joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140e930
Capabilities:
Set environment variable

Disassembly:
push 0x45bc264
call fcn.01425be5
mov eax, dword [0x45bc268]
push 0x45bc264
mov dword [0x45bc26c], eax
call fcn.01425c01
add esp, 8
ret
push esi
push edi
call fcn.01403eb0
mov edi, dword [0x45bdb60]
test edi, edi
je 0x140ea16
mov esi, edi
mov edi, dword [edi + 0x40]
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x140e968
mov eax, dword [esi + 0x3c]
sub eax, 2
je 0x140e963
sub eax, 1
je 0x140e963
sub eax, 1
jne 0x140e968
mov eax, dword [ecx]
call dword [eax + 8]
push dword [esi + 0x30]
call fcn.014010d0
mov ecx, dword [esi + 0x2c]
add esp, 4
cmp ecx, 0x10
jb 0x140e9a7
mov eax, dword [esi + 0x18]
inc ecx
cmp ecx, 0x1000
jb 0x140e99d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x140eaad
mov eax, edx
push ecx
push eax
call fcn.01424ca8
add esp, 8
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0xf
mov byte [esi + 0x18], 0
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x140e9ec
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x140e9e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x140eaad
mov eax, edx
push ecx
push eax
call fcn.01424ca8
add esp, 8
push 0x44
push esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.01424ca8
add esp, 8
test edi, edi
jne 0x140e945
mov dword [0x45bdb60], edi
mov eax, dword [0x45bdb78]
test eax, eax
je 0x140ea37
push 0xac
push eax
call fcn.01424ca8
add esp, 8
mov dword [0x45bdb78], 0
mov eax, dword [0x45bdb7c]
test eax, eax
je 0x140ea58
push 0x218
push eax
call fcn.01424ca8
add esp, 8
mov dword [0x45bdb7c], 0
mov edi, dword [0x45bdb88]
mov esi, dword [0x45bdb84]
mov dword [0x45bcad4], 0
cmp esi, edi
je 0x140ea8b
push 0xc
push dword [esi]
call fcn.01424ca8
add esi, 4
add esp, 8
cmp esi, edi
jne 0x140ea72
mov esi, dword [0x45bdb84]
mov dword [0x45bdb88], esi
call fcn.0140e810
push 0x45bcb40
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
pop esi
jmp 0x14039c0
call fcn.01432587
int3
Function at 0x140ead0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x45bcb24]
test esi, esi
je 0x140ec14
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [eax]
cmp byte [esi + 4], 0
jne 0x140ec07
mov eax, dword [esi]
cmp eax, 1
jne 0x140eb29
call fcn.01401d80
push dword [esi + 0xc]
lea ebx, [esi + 0x18]
push ebx
call fcn.01401700
call fcn.01401e00
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x140ec03
mov eax, dword [ebx]
jmp 0x140ec01
cmp eax, 2
jne 0x140eb64
mov ebx, dword [esi + 0x28]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [esi + 8], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push ebx
call edi
test eax, eax
je 0x140ebf7
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
jmp 0x140ebf5
cmp eax, 3
jne 0x140eb98
mov ebx, dword [esi + 0x20]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [esi + 8], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push ebx
call edi
test eax, eax
je 0x140ebf7
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
jmp 0x140ebf5
cmp eax, 4
jne 0x140ec03
push 1
push dword [esi + 0x18]
call fcn.01405fb0
push dword [esi + 0x1c]
mov dword [esi + 8], eax
lea eax, [esi + 0x20]
push dword [esi + 0x18]
push eax
call fcn.01427290
mov ebx, dword [esi + 0x1c]
lea ecx, [ebp - 4]
mov eax, dword [esi + 0x18]
add esp, 0x14
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
push ecx
push 0x40
push ebx
push eax
call edi
test eax, eax
je 0x140ebf7
push ebx
lea eax, [esi + 0x28]
push eax
push dword [ebp - 8]
call fcn.01427290
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp - 8]
call edi
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x140ec03
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov byte [esi + 4], 1
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x140eaf0
pop edi
pop ebx
mov byte [0x45bcb39], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1412a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
je 0x1412a3a
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1412a3a
cmp dword [ebp - 8], 4
mov eax, dword [ebp - 0xc]
je 0x1412a3d
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x1412a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [0x45bdbd0], 0
cmp byte [ecx + 4], 0
mov dword [ebp - 4], 0x200
je 0x1412a94
lea eax, [ebp - 4]
push eax
push 0x45bdbd0
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1412a94
cmp dword [ebp - 8], 1
mov eax, 0x45bdbd0
je 0x1412a97
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x143438b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x14343ca
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x14343ca
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x14343ca
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x14343ca
cmp dword [ecx + 0x74], 0xe
jbe 0x14343ca
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x14380d7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4584678
push 0x4584670
push str.FlsAlloc
push 0x1f
call fcn.01437f9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x143810b
push dword [ebp + 8]
mov ecx, esi
call dword [0x44491cc]
call esi
jmp 0x1438111
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1438155
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4584688
push 0x4584680
push str.FlsGetValue
push 0x21
call fcn.01437f9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x143818c
push dword [ebp + 8]
mov ecx, esi
call dword [0x44491cc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1438194
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4584690
push 0x4584688
push str.FlsSetValue
push 0x22
call fcn.01437f9f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x14381ce
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x44491cc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x143b9ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.01424f70
mov eax, dword [0x45bb068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0143870a
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x143ba41
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x143bb9d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.01447dd0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x45bef30]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0143c9fc
mov ecx, dword [esi*4 + 0x45bef30]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x143bb96
cmp eax, dword [ecx + edi + 0x24]
jne 0x143bb96
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x143bb96
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0143c9fc
add esp, 0x14
test edx, edx
jl 0x143bb96
jg 0x143bb0c
test eax, eax
jb 0x143bb96
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x143bb96
jl 0x143bb26
cmp dword [ebp - 0x1008], eax
ja 0x143bb96
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x143bb44
test ebx, ebx
je 0x143bb7d
cmp ecx, edi
jae 0x143bb7d
mov al, byte [ecx]
cmp al, 0xd
jne 0x143bb5e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x143bb6a
cmp byte [ecx + 1], 0xa
jne 0x143bb6a
inc ecx
jmp 0x143bb6a
movzx eax, al
movsx eax, byte [eax + 0x45bb338]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x143bb44
cmp edx, ebx
jne 0x143bb44
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x143bb9b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01425239
leave
ret
Function at 0x143be94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x45bef30]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x143bed4
cmp byte [ebx], 0xa
jne 0x143bed4
or byte [edi + eax + 0x28], 4
jmp 0x143bed9
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x143bfd8
mov dl, byte [eax]
cmp dl, 0x1a
je 0x143bfbb
inc eax
cmp dl, 0xd
je 0x143bf05
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x143bf2b
cmp eax, ecx
jae 0x143bf39
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x143beed
jmp 0x143bfd8
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x143bfb6
cmp dword [ebp - 0x10], 0
je 0x143bfb6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x45bef30]
test byte [eax + edi + 0x28], 0x48
je 0x143bf90
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x143bf7b
mov byte [esi], dl
jmp 0x143bf8c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x45bef30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x143bfd8
cmp byte [ebp - 1], 0xa
jne 0x143bf9f
cmp esi, ebx
jne 0x143bf9f
mov byte [esi], 0xa
jmp 0x143bfd7
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0143ca1a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x143bfd8
mov byte [esi], 0xd
jmp 0x143bfd7
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x45bef30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x143bfd5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x143bfd8
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x143bfe1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x45bef30]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x143c027
cmp word [ebx], dx
jne 0x143c027
or byte [eax + edi + 0x28], 4
jmp 0x143c02c
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x143c18f
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x143c16f
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x143c06d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x143c0a3
cmp eax, edx
jae 0x143c0b1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x143c048
jmp 0x143c18f
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x143c16a
cmp dword [ebp - 0x18], 0
je 0x143c16a
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x45bef30]
test byte [eax + edi + 0x28], 0x48
je 0x143c140
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x143c104
mov word [esi], cx
jmp 0x143c13b
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x45bef30]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x45bef30]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x45bef30]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x143c18f
pop eax
cmp word [ebp - 4], ax
jne 0x143c150
cmp esi, ebx
jne 0x143c150
mov word [esi], ax
jmp 0x143c18c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0143ca1a
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x143c18f
push 0xd
pop eax
jmp 0x143c14b
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x45bef30]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x143c189
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x143c18f
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x143e7a0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x143e83d
push ebx
push esi
call fcn.0143e769
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0143e6fd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x143e7ea
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x143e83c
push edi
push eax
call fcn.0143962a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x143e80a
call fcn.01437cc0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x143e83b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0143e6fd
add esp, 0x20
test eax, eax
jne 0x143e829
push edi
call fcn.01437cc0
jmp 0x143e831
push ebx
call fcn.01437cc0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x14412ac
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.01438dd9
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x144131b
cmp esi, dword [ebp - 4]
je 0x1441316
cmp dword [ebp + 0xc], 0
je 0x1441316
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x14412f3
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.01440dfe
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x144131d
xor eax, eax
inc eax
jmp 0x144131d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1441382
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x45bb068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.01438dd9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.01438dd9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x14413f9
cmp word [ecx], dx
je 0x14413f9
mov eax, dword [0x4585234]
push edi
dec eax
push eax
push 0x4585120
call fcn.01441321
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x144146c
cmp word [eax], dx
je 0x144146c
mov eax, dword [edi]
test eax, eax
je 0x144141d
cmp word [eax], dx
je 0x144141d
lea eax, [ebp - 0x10]
push eax
call fcn.01440d04
jmp 0x1441426
lea eax, [ebp - 0x10]
push eax
call fcn.01440d9f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1441496
mov eax, dword [0x458511c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4584e10
call fcn.01441321
add esp, 0xc
test al, al
je 0x1441496
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1441461
cmp word [eax], di
je 0x1441461
lea eax, [ebp - 0x10]
push eax
call fcn.01440d04
pop ecx
jmp 0x1441498
lea eax, [ebp - 0x10]
push eax
call fcn.01440d9f
jmp 0x144145e
mov eax, dword [edi]
test eax, eax
je 0x1441483
cmp word [eax], dx
je 0x1441483
lea eax, [ebp - 0x10]
push eax
call fcn.01440cb9
pop ecx
jmp 0x1441496
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1441561
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.014411a6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1441561
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1441561
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1441561
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x14414ee
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.014382d4
test ebx, ebx
je 0x144155c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.014382d4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1441561
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1441561
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.014468d4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1441563
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01425239
leave
ret
Function at 0x1446e86
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.01446e02
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1446ff5
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1446ff5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1446faa
jg 0x1446ee2
test eax, eax
je 0x1446fa0
push 1
push 0x1000
call fcn.01437c63
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1446f05
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1446f97
push 0x8000
push ebx
call fcn.0143509c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1446f2e
jg 0x1446f29
cmp ecx, 0x1000
jb 0x1446f2e
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0143b3e8
add esp, 0x10
cmp eax, 0xffffffff
je 0x1446f73
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1446f29
jl 0x1446f5a
test ecx, ecx
jne 0x1446f1b
push dword [ebp - 0xc]
push ebx
call fcn.0143509c
push esi
call fcn.01437cc0
add esp, 0xc
xor ebx, ebx
jmp 0x1447003
cmp byte [edi + 0x24], 0
je 0x1446f8a
cmp dword [edi + 0x20], 5
jne 0x1446f8a
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1446f95
mov ebx, dword [edi + 0x18]
jmp 0x1446f97
xor ebx, ebx
push esi
call fcn.01437cc0
pop ecx
jmp 0x1447003
test ecx, ecx
jg 0x1446f6c
jl 0x1446faa
test eax, eax
jae 0x1446f6c
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0143ca1a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1446fca
cmp byte [edi + 0x1c], 0
je 0x1446f6c
jmp 0x1446ffb
push ebx
call fcn.0143f17c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1446f6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1447003
cmp byte [edi + 0x1c], 0
je 0x1447000
mov ebx, dword [edi + 0x18]
jmp 0x1447003
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0143ca1a
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44c323
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x46b578
call fcn.0044ca51
push 1
call fcn.0044c4de
pop ecx
test al, al
jne 0x44c1cc
push 7
call fcn.0044d2fd
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0044c4a9
mov byte [ebp - 0x24], al
mov eax, dword [0x484c10]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x44c1c5
test eax, eax
jne 0x44c236
mov dword [0x484c10], ecx
push 0x45151c
push 0x451504
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x44c219
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x44c31d
push 0x451500
push 0x451440
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x484c10], 2
jmp 0x44c23b
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0044c63b
pop ecx
call fcn.0044d2f1
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x44c26b
push esi
call fcn.0044c5ae
pop ecx
test al, al
je 0x44c26b
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0044d52c
call esi
call fcn.0044d2f7
mov esi, eax
cmp dword [esi], edi
je 0x44c289
push esi
call fcn.0044c5ae
pop ecx
test al, al
je 0x44c289
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0044d412
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0044d445
test al, al
jne 0x44c2c2
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x44c2cb
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0044c658
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x44c31d
call fcn.0044ca97
ret
call fcn.0044c032
jmp 0x44c1ad

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx