joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dca0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa64], 0
mov eax, dword [ebp + 8]
push eax
push 0x4113d0
push 0x400
lea ecx, [ebp - 0xa60]
push ecx
call fcn.00401238
add esp, 0x10
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0xa60]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0xa64], 0xffffffff
jne 0x40dd02
jmp 0x40deed
push 0x4113dc
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00401aae
add esp, 8
test eax, eax
je 0x40dd32
push 0x4113e0
lea edx, [ebp - 0x22c]
push edx
call fcn.00401aae
add esp, 8
test eax, eax
jne 0x40dd37
jmp 0x40debc
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4113e8
push 0x400
lea edx, [ebp - 0xa60]
push edx
call fcn.00401238
add esp, 0x14
lea eax, [ebp - 0xa60]
push eax
call fcn.0040cf60
add esp, 4
mov dword [ebp - 0x25c], eax
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00401a5d
add esp, 4
cmp eax, 1
jne 0x40de38
movzx edx, word [ebp - 0x22c]
cmp edx, 0x4c
je 0x40ddf4
movzx eax, word [ebp - 0x22c]
cmp eax, 0x6c
je 0x40ddf4
movzx ecx, word [ebp - 0x22c]
cmp ecx, 0x55
je 0x40ddf4
movzx edx, word [ebp - 0x22c]
cmp edx, 0x75
je 0x40ddf4
movzx eax, word [ebp - 0x22c]
cmp eax, 0x40
je 0x40ddf4
movzx ecx, word [ebp - 0x22c]
cmp ecx, 0x6e
je 0x40ddf4
movzx edx, word [ebp - 0x22c]
cmp edx, 0x4e
je 0x40ddf4
movzx eax, word [ebp - 0x22c]
cmp eax, 0x7a
je 0x40ddf4
movzx ecx, word [ebp - 0x22c]
cmp ecx, 0x5a
jne 0x40de38
mov edx, dword [0x426bbc]
add edx, 1
mov dword [0x426bbc], edx
lea eax, [ebp - 0xa60]
push eax
push 0x400
mov ecx, dword [0x41699c]
shl ecx, 0xb
add ecx, 0x416ba8
push ecx
call fcn.00401ae5
add esp, 0xc
mov edx, dword [0x41699c]
add edx, 1
mov dword [0x41699c], edx
jmp 0x40dea2
lea eax, [ebp - 0x22c]
push eax
call fcn.00401a5d
add esp, 4
cmp eax, 0xa
jne 0x40dea2
movzx ecx, word [ebp - 0x21c]
cmp ecx, 0x2e
jne 0x40dea2
movzx edx, word [ebp - 0x21a]
cmp edx, 0x40
jne 0x40dea2
mov eax, dword [0x426bbc]
add eax, 1
mov dword [0x426bbc], eax
lea ecx, [ebp - 0xa60]
push ecx
push 0x400
mov edx, dword [0x41699c]
shl edx, 0xb
add edx, 0x416ba8
push edx
call fcn.00401ae5
add esp, 0xc
mov eax, dword [0x41699c]
add eax, 1
mov dword [0x41699c], eax
mov ecx, dword [ebp - 0x258]
and ecx, 0x10
je 0x40debc
lea edx, [ebp - 0xa60]
push edx
call fcn.0040dca0
add esp, 4
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0xa64]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40dd02
mov edx, dword [ebp - 0xa64]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jne 0x40dcbd
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401110
mov esp, ebp
pop ebp
ret
Function at 0x40df00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xee
mov dword [ebp - 0xa64], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040cf60
add esp, 4
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4113f4
push 0x400
lea edx, [ebp - 0xa60]
push edx
call fcn.00401238
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0xa60]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa64], eax
cmp dword [ebp - 0xa64], 0xffffffff
jne 0x40df7b
jmp 0x40e055
push 0x411400
lea edx, [ebp - 0x22c]
push edx
call fcn.00401aae
add esp, 8
test eax, eax
je 0x40dfab
push 0x411404
lea eax, [ebp - 0x22c]
push eax
call fcn.00401aae
add esp, 8
test eax, eax
jne 0x40dfad
jmp 0x40e024
lea ecx, [ebp - 0x22c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x41140c
push 0x400
lea eax, [ebp - 0xa60]
push eax
call fcn.00401238
add esp, 0x14
mov ecx, dword [ebp - 0x258]
and ecx, 0x10
je 0x40e01d
movzx edx, word [ebp - 0x22c]
cmp edx, 0x24
jne 0x40e00e
lea eax, [ebp - 0xa60]
push eax
call fcn.0040cf60
add esp, 4
mov dword [ebp - 0x25c], eax
lea ecx, [ebp - 0xa60]
push ecx
call fcn.0040dca0
add esp, 4
jmp 0x40e01d
lea edx, [ebp - 0xa60]
push edx
call fcn.0040df00
add esp, 4
mov dword [ebp - 4], 1
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0xa64]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40df7b
mov edx, dword [ebp - 0xa64]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jne 0x40df24
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401110
mov esp, ebp
pop ebp
ret
Function at 0x14592f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x12c7015
lea edi, [esi - 0xec6015]
push edi
or ebp, 0xffffffff
jmp 0x1459312
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1459319
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1459308
mov eax, 1
add ebx, ebx
jne 0x145932b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x145933c
jne 0x145935b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145935b
dec eax
add ebx, ebx
jne 0x1459348
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1459320
add ebx, ebx
jne 0x1459357
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x14593ad
xor ecx, ecx
sub eax, 3
jb 0x1459373
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x14593e2
sar eax, 1
mov ebp, eax
jmp 0x145937e
add ebx, ebx
jne 0x145937e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145934c
inc ecx
add ebx, ebx
jne 0x145938c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145934c
add ebx, ebx
jne 0x1459399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x145938e
jne 0x14593aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x145938e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x14593cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x14593be
jmp 0x145930e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x14593cc
add edi, ecx
jmp 0x145930e
pop esi
mov edi, esi
mov ecx, 0xf10a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x14593ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x14593ef
lea edi, [esi + 0x1057000]
mov eax, dword [edi]
or eax, eax
je 0x1459460
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10598c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1059904]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1459415
mov ecx, edi
jns 0x1459444
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x105990c]
or eax, eax
je 0x145945a
mov dword [ebx], eax
add ebx, 4
jmp 0x1459432
call dword [esi + 0x1059908]
mov ebp, dword [esi + 0x1059910]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1459494
sub esp, 0xffffff80
jmp 0x43735c
Function at 0x401010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, eax
je 0x401031
push dword [ebp + 0x10]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
xor ecx, ecx
shr eax, 3
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x4010ec
lea edx, [ebx + 4]
lea eax, [esi + 0x44]
mov dword [ebp - 8], edx
push edi
mov edi, eax
mov dword [ebp - 4], 0x10
nop word [eax + eax]
mov ebx, dword [edi]
lea edi, [edi - 4]
mov eax, dword [ebp + 8]
xor ebx, dword [eax + ecx*8]
mov dword [eax + ecx*8], ebx
mov eax, ebx
shr eax, 0x10
mov ecx, ebx
movzx eax, al
shr ecx, 0x18
mov edx, dword [esi + eax*4 + 0x448]
mov eax, ebx
add edx, dword [esi + ecx*4 + 0x48]
mov ecx, dword [ebp + 0xc]
shr eax, 8
movzx eax, al
xor edx, dword [esi + eax*4 + 0x848]
movzx eax, bl
mov ebx, dword [ebp + 8]
add edx, dword [esi + eax*4 + 0xc48]
mov eax, dword [ebp - 8]
xor dword [eax + ecx*8], edx
sub dword [ebp - 4], 1
mov eax, dword [eax + ecx*8]
mov edx, dword [ebx + ecx*8]
mov dword [ebx + ecx*8], eax
mov dword [ebx + ecx*8 + 4], edx
jne 0x401060
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + eax*8], edx
mov dword [ebx + eax*8 + 4], ecx
mov eax, dword [esi + 4]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebx + ecx*8 + 4], eax
mov eax, dword [esi]
xor dword [ebx + ecx*8], eax
inc ecx
lea eax, [esi + 0x44]
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x401051
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + ecx*4]
xor ebx, dword [eax]
mov dword [eax], ebx
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
movzx ecx, cl
shr edx, 0x18
mov esi, dword [edi + ecx*4 + 0x448]
mov ecx, ebx
add esi, dword [edi + edx*4 + 0x48]
shr ecx, 8
movzx ecx, cl
xor esi, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
mov ebx, dword [ebp + 0xc]
add esi, dword [edi + ecx*4 + 0xc48]
xor dword [ebx], esi
mov ecx, dword [ebx]
mov esi, dword [eax]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebx], esi
mov dword [ebp - 4], ecx
cmp ecx, 0x10
jl 0x401111
mov edx, dword [eax]
mov dword [eax], esi
mov dword [ebx], edx
mov ecx, dword [edi + 0x40]
xor ecx, edx
mov dword [ebx], ecx
mov ecx, dword [edi + 0x44]
xor dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401180
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movups xmm0, xmmword [0x406120]
push ebx
push esi
mov esi, ecx
push edi
push 0x1000
push 0x406168
movups xmmword [esi], xmm0
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], esi
movups xmm0, xmmword [0x406130]
push eax
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [0x406140]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [0x406150]
movups xmmword [esi + 0x30], xmm0
movq xmm0, qword [0x406160]
movq qword [esi + 0x40], xmm0
call sub.msvcrt.dll_memcpy
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov ecx, edi
mov ebx, 4
and ecx, 0x80000003
jns 0x4011f5
dec ecx
or ecx, 0xfffffffc
add ecx, 1
je 0x401204
mov eax, ebx
mov ebx, ecx
cdq
idiv ecx
mov ecx, edx
test ecx, ecx
jne 0x4011f7
mov eax, edi
mov ecx, 4
cdq
idiv ebx
mov dword [ebp - 0xc], eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.00403316
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
test eax, eax
jle 0x401289
mov ebx, dword [ebp + 8]
mov ecx, 2
mov esi, dword [ebp - 8]
mov dword [ebp - 4], eax
nop
lea eax, [ecx - 2]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xf], al
lea eax, [ecx - 1]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xe], al
mov eax, ecx
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xd], al
lea eax, [ecx + 1]
cdq
idiv edi
movzx eax, byte [edx + ebx]
mov byte [ebp + 0xc], al
mov eax, dword [ebp + 0xc]
mov dword [ecx + esi - 2], eax
add ecx, 4
sub dword [ebp - 4], 1
jne 0x401240
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
lea ecx, [esi + 8]
mov esi, 2
lea eax, [esi - 2]
cdq
lea ecx, [ecx + 0x18]
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x20], eax
lea eax, [esi - 1]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x1c], eax
mov eax, esi
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x18], eax
lea eax, [esi + 1]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x14], eax
lea eax, [esi + 2]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0x10], eax
lea eax, [esi + 3]
cdq
add esi, 6
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [ecx - 0xc], eax
lea eax, [esi - 2]
cmp eax, 0x12
jl 0x401294
push ebx
call fcn.0040331f
mov esi, dword [ebp - 0x10]
add esp, 4
mov dword [ebp + 0xc], 0
xor edi, edi
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401100
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*8], eax
mov eax, dword [ebp + 8]
mov dword [esi + edi*8 + 4], eax
inc edi
cmp edi, 9
jl 0x401305
lea edi, [esi + 0x4c]
mov ebx, 0x200
nop
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401100
mov eax, dword [ebp + 0xc]
lea edi, [edi + 8]
mov dword [edi - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi - 8], eax
sub ebx, 1
jne 0x401330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401c00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x401c5d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x401c20
mov eax, dword [esi]
jmp 0x401d37
cmp eax, 0x4e0
jb 0x401d37
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x401c76
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x401cc0
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401db0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x271c
call fcn.00403790
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x1571
mov eax, 1
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [ebp + eax*4 - 0x1388], edx
inc eax
cmp eax, 0x270
jb 0x401dd1
call fcn.004032c0
mov dword [ebp - 0x1398], 0xffffffff
mov edx, 1
mov dword [ebp - 0x2718], eax
nop dword [eax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x2718], eax
inc edx
cmp edx, 0x270
jb 0x401e10
push esi
push 0x1388
lea eax, [ebp - 0x271c]
mov dword [ebp - 0x271c], 0x270
push eax
lea eax, [ebp - 0x138c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x138c]
call fcn.00401c00
mov esi, 0x7d1
mul esi
cmp eax, esi
jae 0x401e86
cmp eax, 0x376
jae 0x401e86
lea ecx, [ebp - 0x138c]
call fcn.00401c00
mul esi
cmp eax, 0x376
jb 0x401e72
lea eax, [edx - 0x7ffff830]
xor eax, 0x80000000
cdq
mov dword [ebp - 0x1394], eax
lea eax, [ebp - 0x1394]
push eax
mov dword [ebp - 0x1390], edx
call fcn.004016f0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.004035b2
mov esp, ebp
pop ebp
ret

Function at 0x401ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x401ef0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ef0
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x400
jg 0x401ef0
add eax, ecx
xor ecx, ecx
cmp dword [eax], 0x4550
cmovne eax, ecx
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x403362
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x403397
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x403394
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x4033a0
add edx, 0x28
cmp edx, esi
jne 0x403382
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x40339d

Function at 0x403f23
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403f62
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403f62
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403f62
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403f62
cmp dword [ecx + 0x74], 0xe
jbe 0x403f62
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x404540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x404567
mov ecx, 5
int 0x29
push 2
call fcn.00403fc7
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x404672
test esi, esi
jne 0x404672
push 2
call fcn.00403fc7
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004035b2
mov esp, ebp
pop ebp
ret

Function at 0x4048a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004048d0
mov esi, dword [ebp + 8]
test al, al
je 0x4048be
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.004048e0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404a10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404a6c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404a6c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404a6c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404a6c
cmp dword [ecx + 0x74], 0xe
jbe 0x404a6c
cmp dword [ecx + 0xe8], 0
je 0x404a6c
push dword [ebp + 8]
call fcn.004048e0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40957c
call fcn.004046b0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x404aa1
push dword [ebp + 8]
call fcn.004048a0
mov esp, ebp
pop ebp
ret

Function at 0x404ae0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404b3c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404b3c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404b3c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404b3c
cmp dword [ecx + 0x74], 0xe
jbe 0x404b3c
cmp dword [ecx + 0xe8], 0
je 0x404b3c
push dword [ebp + 8]
call fcn.004048e0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40957c
call fcn.004046b0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x404b71
push dword [ebp + 8]
call fcn.004048a0
mov esp, ebp
pop ebp
ret

Function at 0x4051f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x40521a
mov eax, 2
pop ebp
ret
push esi
call fcn.004043a0
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x40523a
jmp dword [eax*4 + 0x405270]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.004044d0
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x10004094
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x104
push ebx
push edi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x1002984f
lea ecx, [esi + 0x18]
cmp ecx, edi
jae 0x10029848
push 0x5c
pop eax
mov word [ebx + esi*2], ax
inc esi
push 8
lea eax, [ebp - 8]
push eax
call fcn.10004165
test eax, eax
js 0x100040f3
push dword [ebp - 4]
sub edi, esi
lea eax, [ebx + esi*2]
push dword [ebp - 8]
push 0x10001a20
push edi
push eax
call fcn.10004101
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80030003
jmp 0x1002985c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
cmp dword [ebp + 8], 0
je 0x100040f3
push 0x2e
pop eax
xor esi, esi
mov word [ebx], ax
inc esi
jmp 0x100040c2