joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409d10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fb35
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x45aa54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 0x18], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00413272
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x14], eax
lea esi, [eax + 8]
mov edx, dword [ecx]
mov ecx, edx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409d80
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00405a30
cmp dword [esi + 0x14], 0x10
mov edx, esi
mov dword [ebp - 4], 1
jb 0x409da3
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x409dc2
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x409db0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push edi
push esi
push eax
call fcn.00409b50
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409e4e
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov byte [edi + 4], 0
test eax, eax
je 0x409e39
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x409e1d
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x409e10
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409ee1
mov eax, edx
push ecx
push eax
call fcn.0041309d
mov eax, dword [ebp - 0x14]
add esp, 8
push 0x20
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.0041309d
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
cmp eax, 0x7ffffff
je 0x409ee6
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x434800]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x434800]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x409eb6
call fcn.0040c0f0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push edi
push esi
push eax
call fcn.00409b50
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
jmp 0x409eb9
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push edx
push edi
call fcn.0040bea0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.0041b8c1
push str.unordered_map_set_too_long
call fcn.00412c3a
int3
Function at 0x40e4c0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret
Function at 0x410400
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
push str.CommandLineToArgvW_failure
setne cl
movzx ecx, cl
push ecx
push 0xfe4
push str.D:_acactuscactus_src_base_system.cpp
call fcn.004105c0
cmp dword [ebp - 4], 0
push str.Invalid_argc_value
setg al
movzx eax, al
push eax
push 0xfe5
push str.D:_acactuscactus_src_base_system.cpp
call fcn.004105c0
mov eax, dword [ebp - 4]
add esp, 0x20
xor ebx, ebx
xor edi, edi
test eax, eax
jle 0x4104b9
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + edi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xfec
push str.D:_acactuscactus_src_base_system.cpp
call fcn.004105c0
mov eax, dword [ebp - 4]
add ebx, esi
mov esi, dword [ebp - 8]
inc edi
add esp, 0x10
cmp edi, eax
jl 0x410470
lea eax, [eax*4 + 4]
push eax
call fcn.0041a608
push ebx
mov dword [ebp - 0xc], eax
call fcn.0041a608
mov edi, eax
mov eax, dword [ebp - 0xc]
push ebx
push 0
push edi
mov dword [eax], edi
call fcn.004147c0
add esp, 0x14
mov dword [ebp - 0x14], 0
cmp dword [ebp - 4], 0
jle 0x410558
mov ecx, dword [ebp - 0xc]
mov edx, esi
sub edx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ecx
mov dword [ebp - 0x18], edx
nop
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push dword [edx + eax]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
push str.WideCharToMultiByte_failure
setne cl
movzx ecx, cl
push ecx
push 0xff8
push str.D:_acactuscactus_src_base_system.cpp
call fcn.004105c0
mov eax, dword [ebp - 0x10]
add edi, esi
mov ecx, dword [ebp - 0x14]
add eax, 4
mov edx, dword [ebp - 0x18]
inc ecx
add esp, 0x10
mov dword [ebp - 0x10], eax
sub ebx, esi
mov dword [ebp - 0x14], ecx
mov dword [eax], edi
cmp ecx, dword [ebp - 4]
jl 0x410500
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [edx + eax*4], 0
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x4106f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fd9d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
lea ecx, [ebp - 0x28]
push 0x30
push esi
call fcn.0040f970
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4107c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00412350
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
cmovae ecx, dword [ebp - 0x40]
push ecx
push esi
push str.GetCurrentDirectoryW_failed:__ld__s
push str.filesystem
call fcn.004106d0
mov ecx, dword [ebp - 0x2c]
add esp, 0x18
mov byte [ebx], 0
cmp ecx, 0x10
jb 0x4107be
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4107b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410862
push ecx
push edx
call fcn.0041309d
add esp, 8
xor ebx, ebx
jmp 0x41080f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004125d0
add esp, 8
cmp byte [ebp - 0x44], 0
mov byte [ebx], 0
jne 0x4107e7
xor ebx, ebx
jmp 0x410807
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp + 0xc]
cmovae ecx, dword [ebp - 0x5c]
dec eax
push eax
push ecx
push ebx
call fcn.0041cfb0
push ebx
call fcn.00412020
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0040fc90
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x410845
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41083b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410867
push ecx
push edx
call fcn.0041309d
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
call fcn.0041b8c1
int3
Function at 0x410870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412490
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4108b3
test al, 0x10
je 0x4108b3
mov esi, 1
jmp 0x4108b5
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 8
jb 0x4108eb
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4108e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4108fc
push ecx
push edx
call fcn.0041309d
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
int3
Function at 0x410a40
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fdeb
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x480], eax
mov eax, dword [ebp + 0x14]
push str._s_
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.00411ae0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00412490
add esp, 0x18
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x478]
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x410c03
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.004125d0
add esp, 8
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 1
jne 0x410b2a
push edi
push str.ERROR:_file_folder_name_containing_invalid_UTF_16_found_in_folder__s
push str.filesystem
push 0
call fcn.0040f250
add esp, 0x10
jmp 0x410b62
cmp dword [ebp - 0x488], 0x10
lea ecx, [ebp - 0x49c]
push dword [ebp - 0x47c]
cmovae ecx, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x478]
push dword [ebp + 0x10]
shr eax, 4
and eax, 1
push eax
push ecx
call dword [ebp - 0x480]
add esp, 0x10
test eax, eax
jne 0x410bbd
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 0
je 0x410ba9
mov ecx, dword [ebp - 0x488]
cmp ecx, 0x10
jb 0x410ba9
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410b9f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410c5b
push ecx
push edx
call fcn.0041309d
add esp, 8
lea eax, [ebp - 0x478]
push eax
push esi
call ebx
test eax, eax
jne 0x410af0
jmp 0x410bfc
cmp byte [ebp - 0x484], 0
je 0x410bfc
mov ecx, dword [ebp - 0x488]
cmp ecx, 0x10
jb 0x410bfc
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410bf2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410c5b
push ecx
push edx
call fcn.0041309d
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x214]
cmp ecx, 8
jb 0x410c3f
mov edx, dword [ebp - 0x228]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410c35
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410c60
push ecx
push edx
call fcn.0041309d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
call fcn.0041b8c1
int3
Function at 0x411010
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412490
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae eax, dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41105b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41105b
or esi, 0xffffffff
jmp 0x41105d
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 8
jb 0x411093
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411089
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110a4
push ecx
push edx
call fcn.0041309d
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
int3

Function at 0x4110b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x7ff
push eax
lea eax, [ebp - 0x804]
mov byte [ebp - 0x804], 0
push eax
call fcn.0041cfb0
lea eax, [ebp - 0x804]
add esp, 0xc
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4110f0
push ebx
sub eax, edx
push esi
push edi
test eax, eax
jle 0x411134
dec eax
lea esi, [ebp - 0x804]
add esi, eax
mov cl, byte [esi]
and cl, 0xc0
cmp cl, 0x80
jne 0x411117
test eax, eax
jne 0x411100
lea eax, [ebp - 0x820]
mov dword [ebp - 0x820], esi
push eax
call fcn.00411e20
add esp, 4
cmp eax, 0xffffffff
jne 0x411134
mov byte [esi], 0
mov al, byte [ebp - 0x803]
lea esi, [ebp - 0x803]
test al, al
je 0x4111af
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp al, 0x2f
jne 0x4111a7
cmp byte [esi + 1], 0
je 0x4111a7
lea eax, [ebp - 0x804]
mov byte [esi], 0
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.00412490
add esp, 8
lea eax, [ebp - 0x81c]
cmp dword [ebp - 0x808], 8
cmovae eax, dword [ebp - 0x81c]
push 0
push eax
call ebx
test eax, eax
jne 0x411199
call edi
cmp eax, 0xb7
jne 0x4111c2
lea ecx, [ebp - 0x81c]
call fcn.004072b0
mov byte [esi], 0x2f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x411150
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004130ab
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x81c]
call fcn.004072b0
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004130ab
mov esp, ebp
pop ebp
ret
Function at 0x4111f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412490
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
cmp ecx, 8
jb 0x41125d
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411253
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41126f
push ecx
push edx
call fcn.0041309d
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
xor ecx, ebp
pop esi
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
int3

Function at 0x411280
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00412490
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
neg esi
cmp ecx, 8
jb 0x4112ef
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4112e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411301
push ecx
push edx
call fcn.0041309d
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
xor ecx, ebp
pop esi
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
int3
Function at 0x411310
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fe7d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x45aa54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00412490
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00412490
add esp, 0x10
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push 3
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
neg eax
sbb esi, esi
cmp ecx, 8
jb 0x4113b7
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4113ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41141e
push ecx
push edx
call fcn.0041309d
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 8
jb 0x411401
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4113f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41141e
push ecx
push edx
call fcn.0041309d
add esp, 8
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004130ab
mov esp, ebp
pop ebp
ret
call fcn.0041b8c1
int3

Function at 0x411450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004114b0
add esp, 8
mov esi, eax
test byte [ebp + 0xc], 8
je 0x4114a6
test esi, esi
je 0x4114a6
push esi
push 3
lea eax, [ebp - 4]
push 1
push eax
call fcn.0041e55a
add esp, 0x10
cmp eax, 3
jne 0x411497
cmp byte [ebp - 4], 0xef
jne 0x411497
cmp byte [ebp - 3], 0xbb
jne 0x411497
cmp byte [ebp - 2], 0xbf
je 0x4114a4
push 0
push 0
push esi
call fcn.0041e8fd
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0041e55a
add esp, 0x10
pop ebp
ret
Function at 0x411670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
call fcn.0041e8fd
push ebx
call fcn.0041ef5c
push 0
push 0
push ebx
mov esi, eax
call fcn.0041e8fd
mov eax, 0x400
test esi, esi
cmovs esi, eax
lea edi, [esi + 1]
push edi
call fcn.0041a608
push dword [ebp + 8]
mov ebx, eax
push edi
push 1
push ebx
call fcn.0041e55a
add esp, 0x30
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x4116d0
lea ecx, [eax + 1]
push ecx
push ebx
call fcn.0041b9b8
mov esi, dword [ebp - 4]
jmp 0x411730
jbe 0x411735
lea edi, [eax + eax]
mov esi, eax
push edi
push ebx
call fcn.0041b9b8
push dword [ebp + 8]
mov ebx, eax
mov eax, esi
push eax
push 1
lea ecx, [eax + ebx]
push ecx
call fcn.0041e55a
add esp, 0x18
test eax, eax
je 0x411726
add esi, eax
cmp esi, edi
jne 0x41170c
add edi, edi
push edi
push ebx
call fcn.0041b9b8
add esp, 8
mov ebx, eax
push dword [ebp + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push 1
push eax
call fcn.0041e55a
add esp, 0x10
test eax, eax
jne 0x4116f8
lea eax, [esi + 1]
push eax
push ebx
call fcn.0041b9b8
mov ebx, eax
add esp, 8
mov eax, dword [ebp + 0xc]
mov byte [ebx + esi], 0
pop edi
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
call fcn.0041e8fd
push ebx
call fcn.0041ef5c
push 0
push 0
push ebx
mov esi, eax
call fcn.0041e8fd
mov eax, 0x400
test esi, esi
cmovs esi, eax
lea edi, [esi + 1]
push edi
call fcn.0041a608
push dword [ebp + 8]
mov ebx, eax
push edi
push 1
push ebx
call fcn.0041e55a
add esp, 0x30
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x4117b0
lea ecx, [eax + 1]
push ecx
push ebx
call fcn.0041b9b8
mov esi, dword [ebp - 4]
jmp 0x411810
jbe 0x411815
lea edi, [eax + eax]
mov esi, eax
push edi
push ebx
call fcn.0041b9b8
push dword [ebp + 8]
mov ebx, eax
mov eax, esi
push eax
push 1
lea ecx, [eax + ebx]
push ecx
call fcn.0041e55a
add esp, 0x18
test eax, eax
je 0x411806
add esi, eax
cmp esi, edi
jne 0x4117ec
add edi, edi
push edi
push ebx
call fcn.0041b9b8
add esp, 8
mov ebx, eax
push dword [ebp + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push 1
push eax
call fcn.0041e55a
add esp, 0x10
test eax, eax
jne 0x4117d8
lea eax, [esi + 1]
push eax
push ebx
call fcn.0041b9b8
mov ebx, eax
add esp, 8
xor eax, eax
mov byte [ebx + esi], 0
test esi, esi
je 0x41182b
nop
cmp byte [eax + ebx], 0
je 0x411834
inc eax
cmp eax, esi
jb 0x411820
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0041a5ed
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4121a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 8
call fcn.0041a608
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push 0
push 0
push eax
push 0x412200
push 0
push 0
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
push str.CreateThread_failure
setne cl
movzx ecx, cl
push ecx
push 0x335
push str.D:_acactuscactus_src_base_system.cpp
call fcn.004105c0
add esp, 0x10
mov eax, esi
pop esi
pop ebp
ret

Function at 0x413fcc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41400b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41400b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41400b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41400b
cmp dword [ecx + 0x74], 0xe
jbe 0x41400b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret