joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431f10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x47900c]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
push 0x64
lea eax, [esp + 0x24]
mov ebx, edx
push 0
push eax
mov dword [esp + 0x20], ebx
mov esi, ecx
call fcn.00437ca0
add esp, 0xc
cmp dword [0x47d938], 1
je 0x431f69
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x432140
test ebx, ebx
je 0x432140
lea edx, [esp + 0x38]
mov ecx, esi
call fcn.004335c0
test eax, eax
je 0x432140
push 0x28
call fcn.004443a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x431fb4
lea eax, [esi + 5]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
push 0
movups xmmword [esi], xmm0
push 0
movups xmmword [esi + 0x10], xmm0
push 0
movq qword [esi + 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x431ff9
push esi
call fcn.0043da60
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
mov edx, esi
mov dword [esi + 0x20], 1
mov ecx, 2
mov dword [esi + 0x18], 1
call fcn.0042ee80
mov ebx, eax
mov dword [esp + 0x30], 0xb
mov eax, edx
mov ecx, 2
push eax
push ebx
push 0
push 0
push 0x28
lea edx, [esp + 0x34]
mov dword [esp + 0x24], eax
call fcn.0042f370
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x432045
mov edi, dword [esi + 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x43205c
push eax
call fcn.0043da60
add esp, 4
mov dword [esi + 0xc], 0
mov dword [esp + 0x18], ebx
push 0xffffffffffffffff
test edi, edi
jne 0x432095
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
push dword [0x47b874]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add dword [esi + 0x20], 0xffffffff
jne 0x43211d
cmp dword [esi + 0x1c], edi
je 0x43211d
jmp 0x4320af
mov eax, dword [esp + 0x14]
push dword [0x47b874]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add dword [esi + 0x20], 0xffffffff
jne 0x432116
lea eax, [esp + 0x18]
mov ecx, 0x47b878
push eax
call fcn.00430330
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4320d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4320ea
push eax
call fcn.0043da60
add esp, 4
mov dword [esi + 0xc], 0
push esi
call fcn.0043da60
add esp, 4
push dword [0x47b874]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x1c], 1
push dword [0x47b874]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x8c]
mov eax, 6
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434098
mov esp, ebp
pop ebp
ret
Function at 0x4336f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x47900c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jg 0x433748
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x408]
push 0x400
push eax
call fcn.00401bf0
add esp, 0x14
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp + 8], 0
jne 0x433748
lea eax, [ebp - 0x408]
push eax
call fcn.0041c910
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434098
mov esp, ebp
pop ebp
ret

Function at 0x447237
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x447272
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x447259
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x44726a
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x447274
inc edi
add eax, 0x28
cmp edi, esi
jb 0x44724f
xor eax, eax
pop edi
pop esi
ret
Function at 0x449233
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x449246
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x44928d
lea eax, [ebp - 0x714]
push eax
call fcn.00447207
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
invalid
invalid

Function at 0x44b7c8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b63e
Function at 0x42fe70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x42fe8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42fe91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42fe80
mov eax, 1
add ebx, ebx
jne 0x42fea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42fe98
jne 0x42feb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fe98
xor ecx, ecx
sub eax, 3
jb 0x42fec8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ff3a
mov ebp, eax
add ebx, ebx
jne 0x42fed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42fee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ff04
inc ecx
add ebx, ebx
jne 0x42fef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42fee5
jne 0x42ff01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fee5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ff24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ff15
jmp 0x42fe86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ff24
add edi, ecx
jmp 0x42fe86
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ff42
cmp byte [edi], 9
jne 0x42ff42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ff47
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42ffbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41274]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41354]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ff74
mov ecx, edi
jns 0x42ffa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4135c]
or eax, eax
je 0x42ffb9
mov dword [ebx], eax
add ebx, 4
jmp 0x42ff91
call dword [esi + 0x41358]
mov ebp, dword [esi + 0x41360]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42fff3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x1001d99
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 4]
lea eax, [ecx + 8]
test edx, edx
jle 0x1001dad
push esi
movzx esi, word [eax + 2]
add eax, esi
dec edx
jne 0x1001da3
pop esi
sub eax, ecx
pop ebp
ret 4

Function at 0x100278d
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10026b5
sub eax, edx
sar eax, 1
jne 0x10026cd
push 0x57
pop eax
jmp 0x10027f7
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
and dword [eax], 0
push esi
mov esi, dword [ebp + 0xc]
mov byte [ecx], 0
push ebx
xor edx, edx
xor ebx, ebx
cmp dword [0x1007110], edx
je 0x1002728
mov eax, 0x1007110
mov ecx, dword [eax]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10026f6
sub eax, esi
sar eax, 1
mov esi, eax
push esi
push ecx
push edi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x1002723
inc ebx
lea eax, [ebx*8 + 0x1007110]
cmp dword [eax], 0
jne 0x10026ef
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, ebx
shl eax, 3
cmp dword [eax + 0x1007110], edx
je 0x1002742
mov al, byte [eax + 0x1007114]
or byte [ecx], al
lea edi, [edi + esi*2]
jmp 0x10026de
movzx eax, word [edi]
pop ebx
cmp ax, 0x4c
je 0x1002789
cmp ax, 0x6c
je 0x1002789
cmp ax, 0x4d
je 0x100277e
cmp ax, 0x6d
je 0x100277e
cmp ax, 0x48
je 0x1002773
cmp ax, 0x68
je 0x1002773
mov dword [ebp - 4], 0x57
jmp 0x10027ea
lea eax, [ebp + 0x10]
push eax
push 0x1001678
jmp 0x1002792
lea eax, [ebp + 0x10]
push eax
push 0x1001670
jmp 0x1002792
lea eax, [ebp + 0x10]
push eax
push 0x1001668
mov dword [ebp + 0x10], edx
call fcn.010051d2
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x10027dc
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LocalSize]
call esi
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [edi], eax
test eax, eax
je 0x10027d5
push dword [ebp + 0x10]
push eax
push dword [ebp + 0x10]
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10027dc
mov dword [ebp - 4], 8
cmp dword [edi], 0
jne 0x10027ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [ebp - 4]
pop esi
pop edi
leave
ret 0x10
Function at 0x404370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov ebx, dword [ebp + 8]
push 0x501918
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
pcmpeqd xmm0, xmm0
test eax, eax
mov dword [esp + 0x60], 0xffffffff
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp], xmm0
je 0x40448c
mov esi, eax
mov edi, esp
push eax
push 1
push 0x10
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x4043f7
movdqa xmm0, xmmword [esp]
pcmpeqb xmm0, xmmword [0x501070]
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x4044d5
push 2
push 0xffffffffffffffe7
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
push esi
push 1
push 0x19
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x404448
movzx eax, byte [esp + 0x10]
movdqa xmm0, xmmword [esp]
movd xmm1, eax
pcmpeqb xmm0, xmmword [0x501080]
pcmpeqb xmm1, xmmword [0x501090]
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
je 0x4044e5
push 2
push 0xffffffffffffffea
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
push esi
push 1
push 0x16
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x4044ad
cmp byte [esp], 0x50
jne 0x4044ad
cmp byte [esp + 1], 0x4b
jne 0x404488
cmp byte [esp + 2], 5
jne 0x404488
cmp byte [esp + 3], 6
mov edi, 3
je 0x4044ea
xor edi, edi
jmp 0x4044ea
cmp dword [ebp + 0xc], 0
je 0x4044a6
push 0
push ebx
push str._.zip
call fcn.0042c980
add esp, 0xc
test eax, eax
je 0x4044fd
mov edi, 1
jmp 0x4044f3
xor edi, edi
cmp dword [ebp + 0xc], 0
je 0x4044ea
test eax, eax
jne 0x4044ea
push 0
push ebx
push str._.zip
call fcn.0042c980
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*2]
jmp 0x4044ea
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
mov edi, 1
jmp 0x4044f3
mov edi, 2
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 3
jmp 0x4044f3
Function at 0x4059c0
Capabilities:
Terminate process

Disassembly:
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.Error:_out_of_memory_n
push eax
call fcn.00404690
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit

Function at 0x4059e0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov esi, edx
cmp edi, ecx
je 0x4059f2
mov eax, dword [esi + edi*4]
pop esi
pop edi
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push dword [esi + edi*4 - 4]
push dword [esi]
push str._s:_Error:_missing_argument_to__s_n
push eax
call fcn.004014c0
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax + eax]
Function at 0x405c30
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [ecx], 0
jne 0x405d0c
mov al, byte [ecx + 0xa]
mov ebx, edx
mov esi, ecx
test al, al
je 0x405c5b
cmp al, 6
ja 0x405cb0
movzx eax, al
jmp dword [eax*4 + 0x5010a0]
push esi
push 0
jmp 0x405ca8
mov eax, dword [esi + 0x520]
test eax, eax
je 0x405c84
cmp byte [eax], 0
je 0x405c84
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
push eax
call fcn.00404370
add esp, 8
mov byte [esi + 0xa], al
cmp al, 6
jbe 0x405c4c
jmp 0x405cb0
mov byte [esi + 0xa], 1
mov eax, dword [esi + 0x20]
or eax, 6
push 0
push eax
push esi
push dword [esi + 0x520]
call fcn.00432890
add esp, 0x10
jmp 0x405cb0
push esi
push 0x501896
call fcn.00432140
add esp, 8
mov eax, dword [esi]
test eax, eax
mov dword [0x51e7c0], eax
je 0x405cc8
push eax
call fcn.00431fc0
add esp, 4
test eax, eax
je 0x405d11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ebp, dword [esi + 0x520]
mov edi, eax
push dword [esi]
call fcn.0042cf50
add esp, 4
push eax
push ebp
push 0x50281f
push edi
call fcn.004014c0
add esp, 0x10
test bl, 1
je 0x405e9e
push esi
push 0x501896
call fcn.00432140
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 8
push dword [esi]
call fcn.00401c70
add esp, 4
push dword [esi]
call fcn.00401550
add esp, 0xc
push 0
push 0x51d008
push str.completion
push dword [esi]
call fcn.0042de30
add esp, 0x10
push 0x4021a0
push 0
push 1
push str.uint
push dword [esi]
call fcn.004329f0
add esp, 0x14
push 0
push 0
push 0x412770
push 0
push 1
push 3
push str.shell_add_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412980
push 0
push 1
push 1
push str.shell_module_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x4129e0
push esi
push 1
push 1
push str.shell_putsnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412a20
push 0
push 1
push 1
push str.shell_escape_crnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412dc0
push 0
push 1
push 2
push str.shell_int32
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e20
push 0
push 1
push 1
push str.shell_idquote
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 1
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 2
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
cmp byte [esi + 0xa], 3
jne 0x405d0c
push dword [esi + 0x520]
push str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.0041ef10
add esp, 8
mov edi, eax
push 0
push 0
push 0
push eax
push dword [esi]
call fcn.0042c9a0
add esp, 0x14
push edi
call fcn.0041c220
add esp, 4
jmp 0x405d0c
mov eax, dword [esi + 0x20]
or eax, 6
push str.apndvfs
jmp 0x405c90
mov eax, dword [esi + 0x20]
or eax, 1
jmp 0x405c8e
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
Function at 0x405c56
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [ecx], 0
jne 0x405d0c
mov al, byte [ecx + 0xa]
mov ebx, edx
mov esi, ecx
test al, al
je 0x405c5b
cmp al, 6
ja 0x405cb0
movzx eax, al
jmp dword [eax*4 + 0x5010a0]
push esi
push 0
jmp 0x405ca8
mov eax, dword [esi + 0x520]
test eax, eax
je 0x405c84
cmp byte [eax], 0
je 0x405c84
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
push eax
call fcn.00404370
add esp, 8
mov byte [esi + 0xa], al
cmp al, 6
jbe 0x405c4c
jmp 0x405cb0
mov byte [esi + 0xa], 1
mov eax, dword [esi + 0x20]
or eax, 6
push 0
push eax
push esi
push dword [esi + 0x520]
call fcn.00432890
add esp, 0x10
jmp 0x405cb0
push esi
push 0x501896
call fcn.00432140
add esp, 8
mov eax, dword [esi]
test eax, eax
mov dword [0x51e7c0], eax
je 0x405cc8
push eax
call fcn.00431fc0
add esp, 4
test eax, eax
je 0x405d11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ebp, dword [esi + 0x520]
mov edi, eax
push dword [esi]
call fcn.0042cf50
add esp, 4
push eax
push ebp
push 0x50281f
push edi
call fcn.004014c0
add esp, 0x10
test bl, 1
je 0x405e9e
push esi
push 0x501896
call fcn.00432140
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 8
push dword [esi]
call fcn.00401c70
add esp, 4
push dword [esi]
call fcn.00401550
add esp, 0xc
push 0
push 0x51d008
push str.completion
push dword [esi]
call fcn.0042de30
add esp, 0x10
push 0x4021a0
push 0
push 1
push str.uint
push dword [esi]
call fcn.004329f0
add esp, 0x14
push 0
push 0
push 0x412770
push 0
push 1
push 3
push str.shell_add_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412980
push 0
push 1
push 1
push str.shell_module_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x4129e0
push esi
push 1
push 1
push str.shell_putsnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412a20
push 0
push 1
push 1
push str.shell_escape_crnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412dc0
push 0
push 1
push 2
push str.shell_int32
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e20
push 0
push 1
push 1
push str.shell_idquote
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 1
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 2
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
cmp byte [esi + 0xa], 3
jne 0x405d0c
push dword [esi + 0x520]
push str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.0041ef10
add esp, 8
mov edi, eax
push 0
push 0
push 0
push eax
push dword [esi]
call fcn.0042c9a0
add esp, 0x14
push edi
call fcn.0041c220
add esp, 4
jmp 0x405d0c
mov eax, dword [esi + 0x20]
or eax, 6
push str.apndvfs
jmp 0x405c90
mov eax, dword [esi + 0x20]
or eax, 1
jmp 0x405c8e
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
Function at 0x405c88
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [ecx], 0
jne 0x405d0c
mov al, byte [ecx + 0xa]
mov ebx, edx
mov esi, ecx
test al, al
je 0x405c5b
cmp al, 6
ja 0x405cb0
movzx eax, al
jmp dword [eax*4 + 0x5010a0]
push esi
push 0
jmp 0x405ca8
mov eax, dword [esi + 0x520]
test eax, eax
je 0x405c84
cmp byte [eax], 0
je 0x405c84
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
push eax
call fcn.00404370
add esp, 8
mov byte [esi + 0xa], al
cmp al, 6
jbe 0x405c4c
jmp 0x405cb0
mov byte [esi + 0xa], 1
mov eax, dword [esi + 0x20]
or eax, 6
push 0
push eax
push esi
push dword [esi + 0x520]
call fcn.00432890
add esp, 0x10
jmp 0x405cb0
push esi
push 0x501896
call fcn.00432140
add esp, 8
mov eax, dword [esi]
test eax, eax
mov dword [0x51e7c0], eax
je 0x405cc8
push eax
call fcn.00431fc0
add esp, 4
test eax, eax
je 0x405d11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ebp, dword [esi + 0x520]
mov edi, eax
push dword [esi]
call fcn.0042cf50
add esp, 4
push eax
push ebp
push 0x50281f
push edi
call fcn.004014c0
add esp, 0x10
test bl, 1
je 0x405e9e
push esi
push 0x501896
call fcn.00432140
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 8
push dword [esi]
call fcn.00401c70
add esp, 4
push dword [esi]
call fcn.00401550
add esp, 0xc
push 0
push 0x51d008
push str.completion
push dword [esi]
call fcn.0042de30
add esp, 0x10
push 0x4021a0
push 0
push 1
push str.uint
push dword [esi]
call fcn.004329f0
add esp, 0x14
push 0
push 0
push 0x412770
push 0
push 1
push 3
push str.shell_add_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412980
push 0
push 1
push 1
push str.shell_module_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x4129e0
push esi
push 1
push 1
push str.shell_putsnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412a20
push 0
push 1
push 1
push str.shell_escape_crnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412dc0
push 0
push 1
push 2
push str.shell_int32
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e20
push 0
push 1
push 1
push str.shell_idquote
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 1
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 2
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
cmp byte [esi + 0xa], 3
jne 0x405d0c
push dword [esi + 0x520]
push str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.0041ef10
add esp, 8
mov edi, eax
push 0
push 0
push 0
push eax
push dword [esi]
call fcn.0042c9a0
add esp, 0x14
push edi
call fcn.0041c220
add esp, 4
jmp 0x405d0c
mov eax, dword [esi + 0x20]
or eax, 6
push str.apndvfs
jmp 0x405c90
mov eax, dword [esi + 0x20]
or eax, 1
jmp 0x405c8e
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop