joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x410414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x410423
pop dword [ebp - 0x14]
mov eax, 0x77f7ca7
sub eax, 0x73e7884
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x1e432b76
add dword [ebp - 0x24], 0x300f19d5
mov dword [ebp - 0x20], 0xbe9c4396
add dword [ebp - 0x20], 0x739708af
mov dword [ebp - 0x1c], 0x3afb7305
add dword [ebp - 0x1c], 0x1150d129
mov dword [ebp - 0x18], 0xab4dcff7
sub dword [ebp - 0x18], 0xab4dcff7
lea eax, [ebp - 0x24]
push eax
mov eax, 0x131c2ed5
add eax, 0xed26019f
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf814ffa5
add dword [ebp - 0x24], 0x7c5d69b1
mov dword [ebp - 0x20], 0x9bbcc3f2
sub dword [ebp - 0x20], 0x5a50627d
mov dword [ebp - 0x1c], 0xdeff3cb
add dword [ebp - 0x1c], 0x557f78a1
mov dword [ebp - 0x18], 0xc2ea3113
sub dword [ebp - 0x18], 0xc2ea3113
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3f832
push 0
call eax
mov ecx, 0x3a4427e8
sub ecx, 0x3a43d8d1
xor edi, edi
add edi, eax
mov esi, 0x4b7cfa9a
sub esi, 0x4b39b69a
add esi, dword [ebp - 0x14]
mov ebx, 0x72ce979b
add ebx, 0xa132c391
mov edx, dword [esi]
xor dword [ebp - 8], 0x5dcc7d19
xor edx, ebx
mov dword [ebp - 4], 0xf605061c
mov dword [edi], edx
xor dword [ebp - 8], 0x69c9016
add edi, 0xcc19dab5
sub edi, 0xcc19dab1
add esi, 0x15e412cd
add esi, 0xea1bed37
loop 0x410542
add eax, 0x83240b8b
add eax, 0x7cdd23a4
mov ebx, eax
add eax, 0xd28d69f8
sub eax, 0xd28d69f3
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x401750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov edi, dword [ebx + ecx*4]
inc ebp
or byte [ebx + 0x6e43c8a0], cl
add byte [eax - 0x45], dl

Function at 0x404547
Capabilities:
Encode data using xor

Disassembly:
call 0x404425
mov ecx, 0x256
call 0x404547
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40454a
sub bl, cl
mov dl, 0x94
fsub st(0), st(0)
fidivr word [ebp + ebp - 2]
push eax
lea edi, [esi + 0x1d]
cld
ljmp 0xf4e9
Function at 0x401250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
push 0x1000
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [0x41e558]
push ecx
call fcn.00401740
add esp, 4
call eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x4012a2
push str.Virt_alloc_dont_alloc_mem__n
call fcn.00401040
add esp, 4
jmp 0x40137a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
call fcn.00404200
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x264]
add esp, 8
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
je 0x40137a
mov ecx, dword [ebp - 0x268]
push ecx
push str._start:_d__n
call fcn.00401040
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x250]
push edx
call fcn.00402c30
add esp, 0xc
mov dword [ebp - 0x250], 0x44
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x250]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push str._end__n
call fcn.00401040
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401893
mov esp, ebp
pop ebp
ret
Function at 0x4013f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0x14], 0
jbe 0x40157c
mov dword [ebp - 0x10], 0x100
mov dword [ebp - 4], 0
jmp 0x401429
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 4]
mov byte [ebp + eax - 0x118], cl
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jae 0x401433
jmp 0x401413
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x40144b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jae 0x4014b0
mov ecx, dword [ebp - 4]
movzx ecx, byte [ebp + ecx - 0x118]
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx edx, byte [eax + edx]
add ecx, edx
mov eax, ecx
xor edx, edx
div dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x118]
mov byte [ebp - 9], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov cl, byte [ebp + eax - 0x118]
mov byte [ebp + edx - 0x118], cl
mov edx, dword [ebp - 8]
mov al, byte [ebp - 9]
mov byte [ebp + edx - 0x118], al
xor ecx, ecx
jne 0x40147c
jmp 0x401442
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x14]
sub edx, 1
mov dword [ebp + 0x14], edx
cmp dword [ebp - 0x18], 0
je 0x401577
mov eax, dword [ebp - 4]
add eax, 1
xor edx, edx
div dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx eax, byte [ebp + eax - 0x118]
add eax, dword [ebp - 8]
xor edx, edx
div dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
mov dl, byte [ebp + ecx - 0x118]
mov byte [ebp - 0xa], dl
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ebp + ecx - 0x118]
mov byte [ebp + eax - 0x118], dl
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 0xa]
mov byte [ebp + eax - 0x118], cl
xor edx, edx
jne 0x401500
mov eax, dword [ebp - 4]
movzx eax, byte [ebp + eax - 0x118]
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0x118]
add eax, edx
cdq
idiv dword [ebp - 0x10]
movzx eax, byte [ebp + edx - 0x118]
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x14]
mov byte [eax], dl
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x4014c3
mov eax, dword [ebp + 0x10]
jmp 0x40157e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401740
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.00401140
mov dword [ebp - 0x10], 0
jmp 0x40176e
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0xc]
call fcn.004011c0
push eax
call fcn.00401390
add esp, 4
cmp eax, 0x3285501
jne 0x401798
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
call fcn.004011f0
jmp 0x40179a
jmp 0x401765
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401893
mov esp, ebp
pop ebp
ret

Function at 0x4017b0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
push ecx
push 0x53b2070f
call fcn.004017d0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x402173
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x4021b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4021b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4021b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4021b2
cmp dword [ecx + 0x74], 0xe
jbe 0x4021b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408064
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155a0
push 0x415598
push str.FlsAlloc
push 0x1e
call fcn.00407f25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408098
push dword [ebp + 8]
mov ecx, esi
call dword [0x41411c]
call esi
jmp 0x40809e
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4080e2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4155b0
push 0x4155a8
push str.FlsGetValue
push 0x20
call fcn.00407f25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408119
push dword [ebp + 8]
mov ecx, esi
call dword [0x41411c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsGetValue]
Function at 0x40b61f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b6bc
push ebx
push esi
call fcn.0040b5e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b531
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b669
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b6bb
push edi
push eax
call fcn.00408817
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b689
call fcn.00407db8
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b6ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b531
add esp, 0x20
test eax, eax
jne 0x40b6a8
push edi
call fcn.00407db8
jmp 0x40b6b0
push ebx
call fcn.00407db8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413660
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41368d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41368d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x47
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x7c
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xb1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x79
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x38
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xeb
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb9
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x64
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x48
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc6
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xf
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x80
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4c
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40aeb7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43ad20]
jne 0x40aec1
repz ret
jmp fcn.0040e51c

Function at 0x40cbd2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43ad20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040698f
and dword [ebp - 0x14], 0
cmp dword [0x43c348], 0
mov dword [ebp - 0x18], eax
jne 0x40cc85
push 0x404510
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40cd2d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404504
push ebx
call edi
test eax, eax
je 0x40cd2d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4044f4
push ebx
mov dword [0x43c348], eax
call edi
push eax
call esi
push 0x4044e0
push ebx
mov dword [0x43c34c], eax
call edi
push eax
call esi
push 0x4044c4
push ebx
mov dword [0x43c350], eax
call edi
push eax
call esi
mov dword [0x43c358], eax
test eax, eax
je 0x40cc85
push 0x4044ac
push ebx
call edi
push eax
call esi
mov dword [0x43c354], eax
mov eax, dword [0x43c354]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ccde
cmp dword [0x43c358], ecx
je 0x40ccde
push eax
call esi
push dword [0x43c358]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ccde
test ebx, ebx
je 0x40ccde
call edi
test eax, eax
je 0x40ccd5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ccd5
test byte [ebp - 8], 1
jne 0x40ccde
or dword [ebp + 0x10], 0x200000
jmp 0x40cd11
mov eax, dword [0x43c34c]
cmp eax, dword [ebp - 0x18]
je 0x40cd11
push eax
call esi
test eax, eax
je 0x40cd11
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40cd11
mov eax, dword [0x43c350]
cmp eax, dword [ebp - 0x18]
je 0x40cd11
push eax
call esi
test eax, eax
je 0x40cd11
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43c348]
call esi
test eax, eax
je 0x40cd2d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40cd2f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aeb7
leave
ret
Function at 0x423900
Capabilities:
Delete directory
Get common file path
Read file on windows
Set console window title

Disassembly:
mov eax, 0x1464
call fcn.0040e6e0
cmp dword [0x7c13b8], 0x37
jne 0x4239f2
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046a8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
push 0
lea edx, [esp + 0x868]
push edx
push 0x4046e0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0xc68]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0x404714
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea eax, [esp + 8]
push eax
push 0x404720
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0x404760
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
lea ecx, [esp + 0x68]
push ecx
push 0
push 0x4047a8
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
lea edx, [esp + 0x464]
push edx
push 0
push 0x404808
push 0x404820
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0
push 0
push 0
push 0x404824
push 0x404858
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov eax, dword [0x7c13bc]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x44141c]
mov byte [eax + esi], dl
add esp, 0x1464
ret
Function at 0x423bb0
Capabilities:
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7c13b8]
sub esp, 0x1d4
push ebx
push ebp
push esi
mov esi, dword [0x44141c]
shr eax, 3
push edi
test eax, eax
je 0x423d65
mov dword [esp + 0x38], 0x9e3779b9
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], eax
jmp 0x423be6
mov esi, dword [esp + 0x1c]
cmp dword [0x7c13b8], 0x1c
jne 0x423c03
lea eax, [esp + 0x3c]
push eax
push 0
lea ecx, [esp + 0x4c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov edx, dword [0x43b310]
mov ecx, dword [0x43b314]
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x2c], edx
mov edx, dword [0x43b318]
mov dword [esp + 0x30], ecx
mov ecx, dword [0x43b31c]
mov dword [esp + 0x14], eax
mov ebx, 0xc6ef3720
mov dword [esp + 0x28], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], 0x20
jmp 0x423c47
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x34]
shl ecx, 4
add ecx, dword [esp + 0x28]
add eax, ebx
xor edx, ecx
xor edx, eax
sub edi, edx
mov ecx, edi
shl ecx, 4
mov dword [0x7c033c], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
cmp dword [0x7c13b8], 0x1be
lea ebp, [ebx + edi]
jne 0x423c9c
lea edx, [esp + 0x40]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x30]
cmp dword [0x7c13b8], 0x979
mov dword [0x7c0340], 0xff6b3619
mov dword [0x7c0344], 0xffffffff
jne 0x423cd5
lea eax, [esp + 0xa0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor esi, ebp
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x38]
add dword [esp + 0x18], eax
sub ebx, dword [esp + 0x18]
dec dword [esp + 0x20]
jne 0x423c43
cmp dword [0x7c13b8], 0x8d4
jne 0x423d18
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], edi
cmp dword [0x7c13b8], 0x17
jne 0x423d54
push 0
push 0
push 0
push 0x404568
push 0x4045e0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0xa0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], esi
jne 0x423be2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d4
ret