joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f97b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], edi
je 0x49f9b8
cmp dword [ebp + 0x14], edi
je 0x49f9b8
cmp ecx, edi
jne 0x49f9bf
call fcn.004a22b2
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004a3d5d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x49f9d3
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x49f9f4
cmp ebx, 0xffffffff
je 0x49f9e3
push ebx
push edi
push ecx
call fcn.0049e680
add esp, 0xc
cmp esi, edi
je 0x49f9a0
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x49f9a0
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test dword [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x49fa11
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x49fa18
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x49fb0a
test dword [esi + 0xc], 0x10c
je 0x49fa6d
mov eax, dword [esi + 4]
test eax, eax
je 0x49fa6d
jl 0x49fb6b
mov edi, ebx
cmp ebx, eax
jb 0x49fa3e
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x49fb12
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004a8387
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x49fb02
cmp ebx, dword [ebp - 0xc]
jb 0x49fada
cmp dword [ebp - 0xc], 0
je 0x49fa97
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x49fa8c
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x49fa93
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x49faa2
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x49faa2
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x49fb3e
push eax
push dword [ebp - 8]
push esi
call fcn.004a7047
pop ecx
push eax
call fcn.004a828a
add esp, 0xc
test eax, eax
je 0x49fb7d
cmp eax, 0xffffffff
je 0x49fb6b
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x49fb02
push esi
call fcn.004a7ba4
pop ecx
cmp eax, 0xffffffff
je 0x49fb6f
cmp dword [ebp - 4], 0
je 0x49fb3e
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x49fa20
mov eax, dword [ebp + 0x14]
jmp 0x49f9ba
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x49fb29
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0049e680
add esp, 0xc
call fcn.004a22b2
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x49f9b0
cmp dword [ebp + 0xc], 0xffffffff
je 0x49fb54
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0049e680
add esp, 0xc
call fcn.004a22b2
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x49f9b0
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x49f9ba
or dword [esi + 0xc], 0x10
jmp 0x49fb6f
Function at 0x4a3c56
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4c0390]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
and dword [ebp - 0x80], 0
push ebx
push 0x4c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0049e680
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov eax, dword [ebp + 0x2ac]
lea ecx, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x9c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp + 0x8c], ecx
mov dword [ebp - 0x80], 0xc0000417
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4a3d35
test ebx, ebx
jne 0x4a3d35
push 2
call fcn.004a965d
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
pop ebx
call fcn.0049e0c6
add ebp, 0x2a8
leave
ret

Function at 0x4a3d5d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x5010d4]
call fcn.004a4fe5
pop ecx
test eax, eax
je 0x4a3d73
pop ebp
jmp eax
push 2
call fcn.004a965d
pop ecx
pop ebp
jmp fcn.004a3c56
Function at 0x4a40db
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4c0930]
je 0x4a40f6
inc edi
cmp edi, 0x17
jb 0x4a40e7
cmp edi, 0x17
jae 0x4a4276
push ebp
push 3
call fcn.004a9f9e
pop ecx
cmp eax, 1
je 0x4a4242
push 3
call fcn.004a9f9e
pop ecx
test eax, eax
jne 0x4a412a
cmp dword [0x4c0680], 1
je 0x4a4242
cmp ebx, 0xfc
je 0x4a4275
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x501110
push ebp
call fcn.004a8ad0
add esp, 0xc
test eax, eax
je 0x4a4160
push esi
push esi
push esi
push esi
push esi
call fcn.004a3c56
add esp, 0x14
push 0x104
mov esi, 0x501129
push esi
push 0
mov byte [0x50122d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4a41a4
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004a8ad0
add esp, 0xc
test eax, eax
je 0x4a41a4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004a3c56
add esp, 0x14
push esi
call fcn.004a89b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4a41e9
push esi
call fcn.004a89b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x501424
push 0x4b374c
sub ecx, eax
push ecx
push eax
call fcn.004a9eeb
add esp, 0x14
test eax, eax
je 0x4a41e9
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004a3c56
add esp, 0x14
jmp 0x4a41eb
xor esi, esi
push 0x4b63a0
push ebx
push ebp
call fcn.004a9e7a
add esp, 0xc
test eax, eax
je 0x4a420b
push esi
push esi
push esi
push esi
push esi
call fcn.004a3c56
add esp, 0x14
push dword [edi*8 + 0x4c0934]
push ebx
push ebp
call fcn.004a9e7a
add esp, 0xc
test eax, eax
je 0x4a422d
push esi
push esi
push esi
push esi
push esi
call fcn.004a3c56
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004a9d13
add esp, 0xc
jmp 0x4a4275
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4a4275
cmp ebp, 0xffffffff
je 0x4a4275
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4c0934]
push dword [esi]
call fcn.004a89b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a540e
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
push edi
mov esi, str.KERNEL32.DLL
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a5427
push esi
call fcn.004a3d81
pop ecx
mov edi, eax
test edi, edi
je 0x4a558f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push edi
call esi
push str.FlsGetValue
push edi
mov dword [0x501424], eax
call esi
push str.FlsSetValue
push edi
mov dword [0x501428], eax
call esi
push str.FlsFree
push edi
mov dword [0x50142c], eax
call esi
cmp dword [0x501424], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x501430], eax
je 0x4a5490
cmp dword [0x501428], 0
je 0x4a5490
cmp dword [0x50142c], 0
je 0x4a5490
test eax, eax
jne 0x4a54b4
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x501428], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x501424], 0x4a5054
mov dword [0x50142c], esi
mov dword [0x501430], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4c0a10], eax
cmp eax, 0xffffffff
je 0x4a5594
push dword [0x501428]
push eax
call esi
test eax, eax
je 0x4a5594
call fcn.004a408f
push dword [0x501424]
call fcn.004a4f6d
push dword [0x501428]
mov dword [0x501424], eax
call fcn.004a4f6d
push dword [0x50142c]
mov dword [0x501428], eax
call fcn.004a4f6d
push dword [0x501430]
mov dword [0x50142c], eax
call fcn.004a4f6d
add esp, 0x10
mov dword [0x501430], eax
call fcn.004a2320
test eax, eax
je 0x4a558f
push fcn.004a5276
push dword [0x501424]
call fcn.004a4fe5
pop ecx
call eax
mov dword [0x4c0a0c], eax
cmp eax, 0xffffffff
je 0x4a558f
push 0x214
push 1
call fcn.004a6caa
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4a558f
push esi
push dword [0x4c0a0c]
push dword [0x50142c]
call fcn.004a4fe5
pop ecx
call eax
test eax, eax
je 0x4a558f
push 0
push esi
call fcn.004a5100
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x4a5596
call fcn.004a50c3
xor eax, eax
pop edi
pop esi
ret

Function at 0x4a69e0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4a69f1
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4a69ee
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
ret

Function at 0x4a6a10
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x4a6a4a
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4a6a42
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4a6a4c
inc edx
add eax, 0x28
cmp edx, esi
jb 0x4a6a32
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4a7ba4
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x4a7bcd
call fcn.004a22b2
push edi
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
call fcn.004a3d5d
add esp, 0x14
jmp 0x4a7cc4
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x4a7cc4
test al, 0x40
jne 0x4a7cc4
test al, 2
je 0x4a7bef
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x4a7cc4
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
jne 0x4a7c05
push esi
call fcn.004a9801
pop ecx
jmp 0x4a7c0a
mov eax, dword [esi + 8]
mov dword [esi], eax
push dword [esi + 0x18]
push dword [esi + 8]
push esi
call fcn.004a7047
pop ecx
push eax
call fcn.004a828a
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, edi
je 0x4a7cb4
cmp eax, 0xffffffff
je 0x4a7cb4
test byte [esi + 0xc], 0x82
jne 0x4a7c89
push esi
call fcn.004a7047
pop ecx
cmp eax, 0xffffffff
je 0x4a7c74
push esi
call fcn.004a7047
pop ecx
cmp eax, 0xfffffffe
je 0x4a7c74
push esi
call fcn.004a7047
sar eax, 5
push esi
lea edi, [eax*4 + 0x501700]
call fcn.004a7047
and eax, 0x1f
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
jmp 0x4a7c79
mov eax, 0x4c1150
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x4a7c89
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x4a7ca7
mov eax, dword [esi + 0xc]
test al, 8
je 0x4a7ca7
test eax, 0x400
jne 0x4a7ca7
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x4a7cc7
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], edi
or eax, 0xffffffff
pop edi
pop esi
ret
Function at 0x4a9448
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x5015a0]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
push 2
pop ebp
cmp eax, ebx
jne 0x4a9491
call edi
mov esi, eax
cmp esi, ebx
je 0x4a9478
mov dword [0x5015a0], 1
jmp 0x4a949a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4a948c
mov eax, ebp
mov dword [0x5015a0], eax
jmp 0x4a9491
mov eax, dword [0x5015a0]
cmp eax, 1
jne 0x4a951e
cmp esi, ebx
jne 0x4a94ad
call edi
mov esi, eax
cmp esi, ebx
jne 0x4a94ad
xor eax, eax
jmp 0x4a9576
mov eax, esi
cmp word [esi], bx
je 0x4a94c2
add eax, ebp
cmp word [eax], bx
jne 0x4a94b4
add eax, ebp
cmp word [eax], bx
jne 0x4a94b4
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x4a9513
push ebp
call fcn.004a6c6a
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x4a9513
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x4a950f
push dword [esp + 0x10]
call fcn.0049de1d
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x4a9576
cmp eax, ebp
je 0x4a9526
cmp eax, ebx
jne 0x4a94a6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x4a94a6
cmp byte [esi], bl
je 0x4a9544
inc eax
cmp byte [eax], bl
jne 0x4a953a
inc eax
cmp byte [eax], bl
jne 0x4a953a
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.004a6c6a
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x4a9562
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4a94a6
push ebp
push esi
push edi
call fcn.0049e700
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4a9d13
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004a4fdc
and dword [ebp - 4], 0
cmp dword [0x5015cc], 0
mov ebx, eax
jne 0x4a9dc2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a9e73
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b6654
push edi
call esi
test eax, eax
je 0x4a9e73
push eax
call fcn.004a4f6d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5015cc], eax
call esi
push eax
call fcn.004a4f6d
mov dword [esp], 0x4b6630
push edi
mov dword [0x5015d0], eax
call esi
push eax
call fcn.004a4f6d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5015d4], eax
call esi
push eax
call fcn.004a4f6d
pop ecx
mov dword [0x5015dc], eax
test eax, eax
je 0x4a9dc2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004a4f6d
pop ecx
mov dword [0x5015d8], eax
mov eax, dword [0x5015d8]
cmp eax, ebx
je 0x4a9e1a
cmp dword [0x5015dc], ebx
je 0x4a9e1a
push eax
call fcn.004a4fe5
push dword [0x5015dc]
mov esi, eax
call fcn.004a4fe5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4a9e1a
test edi, edi
je 0x4a9e1a
call esi
test eax, eax
je 0x4a9e11
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a9e11
test byte [ebp - 0xc], 1
jne 0x4a9e1a
or dword [ebp + 0x10], 0x200000
jmp 0x4a9e53
mov eax, dword [0x5015d0]
cmp eax, ebx
je 0x4a9e53
push eax
call fcn.004a4fe5
pop ecx
test eax, eax
je 0x4a9e53
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4a9e53
mov eax, dword [0x5015d4]
cmp eax, ebx
je 0x4a9e53
push eax
call fcn.004a4fe5
pop ecx
test eax, eax
je 0x4a9e53
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5015cc]
call fcn.004a4fe5
pop ecx
test eax, eax
je 0x4a9e73
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a9e75
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ac25e
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.004a9665
mov dword [ebp - 0x18], eax
and eax, edx
add esp, 0x10
mov dword [ebp - 0x14], edx
cmp eax, 0xffffffff
je 0x4ac2e4
push 2
push ebx
push ebx
push dword [ebp + 8]
call fcn.004a9665
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
je 0x4ac2e4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
js 0x4ac379
jg 0x4ac2bd
cmp esi, ebx
jbe 0x4ac379
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ac2f0
call fcn.004a22b2
mov dword [eax], 0xc
call fcn.004a22b2
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.004ac412
pop ecx
pop ecx
mov dword [ebp - 8], eax
test edi, edi
jl 0x4ac310
jg 0x4ac30c
cmp esi, ebx
jb 0x4ac310
mov eax, ebx
jmp 0x4ac312
mov eax, esi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.004a70a0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4ac35c
cdq
sub esi, eax
sbb edi, edx
js 0x4ac333
jg 0x4ac302
test esi, esi
ja 0x4ac302
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004ac412
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x4ac3e2
call fcn.004a22c5
cmp dword [eax], 5
jne 0x4ac371
call fcn.004a22b2
mov dword [eax], 0xd
or esi, 0xffffffff
mov dword [ebp - 0xc], esi
jmp 0x4ac336
cmp edi, ebx
jg 0x4ac3ee
jl 0x4ac383
cmp esi, ebx
jae 0x4ac3ee
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a9665
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4ac2e4
push dword [ebp + 8]
call fcn.004a0ab3
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
mov dword [ebp - 0xc], edx
cmp eax, 0xffffffff
jne 0x4ac3ee
call fcn.004a22b2
mov dword [eax], 0xd
call fcn.004a22c5
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x4ac2e4
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.004a9665
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4ac2e4
xor eax, eax
jmp 0x4ac2eb
Function at 0x4ac688
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4c0390]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
or dword [ebp - 0x7c], 0xffffffff
push ebx
xor ebx, ebx
push esi
lea esi, [ebp - 0x74]
mov dword [ebp - 0x80], ebx
cmp eax, ebx
jne 0x4ac6e2
call fcn.004a22c5
mov dword [eax], ebx
call fcn.004a22b2
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.004a3d5d
add esp, 0x14
or eax, 0xffffffff
jmp 0x4ac794
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4ac777
lea eax, [ebp - 0x74]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
cmp edi, 0x104
jle 0x4ac735
lea ebx, [edi + 1]
push 1
push ebx
call fcn.004a6caa
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4ac775
mov dword [ebp - 0x80], 1
test edi, edi
je 0x4ac775
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x4ac777
mov al, byte [esi]
cmp al, 0x5c
je 0x4ac743
cmp al, 0x2f
jne 0x4ac748
cmp al, byte [esi + 1]
je 0x4ac770
mov byte [ebp - 0x78], 0x3d
movzx eax, byte [esi]
push eax
call fcn.004acad4
pop ecx
mov byte [ebp - 0x77], al
push esi
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 0x76], 0x3a
mov byte [ebp - 0x75], 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x4ac777
mov dword [ebp - 0x7c], ebx
jmp 0x4ac784
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a22d8
pop ecx
pop edi
cmp dword [ebp - 0x80], ebx
je 0x4ac791
push esi
call fcn.0049de1d
pop ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x94]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049e0c6
add ebp, 0x98
leave
ret
Function at 0x10029a64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10029a73
pop dword [ebp - 0x40]
mov eax, 0xea6200e
add eax, 0x15c7a65
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x7ee8259e
sub dword [ebp - 0x50], 0x3095e053
mov dword [ebp - 0x4c], 0x7937693b
sub dword [ebp - 0x4c], 0x47041cf6
mov dword [ebp - 0x48], 0x9adf6a39
add dword [ebp - 0x48], 0xb16cd9f5
mov dword [ebp - 0x44], 0x12a1994c
sub dword [ebp - 0x44], 0x12a1994c
lea eax, [ebp - 0x50]
push eax
mov eax, 0x41271f2f
sub eax, 0x31238dc7
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x696b06d9
sub dword [ebp - 0x50], 0xf4f89d83
mov dword [ebp - 0x4c], 0x8f3066a
sub dword [ebp - 0x4c], 0xc786a4f5
mov dword [ebp - 0x48], 0x426e0f6
sub dword [ebp - 0x48], 0xa0b7748a
mov dword [ebp - 0x44], 0x1dbdba1c
sub dword [ebp - 0x44], 0x1dbdba1c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3fadf
push 0
call eax
mov ecx, 0xa14709f3
add ecx, 0x5eb9576d
mov edi, eax
mov ebx, 0x31a43830
sub ebx, 0x219f0030
add ebx, dword [ebp - 0x40]
mov esi, 0xfe0a2daf
sub esi, 0x13ac321d
add dword [ebp - 0x18], edi
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 0x10], edx
mov dword [edi], edx
sub dword [ebp - 0x3c], ebx
add edi, 4
add ebx, 0xafb3c02c
add ebx, 0x504c3fd8
loop 0x10029b90
add eax, 0x17853
xor ebx, ebx
add ebx, eax
add eax, 0xfa6fdc85
sub eax, 0xfa6fdc80
mov ecx, sym.EXPSRV.dll_Ordinal_790
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10029dae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100436e0]
jne 0x10029db8
repz ret
jmp fcn.1002a2cf
Function at 0x4179b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4179c3
pop dword [ebp - 0x1c]
mov eax, 0x71308838
sub eax, 0x70ef0e75
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3d219
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x6eac3fa8
sub ecx, 0x6eabfa2a
xor edx, edx
add edx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x1c]
mov ebx, 0x23ad2d63
sub dword [ebp - 0x10], ecx
mov edi, dword [esi]
sub dword [ebp - 0x10], 0xfc532ca1
sub edi, ebx
sub dword [ebp - 0x10], esi
mov dword [edx], edi
xor dword [ebp - 4], 0x24fc0586
add edx, 0x66187036
add edx, 0x99e78fce
add esi, 0x30aa154f
add esi, 0xcf55eab5
loop 0x417a13
add eax, 0x6508529d
sub eax, 0x650749d2
mov ebx, eax
add eax, 0xd394f570
add eax, 0x2c6b0a95
mov ecx, 0x97e72829
sub ecx, 0x97a72829
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x41dc09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x41dc18
pop dword [ebp - 0x30]
mov eax, 0x41dc18
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x41f1c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4e76c187
add ecx, 0xb1899c9c
mov edi, eax
mov edx, 0x432e00
add edx, dword [ebp - 0x30]
mov esi, 0xe93b1620
xor dword [ebp - 0x1c], 0x59c457ce
mov ebx, dword [edx]
sub dword [ebp - 8], ebx
xor ebx, esi
xor dword [ebp - 0x10], 0x29ca846a
mov dword [edi], ebx
xor dword [ebp - 0xc], eax
add edi, 0xbf5e11f0
add edi, 0x40a1ee14
add edx, 0xa4cf14c1
sub edx, 0xa4cf14bd
loop 0x41dc61
add eax, 0x6db0f2f
add eax, 0xf9265c30
mov ebx, eax
add eax, 0xa17b1fc0
add eax, 0x5e84e045
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret