joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427260
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov dword [esp + 8], edx
push ebx
push esi
mov ebx, ecx
push edi
test ebx, ebx
push ebp
je 0x42742d
cmp ebx, 0xffffffff
je 0x42742d
push 0x45af50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx]
cmp eax, 0x1c
jne 0x4273c2
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
shl esi, 5
add esi, dword [eax + 0x18]
cmp dword [esp + 0x28], 0
je 0x4272b1
mov eax, dword [esp + 0x28]
mov dword [eax], 0
test byte [ebx + 0x17], 0x80
jne 0x4272d8
mov ecx, 0xfffffffa
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov edx, dword [ebx + 0x10]
mov eax, dword [esi + 0x10]
sub eax, edx
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jae 0x4272ea
mov ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0xc]
add ecx, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
and eax, 0x7fff
xor eax, edx
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, ecx
cdq
and edx, 0x7fff
add eax, edx
sar eax, 0xf
cmp dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
jle 0x427387
mov ebp, 0x8000
sub ebp, dword [esp + 0x14]
cmp dword [esp + 0x10], ebp
jge 0x427333
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebx + 8]
call fcn.00427450
test eax, eax
je 0x4273a1
mov esi, dword [eax + 0xc]
mov edi, dword [esp + 0x18]
add esi, dword [esp + 0x14]
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
sub dword [esp + 0x10], ebp
inc dword [esp + 0x1c]
add dword [ebx + 0x10], ebp
add dword [esp + 0x18], ebp
mov dword [esp + 0x14], 0
cmp dword [esp + 0x28], 0
je 0x427380
mov eax, dword [esp + 0x28]
add dword [eax], ebp
cmp dword [esp + 0x10], 0
jg 0x427320
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov ecx, 0xfffffff8
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
cmp eax, 0xc
jne 0x42740c
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
mov ecx, dword [ebx + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
jne 0x4273f5
mov ecx, 0xfffffff8
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov ecx, 0xfffffffe
call fcn.00426570
push 0x45af50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov ecx, 0xfffffffe
call fcn.00426570
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
Function at 0x427b80
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433d40
push 0x42980c
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov eax, dword [edx + 8]
push edi
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x18], esp
mov ecx, dword [esi + 0x1c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x427bda
cmp eax, 3
jb 0x427bc4
cmp eax, 4
jbe 0x427c3a
mov ecx, 0xfffffff9
call fcn.00426570
mov dword [ebp - 0x1c], 0
jmp 0x427c7a
push 0
mov eax, dword [esi + 0x10]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x427c01
mov ecx, 0xfffffff9
call fcn.00426570
mov dword [ebp - 0x1c], 0
jmp 0x427c7a
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebx + 0xc]
push 0x8000
mov edx, dword [esi + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x427c31
mov ecx, 0xfffffff9
call fcn.00426570
mov dword [ebp - 0x1c], 0
jmp 0x427c7a
mov dword [ebp - 0x1c], 1
jmp 0x427c7a
mov dword [ebp - 4], 0
mov edi, dword [esi + 0x30]
add edi, ecx
mov esi, dword [ebx + 0xc]
mov ecx, 0x2000
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], 1
jmp 0x427c73
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4298f0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433e48
push 0x42980c
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x447a1c], eax
xor eax, eax
mov al, byte [0x447a1d]
mov dword [0x447a28], eax
mov eax, dword [0x447a1c]
shr dword [0x447a1c], 0x10
and eax, 0xff
mov dword [0x447a24], eax
shl eax, 8
add eax, dword [0x447a28]
mov dword [0x447a20], eax
call fcn.0042a710
test eax, eax
jne 0x429964
push 0x1c
call fcn.00429a90
add esp, 4
mov dword [ebp - 4], 0
call fcn.0042dd70
call fcn.0042dd60
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x45d160], eax
call fcn.0042d910
mov dword [0x446f44], eax
test eax, eax
je 0x429997
cmp dword [0x45d160], 0
jne 0x4299a1
push 0xffffffffffffffff
call fcn.0042d2a0
add esp, 4
call fcn.0042d690
call fcn.0042d5a0
call fcn.0042d270
mov esi, dword [0x45d160]
mov al, byte [esi]
cmp al, 0x22
je 0x4299c8
cmp al, 0x20
jbe 0x4299f5
inc esi
cmp byte [esi], 0x20
ja 0x4299c0
jmp 0x4299f5
inc esi
cmp byte [esi], 0x22
je 0x4299f4
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x4299ef
xor eax, eax
mov al, bl
push eax
call fcn.0042d540
add esp, 4
test eax, eax
je 0x4299e9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x4299d1
cmp byte [esi], 0x22
jne 0x4299f5
inc esi
cmp byte [esi], 0
je 0x429a05
cmp byte [esi], 0x20
ja 0x429a05
inc esi
cmp byte [esi], 0
jne 0x4299fa
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x429a29
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0042d2a0
jmp 0x429a6a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d2e0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x447a58], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x42d2fe
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x447a54], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x447a50], bl
jne 0x42d358
cmp dword [0x45d158], 0
je 0x42d346
mov edi, dword [0x45d154]
sub edi, 4
cmp edi, dword [0x45d158]
jb 0x42d346
mov eax, dword [edi]
test eax, eax
je 0x42d33b
call eax
sub edi, 4
cmp edi, dword [0x45d158]
jae 0x42d333
push 0x43c150
push 0x43c148
call fcn.0042d390
add esp, 8
push 0x43c158
push 0x43c154
call fcn.0042d390
add esp, 8
test ebx, ebx
jne 0x42d37f
mov dword [0x447a58], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x42d910
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x447af0], ebx
jne 0x42d95f
call esi
cmp eax, ebx
mov edi, eax
je 0x42d93d
mov dword [0x447af0], 1
jmp 0x42d95f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x42d955
mov dword [0x447af0], 2
jmp 0x42d95f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x447af0], 1
jne 0x42da0e
test edi, edi
jne 0x42d982
call esi
mov edi, eax
test edi, edi
jne 0x42d982
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x42d99c
add esi, 2
cmp word [esi], 0
jne 0x42d98a
add esi, 2
cmp word [esi], 0
jne 0x42d98a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x42d9fd
push ebp
call fcn.00428740
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x42d9fd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x42d9ec
push ebx
call fcn.00428670
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x447af0], 2
jne 0x42da92
test ebx, ebx
jne 0x42da31
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x42da31
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x42da46
inc ebp
cmp byte [ebp], 0
jne 0x42da38
inc ebp
cmp byte [ebp], 0
jne 0x42da38
sub ebp, ebx
inc ebp
push ebp
call fcn.00428740
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x42da6b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x42df90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x447d18
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x42dfb7
add eax, 8
inc ecx
cmp eax, 0x447da8
jb 0x42dfa8
cmp dword [ecx*8 + 0x447d18], edx
lea ebx, [ecx*8]
jne 0x42e17b
cmp dword [0x446f50], 1
je 0x42e137
cmp dword [0x446f50], 0
jne 0x42dfee
cmp dword [0x446f54], 1
je 0x42e137
cmp edx, 0xfc
je 0x42e17b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x42e02b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x42e06f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x446e84
push ebp
call fcn.00430680
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43427c
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x447d1c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.004305e0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x45d050], 0
je 0x42e14d
mov eax, dword [0x45d050]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x42e157
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x447d1c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x42f650
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x45d150], edx
push ebx
push esi
push edi
push ebp
jbe 0x42f857
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x45d050
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x42f857
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x42f6b9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x42f6ca
push 2
push 0
push edx
call fcn.0042f880
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x42f766
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x42f79f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x42f72d
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x42f71b
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x42f702
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42f795
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x42f6ed
jmp 0x42f79f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42f795
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x42f79f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x42f846
cmp dword [esp + 0x10], 0
je 0x42f7f8
cmp dword [esp + 0x10], 5
jne 0x42f7db
mov dword [0x447a10], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x447a14], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00431580
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x42f822
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x42f822
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x447a10], 0x1c
mov dword [0x447a14], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x447a10], 9
mov dword [0x447a14], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x432450
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
cmp dword [esp + 8], 0
push ebx
push esi
push edi
push ebp
je 0x43268e
mov edx, dword [esp + 0x18]
push 0x3d
push edx
call fcn.00432780
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x43268e
cmp ebp, dword [esp + 0x18]
je 0x43268e
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x447a38]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x447a3c], ecx
jne 0x4324ad
push ecx
call fcn.00432700
add esp, 4
mov dword [0x447a38], eax
cmp dword [0x447a38], 0
jne 0x43255d
cmp dword [esp + 0x1c], 0
je 0x4324e4
cmp dword [0x447a40], 0
je 0x4324e4
call fcn.00431f90
test eax, eax
je 0x43255d
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [esp + 0x10], 0
je 0x4324f5
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x447a38], 0
jne 0x432529
push 4
call fcn.00428740
add esp, 4
mov dword [0x447a38], eax
test eax, eax
jne 0x43251e
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x447a38]
mov dword [eax], 0
cmp dword [0x447a40], 0
jne 0x43255d
push 4
call fcn.00428740
add esp, 4
mov dword [0x447a40], eax
test eax, eax
jne 0x432552
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x447a40]
mov dword [eax], 0
mov esi, dword [0x447a38]
sub ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.004326a0
add esp, 8
mov edi, eax
test edi, edi
jl 0x4325c5
cmp dword [esi], 0
je 0x4325c5
cmp dword [esp + 0x10], 0
je 0x4325bc
lea ebx, [esi + edi*4]
mov eax, dword [ebx]
push eax
call fcn.00428670
add esp, 4
cmp dword [ebx], 0
je 0x4325a9
mov eax, dword [ebx + 4]
add ebx, 4
inc edi
mov dword [ebx - 4], eax
cmp dword [ebx], 0
jne 0x43259a
shl edi, 2
push edi
push esi
call fcn.004294c0
add esp, 8
test eax, eax
je 0x43260d
jmp 0x432608
mov edx, dword [esp + 0x18]
mov dword [esi + edi*4], edx
jmp 0x43260d
cmp dword [esp + 0x10], 0
jne 0x432684
test edi, edi
jge 0x4325d6
neg edi
lea eax, [edi*4 + 8]
push eax
push esi
call fcn.004294c0
add esp, 8
test eax, eax
jne 0x4325f8
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
lea ecx, [eax + edi*4]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov dword [0x447a38], eax
cmp dword [esp + 0x1c], 0
je 0x43267a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00428740
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x43267a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00428670
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401ae6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401b7a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401b35
cmp eax, 0x40
je 0x401b35
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401ad9
cmp eax, 0x40
je 0x401ad9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401ad9
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x1001b4e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003315b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100419ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x10035dc4
call fcn.1001f6c1
push 4
mov dword [ebp - 4], 0
call fcn.1001fffa
mov edi, eax
add esp, 4
test edi, edi
je 0x1001b560
call fcn.1001edd9
mov dword [edi], eax
call fcn.1001eb98
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1001eacd
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1001b556
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1001eaf5
jmp 0x1001b562
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret