joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a000
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x44a0f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x44a109
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x44a162
cmp eax, edx
jae 0x44a14e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x44a140
lea edx, [esi + 0x20]
push esi
call fcn.00449b00
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x44a17f
jmp 0x44a170
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x44a170
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.00449b00
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44a890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x44a9e4
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x44a9e4
test eax, eax
js 0x44a9e4
mov eax, dword [esi + 0x234]
push eax
call fcn.0044e890
add esp, 4
test eax, eax
jne 0x44a9e9
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x44a8ea
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x44a945
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x44a93e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x44a904
push ebx
push esi
call fcn.0044e800
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x44a902
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x44a948
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x44a9dd
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x44a9d3
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x44a990
push edi
push esi
call fcn.0044e800
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x44a960
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0x44dd20
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x44de20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0x44de39
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0x44de92
cmp eax, edx
jae 0x44de7e
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0x44de70
lea eax, [esi + 0x2c]
push esi
call fcn.0044c270
add esp, 4
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0x44deaf
jmp 0x44dea0
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0x44dea0
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x2c]
push esi
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
call fcn.0044c270
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
add esp, 4
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44e650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x44e6f4
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0x44e681
call eax
dec dword [ebp - 8]
call fcn.0046948b
mov esi, eax
call fcn.0046948b
cmp esi, eax
jne 0x44e6a0
xor edi, 1
call fcn.0046948b
cmp esi, eax
je 0x44e694
call fcn.0046948b
mov esi, eax
call fcn.0046948b
cmp esi, eax
jne 0x44e6bc
xor ebx, 1
call fcn.0046948b
cmp esi, eax
je 0x44e6b0
cmp edi, ebx
je 0x44e684
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0x44e681
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0x44e675
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00467a90
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0x44e850
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0x44e850
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0x44e834
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.00467a90
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457fd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0x45800b
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0x457feb
pop edi
pop esi
pop ebp
ret

Function at 0x45c170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.0044fe16
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0044fcb5
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.004675bc
add esp, 0x20
jmp 0x45c1d2
cmp esi, 0x3fffffff
ja 0x45c1b6
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0044fcb5
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.004675bc
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0x45c1ac
lea eax, [ebp - 0x210]
push eax
call fcn.0044fd7e
pop ecx
pop esi
leave
ret

Function at 0x45c1ec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.0044fe16
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0044fcb5
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.004675bc
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.0044fd7e
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x45c4dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.00450dc4
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0x45c56e
push ebx
push dword [ebp + 8]
dec esi
call fcn.00450f53
pop ecx
pop ecx
cmp eax, 3
jne 0x45c537
test edi, edi
je 0x45c563
push 0
push ebx
push dword [ebp + 8]
call fcn.0045113c
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.00464bfd
add esp, 0x10
test eax, eax
jle 0x45c563
xor edi, edi
inc edi
jmp 0x45c565
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.00450938
add esp, 0xc
test edi, edi
je 0x45c563
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.0046632f
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x45c565
xor edi, edi
inc ebx
test esi, esi
jne 0x45c4f8
test edi, edi
je 0x45c573
xor eax, eax
inc eax
jmp 0x45c582
push 0
push 0
push dword [ebp + 8]
call fcn.0044fadf
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d478
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x43d444
add byte [esi + 0x1454109], dl
imul eax, dword [eax], 0
xchg esi, eax
add eax, 0x8c014541
sub eax, 0x3dee8225
cmp al, byte [ebp + 1]
les eax, [ecx]
ljmp 0:0xfcc8
adc dl, 0x99
mov dx, bp
mov edx, 0xf964dc51
mov esi, 0x64fe62a9
mov ebx, 0x91ed4f71
dec edi
in eax, dx
xchg ecx, eax
movsx ebx, bx
mov cx, ax
call 0x43d478
xchg ebx, eax
adc dword [ebp + 0x4b], edx
test eax, 0x4fe0e4c6
in eax, dx
pop esi
jp 0x43d482
loope 0x43d456
push ebx
inc ebx
push 0x1ce9e28a
add byte [eax], al
add cl, ch
loope 0x43d422
mov esi, 0x2550f6a7
not byte [eax + 0x25]
inc ecx
cmpsb byte [esi], byte es:[edi]
and edi, dword [ebx - 0x2bf7d38d]
test eax, 0xfbc99a7
mov word [esp + eax*4 - 0x4f], gs
or eax, dword [eax - 8]
xor ecx, 0x9dcf3ff3
pop ebp
sbb ch, 0x27
movsx ecx, dx
mov cl, 0xbf
mov ecx, 0x583b06f1
add ebp, 0xc229213e
and bh, 0x31
mov ecx, 0x13b235a9
movsx ebx, dx
xor ebx, 0x455675c1
dec byte [ebp + 0x3dd6de9d]
mov dl, 0x69
dec esi
mov cl, 0xb8
adc edx, 0x3e805361
sub ebp, 1
mov di, cx
adc ecx, 0xbe1abd71
mov edi, esi
mov ecx, 0x81664829
mov ebx, 0x7d28f893
cmp edi, 0x64fe5e70
jne 0x43d4bb
mov edx, 0x47091243
jmp 0x43d43b
Function at 0x402000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [0x40100e], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [0x401012], eax
push 0
push 0x40103e
push 0x18
push str.Press_Enter_to_continue
push dword [0x401012]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
push 0x40103e
push 0x14
push 0x401016
push dword [0x40100e]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
push 3
push 0
push 0
push 0x80000000
push str.input.txt
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x402107
mov dword [0x40100a], eax
call fcn.00402150
cmp eax, 0x2b
je 0x40209c
cmp eax, 0x2d
je 0x4020a3
cmp eax, 0x2a
je 0x4020aa
cmp eax, 0x2f
je 0x4020b1
cmp eax, 0x5e
je 0x4020b8
cmp eax, 0x3f
je 0x4020bf
jmp 0x402123
call fcn.00402299
jmp 0x4020c6
call fcn.004022ac
jmp 0x4020c6
call fcn.004022bf
jmp 0x4020c6
call fcn.004022d2
jmp 0x4020c6
call fcn.004022e5
jmp 0x4020c6
call fcn.0040230c
jmp 0x4020c6
push 0
push 0x40103e
push 9
push str.Result:
push dword [0x401012]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
fld qword [0x4010b5]
call fcn.00402284
push 0
push 0x40103e
push 0xa
push str.Success_r_n_nError:_Could_not_open_the_file_r_n_nError:_Operator_not_recognized_r_n_n_.8f_n
push dword [0x401012]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x40213f
push 0
push 0x40103e
push 0x21
push 0x40106d
push dword [0x401012]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x40213f
push 0
push 0x40103e
push 0x21
push 0x40108e
push dword [0x401012]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x40213f
push dword [0x40100a]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp entry0
Function at 0x402150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0x40103e
push 0x14
push 0x401016
push dword [0x40100a]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
lea esi, [0x401016]
xor eax, eax
mov edi, 1
cmp byte [esi], 0x2d
jne 0x402185
neg edi
inc esi
movzx edx, byte [esi]
cmp edx, 0xd
je 0x4021a2
cmp edx, 0xa
je 0x4021a2
cmp edx, 0x2e
je 0x4021a2
sub edx, 0x30
imul eax, eax, 0xa
add eax, edx
inc esi
jmp 0x402185
imul eax, edi
push eax
fild dword [esp]
add esp, 4
cmp edx, 0x2e
jne 0x4021f0
xor eax, eax
inc esi
mov ecx, 1
movzx edx, byte [esi]
cmp edx, 0xd
je 0x4021d6
cmp edx, 0xa
je 0x4021d6
sub edx, 0x30
jb 0x4021d6
imul eax, eax, 0xa
imul ecx, ecx, 0xa
add eax, edx
inc esi
jmp 0x4021b9
imul eax, edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
fild dword [esp + 8]
fild dword [esp + 0xc]
fdivp st(1)
faddp st(1)
add esp, 4
fstp qword [0x4010bd]
inc esi
inc esi
xor eax, eax
mov edi, 1
cmp byte [esi], 0x2d
jne 0x402209
neg edi
inc esi
jmp 0x402209
movzx edx, byte [esi]
cmp edx, 0xd
je 0x402226
cmp edx, 0xa
je 0x402226
cmp edx, 0x2e
je 0x402226
sub edx, 0x30
imul eax, eax, 0xa
add eax, edx
inc esi
jmp 0x402209
imul eax, edi
push eax
fild dword [esp]
add esp, 4
cmp edx, 0x2e
jne 0x402272
xor eax, eax
inc esi
mov ecx, 1
movzx edx, byte [esi]
cmp edx, 0xd
je 0x402258
cmp edx, 0xa
je 0x402258
sub edx, 0x30
imul eax, eax, 0xa
imul ecx, ecx, 0xa
add eax, edx
inc esi
jmp 0x40223d
imul eax, edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
fild dword [esp + 8]
fild dword [esp + 0xc]
fdivp st(1)
faddp st(1)
add esp, 4
fstp qword [0x4010c5]
inc esi
inc esi
movzx eax, byte [esi]
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x405b23
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405dee
test bl, 8
mov dword [ebp - 8], eax
je 0x405b62
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434fa8], eax
jmp 0x405cdf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b7c
test eax, eax
je 0x405c8d
test bl, 2
je 0x405c8d
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nsr6240.tmpdownload.exe
push edi
push esi
call fcn.00406411
cmp dword [ebp + 8], 0
je 0x405b9b
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405ba1
push edi
call fcn.00405d32
cmp word [edi], 0
jne 0x405bb1
cmp word [str.C:UsersADMINI1AppDataLocalTemp_nsr6240.tmpdownload.exe], 0x5c
jne 0x405bbc
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c82
cmp word [ebp - 0x22c], 0x2e
jne 0x405c06
cmp word [ebp - 0x22a], 0
je 0x405c65
cmp word [ebp - 0x22a], 0x2e
jne 0x405c06
cmp word [ebp - 0x228], 0
je 0x405c65
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406411
test byte [ebp - 0x258], 0x10
je 0x405c31
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c65
push dword [ebp + 0xc]
push edi
call fcn.00405b23
jmp 0x405c65
push dword [ebp - 4]
push edi
call fcn.00405adb
test eax, eax
jne 0x405c5d
cmp dword [ebp - 4], eax
je 0x405c55
push edi
push 0xfffffffffffffff1
call fcn.00405479
push 0
push edi
call fcn.004061d7
jmp 0x405c65
inc dword [0x434fa8]
jmp 0x405c65
push edi
push 0xfffffffffffffff2
call fcn.00405479
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405bde
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c8d
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405cdf
cmp dword [ebp - 8], esi
jne 0x405ca1
inc dword [0x434fa8]
jmp 0x405cdf
push edi
call fcn.0040676f
test eax, eax
je 0x405cdf
push edi
call fcn.00405ce6
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405adb
test eax, eax
jne 0x405cd7
cmp dword [ebp - 4], esi
je 0x405c99
push edi
push 0xfffffffffffffff1
call fcn.00405479
push esi
push edi
call fcn.004061d7
jmp 0x405cdf
push edi
push 0xffffffffffffffe5
call fcn.00405479
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 1
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
jle 0x401230
mov eax, dword [ebp + 0xc]
mov edi, str.__version
mov ecx, 0xa
mov esi, dword [eax + 4]
repe cmpsb byte [esi], byte es:[edi]
je 0x40125c
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp + 8], 0x4041a7
mov dword [esp + 4], str.Usage:_runscript__scriptfile___logfile__homedir___s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov dword [esp + 4], str.2.6.2
mov dword [esp], str.runscript__part_of_minicom_version__s_n
call sub.cygwin1.dll_printf
mov dword [esp], 0
call sub.cygwin1.dll_exit
lea esi, [esi]
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x40602c]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
test eax, eax
je 0x4012a4
mov ebx, dword [ebp - 8]
mov eax, 2
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x407300]
mov esi, dword [eax + 8]
mov eax, dword [0x4073a0]
mov ebx, dword [eax + 8]
call sub.cygwin1.dll___getreent
mov dword [esp + 0x10], 0x4041a7
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.script___s__line__d:_break_outside_of_expect_s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop
lea esi, [esi]

Function at 0x4012f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x407300]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
mov esi, dword [eax + 8]
mov eax, dword [0x4073a0]
mov ebx, dword [eax + 8]
call sub.cygwin1.dll___getreent
mov edx, dword [ebp + 8]
mov dword [esp + 0x14], 0x4041a7
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 4], str.script___s_:_syntax_error_in_line__d__s_s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov esi, esi
lea edi, [edi]

Function at 0x4013c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x401403
mov dword [esp], ebx
call sub.cygwin1.dll_strlen
mov edx, 0x40
mov dword [esp + 4], ebx
cmp eax, 0x40
cmovg eax, edx
sub edx, eax
add edx, 0x406088
mov dword [esp], edx
call sub.cygwin1.dll_strcmp
test eax, eax
sete al
add esp, 0x14
movzx eax, al
pop ebx
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp + 8], str.expfound
mov dword [esp + 4], str.NULL_paramenter_to__s_
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop