joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431a4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0x10]
neg esi
sbb esi, esi
mov eax, 0x2000000
and esi, eax
push edi
push dword [ebp + 0x14]
mov edi, dword [ebp + 8]
add esi, eax
mov eax, dword [ebp + 0x14]
xor eax, 0xa
push edi
mov dword [ebp - 0x10], eax
call fcn.0040d3f8
and dword [ebp + 8], 0
cmp dword [ebp + 0x14], 0
pop ecx
pop ecx
lea ecx, [edi + eax*2]
mov dword [ebp - 8], ecx
mov ebx, eax
mov dword [ebp + 0x10], edi
jne 0x431a94
mov edi, ecx
jmp 0x431ab7
cmp edi, dword [ebp - 8]
jae 0x431b59
mov dword [ebp + 0x10], edi
mov ax, word [edi]
inc edi
inc edi
cmp word [ebp - 0x10], ax
je 0x431ab0
cmp edi, dword [ebp - 8]
jb 0x431aa0
mov ebx, edi
sub ebx, dword [ebp + 0x10]
sar ebx, 1
mov eax, dword [ebp + 0x10]
cmp eax, edi
jae 0x431acb
mov cx, word [ebp + 0x14]
xor word [eax], cx
inc eax
inc eax
cmp eax, edi
jb 0x431abe
push 0
push 0
push ebx
push dword [ebp + 0x10]
mov eax, 0x20804
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [eax + ecx + 1]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0042e20b
push dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx*2]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov dword [ebp - 4], eax
lea eax, [ebx + ebx]
push eax
push 0
push dword [ebp + 0x10]
call fcn.00470340
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jle 0x431a94
add dword [ebp + 8], eax
dec eax
js 0x431a94
lea ecx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dx, word [ebp + 0x14]
xor word [eax], dx
inc eax
inc eax
dec ecx
mov dword [ebp - 0xc], eax
jne 0x431b42
jmp 0x431a94
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov esi, dword [ebp + 8]
mov dx, word [ebp + 0x14]
pop edi
mov word [ecx + esi*2], dx
mov eax, dword [eax]
pop esi
pop ebx
leave
ret
Function at 0x431b70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x209
lea ecx, [ebp - 4]
call fcn.0042e1e2
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
push 8
push esi
xor edi, edi
push str.Device_
mov word [eax], di
call fcn.0042996a
add esp, 0xc
test al, al
jne 0x431bd2
push 0xc
push esi
push str.DosDevices_
call fcn.0042996a
add esp, 0xc
test al, al
jne 0x431bd2
cmp word [esi], di
je 0x431bd6
cmp word [esi + 2], di
je 0x431bd6
push 0x3a
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x431bd6
or dword [ebp + 0x14], 1
push 0xb
push esi
push 0x48a490
call fcn.0042996a
mov ebx, dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
add esp, 0xc
test al, al
je 0x431bfa
and dword [ebp + 0x14], 0xfffffffe
cmp byte [ebp + 0x18], 0
jne 0x431c11
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call ebx
mov edi, eax
test edi, edi
jne 0x431c22
cmp byte [ebp + 0x18], al
jl 0x431c68
mov byte [ebp + 0x18], al
push 0x208
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x431c4a
cmp byte [ebp + 0x18], 0
jle 0x431c68
push 0x208
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x431c68
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
or eax, 0xe
push eax
call ebx
push dword [ebp - 4]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
cmp byte [ebp + 0x18], 0
mov edi, eax
jl 0x431c68
test edi, edi
jne 0x431c68
mov byte [ebp + 0x18], 0xff
jmp 0x431bfa
lea ecx, [ebp - 4]
call fcn.00428a48
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431c77
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push esi
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0x100080
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00404073
cmp dword [ebp - 4], esi
jne 0x431cab
or esi, 0xffffffff
jmp 0x431cda
or dword [ebp - 0xc], 0xffffffff
push esi
lea eax, [ebp - 0x1a0]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x2d1080
push dword [ebp - 4]
mov dword [ebp - 0x1a0], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x431ca6
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.00402abc
mov eax, esi
pop esi
leave
ret
Function at 0x431e7e
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
movzx eax, word [ebp + 0x10]
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 0x10]
sar ebx, 0x10
push esi
and ebx, 0xffdf
cmp dword [ebp + 0xc], 0
push edi
mov dword [ebp + 0x10], eax
jne 0x431eba
push 0x100000
lea ecx, [ebp - 0xc]
call fcn.0042e092
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
push 5
pop ecx
xor eax, eax
mov esi, 0x48a4b8
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push 0x1b
add eax, 4
pop edx
and word [eax + 4], 0
or ecx, 0xffffffff
mov word [eax + 2], cx
mov word [eax], cx
mov word [eax - 4], cx
mov word [eax - 2], cx
add eax, 0xa
dec edx
jne 0x431eda
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x18], eax
xor edi, edi
xor eax, eax
cmp bx, 0x41
mov dword [ebp - 8], 0x19
jb 0x431f20
cmp bx, 0x5a
ja 0x431f20
movzx eax, bx
sub eax, 0x41
mov dword [ebp - 8], eax
movsx ecx, ax
cmp ecx, dword [ebp - 8]
jg 0x432070
lea esi, [eax + 0x41]
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 0x18]
xor eax, eax
inc eax
shl eax, cl
mov word [ebp - 0x38], si
test edx, eax
je 0x43205d
lea eax, [ecx + ecx*4]
mov ecx, dword [ebp + 8]
lea ebx, [ecx + eax*2]
lea eax, [ebp - 0x38]
push eax
mov word [ebx + 8], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
mov dword [ebp - 0x14], eax
je 0x43205d
cmp eax, 3
je 0x431f77
cmp eax, 2
je 0x431f77
xor al, al
jmp 0x431f79
mov al, 1
cmp dword [ebp + 0x10], 4
je 0x431f87
test al, al
je 0x43205d
push edi
push 0x20000000
push 3
push edi
push 3
push 0x80000000
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.00404073
cmp dword [ebp - 4], edi
jne 0x431fb8
lea ecx, [ebp - 4]
call fcn.00402abc
jmp 0x43205d
mov esi, dword [ebp + 0xc]
push 0x90
push edi
push esi
mov dword [ebp - 0x1d0], edi
call fcn.00470340
or dword [esi + 0x18], 0xffffffff
add esp, 0xc
push edi
lea eax, [ebp - 0x1d0]
push eax
push 0x90
push esi
push edi
push edi
push 0x70048
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x431ffd
mov ax, word [esi + 0x18]
mov word [ebx], ax
push edi
mov dword [ebp - 0x1d0], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [esi + 4], 0xffffffff
push edi
lea eax, [ebp - 0x1d0]
push eax
push 0xc
push esi
push edi
push edi
push 0x2d1080
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x432035
mov ax, word [esi + 4]
mov word [ebx + 2], ax
cmp dword [ebp + 0x10], 4
jne 0x43204a
push dword [ebp - 4]
push edi
call fcn.0042fa5a
pop ecx
pop ecx
mov word [ebx + 6], ax
mov ax, word [ebp - 0x14]
lea ecx, [ebp - 4]
mov word [ebx + 4], ax
call fcn.00402abc
mov esi, dword [ebp - 0x10]
inc esi
lea eax, [esi - 0x41]
movsx ecx, ax
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0x10], esi
jle 0x431f32
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
call fcn.00428a48
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43231c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x20]
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
ja 0x432349
cmp dword [ebp + 0x18], ebx
jbe 0x432352
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
cmp eax, ebx
jne 0x43235c
lea eax, [ebp - 0x14]
mov dword [ebp + 0x20], eax
mov edi, dword [ebp + 0x14]
cmp edi, ebx
mov esi, dword [ebp + 8]
jg 0x432370
push dword [esi]
call fcn.0042b29c
pop ecx
mov edi, eax
mov eax, dword [ebp + 0x10]
shl eax, 7
lea eax, [eax + edi - 1]
xor edx, edx
div edi
inc eax
inc eax
mov dword [ebp + 0x10], eax
add eax, 2
imul eax, edi
push eax
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00470340
xor eax, eax
push eax
push eax
push eax
push dword [esi]
mov dword [ebp + 0x14], eax
call fcn.004298d4
add esp, 0x1c
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
cmp dword [ebp + 0x1c], ecx
ja 0x4323e3
jb 0x4323c4
cmp dword [ebp + 0x18], ecx
ja 0x4323e3
mov eax, 0x1c2
cmp byte [eax + ebx], 0xee
jne 0x4323d9
mov edx, dword [eax + ebx + 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
add eax, 0x10
cmp eax, 0x1f2
jle 0x4323c9
push ecx
push dword [ebp - 8]
mov eax, edi
push dword [ebp - 0xc]
cdq
push edx
push eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], edx
call fcn.00471360
push edx
push eax
push dword [esi]
call fcn.004298d4
add esp, 0x10
push 0
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
inc eax
imul eax, edi
push eax
lea eax, [ebx + edi]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0
lea eax, [ebx + edi*2 + 0x10000]
mov dword [ebp + 0x10], eax
je 0x43248d
push edi
push 0
push eax
call fcn.00470340
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [eax + 4], 0
ja 0x43245d
jb 0x43244c
cmp dword [eax], 2
jae 0x43245d
mov ecx, dword [ebx + 0x220]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x224]
mov dword [eax + 4], ecx
push 0
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00471360
push edx
push eax
push dword [esi]
call fcn.004298d4
add esp, 0x10
push 0
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4332d8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
push ebx
push esi
push edi
push 0
mov ebx, 0x200
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00471360
and dword [ebp - 4], 0
push 0
push edx
push eax
push dword [ebp + 8]
lea edi, [ebp - 0x404]
and edi, 0xfffffe00
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
lea esi, [edi + 0x200]
call fcn.004298d4
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x4333ce
cmp edx, dword [ebp + 0x10]
jne 0x4333ce
push 0
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4333ce
push ebx
push esi
push edi
call fcn.00470580
mov esi, dword [ebp + 0x18]
add esp, 0xc
cmp esi, 1
jne 0x433374
push 0x10
push dword [ebp + 0x14]
lea eax, [edi + 0x3ce]
push eax
call fcn.00470580
add esp, 0xc
dec esi
push 0
push dword [ebp + 0x10]
neg esi
push dword [ebp + 0xc]
sbb esi, esi
push dword [ebp + 8]
and esi, 0xffff55ab
add esi, 0xaa55
mov word [edi + 0x3fe], si
call fcn.004298d4
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x4333ce
cmp edx, dword [ebp + 0x10]
jne 0x4333ce
push ebx
lea esi, [edi + 0x200]
push esi
push edi
call fcn.0042e494
add esp, 0xc
test eax, eax
jne 0x4333ce
push eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x4342a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x134
mov ecx, edi
call fcn.0042e20b
push 0xca
lea ecx, [ebp - 0x10]
call fcn.0042e1e2
mov eax, dword [ebp + 0x18]
movzx esi, byte [ebp + 0x18]
and eax, 0x100
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [edi]
test esi, esi
sete bl
neg esi
sbb esi, esi
and esi, 0x19
cmp dword [ebp + 0x14], 0
mov dword [ebp - 4], eax
mov byte [ebp + 0x1b], 0
lea ebx, [ebx + ebx - 1]
mov edx, esi
je 0x434379
cmp dword [ebp + 0x14], 1
not dword [ebp - 4]
jle 0x434379
and dword [ebp - 4], 0xfffffffc
jmp 0x434379
test edx, edx
jl 0x43437e
xor eax, eax
mov ecx, edx
inc eax
shl eax, cl
movsx esi, bl
mov cl, dl
add edx, esi
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
add cl, 0x41
test edx, eax
mov byte [ebp + 0x17], cl
je 0x434376
cmp dword [ebp - 8], 0
je 0x434348
movsx ax, cl
push eax
call fcn.0046fe45
test eax, eax
pop ecx
je 0x434376
mov cl, byte [ebp + 0x17]
cmp byte [ebp + 0x1b], 0
je 0x43435c
mov ax, word [ebp + 0xc]
test ax, ax
je 0x43435c
mov word [edi], ax
inc edi
inc edi
movsx ax, cl
mov word [edi], ax
inc edi
inc edi
cmp dword [ebp + 0x10], 0
mov byte [ebp + 0x1b], 1
je 0x434376
mov word [edi], 0x3a
inc edi
inc edi
mov edx, dword [ebp - 0xc]
cmp edx, 0x1a
jl 0x43430e
mov eax, dword [ebp + 8]
and word [edi], 0
mov esi, dword [eax]
lea ecx, [ebp - 0x10]
call fcn.00428a48
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4343b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
push edi
sete byte [esp + 0x14]
cmp byte [esp + 0x14], 0
je 0x4343cc
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov ebp, dword [esp + 0x18]
lea eax, [eax + eax*2 + 3]
push eax
mov ecx, ebp
call fcn.0042e092
mov eax, dword [ebp]
xor ebx, ebx
mov byte [eax], 0
mov dword [esp + 0x18], eax
xor cl, cl
jmp 0x434408
mov dl, byte [esi]
cmp dl, 0x3d
jne 0x434449
test cl, cl
jle 0x434407
mov byte [eax], bl
inc eax
xor ebx, ebx
xor cl, cl
inc esi
cmp byte [esi], 0
jne 0x4343f5
push dword [esp + 0x18]
mov byte [eax], 0
call edi
cmp byte [esp + 0x14], 0
mov esi, eax
je 0x434441
xor ecx, ecx
test esi, esi
jle 0x434441
mov eax, dword [esp + 0x18]
lea edi, [ecx + eax]
mov eax, ecx
cdq
push 0x14
pop ebx
idiv ebx
mov al, byte [edx + 0x48905c]
xor byte [edi], al
inc ecx
cmp ecx, esi
jl 0x434425
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dl, 0x2b
jne 0x434452
xor dl, dl
jmp 0x434478
cmp dl, 0x2f
jne 0x43445c
add dl, 0xd2
jmp 0x434478
cmp dl, 0x39
ja 0x434466
add dl, 0xd2
jmp 0x434478
cmp dl, 0x5a
ja 0x434470
add dl, 0xcb
jmp 0x434478
cmp dl, 0x7a
ja 0x43447d
add dl, 0xc5
movzx edx, dl
jmp 0x434480
or edx, 0xffffffff
test edx, edx
jl 0x4344ac
shl edx, cl
or ebx, edx
add cl, 6
cmp cl, 8
jge 0x4344a1
test cl, cl
jle 0x434407
cmp byte [esi], 0
jne 0x434407
mov byte [eax], bl
inc eax
shr ebx, 8
add cl, 0xf8
jmp 0x43448b
xor eax, eax
jmp 0x434444
Function at 0x4344b0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea ecx, [ebp - 4]
mov ebx, edi
call fcn.0042e04e
cmp byte [ebp + 0x10], 0
jne 0x434525
cmp edi, 0x14
jge 0x4344db
push 0x14
pop ebx
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 4]
call fcn.0042e092
mov esi, dword [ebp - 4]
lea eax, [ebx + 2]
push eax
push 0
push esi
call fcn.00470340
inc edi
push edi
push dword [ebp + 8]
push esi
call fcn.00470580
add esp, 0x18
xor ecx, ecx
test ebx, ebx
jle 0x434523
mov eax, ecx
cdq
push 0x14
pop edi
idiv edi
mov edi, dword [ebp - 4]
mov al, byte [edx + 0x48905c]
xor byte [ecx + edi], al
inc ecx
cmp ecx, ebx
jl 0x43450a
mov edi, ebx
lea eax, [edi + edi*2 + 0xd]
mov edi, dword [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0042e20b
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
mov word [eax], cx
cmp byte [esi], cl
jne 0x43454b
mov esi, eax
jmp 0x434624
cmp byte [ebp + 0x10], 0
jne 0x434558
mov word [eax], 0x23
inc eax
inc eax
lea edi, [ebx + esi]
mov word [eax], cx
movzx ebx, byte [esi]
inc esi
mov byte [ebp + 0xb], 8
cmp byte [ebp + 0xb], 6
jge 0x434576
cmp byte [ebp + 0xb], 0
jle 0x4345d8
cmp esi, edi
jne 0x4345da
mov dl, bl
and dl, 0x3f
cmp byte [ebp + 0x10], 0
je 0x43458c
movzx ecx, dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x4345bd
test dl, dl
jne 0x434595
add dl, 0x2b
jmp 0x4345bb
cmp dl, 1
jne 0x43459f
add dl, 0x2e
jmp 0x4345bb
cmp dl, 0xc
jae 0x4345a9
add dl, 0x2e
jmp 0x4345bb
cmp dl, 0x26
jae 0x4345b3
add dl, 0x35
jmp 0x4345bb
cmp dl, 0x40
jae 0x4345bb
add dl, 0x3b
mov cl, dl
movzx cx, cl
mov word [eax], cx
inc eax
inc eax
shr ebx, 6
add byte [ebp + 0xb], 0xfa
jns 0x434566
mov word [eax], 0x3d
inc eax
inc eax
jmp 0x434566
cmp esi, edi
jae 0x434611
movzx edx, byte [esi]
mov cl, byte [ebp + 0xb]
add byte [ebp + 0xb], 8
shl edx, cl
or ebx, edx
inc esi
cmp esi, edi
jae 0x434611
movzx edx, byte [esi]
mov cl, byte [ebp + 0xb]
add byte [ebp + 0xb], 8
shl edx, cl
or ebx, edx
inc esi
cmp esi, edi
jae 0x434611
movzx edx, byte [esi]
mov cl, byte [ebp + 0xb]
shl edx, cl
or ebx, edx
inc esi
add byte [ebp + 0xb], 8
cmp byte [ebp + 0xb], 0
jg 0x434566
and word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
lea ecx, [ebp - 4]
call fcn.00428a48
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43576f
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esi]
call fcn.004298d4
add esp, 0x10
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret
Function at 0x4361a3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x500000
lea ecx, [ebp - 8]
call fcn.0042e06b
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
add eax, 0x100000
xor ecx, ecx
and eax, 0xfff00000
cmp byte [ebp + 0x1c], cl
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
jne 0x4361e2
mov dword [ebp + 0x18], ecx
mov eax, dword [ebp + 0x18]
mov bl, byte [ebp + 0x1c]
cdq
add eax, edi
push ecx
mov edi, 0x200
push edi
adc edx, esi
push edx
push eax
call fcn.004725e0
neg bl
sbb ebx, ebx
and ebx, eax
mov dword [ebp - 0xc], ebx
xor ebx, ebx
cmp esi, ebx
jl 0x4362ff
jle 0x4362f6
cmp dword [ebp + 0x18], ebx
jne 0x43622d
mov eax, dword [ebp - 0xc]
cdq
cmp dword [ebp + 0x14], edx
jl 0x43622d
jg 0x436229
cmp dword [ebp + 0x10], eax
jbe 0x43622d
xor dl, dl
jmp 0x43622f
mov dl, 1
cmp dword [ebp + 0x14], ebx
jl 0x436246
jg 0x43623f
cmp dword [ebp + 0x10], 0x10000000
jbe 0x436246
mov esi, 0x10000000
jmp 0x436249
mov esi, dword [ebp + 0x10]
test dl, dl
mov ecx, dword [ebp + 0xc]
mov eax, esi
je 0x4362be
mov esi, edi
sub esi, dword [ebp + 0x18]
xor eax, eax
cmp eax, dword [ebp + 0x14]
jl 0x436268
jg 0x436265
cmp esi, dword [ebp + 0x10]
jbe 0x436268
mov esi, dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp + 8]
call fcn.004298d4
add esp, 0x10
push ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x18], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
add ebx, eax
push ebx
call fcn.00470580
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp + 8]
call fcn.004298d4
mov ecx, dword [ebp - 0x14]
add esp, 0x1c
mov eax, edi
xor ebx, ebx
jmp 0x4362cc
cmp byte [ebp + 0x1c], 0
je 0x4362cc
and esi, 0xfffffe00
mov eax, esi
push ebx
lea edx, [ebp - 4]
push edx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [ebp + 0x10], esi
mov dword [ebp + 0x18], ebx
sbb dword [ebp + 0x14], ebx
add dword [ebp + 0xc], esi
cmp dword [ebp + 0x14], ebx
jg 0x436214
jl 0x4362ff
cmp dword [ebp + 0x10], ebx
ja 0x436214
lea ecx, [ebp - 8]
call fcn.00428a48
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436a58
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
push 0x49b604
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [esi + 0xb]
xor edi, edi
cmp dword [ebp + 0x10], edi
setl byte [ebp - 1]
and bl, 0x11
cmp byte [ebp - 1], 0
jne 0x436a8c
test byte [ebp + 0x10], 0x40
je 0x436a8e
xor bl, bl
mov esi, dword [ebp + 8]
push 0x48a98c
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x436ae2
mov word [ebp - 0x4c], di
call fcn.0042a64d
and edx, 0x7fffffff
push edx
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0042dbf5
mov esi, dword [ebp + 0xc]
add esp, 0xc
push 3
mov ecx, esi
mov word [ebp - 0xe], di
call fcn.0042e20b
mov esi, dword [esi]
mov ax, word [ebp - 0x4c]
mov word [esi], ax
lea eax, [esi + 2]
jmp 0x436c15
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp byte [ebp - 1], 0
mov edi, dword [ebp + 0xc]
movsx eax, bl
mov byte [ebp + 0x13], 0
mov dword [ebp - 8], eax
jne 0x436b0e
cmp word [esi], 0x26
je 0x436bc0
test bl, bl
jne 0x436b99
push 0x52
mov ecx, edi
call fcn.0042e20b
mov esi, dword [edi]
and word [esi], 0
push 0
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi]
push 0x50
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jle 0x436b78
cmp word [esi], 0
jne 0x436b70
lea eax, [ebx + 0xc]
push eax
mov ecx, edi
call fcn.0042e20b
mov esi, dword [edi]
and word [esi], 0
push 0
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi]
add ebx, 0xa
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jg 0x436c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x436c0e
cmp byte [ebp + 0x13], 0
jne 0x436c0c
cmp byte [ebp - 1], 0
mov byte [ebp + 0x13], 1
jne 0x436c0c
mov ecx, dword [ebp - 0xc]
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push dword [ebp + 8]
call fcn.004100d3
cmp eax, ebx
jne 0x436bcf
cmp dword [ebp - 8], ebx
jne 0x436bdd
cmp byte [ebp + 0x13], bl
jne 0x436bdd
mov byte [ebp + 0x13], 1
jmp 0x436b0e
add esi, 2
mov dword [ebp + 8], esi
mov dword [ebp - 8], 1
jmp 0x436b99
mov eax, dword [eax]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 2]
push eax
mov ecx, edi
call fcn.0042e20b
dec ebx
mov esi, dword [edi]
mov dword [ebp + 0xc], esi
js 0x436c18
lea eax, [ebx + 1]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cx, word [ecx]
add dword [ebp + 0xc], 2
add dword [ebp + 8], 2
dec eax
mov word [edx], cx
jne 0x436bf3
jmp 0x436c18
xor ebx, ebx
test ebx, ebx
jle 0x436c18
lea eax, [esi + ebx*2]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, 0x49b604
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc