joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6af950
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x6afab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x6af992
or ebx, 0xffff
mov eax, esi
call fcn.0040a7f8
mov esi, eax
jmp 0x6af994
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x6af9c4
mov eax, edi
call fcn.00409c34
jmp 0x6afa99
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x6afa14
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x74d16c]
call fcn.0042a104
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6f6970]
mov dl, 1
mov eax, dword [0x6b2fd4]
call fcn.0042b874
call fcn.004092a8
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040a984
mov eax, dword [edi]
test eax, eax
je 0x6afa2c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6afa99
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040a7f8
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x6afa99
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x74d16c]
call fcn.0042a104
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6f6970]
mov dl, 1
mov eax, dword [0x6b2fd4]
call fcn.0042b874
call fcn.004092a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6afabd
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00409c94
pop eax
jmp eax

Function at 0x6afcca
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x6afc8b
add esp, 0xfffffff0
call fcn.00408414
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.006b998c
mov dl, 1
mov eax, dword [0x6ae060]
call fcn.006b2e24
mov dword [edi + 0xb8], eax
mov dl, 1
mov eax, dword [0x69f110]
call fcn.006aa4e8
mov dword [edi + 0xb4], eax
mov eax, dword [0x6ad130]
call fcn.006b29e0
push 0
push 0
push 0
push 1
push 0x6afd2c
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0xb0], esi
test esi, esi
jne 0x6afcf9
mov ecx, dword [0x6f6b58]
mov dl, 1
mov eax, dword [0x6b308c]
call fcn.0042b838
call fcn.004092a8
push 0
push 0x10010
push 0x6afad8
mov eax, dword [edi + 0xb0]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x6afd26
call fcn.0040846c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x6b1204
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b13e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xb9], 0
mov byte [ebx + 0xb8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jle 0x6b124e
mov esi, dword [ebp - 4]
movzx esi, word [esi + 0x10]
jmp 0x6b1250
xor esi, esi
push 0
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040a7f8
push eax
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0xb0]
push eax
call sub.winhttp.dll_WinHttpConnect
mov edi, eax
mov dword [ebx + 0xa0], edi
test edi, edi
jne 0x6b12a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6f65c4]
mov dl, 1
mov eax, dword [0x6b3154]
call fcn.0042b874
call fcn.004092a8
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x6b13fc
call fcn.0040abf4
jne 0x6b12bd
or esi, 0x800000
push esi
push 0
push 0
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.006af910
mov eax, dword [ebp - 0x10]
call fcn.0040a7f8
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.006a6798
mov eax, dword [ebp - 0x14]
call fcn.0040a7f8
push eax
mov eax, dword [ebx + 0xa0]
push eax
call sub.winhttp.dll_WinHttpOpenRequest
mov edi, eax
mov dword [ebx + 0xa4], edi
test edi, edi
jne 0x6b1349
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x28]
mov edx, dword [0x74d16c]
call fcn.0042a104
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x6f6acc]
mov dl, 1
mov eax, dword [0x6b3154]
call fcn.0042b874
call fcn.004092a8
mov eax, dword [ebx + 0x14]
push eax
mov eax, ebx
call fcn.006a68ec
push eax
mov esi, dword [ebx + 0xc]
push esi
push esi
mov eax, dword [ebx + 0xa4]
push eax
call sub.winhttp.dll_WinHttpSetTimeouts
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x6b13b6
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x2c]
mov edx, dword [0x74d16c]
call fcn.0042a104
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x6f6c7c]
mov dl, 1
mov eax, dword [0x6b3154]
call fcn.0042b874
call fcn.004092a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b13e7
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00409c94
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409c94
pop eax
jmp eax
Function at 0x6c344c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6c3455
xchg dword [ebp - 4], ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d28
mov eax, dword [ebp - 8]
call fcn.00409d28
mov eax, dword [ebp + 8]
call fcn.00409d28
xor eax, eax
push ebp
push 0x6c35da
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x74d1e0]
push 0x6c35f8
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040aae4
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00424aac
test al, al
je 0x6c3562
push 5
lea eax, [ebp - 0x10]
mov ecx, 0x6c35f8
mov edx, dword [0x74d1e0]
call fcn.0040aa5c
mov eax, dword [ebp - 0x10]
call fcn.0040a7f8
push eax
mov eax, dword [ebp - 8]
call fcn.0040a7f8
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a7f8
push eax
push 0x6c360c
push esi
call sub.shell32.dll_ShellExecuteW
mov esi, eax
cmp esi, 0x20
ja 0x6c35a5
push 0x6c3624
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00424210
push dword [ebp - 0x18]
push 0x6c366c
push 0x6c367c
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00424210
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov eax, dword [0x6f6b8c]
mov eax, dword [eax]
call fcn.0049c038
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040aae4
mov eax, dword [ebp - 0x14]
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.005716cc
jmp 0x6c35a5
cmp byte [ebp + 0xc], 0
jne 0x6c3597
push dword [ebp - 4]
push 0x6c368c
push 0x6c369c
push 0x6c36bc
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040aae4
mov eax, dword [ebp - 0x24]
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.005716cc
jmp 0x6c35a5
or ecx, 0xffffffff
or edx, 0xffffffff
mov eax, dword [ebp + 8]
call fcn.005716cc
test bl, bl
je 0x6c35b5
mov eax, dword [0x6f6d04]
mov eax, dword [eax]
call fcn.005d2144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c35e1
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00409c94
lea eax, [ebp + 8]
call fcn.00409c34
pop eax
jmp eax

Function at 0x6c36c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d28
xor eax, eax
push ebp
push 0x6c3712
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a7f8
push eax
push 0x6c3720
push ebx
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c3719
lea eax, [ebp - 4]
call fcn.00409c34
pop eax
jmp eax
Function at 0x407fa0
Capabilities:
Modify service

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 8], 0
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, 0xffffffff
mov dword [esp + 4], ecx
setne dl
mov eax, 0x70f87c
lea ecx, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push ecx
lea eax, [esp + 4]
push 2
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add esp, 0x1c
ret

Function at 0x408140
Capabilities:
Create http request

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xe
mov esi, str.http:__www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov word [esp + 0x55], ax
push eax
push eax
push eax
push 1
push eax
mov byte [esp + 0x6b], al
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x84000000
push 0
lea ecx, [esp + 0x14]
mov esi, eax
push 0
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
jne 0x4081bc
call esi
push 0
call esi
call fcn.00408090
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 0x10
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5d8af0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x5d87dc
inc edi
call fcn.005d8b27
mov edi, 0x86ad173a
dec ebx
sub edi, 1
xor dword [esi], ecx
sub ebx, edi
add esi, 2
sub edi, edi
cmp esi, edx
jl fcn.005d8af0
and ebx, edi
add ebx, 0x8f0e52ea
ret
Function at 0x40618b
Capabilities:
Create pipe
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4dcc58]
mov ecx, dword [0x4dbbac]
sub esp, 0xe84
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x40628e
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x4dcc58], 0x959
jne 0x40627c
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x405910
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x405968
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00405f98
add ebx, 8
dec dword [ebp - 8]
jne 0x4061b4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40889b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b718]
jne 0x4088a5
repz ret
jmp fcn.0041013c

Function at 0x411eb7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a01d
and dword [ebp - 4], 0
cmp dword [0x42d7a0], 0
mov ebx, eax
jne 0x411f68
push 0x40391c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412019
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403910
push edi
call esi
test eax, eax
je 0x412019
push eax
call fcn.00409fab
mov dword [esp], 0x403900
push edi
mov dword [0x42d7a0], eax
call esi
push eax
call fcn.00409fab
mov dword [esp], 0x4038ec
push edi
mov dword [0x42d7a4], eax
call esi
push eax
call fcn.00409fab
mov dword [esp], 0x4038d0
push edi
mov dword [0x42d7a8], eax
call esi
push eax
call fcn.00409fab
pop ecx
mov dword [0x42d7b0], eax
test eax, eax
je 0x411f68
push 0x4038b8
push edi
call esi
push eax
call fcn.00409fab
pop ecx
mov dword [0x42d7ac], eax
mov eax, dword [0x42d7ac]
cmp eax, ebx
je 0x411fc0
cmp dword [0x42d7b0], ebx
je 0x411fc0
push eax
call fcn.0040a026
push dword [0x42d7b0]
mov esi, eax
call fcn.0040a026
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411fc0
test edi, edi
je 0x411fc0
call esi
test eax, eax
je 0x411fb7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411fb7
test byte [ebp - 0xc], 1
jne 0x411fc0
or dword [ebp + 0x10], 0x200000
jmp 0x411ff9
mov eax, dword [0x42d7a4]
cmp eax, ebx
je 0x411ff9
push eax
call fcn.0040a026
pop ecx
test eax, eax
je 0x411ff9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411ff9
mov eax, dword [0x42d7a8]
cmp eax, ebx
je 0x411ff9
push eax
call fcn.0040a026
pop ecx
test eax, eax
je 0x411ff9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d7a0]
call fcn.0040a026
pop ecx
test eax, eax
je 0x412019
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41201b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x85ca35
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x85c7b9
sub eax, eax
call fcn.0085ca6b
sub ebx, eax
xor dword [edi], esi
mov eax, eax
mov eax, 0xabb40c3c
add eax, 1
add edi, 1
and ebx, ebx
sub eax, eax
cmp edi, ecx
jl fcn.0085ca35
add ebx, eax
mov eax, 0xd189f7f5
ret
Function at 0x406630
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41588b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x40490c
call fcn.00407291
push 4
mov dword [esp + 0x18], 0
call fcn.00407fc7
mov edi, eax
add esp, 4
test edi, edi
je 0x4066a4
push ebx
call fcn.00407169
mov dword [edi], eax
call fcn.00406f28
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407252
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406698
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040727a
pop ebx
jmp 0x4066a6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408a41
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419510]
jne 0x408a4b
repz ret
jmp fcn.0040cc4c
Function at 0x410d63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae06
and dword [ebp - 0x14], 0
cmp dword [0x4301f0], 0
mov dword [ebp - 0x18], eax
jne 0x410e16
push 0x4038dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410ebe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038d0
push ebx
call edi
test eax, eax
je 0x410ebe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038c0
push ebx
mov dword [0x4301f0], eax
call edi
push eax
call esi
push 0x4038ac
push ebx
mov dword [0x4301f4], eax
call edi
push eax
call esi
push 0x403890
push ebx
mov dword [0x4301f8], eax
call edi
push eax
call esi
mov dword [0x430200], eax
test eax, eax
je 0x410e16
push 0x403878
push ebx
call edi
push eax
call esi
mov dword [0x4301fc], eax
mov eax, dword [0x4301fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410e6f
cmp dword [0x430200], ecx
je 0x410e6f
push eax
call esi
push dword [0x430200]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410e6f
test ebx, ebx
je 0x410e6f
call edi
test eax, eax
je 0x410e66
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410e66
test byte [ebp - 8], 1
jne 0x410e6f
or dword [ebp + 0x10], 0x200000
jmp 0x410ea2
mov eax, dword [0x4301f4]
cmp eax, dword [ebp - 0x18]
je 0x410ea2
push eax
call esi
test eax, eax
je 0x410ea2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410ea2
mov eax, dword [0x4301f8]
cmp eax, dword [ebp - 0x18]
je 0x410ea2
push eax
call esi
test eax, eax
je 0x410ea2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4301f0]
call esi
test eax, eax
je 0x410ebe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410ec0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a41
leave
ret
Function at 0x4134e0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004118d0
cmp dword [0x7b3f8c], 0x37
jne 0x41357a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x7b4f80]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x434fdc]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x413800
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b3f8c]
sub esp, 0x974
push ebx
push ebp
push esi
mov esi, dword [0x434fdc]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x4139ff
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x413836
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7b3f8c], 0x1c
jne 0x41384d
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42be58]
mov ebx, dword [0x42be60]
mov ebp, dword [0x42be64]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42be5c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x413896
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b3efc], edi
mov eax, dword [esp + 0x1c]
add dword [0x7b3efc], eax
mov eax, dword [0x7b3efc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x7b3f8c], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x41392d
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x7b3f8c], 0x979
mov dword [0x7b3f00], 0xff6b3619
mov dword [0x7b3f04], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x413977
push 0
lea ecx, [esp + 0x184]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0x7b3f8c]
cmp eax, 0x93
je 0x41399d
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x413890
cmp eax, 0x8d4
jne 0x4139b4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x7b3f8c], 0x17
jne 0x4139ee
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404080
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x413830
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret