joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aed4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x40af96
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407acc
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407c10
mov eax, dword [ebx]
call fcn.0040ad7c
test al, al
jne 0x40af71
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00407acc
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407c10
mov eax, dword [ebx]
call fcn.0040ad7c
test al, al
jne 0x40af71
mov eax, ebx
call fcn.00406f58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40af9d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406fb8
lea eax, [ebp - 4]
call fcn.00406f58
pop eax
jmp eax

Function at 0x40c878
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x41c658
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x41c691
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004070a4
jmp 0x41c69a
mov eax, ebx
mov edx, esi
call fcn.004072fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41c6a4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x41c6c8
movzx eax, word [esp]
jmp 0x41c6ca
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41daf8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41dc1f
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041d900
mov esi, eax
mov eax, dword [0x48a670]
cmp byte [eax], 0
je 0x41dbc5
mov eax, dword [0x48a4dc]
call fcn.004053dc
call fcn.00405110
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41dac8]
call fcn.00409abc
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41dc38
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x41dc01
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x48a4b0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48e62c]
call fcn.00409e54
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dc26
lea eax, [ebp - 4]
mov edx, dword [0x41dac8]
call fcn.00409be0
pop eax
jmp eax
Function at 0x41e8b4
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x41e8f7
mov eax, dword [ebp - 0x10c]
mov dword [0x48e8c8], eax
mov eax, 0x48e8cc
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.00407acc
mov eax, 0x48e8d0
call fcn.00406f58
xor eax, eax
mov dword [0x48e8d4], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x48e78c], 0xa
jl 0x41ea4d
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x41ea58
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x41ea4d
xor eax, eax
push ebp
push 0x41ea46
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x41eab4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x41e9a6
cmp dword [ebp - 8], 2
jle 0x41e9a6
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x41e979
adc edx, 0
mov eax, 0x48e8d0
call fcn.00407b38
lea eax, [ebp - 8]
push eax
mov eax, dword [0x48e8d0]
call fcn.00407a40
push eax
push 0
push 0
push 0x41eab4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x41ea00
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x41ead4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x41ea00
cmp dword [ebp - 8], 2
jle 0x41ea00
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x41e9d5
adc edx, 0
mov eax, 0x48e8d0
call fcn.00407b38
lea eax, [ebp - 8]
push eax
mov eax, dword [0x48e8d0]
call fcn.00407a40
push eax
push 0
push 0
push 0x41ead4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x48e8d4
push 0
push 0
push 0x41eae8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x41ea2d
xor eax, eax
mov dword [0x48e8d4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ea4d
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x487560], 1
mov esp, ebp
pop ebp
ret
Function at 0x41f3c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407428
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c858
mov edi, eax
cmp edi, 0x104
jbe 0x41f373
mov eax, edi
add eax, eax
call fcn.00404fbc
mov esi, eax
jmp 0x41f375
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040c858
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41f3ae
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41f398
mov eax, esp
cmp esi, eax
je 0x41f3bb
mov eax, esi
call fcn.00404fd8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41f3f4
cmp bl, 0
je 0x41f3f0
cmp bl, 0x41
jl 0x41f3eb
cmp bl, 0x5a
jg 0x41f3eb
or bl, 0x20
xor al, bl
inc esi
jmp 0x41f3cf
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41f334

Function at 0x41feb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41fed4
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x41feee
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x41fee9
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41fef3
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x41ff61
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x41ffaa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41ff1f
inc dword [ebp - 0xc]
jmp 0x41ff37
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x41ff37
cmp dword [ebp - 0xc], 0
jle 0x41ff37
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x41ff59
xor eax, eax
jmp 0x41ff55
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41ff54
mov eax, esi
jmp 0x41ffad
inc eax
cmp eax, ecx
jle 0x41ff41
inc esi
cmp esi, dword [ebp - 8]
jl 0x41ff0b
jmp 0x41ffaa
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x41ffaa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x41ff82
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x41ffa4
xor eax, eax
jmp 0x41ffa0
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x41ff9f
mov eax, esi
jmp 0x41ffad
inc eax
cmp eax, ecx
jle 0x41ff8c
inc esi
cmp esi, dword [ebp - 8]
jl 0x41ff6a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42011c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42013b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42014b
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42026d
test ebx, ebx
jl 0x42026d
test esi, esi
jle 0x42026d
mov eax, dword [ebp - 8]
call fcn.00407a40
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407a40
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42020a
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42026d
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x4201ef
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x4201be
inc dword [ebp - 0x14]
jmp 0x4201ce
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x4201ce
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x4201d9
or eax, 0xffffffff
jmp 0x4201ef
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x4201ec
inc eax
jmp 0x4201ef
or eax, 0xffffffff
test eax, eax
jl 0x4201f7
cmp esi, eax
jg 0x4201ac
cmp esi, eax
jg 0x420202
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x420270
inc edx
dec dword [ebp - 0x1c]
jne 0x4201a8
jmp 0x42026d
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42026d
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x420254
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x420233
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42023e
or eax, 0xffffffff
jmp 0x420254
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x420251
inc eax
jmp 0x420254
or eax, 0xffffffff
test eax, eax
jl 0x42025c
cmp esi, eax
jg 0x42021c
cmp esi, eax
jg 0x420267
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x420270
inc edx
dec dword [ebp - 0x1c]
jne 0x420218
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42f220
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x42f228
push ebx
push esi
mov ebx, edx
mov byte [ebp - 0xd], al
xor eax, eax
push ebp
push 0x42f446
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00432c80
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00434060
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00434170
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00434650
test eax, eax
jne 0x42f2a0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041770c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
lea eax, [ebp - 0xc]
call fcn.00407c10
jmp 0x42f37a
cmp dword [0x487780], 0
jne 0x42f331
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00434060
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.00432c80
xor ebx, ebx
inc ebx
push dword [ebp - 0xc]
push 0x42f464
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0041770c
push dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407c98
mov eax, dword [ebp - 8]
call fcn.00434410
test al, al
jne 0x42f2c8
mov eax, dword [ebp - 8]
call fcn.00434590
test al, al
jne 0x42f2c8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.00432c30
mov edx, dword [ebp - 0x28]
mov eax, 0x487780
call fcn.004072fc
mov dl, 1
mov eax, dword [0x487780]
call fcn.0042f1e0
mov eax, dword [0x487780]
call fcn.00433030
mov eax, dword [0x487780]
call fcn.00434590
test al, al
je 0x42f36a
push dword [0x487780]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041770c
push dword [ebp - 0x2c]
push 0x42f47c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407c98
jmp 0x42f37a
lea eax, [ebp - 0xc]
mov ecx, 0x42f490
mov edx, dword [ebp - 4]
call fcn.00407c10
xor ebx, ebx
inc ebx
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.0041770c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00407c10
mov eax, dword [ebp - 8]
call fcn.00434410
test al, al
jne 0x42f37c
mov eax, dword [ebp - 8]
call fcn.00434590
test al, al
jne 0x42f37c
push 1
mov eax, dword [ebp - 8]
call fcn.00407a40
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00407a40
mov esi, eax
push esi
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x42f3ec
push 4
push 0
push ebx
call sub.kernel32.dll_MoveFileExW
test eax, eax
jne 0x42f3e8
movzx edx, byte [ebp - 0xd]
mov eax, dword [ebp - 8]
call fcn.0042f1e0
mov bl, 1
jmp 0x42f3fc
push 4
push 0
push esi
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f44d
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00406fb8
lea eax, [ebp - 0x20]
call fcn.00406f58
lea eax, [ebp - 0x1c]
call fcn.00406f58
lea eax, [ebp - 0x18]
call fcn.00406f58
lea eax, [ebp - 0x14]
call fcn.00406f58
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406fb8
pop eax
jmp eax
Function at 0x4307f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
add esp, 0xffffffe8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
mov edi, dword [esp + 4]
test edi, edi
jle 0x4308f8
movzx eax, word [esi]
mov word [esp + 8], ax
movzx eax, word [esp + 8]
add eax, 0xffffffc6
sub ax, 7
jae 0x430824
mov al, 1
jmp 0x43083b
movzx eax, word [esi]
mov word [esp + 0xa], ax
movzx eax, word [esp + 0xa]
add eax, 0xffffffb9
sub ax, 0x1a
setb al
test al, al
je 0x430843
mov dl, 1
jmp 0x430882
movzx eax, word [esi + 2]
mov word [esp + 0xc], ax
movzx eax, word [esp + 0xc]
add eax, 0xffffffc6
sub ax, 7
jae 0x430861
mov byte [esp + 0x10], 1
jmp 0x43087d
movzx eax, word [esi + 2]
mov word [esp + 0xe], ax
movzx eax, word [esp + 0xe]
add eax, 0xffffffb9
sub ax, 0x1a
setb al
mov byte [esp + 0x10], al
movzx edx, byte [esp + 0x10]
test dl, dl
jne 0x4308f8
movzx eax, word [esi]
mov word [esp + 0x12], ax
movzx eax, word [esp + 0x12]
add eax, 0xffffffd0
sub ax, 0x37
jb 0x4308a3
mov byte [esp + 0x16], 1
jmp 0x4308c1
movzx eax, word [esi + 2]
mov word [esp + 0x14], ax
movzx eax, word [esp + 0x14]
add eax, 0xffffffd0
sub ax, 0x37
setb al
xor al, 1
mov byte [esp + 0x16], al
cmp byte [esp + 0x16], 0
jne 0x4308f8
movzx eax, byte [esi]
movzx eax, word [eax*2 + 0x487798]
shl eax, 4
movzx edx, byte [esi + 2]
movzx edx, word [edx*2 + 0x487798]
add al, dl
mov edx, dword [esp]
mov byte [edx], al
inc dword [esp]
add esi, 4
dec edi
test edi, edi
jg 0x43080a
mov eax, dword [esp + 4]
sub eax, edi
add esp, 0x18
pop edi
pop esi
ret
Function at 0x433280
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x433358
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43333b
xor eax, eax
push ebp
push 0x433334
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00432b10
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x433317
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, esi
call fcn.00436cd0
mov eax, dword [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00407d80
mov eax, dword [ebp - 0xc]
mov edx, 0x433378
call fcn.00407d48
jne 0x433311
mov edx, ebx
mov eax, esi
call fcn.004371f0
dec ebx
cmp ebx, 0xffffffff
jne 0x4332d7
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43333b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43335f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406fb8
pop eax
jmp eax
Function at 0x4338c0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 4], edx
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_PeekNamedPipe
test eax, eax
je 0x433a1d
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jbe 0x433a1d
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
xor ecx, ecx
call fcn.004078cc
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.004074e0
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
test eax, eax
je 0x433932
sub eax, 4
mov eax, dword [eax]
xor ecx, ecx
xchg edx, eax
call fcn.00405454
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 4], edx
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.004074e0
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ebx, eax
test ebx, ebx
je 0x433960
sub ebx, 4
mov ebx, dword [ebx]
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x433a1d
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jbe 0x433a10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp word [eax + 0x2a], 0
je 0x4339ae
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
movzx ecx, byte [ebp - 5]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
jmp 0x433a10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4339c0
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [edx - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, dword [ebp + 8]
add edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, 0x20
xor ecx, ecx
call fcn.004078cc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, 0x20
call fcn.004074e0
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
add eax, edx
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.004074e0
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 4]
pop edx
call fcn.00405160
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
jne 0x4338ce
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x434410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
call sub.kernel32.dll_GetTickCount64
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, ebx
call fcn.00407a40
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43443d
test al, 0x10
sete bl
jmp 0x43443f
xor ebx, ebx
lea eax, [ebp - 8]
call fcn.0042f030
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [0x487750]
mov edx, dword [0x487754]
cmp edx, dword [ebp - 0xc]
jne 0x434465
cmp eax, dword [ebp - 0x10]
jae 0x434479
jmp 0x434467
jge 0x434479
mov eax, dword [ebp - 0x10]
mov dword [0x487750], eax
mov eax, dword [ebp - 0xc]
mov dword [0x487754], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4344b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00407a40
mov edi, eax
push edi
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x434507
push edi
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x434507
test edi, 1
je 0x434507
and edi, 0xfffffffe
push edi
mov eax, esi
call fcn.00407a40
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x434510
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov bl, 1
mov eax, esi
call fcn.00407a40
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x43454d
test edi, 1
je 0x43454d
and edi, 0xfffffffe
push edi
mov eax, esi
call fcn.00407a40
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x43454d
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x434560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407a40
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x43457c
test al, 1
jne 0x434581
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret

Function at 0x434590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
call sub.kernel32.dll_GetTickCount64
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, ebx
call fcn.00407a40
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4345c1
test eax, 0x10
seta bl
jmp 0x4345c3
xor ebx, ebx
lea eax, [ebp - 8]
call fcn.0042f030
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [0x487758]
mov edx, dword [0x48775c]
cmp edx, dword [ebp - 0xc]
jne 0x4345e9
cmp eax, dword [ebp - 0x10]
jae 0x4345fd
jmp 0x4345eb
jge 0x4345fd
mov eax, dword [ebp - 0x10]
mov dword [0x487758], eax
mov eax, dword [ebp - 0xc]
mov dword [0x48775c], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret