
mov dword [esi], ecx
add esi, 4
mov eax, dword [ebp - 8]
inc edx
shr eax, 2
cmp edx, eax
jl 0x40db89
xor edi, edi
inc edi
cmp ebx, edi
jle 0x40dbbd
mov eax, dword [ebp + 0xc]
push dword [eax + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov dword [esi], eax
add esi, 4
inc edi
pop ecx
cmp edi, ebx
jl 0x40dba6
and dword [esi], 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
pop edi
shr edx, 2
cmp dword [ebp - 4], 0
pop esi
mov dword [ecx], edx
pop ebx
je 0x40dbdc
lea ecx, [ebp - 0xc]
call fcn.0040137f
mov eax, dword [ebp + 8]
leave
ret

Function at 0x418d80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x428db0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
cmp eax, dword [ebp + 8]
jbe 0x418de7
lea eax, [ebp - 0x108]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea eax, [ebp - 0x108]
push 0x2f
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 0x10
test eax, eax
je 0x418de7
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.00401762
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401361
leave
ret
Function at 0x42f235
Capabilities:
Terminate process

Disassembly:
jmp 0x438e70
jmp fcn.00447400
cmp ecx, dword [0x4a20ec]
jne 0x438e7a
repz ret
jmp 0x42f776

Function at 0x4323c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], 0
jmp 0x432417
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x28
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x4324da
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x10], 0
jne 0x432485
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x432483
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.00430040
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042f66d
add esp, 0xc
jmp 0x432405
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.00430040
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042fc8f
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
jmp 0x432405
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.00430040
mov esp, ebp
pop ebp
ret
Function at 0x432540
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
lea edi, [ebp - 0x120]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
jmp 0x43258e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x4326b9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x40000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
je 0x432614
mov esi, esp
push 0x4000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp esi, esp
call fcn.00430040
jmp 0x43257c
mov eax, dword [ebp - 0x44]
shl eax, 4
mov ecx, dword [ebp - 0x50]
lea edx, [eax + ecx*8 + section..data]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x432646
mov eax, dword [ebp - 0x20]
or eax, 0x200
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0
jne 0x432686
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x40
je 0x43266d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x38], edx
jmp 0x432686
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
je 0x432686
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0
jbe 0x4326b4
mov esi, esp
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.00430040
test eax, eax
jne 0x4326b4
jmp 0x4326b9
jmp 0x43257c
push edx
mov ecx, ebp
push eax
lea edx, [0x4326e0]
call fcn.0042f6fe
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x120
cmp ebp, esp
call fcn.00430040
mov esp, ebp
pop ebp
ret