joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bdf0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.0041f3e0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov esi, eax
add esp, 8
test esi, esi
je 0x45bf72
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x45be72
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x45bee3
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x45bea0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x45bf15
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x4cab91
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x4cab92
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x45bef0
push dword [esp + 0x30]
call fcn.0041f3e0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x45bf40
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x4e8004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x45c050
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x45c076
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x45c0ae
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.0041f3e0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x45c105
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x45c114
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x45c125
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x45cd60
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x45cdac
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x45cd71
pop ebx
pop edi
pop esi
ret

Function at 0x4681f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00467e10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x468222
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4bd330]
call dword [ebp - 8]
jmp 0x46822c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x49b860
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00462e00
mov eax, dword [0x4e83c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4ea7c0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x49ba38
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x49b987
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x49b987
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x49b965
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x49b8e9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49b9f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x49ba58
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x49ba33
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x49ba58
jmp 0x49b8c2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004620f0
mov esp, ebp
pop ebp
ret
Function at 0x49ba70
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00462e00
mov eax, dword [0x4e83c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4ea7c0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x49bc5b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x49bba6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x49bba6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x49bb82
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x49baf9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49bc14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x49bc7b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x49bc56
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x49bc7b
jmp 0x49bad2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004620f0
mov esp, ebp
pop ebp
ret
Function at 0x4a1400
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004a0b70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a1434
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4bd330]
call dword [ebp - 8]
jmp 0x4a143a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4a1490
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004a0bb0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a14c4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4bd330]
call dword [ebp - 8]
jmp 0x4a14ce
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x4a14e0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004a0bd0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a1518
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x4bd330]
call dword [ebp - 8]
jmp 0x4a1526
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x4a15b0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004a0c50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a15f0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4bd330]
call dword [ebp - 8]
jmp 0x4a160e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004a1880
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a7150
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4e83c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00464490
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x104
ja 0x4a71b3
lea edx, [ebp - 0x210]
push edx
call fcn.004a7100
add esp, 4
jmp 0x4a7291
push 0x25
push str.minkernelcrtsucrt_srcdesktopcrtmiscdrive.cpp
push 2
push 2
mov eax, dword [ebp - 0x218]
add eax, 1
push eax
call fcn.0046cf80
add esp, 0x14
push eax
lea ecx, [ebp - 0x214]
call fcn.00468590
lea ecx, [ebp - 0x214]
call fcn.00468930
test eax, eax
jne 0x4a7213
call fcn.0047bb80
mov dword [eax], 0xc
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x214]
call fcn.0046a080
mov eax, dword [ebp - 0x21c]
jmp 0x4a7291
lea ecx, [ebp - 0x214]
call fcn.00468930
push eax
mov ecx, dword [ebp - 0x218]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4a7266
call fcn.0047bb80
mov dword [eax], 0xc
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x214]
call fcn.0046a080
mov eax, dword [ebp - 0x224]
jmp 0x4a7291
lea ecx, [ebp - 0x214]
call fcn.00468930
push eax
call fcn.004a7100
add esp, 4
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x214]
call fcn.0046a080
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004620f0
mov esp, ebp
pop ebp
ret
Function at 0x4acf80
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00468590
lea ecx, [ebp - 4]
call fcn.004acf50
movzx eax, al
test eax, eax
jne 0x4acfbd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x18]
jmp 0x4ad0e5
lea ecx, [ebp - 4]
call fcn.00468930
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004acf10
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.00468930
push eax
push 0
push 0
call fcn.004a58a0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4ad023
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x20]
jmp 0x4ad0e5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0046d140
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.004616b0
lea ecx, [ebp - 8]
call fcn.00461cc0
movzx edx, al
test edx, edx
jne 0x4ad06c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00461ca0
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x24]
jmp 0x4ad0e5
lea ecx, [ebp - 8]
call fcn.00461720
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.00468930
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.004a58a0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4ad0c7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00461ca0
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x34]
jmp 0x4ad0e5
lea ecx, [ebp - 8]
call fcn.0046a0a0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00461ca0
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x4ad0f0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00468590
lea ecx, [ebp - 4]
call fcn.004ace90
movzx eax, al
test eax, eax
jne 0x4ad12d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x14]
jmp 0x4ad1e7
lea ecx, [ebp - 4]
call fcn.00468930
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004acf10
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.0046d140
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00468590
lea ecx, [ebp - 8]
call fcn.00494c40
movzx ecx, al
test ecx, ecx
jne 0x4ad19d
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.0046a080
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x1c]
jmp 0x4ad1e7
lea ecx, [ebp - 4]
call fcn.00468930
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.00468930
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00464860
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.0046a0a0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.0046a080
lea ecx, [ebp - 4]
call fcn.004ace70
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x4b2d80
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4b2da7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047bad0
add esp, 4
or eax, 0xffffffff
jmp 0x4b2da9
xor eax, eax
pop ebp
ret

Function at 0x4b7670
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e83c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x1a
jbe 0x4b7706
call fcn.0047bb50
mov dword [eax], 0xf
xor eax, eax
je 0x4b76a0
mov dword [ebp - 0x14], 1
jmp 0x4b76a7
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x4b76d6
push str.__Invalid_Drive_Index___0_
push 0x4cbf28
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push 2
call fcn.00469780
add esp, 0x18
cmp eax, 1
jne 0x4b76d6
int3
cmp dword [ebp - 0x18], 0
jne 0x4b7706
call fcn.0047bb80
mov dword [eax], 0xd
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push str.is_valid_drive
push str.__Invalid_Drive_Index___0_
call fcn.00469ef0
add esp, 0x14
xor eax, eax
jmp 0x4b775f
cmp dword [ebp + 8], 0
jne 0x4b7713
mov eax, 1
jmp 0x4b775f
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x10]
mov word [ebp - 0xc], cx
mov edx, 0x3a
mov word [ebp - 0xa], dx
mov eax, 0x5c
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4b7756
cmp dword [ebp - 0x1c], 1
jne 0x4b775a
xor eax, eax
jmp 0x4b775f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004620f0
mov esp, ebp
pop ebp
ret

Function at 0x4b89b0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.00488f30
lea ecx, [ebp - 0x34]
call fcn.00488f30
call fcn.00489000
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00488f00
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b8a03
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.00488f80
lea ecx, [ebp - 0x4c]
call fcn.00488f80
mov eax, dword [ebp - 8]
jmp 0x4b8a78
call fcn.00489000
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00488f00
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b8a3e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.00488f80
lea ecx, [ebp - 0x4c]
call fcn.00488f80
mov eax, dword [ebp - 0x10]
jmp 0x4b8a78
lea ecx, [ebp - 0x34]
call fcn.00489190
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.00489190
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.00488f80
lea ecx, [ebp - 0x4c]
call fcn.00488f80
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret