joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x401dba
push 9
push str.ERROR_
push dword [0x40f2ca]
call fcn.004024a9
mov edi, dword [0x40f2ca]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [ebp + 8]
call fcn.004027bc
cmp dword [0x40ecde], 0
je 0x401d93
push 0xa
push str._IN_LINE
push dword [0x40f2ca]
call fcn.004024e1
mov edi, dword [0x40f2ca]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x40ecde]
call fcn.004027bc
push 3
push 0x40e090
push dword [0x40f2ca]
call fcn.004024e1
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40f2ca]
call fcn.004024e1
jmp 0x401dcd
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40f2ca]
call fcn.004024a9
push 0x15
push str.ERROR
push dword [0x40f2ca]
push 0
call sub.USER32.dll_MessageBoxA
cmp eax, 2
jne 0x401df0
mov esi, 0x40ecf0
jmp 0x40c0a4
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x401df7
Capabilities:
Write file on windows

Disassembly:
push eax
push ebx
push edi
pushfd
mov ebx, dword [0x4112da]
cmp ebx, 0x200
jae 0x401e47
mov edi, dword [0x40f2ca]
mov dword [ebx*4 + 0x40f2da], edi
add ebx, 1
mov dword [0x4112da], ebx
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
mov eax, pe_overlay
sub eax, ecx
test eax, 1
je 0x401e39
add eax, 1
add eax, dword [0x40f2ca]
cmp eax, dword [0x4112de]
jl 0x401e9a
popfd
push 0x37
push str.PASPLUS_RUNTIME_ERROR:_STRING_MEMORY_OVERFLOW_IN_LINE
push dword [0x40f2ca]
call fcn.004024a9
mov edi, dword [0x40f2ca]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x40ecde]
call fcn.004027bc
push 0x10
push str.ERROR
push dword [0x40f2ca]
push 0
call sub.USER32.dll_MessageBoxA
mov esi, 0x40ecf0
jmp 0x40c0a4
mov dword [0x40f2ca], eax
popfd
pop edi
pop ebx
pop eax
ret

Function at 0x4023fa
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x40ec68
push 2
push 0x40e001
push dword [0x40ece6]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x40ec68]
pop esi
ret

Function at 0x40294c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x402965
lea ebx, [0x40eff8]
mov dword [ebp - 4], ebx
mov eax, 0
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x402979
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov dword [esi], 0
add esi, 4
mov dword [esi], 0

Function at 0x40342f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
invalid
add dword [eax], eax
invalid

Function at 0x4036fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov eax, 0
mov dword [ebp - 4], eax
invalid

Function at 0x404adb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.USER32.dll_GetDlgItem
mov dword [esi], eax
push 0
add bh, bh
call sub.USER32.dll_ShowWindow
add cl, cl
ret 8
Function at 0x406380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
push es
pop esi
add byte [eax], al

Function at 0x40be02
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x40ecf0
invalid
add byte [ebx], dl
inc ecx
Function at 0x10001c60
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001cf8
push str.avifil32.dll
call fcn.100066ba
test al, al
jne 0x10001c7d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001d40
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001dd8
push str.winmm.dll
call fcn.100066ba
test al, al
jne 0x10001d5d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret
Function at 0x100066ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100066c9
pop dword [ebp - 0x28]
mov eax, 0xfba6849f
sub eax, 0xeba61dd6
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x452c133e
add dword [ebp - 0x38], 0x926320d
mov dword [ebp - 0x34], 0xe620d0ed
add dword [ebp - 0x34], 0x4c127b58
mov dword [ebp - 0x30], 0x64a6c806
add dword [ebp - 0x30], 0xe7a57c28
mov dword [ebp - 0x2c], 0xfee440fb
add dword [ebp - 0x2c], 0x11bbf05
lea eax, [ebp - 0x38]
push eax
mov eax, 0x21cea9db
sub eax, 0x11cdb92b
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x27257bf2
add dword [ebp - 0x38], 0x4d4ced64
mov dword [ebp - 0x34], 0x3a5c5213
sub dword [ebp - 0x34], 0xf8eff09e
mov dword [ebp - 0x30], 0xe53021bf
sub dword [ebp - 0x30], 0x81c0b553
mov dword [ebp - 0x2c], 0xf444cac2
sub dword [ebp - 0x2c], 0xf444cac2
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x635e3544
sub eax, 0x535d449c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3aedf
push 0
call eax
mov ecx, 0xfa3def11
add ecx, 0x5c260ff
mov esi, eax
mov edi, 0x10023600
add edi, dword [ebp - 0x28]
mov ebx, 0xfac2c0c9
sub ebx, 0xf0b7ca05
xor dword [ebp - 4], ecx
mov edx, dword [edi]
sub edx, ebx
add dword [ebp - 0xc], edx
mov dword [esi], edx
sub dword [ebp - 0x10], 0xce8007f3
add esi, 0x6d3c7c3d
add esi, 0x92c383c7
add edi, 0x3f78d1bf
sub edi, 0x3f78d1bb
loop 0x100067e5
add eax, 0xfb6d688a
add eax, 0x493ca89
mov ebx, eax
add eax, 0xb04411d7
add eax, 0x4fbbee2e
mov ecx, 0x17d7911
add ecx, 0xe8286ef
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1000b1e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b238
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b238
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.100066ba
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b7d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40b1d1
pop dword [ebp - 0x30]
mov eax, 0x8f5f3d95
sub eax, 0x8f1e8bc4
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3b86b
push 0
mov eax, 0xa7f6e740
sub eax, 0xa7b60668
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x50d6
mov edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x30]
mov edi, 0x22596d9
add edi, 0x843a0ace
sub dword [ebp - 4], edx
mov esi, dword [ebx]
add dword [ebp - 0x10], esi
xor esi, edi
xor dword [ebp - 0x28], ecx
mov dword [edx], esi
add dword [ebp - 0x20], 0x10914ce5
add edx, 0xbac6d358
add edx, 0x45392cac
add ebx, 0x3a37899f
sub ebx, 0x3a37899b
loop 0x40b224
add eax, 0x1362b
mov ebx, eax
add eax, 0x8ef3400c
sub eax, 0x8ef34007
mov ecx, 0xbd2dc7dc
sub ecx, 0xbcedc7dc
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4c12d5
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
invalid
shr dword [edx], 1
mov eax, 0x50ed754a
je 0x4c1296
loopne 0x4c133d
mov ah, 0x5c
pop eax
out dx, al
or eax, 0xdb3e6a4d
adc al, byte [edi]
add dh, byte [ebx + edi]
xor al, 0x3b
sub ah, byte [edx]
fdivr dword [ebp + 0x4b]
or eax, 0xe02abe9b
stosd dword es:[edi], eax
mov ch, 0x13
popal
jle 0x4c12ec
loopne 0x4c1357
xchg edi, eax
xchg edi, eax
jnp 0x4c1343
mov bh, 0xb8
jp 0x4c1327
hlt
ret
cmpsd dword [esi], dword es:[edi]
sbb eax, 0x132c8858
aas
or esi, dword [esi + 9]
pop esi
jnp 0x4c12ee
aas
fidivr word [esi]
xchg edi, eax
mov gs, ebp
invalid
fidiv dword [ecx - 0x71749403]
inc esi
mov cl, 0xfd
imul ecx, dword [ebx + 0x6ec2468e], 0xffffffb8
add eax, esi
sbb esi, dword [ecx]
or edx, dword [esi + 0x53]
jl 0x4c133c
ret 0xb86e
mov esi, dword [esi - 0x3e]
sti
cmpsd dword [esi], dword es:[edi]
adc esi, esp
add ebp, eax
sbb edx, eax
arpl dx, dx
call 0xd2afe377
call 0xc35ba9a9
jl 0x4c13c0
sbb esp, esi
scasd eax, dword es:[edi]
xchg ebx, eax
mov eax, dword [0xe55c0d10]
rcl dword [esi], cl
cmp dh, byte [eax - 0x29]
cmp al, 0x23
jbe 0x4c13e7
sbb cl, dl
push esp
mov cl, 0x62
wait
jp 0x4c1316
das
jmp 0xd018dcad
lodsd eax, dword [esi]
xor ebx, dword [edi + 0x3773c431]
aas
out dx, eax
inc esp
invalid
scasb al, byte es:[edi]
add al, 0xc
invalid

Function at 0x4e3ac5
Capabilities:
Encode data using xor

Disassembly:
pushal
inc esp
cwde
sub al, byte [esi - 0x7b]
mov ebx, 0x6517407c
invalid

Function at 0x4ea541
Capabilities:
Encode data using xor

Disassembly:
or eax, esi
stosb byte es:[edi], al
popfd
lock or dword [eax - 0x15771957], ebx
xor al, 1
cmp byte [edi], ah
mov esp, 0xac5fa7ec
lds esi, cs:[edx]
mov esi, 0x317af58c
mov al, byte [0x2a086501]
add dword [ebp + 8], esp
invalid
add dword [ebp + 8], esp
sub dl, ch
or byte [ebp - 0x13], al
aad 8
inc ebp
in eax, dx
dec ebx
out dx, al
sti
clc
and dword [ecx], ecx
dec esi
inc edi
mov fs, edx
pushfd
add bh, bh
xchg esi, eax
lodsb al, byte [esi]
mov esp, 0xd77b5c38
mov ah, cl
les ebx, [esi + 0x6b601a43]
xchg edi, eax
dec esi
loope 0x4ea523
lodsd eax, dword [esi]
insb byte es:[edi], dx
add ebx, dword [ebp + edi*4 + 0x16d26eb5]
push ss
Function at 0x525e30
Capabilities:
Encode data using xor

Disassembly:
xorps xmm0, xmm0
mov dword [0x7006f8], 0
push 0x700700
movups xmmword [0x700700], xmm0
mov dword [0x7006fc], 0x19
call esi
push 0x1e
push 0x56
push 0
push 0x2b
xorps xmm0, xmm0
mov dword [0x700710], 0x19
push 0x700718
movups xmmword [0x700718], xmm0
mov dword [0x700714], 0xcc00003f
int3
mov byte [0x3cd6f56c], al
inc edi
xchg dword [esi + 0x7a5f64ee], ecx
jae 0x525dd1
or dword gs:[esi - 0x46], edi
in eax, dx
fiadd word [ebp + 0x3027e737]
jge 0x525e83
out dx, al
push ss
arpl si, bp
dec ebx
wait
outsb dx, byte [esi]
mov ebp, 0x53e8775b
int 1
lodsb al, byte [esi]
in al, dx
daa
xchg ebp, eax
jge 0x525e6a
pop es
invalid
lcall 0x344, 0xec5b6847
or al, 0x1a
add ecx, dword [edx + ebx]
ficomp word [ebp - 0x56d8a835]
jae 0x525e4c
mov eax, dword [0x9adae2f]
jl 0x525e70
sbb bl, byte [ebp + 0x5cd8665a]
popfd
pop edx
fcomp dword [edx + 0x75]
loop 0x525e73
bound esi, qword [ebp - 0x1e]
out 0x52, eax
push edx
lds edx, [eax]
cmp byte [edi - 0x62], dh
sbb byte [0xb3a15414], bh
outsd dx, dword [esi]
mov eax, dword [0x6eeaeb42]
push 0xffffffffffffff82
clc
xchg edx, eax
sbb esi, esp
mov ah, 0x8a
les esi, [esp + ecx]
lodsd eax, dword [esi]
in al, dx
xchg edx, eax
in al, 0xe8
or byte [eax], bl
sbb dword [ebp + 0x5d], edx
xor ebx, dword [edi + 0x53]
mov ch, 1
xlatb
scasd eax, dword es:[edi]
loop 0x525e9c
jmp 0x525e88
mov edx, esp
sub dword [ebp + 0x48], 0xa1ed545b
mov ah, 0x39
cmp dword [edx + 0x1c135b12], eax
or byte [esi + 0x2bd53392], bl
aad 0x2b
pop esp
mov eax, dword [0xd97939fd]
adc ebx, dword [esi]
mov esi, gs
pop edi
shr dword [edx + 0x15], cl
das
pop ebx
sub edx, ebp
push ebx
neg dword [edx*2 + 0x656c9485]
or dword [edx - 0xd], edi
mov dh, bl
fdivr qword [0x4d3010d7]
and al, 0x8c
pop esp
pop ss
mov bh, 0x7c
les esp, [edi + 0x20]
sbb dword [ebp - 0x475eabef], esp
outsd dx, dword [esi]
mov eax, dword [0x1d68eb4f]
jl 0x525ee5
pushal
pop eax
xchg ecx, eax
dec edx
leave
push ebx
mul dword [ecx + ebx*2]
jae 0x525f2f
sbb byte [ecx + 0xb], ch
jl 0x525ed3
add eax, 0x2bc031d4
fdivr dword [ecx - 0x1f122773]
lahf
or bh, byte fs:[edi]
or bh, byte [edi]
outsb dx, byte [esi]
push esp
mov ebp, 0x53dc6a5b
hlt

Function at 0x58b9b4
Capabilities:
Encode data using xor

Disassembly:
inc ebp
push ebp
pop edx
fmul qword [ecx + 0x5e548cf3]
loop 0x58b9ef
mov fs, word [esi + 0x6c]
clc
cli
invalid
cdq
or cl, byte [ebp - 0x1529702b]
aad 0xaa
pop ss
dec esp
sbb al, 0xec
mov edi, 0xdecfc2dc
inc ecx
xor al, 0xe2
bound ecx, qword [ebx + 0x56]
pop esi
stc
lea ebx, [ecx + edx - 0x7db0f3d3]
push edx
mov ebx, 0x91a5e18f
sub eax, 0x90fc7c5f
pop edi
jl 0x58ba16
nop
mov cs, word [edx]
loop 0x58ba17
push ecx
and byte [esi + eax*8 - 0x26], bh
div dword [edx - 0x62ccad0e]
sbb eax, 0x2443093
dec edi
salc
mov edi, 0xa43894e
out 0, al
push eax
push 0x2d007ddd
loop 0x58ba9b
mov bl, 0xa8
push eax
push ebp
outsd dx, dword [esi]
push eax
invalid
xchg ah, ah
mov byte [0x50704cba], al
enter 0xffffffffffffb994, 0x62
mov bh, 0x50
push edx
adc ecx, dword [edx]
mov bh, 0x60
invalid
Function at 0x595aa5
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xae8b70b7], al
mov ds, word [edx + 0x32]
daa
mov al, byte [0x61bd1647]
outsd dx, dword [esi]
js 0x595ae1
hlt
sub dword [0x77cc13c9], ebx
jns 0x595b04
xchg dword [esp + edx*2 + 0x36], ecx
dec ebp
and al, 0x10
fdiv st(2)
enter 0x7e14, 0x1c
pop ss
adc eax, 0xaf5821d5
das
mov dword [edx], edi
inc edx
inc ecx
pop esp
jl 0x595b33
jbe 0x595b4c
sbb dword [esi + edi*8 - 0x19f8eb05], esi
or al, 0x20
insd dword es:[edi], dx
inc esi
adc eax, 0x6c7d6451
out dx, al
dec esp
xchg esi, eax
sbb eax, 0x7df66d84
cmp byte [esi + eax*2 + 0x736d5b14], 0xfe
out dx, al
fisttp word [esi]
sbb al, 0x9f
aam 0xb2
stc
push esp
das
push esi
xor dl, ch
cmc
jecxz 0x595b2e
clc
in eax, 0x82
add edi, dword [esp + ebx*2]
std
or al, 3
les edx, [eax + 0x3f137f76]
and al, 0xcc
inc edi
aaa
mov dl, dl
fcmovu st(0), st(5)
and al, 0x6a
frstor dword [edx + ebp*2]
sub eax, 0xec4b6de6
neg byte [esi - 0xe]
out 0xd9, al
sbb ecx, dword [eax + 0x46]
mov eax, 0xa69872b0
lahf
dec esp
jg 0x595b35
xchg esp, eax
mov al, byte [0x916c1470]
cli
mov eax, 0x2e2ed31f
pop ebp
test byte [ebp - 0x1a], cl
cld
out 0x3e, al
xchg edi, eax
rcl byte [esi - 0x361fd52c], cl
sbb al, 0x35
or eax, 0xda684c54
mov cl, 0x9d
adc byte [ebx - 0x2d87b6d2], cl
in eax, dx
inc edi
inc eax
fidiv dword [edx + 0x21562cb9]
inc edi
push 0xffffffffffffff86
salc
push edi
js 0x595c0f
cmp eax, 0x4e060cbe
sahf
lea ebp, [ecx + 0x7c]
mov bh, 0xff
xor dl, byte [ebp - 0x41]
and dword [eax], 0x2ee5f702
dec edi
push ds
in eax, dx
and al, 0xc7
adc eax, 0xaa1bfcbc
out 0xc1, eax
daa
pop esp
push 0xfffffffffffffff6
mov edi, 0xdc964e86
pop ebx
test al, 0xb0
lodsb al, byte [esi]
mov word [ecx + 0x23], es
wait
jbe 0x595b9f
cli
or ecx, edi
xchg edx, eax
shr eax, 1
outsd dx, dword [esi]
mov ch, 0xc2
cdq
shl ah, cl
cli
outsb dx, byte [esi]
inc eax
jnp 0x595c59
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
loope 0x595bf9
hlt
cwde
invalid
retf
mov eax, dword [ecx + 0x160ee782]
invalid
Function at 0x64e2dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6593d8
cmp edx, dword [eax]
je 0x64e2ff
add eax, 8
inc ecx
cmp eax, 0x659468
jl 0x64e2f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6593d8]
jne 0x64e42d
mov eax, dword [0xa5cd48]
cmp eax, 1
je 0x64e407
test eax, eax
jne 0x64e330
cmp dword [0x659304], 1
je 0x64e407
cmp edx, 0xfc
je 0x64e42d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e367
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ecc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064f150
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e3aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064f150
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653f4c
push edi
call fcn.00651020
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ecc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ecd0
lea eax, [ebp - 0xa0]
push 0x653f2c
push eax
call fcn.0064ecd0
push dword [esi + 0x6593dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ecd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650f94
add esp, 0x2c
pop edi
jmp 0x64e42d
lea eax, [ebp + 8]
lea esi, [esi + 0x6593dc]
push 0
push eax
push dword [esi]
call fcn.0064f150
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405425
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004056e3
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405464
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423748], eax
jmp 0x4055ee
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40547e
test eax, eax
je 0x40559c
test bl, 2
je 0x40559c
mov esi, 0x420cc8
push edi
push esi
call fcn.00405b65
cmp dword [ebp + 8], 0
je 0x40549d
push 0x409360
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054a3
push edi
call fcn.0040563c
cmp byte [edi], 0
jne 0x4054b1
cmp byte [0x420cc8], 0x5c
jne 0x4054bc
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405592
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405620
cmp byte [eax], 0
je 0x405502
cmp byte [ebp - 0x1c], 0
je 0x405502
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405518
mov al, byte [esi + 1]
test al, al
je 0x405571
cmp al, 0x2e
jne 0x405518
cmp byte [esi + 2], 0
je 0x405571
push esi
push ebx
call fcn.00405b65
test byte [ebp - 0x14c], 0x10
je 0x40553d
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405571
push dword [ebp + 0xc]
push edi
call fcn.00405425
jmp 0x405571
push dword [ebp - 4]
push edi
call fcn.004053dd
test eax, eax
jne 0x405569
cmp dword [ebp - 4], eax
je 0x405561
push edi
push 0xfffffffffffffff1
call fcn.00404e50
push 0
push edi
call fcn.00405a19
jmp 0x405571
inc dword [0x423748]
jmp 0x405571
push edi
push 0xfffffffffffffff2
call fcn.00404e50
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054e0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40559c
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4055ee
cmp dword [ebp - 0xc], esi
jne 0x4055b0
inc dword [0x423748]
jmp 0x4055ee
push edi
call fcn.00405e69
test eax, eax
je 0x4055ee
push edi
call fcn.004055f5
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004053dd
test eax, eax
jne 0x4055e6
cmp dword [ebp - 4], esi
je 0x4055a8
push edi
push 0xfffffffffffffff1
call fcn.00404e50
push esi
push edi
call fcn.00405a19
jmp 0x4055ee
push edi
push 0xffffffffffffffe5
call fcn.00404e50
pop edi
pop esi
pop ebx
leave
ret 8