joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad01aba
Capabilities:
Set console window title

Disassembly:
push ebp
xor ebp, ebp
cmp dword [esp + 8], ebp
je 0x4ad01acf
cmp dword [0x4ad2cac4], ebp
je 0x4ad09d27
pop ebp
ret 4
cmp dword [0x4ad2cabc], ebp
jne 0x4ad01acf
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20c
push ebp
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, ebp
je 0x4ad09de0
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov esi, eax
cmp esi, ebp
je 0x4ad09de0
push dword [esp + 0x14]
mov ebp, dword [sym.imp.msvcrt.dll_wcslen]
call ebp
pop ecx
mov ecx, dword [0x4ad30af8]
add ecx, eax
add ecx, esi
lea eax, [ecx + ecx + 0x14]
push eax
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
je 0x4ad138df
cmp byte [0x4ad30afc], 0
jne 0x4ad138e5
mov ebx, dword [sym.imp.msvcrt.dll_wcscat]
push 0x4ad0bc04
push esi
call ebx
push esi
call ebp
push dword [esp + 0x20]
mov dword [0x4ad30af8], eax
push esi
call ebx
add esp, 0x14
mov byte [0x4ad30afc], 1
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
jmp 0x4ad01acf
push ebx
jmp 0x4ad09dd5
mov eax, dword [0x4ad30af8]
push dword [esp + 0x14]
lea eax, [esi + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x4ad09dcd

Function at 0x4ad0210b
Capabilities:
Query environment variable

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 8], edi
je 0x4ad1094f
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
cmp esi, edi
je 0x4ad0218a
push edi
push dword [esp + 0x18]
call fcn.4ad01b82
mov ebx, eax
push 0x20
push ebx
call fcn.4ad01b0c
cmp eax, edi
jne 0x4ad10956
cmp ebx, edi
je 0x4ad02151
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov edi, eax
test esi, esi
je 0x4ad07bac
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebp, eax
test ebp, ebp
jbe 0x4ad0218a
cmp dword [0x4ad289e8], 0
jne 0x4ad0218a
push edi
push esi
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad07b98
lea esi, [esi + ebp*2 + 2]
jmp 0x4ad02151
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
ret 4
cmp word [esi + edi*2], 0x3d
jne 0x4ad02184
lea eax, [esi + edi*2 + 2]
jmp 0x4ad0218c
xor ebp, ebp
jmp 0x4ad02163
xor eax, eax
jmp 0x4ad0218f
mov word [eax], di
jmp 0x4ad02143
Function at 0x4ad03492
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
xor edi, edi
and eax, 3
cmp eax, 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0xc
ja 0x4ad0e963
test byte [ebp + 0xc], bl
jne 0x4ad0500f
cmp eax, edi
mov esi, 0x80000000
jne 0x4ad04ef5
mov dword [ebp - 8], esi
push 3
cmp dword [ebp + 0xc], 0x10a
pop eax
push edi
je 0x4ad0b6a4
push 0x80
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad1392b
push 8
push ebx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
test byte [ebp + 0xc], 8
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
jne 0x4ad0b6d6
push dword [ebp + 0x10]
call fcn.4ad03534
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x4ad0ba90
push dword [ebp + 8]
mov dword [ebp - 8], 0x40000000
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad04f13
mov dword [ebp + 0x10], ebx
push 2
jmp 0x4ad034d7
test byte [ebp + 0xc], 8
jne 0x4ad0e963
jmp 0x4ad034c5
mov edi, 0x80
push edi
push 3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
or eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad0e93f
xor edi, edi
jmp 0x4ad0350a
push eax
call fcn.4ad01eec
test eax, eax
jne 0x4ad03522
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x4ad03522
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call esi
cmp eax, 0xffffffff
je 0x4ad138ff
push edi
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad1394e
cmp word [ebp - 0xc], 0x1a
jne 0x4ad03522
jmp 0x4ad13960
push 0
push edi
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad1392b
jmp 0x4ad0b6cf
or eax, 0xffffffff
jmp 0x4ad0352d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov dword [0x4ad28a04], eax
je 0x4ad0b715
cmp dword [ebp + 0x10], 0xffffffff
je 0x4ad0e963
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__close]
pop ecx
jmp 0x4ad0e963
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6e
mov dword [0x4ad28a04], eax
jne 0x4ad0e963
mov dword [0x4ad28a04], 2
jmp 0x4ad0e963
push 2
lea eax, [ebp - 4]
push eax
push edi
push ebx
mov dword [ebp - 4], edi
call esi
jmp 0x4ad0b72f
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
call esi
jmp 0x4ad03522
Function at 0x4ad036ee
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov edi, 0x4ad260a0
mov esi, edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad05937
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x4ad05937
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jle 0x4ad0376c
nop
nop
cmp dword [ebp - 4], 3
jl 0x4ad03754
mov al, byte [esi]
cmp al, 0xa
je 0x4ad0593e
cmp al, 0xd
je 0x4ad03790
movzx eax, byte [esi]
cmp byte [eax + 0x4ad31720], bl
jne 0x4ad0fe6a
dec dword [ebp - 4]
inc esi
cmp dword [ebp - 4], ebx
jg 0x4ad03740
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
push edi
push 1
push dword [0x4ad289ec]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp byte [esi + 1], 0xa
jne 0x4ad03754
mov eax, dword [ebp - 0xc]
mov byte [esi + 2], bl
sub esi, edi
inc esi
inc esi
push ebx
push ebx
mov dword [ebp - 8], esi
add esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4ad0376c
xor eax, eax
jmp 0x4ad03789
cmp byte [esi + 1], 0xd
je 0x4ad03796
jmp 0x4ad03750
cmp dword [ebp - 4], 1
je 0x4ad0fe7b
sub dword [ebp - 4], 2
inc esi
inc esi
jmp 0x4ad03767
push ebx
lea eax, [ebp - 4]
push eax
push 1
inc esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad0fe9e
cmp dword [ebp - 4], ebx
je 0x4ad0fe9e
inc dword [ebp - 8]
jmp 0x4ad0376c
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x4ad05937
Function at 0x4ad05043
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
xor ebx, ebx
cmp byte [0x4ad30c3c], bl
pop ecx
mov dword [ebp + 8], eax
jne 0x4ad133b1
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov edi, 0x4ad260a0
mov esi, 0x2000
cmp dword [ebp + 0x10], esi
ja 0x4ad133c5
cmp dword [ebp + 0x10], ebx
je 0x4ad0971e
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [0x4ad289ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
push ebx
dec esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad09726
cmp dword [ebx], esi
jne 0x4ad09726
mov eax, dword [ebp - 8]
mov dword [ebx], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov ebx, dword [ebp + 0x14]
jmp 0x4ad050c7
xor eax, eax
jmp 0x4ad050cf
push ebx
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad050d0
push ebx
push ebx
push esi
push edi
push 0x1000
push dword [ebp + 0xc]
push ebx
push dword [0x4ad289ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [ebp + 0xc], esi
sub dword [ebp + 0x10], esi
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad09726
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
jne 0x4ad09726
jmp 0x4ad0507c
Function at 0x4ad05314
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.4ad0171e
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x414]
push ecx
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
test esi, esi
je 0x4ad053a1
push 4
lea eax, [ebp - 0x414]
push 0x4ad0ba98
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4ad13ce3
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ad13d3e
cmp word [eax], 0
je 0x4ad13d3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x664]
push eax
push 0x37
lea eax, [ebp - 0x414]
push eax
call fcn.4ad017bc
push dword [ebp - 4]
movzx esi, al
call fcn.4ad01c46
test esi, esi
je 0x4ad053cd
mov eax, esi
pop edi
pop esi
leave
ret 4
cmp word [ebp - 0x412], 0x5c
je 0x4ad053f4
cmp word [ebp - 0x412], 0x3a
jne 0x4ad053a1
cmp word [ebp - 0x410], 0x5c
jne 0x4ad053a1
cmp word [ebp - 0x40e], si
jne 0x4ad053a1
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad053a1
jmp 0x4ad13d36
lea eax, [ebp - 0x40c]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x40c]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 8], eax
je 0x4ad13d1f
cmp eax, edi
jbe 0x4ad13d1f
mov si, word [eax]
and word [eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], si
jmp 0x4ad13d28
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, ecx
inc eax
neg eax
sbb eax, eax
and eax, ecx
jmp 0x4ad053a3
xor esi, esi
inc esi
jmp 0x4ad053a1
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x4ad053a1

Function at 0x4ad0559a
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ebp + 8]
and word [ebp - 2], 0
push ebx
add eax, 0x40
push esi
mov word [ebp - 6], ax
push edi
lea eax, [ebp - 8]
push eax
mov word [ebp - 8], 0x3d
mov word [ebp - 4], 0x3a
call fcn.4ad0133f
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
test edi, edi
je 0x4ad13aa2
push edi
call esi
test al, al
je 0x4ad13a9b
push 0
push 0x4ad31400
call fcn.4ad03be2
pop edi
pop esi
pop ebx
leave
ret 4
push 1
call ebx
mov dword [ebp + 8], eax
mov ax, word [ebp - 6]
and word [ebp - 0x20a], 0
mov word [ebp - 0x210], ax
mov ax, word [ebp - 4]
mov word [ebp - 0x20e], ax
mov ax, word [0x4ad30b84]
mov word [ebp - 0x20c], ax
push 0x4ad280d0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push eax
call fcn.4ad01fd9
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x4ad13afe
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad0b54d
pop ecx
pop ecx
test edi, edi
je 0x4ad055eb
push dword [ebp + 8]
call ebx
jmp 0x4ad055eb
Function at 0x4ad05dba
Capabilities:
Manipulate console buffer
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
je 0x4ad0ff0a
pop ebp
jmp fcn.4ad036ee
pop ebp
jmp fcn.4ad0e9f0
Function at 0x4ad084d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
push 0x20
call fcn.4ad01566
mov esi, eax
mov eax, dword [ebp + 8]
push esi
mov dword [esi], eax
call fcn.4ad07cdc
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
mov edi, dword [esi + 8]
push 0x208
mov dword [ebp - 4], eax
call fcn.4ad01566
push 0
push eax
mov dword [0x4ad30ae8], eax
call fcn.4ad03be2
push 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01d5f
test eax, eax
jne 0x4ad085de
mov ax, word [0x4ad30b84]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01b0c
and word [eax + 2], 0
lea eax, [ebp - 0x20c]
push eax
push 0x4ad31400
call dword [sym.imp.msvcrt.dll_wcscpy]
test edi, edi
pop ecx
pop ecx
je 0x4ad085c5
mov ax, word [edi]
cmp ax, 0x3a
je 0x4ad085c5
cmp ax, word [0x4ad30b84]
jne 0x4ad08593
cmp edi, ebx
je 0x4ad085da
push edi
push ebx
call fcn.4ad08750
mov ax, word [eax]
cmp ax, 0x3a
je 0x4ad085da
cmp ax, word [0x4ad30b84]
je 0x4ad085da
mov ax, word [edi]
and word [edi], 0
push ebx
mov word [ebp + 8], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad13567
and dword [0x4ad28a04], 0
mov ax, word [ebp + 8]
mov word [edi], ax
cmp dword [0x4ad28a04], 0
jne 0x4ad085de
push esi
call fcn.4ad07cdc
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
inc edi
inc edi
jmp 0x4ad08593
xor eax, eax
inc eax
jmp 0x4ad085d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad28a04], eax
jmp 0x4ad085b5

Function at 0x4ad08602
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [0x4ad28a04], esi
call fcn.4ad0844f
test al, al
je 0x4ad08695
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push 0x4ad0b9f4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push 0x106
lea eax, [ebp - 0x624]
push eax
push esi
lea eax, [ebp + 8]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad14939
lea eax, [ebp - 0x624]
push 0x4ad0babc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad14928
xor al, al
pop esi
leave
ret 4
cmp dword [ebp + 8], 0xc
jne 0x4ad08695
mov al, 1
jmp 0x4ad08697
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x90
mov dword [0x4ad28a04], eax
jne 0x4ad08695
mov dword [0x4ad28a04], esi
jmp 0x4ad08695
Function at 0x4ad092c0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push dword [ebp + 8]
call fcn.4ad08824
cmp dword [ebp + 0xc], 0
je 0x4ad092e9
push dword [ebp + 0xc]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x224]
push eax
call fcn.4ad093c5
test eax, eax
jne 0x4ad14b10
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 6
push dword [ebp + 8]
call fcn.4ad08838
lea eax, [ebp - 0x224]
push eax
push 0xe
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
call fcn.4ad088f3
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0x14]
push 0x4ad0bcb8
call fcn.4ad09368
push eax
push 2
push 0x2379
push dword [ebp + 8]
call fcn.4ad08d72
add esp, 0x14
leave
ret 0x10
lea eax, [ebp - 0x224]
push 0x4ad0b9f4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
jmp 0x4ad092fd

Function at 0x4ad095fd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
call fcn.4ad0844f
test al, al
je 0x4ad14a5e
push edi
lea eax, [ebp - 0x214]
push 0x4ad0b9f4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad14a65
cmp word [ebp - 0x214], 0x5c
je 0x4ad14a8e
mov word [ebp - 0x212], di
cmp word [ebp - 0x420], di
jne 0x4ad14aa2
lea eax, [ebp - 0x214]
push eax
push 1
push 0x235e
push dword [ebp + 8]
call fcn.4ad08d72
add esp, 0x10
cmp eax, edi
jne 0x4ad096dd
mov eax, dword [ebp - 8]
mov ecx, eax
and ecx, 0xffff
push ecx
shr eax, 0x10
push eax
push str._04X__04X
lea eax, [ebp - 0x620]
push 0x100
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
lea eax, [ebp - 0x620]
push eax
push 1
push 0x235b
push dword [ebp + 8]
call fcn.4ad08d72
add esp, 0x24
pop edi
pop esi
leave
ret 8
xor eax, eax
jmp 0x4ad096de
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x90
jne 0x4ad14a7b
xor eax, eax
jmp 0x4ad096dd
push edi
call esi
push eax
call fcn.4ad0b54d
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4ad096dd
lea eax, [ebp - 0x214]
push eax
call fcn.4ad01d2c
mov word [eax], di
jmp 0x4ad09673
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x214]
push eax
push 2
push 0x235f
push dword [ebp + 8]
call fcn.4ad08d72
add esp, 0x14
jmp 0x4ad09699
Function at 0x4ad09f58
Capabilities:
Terminate process

Disassembly:
push 0
call fcn.4ad09f1e
test eax, eax
je fcn.4ad09f58
push dword [esp + 4]
call dword [sym.imp.msvcrt.dll_exit]
call fcn.4ad01e68
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [0x4ad289ec], eax
push 0x4ad31620
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push ebx
call fcn.4ad01e54
cmp dword [0x4ad2cabc], ebx
je 0x4ad09f9f
push dword [ebp - 0x34]
call fcn.4ad09f58
mov dword [0x4ad30b68], ebx
jmp 0x4ad0eb05
push dword [ebp - 4]
push 0x4ad1c161
push 2
push 0x4ad35b00
call sub.msvcrt.dll__setjmp3
add esp, 0x10
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x34], eax
cmp eax, ebx
jne 0x4ad12772
cmp dword [ebp - 0x20], 2
je 0x4ad12786
push ebx
call fcn.4ad01eec
mov esi, eax
neg esi
sbb esi, esi
add esi, 3
mov dword [ebp - 0x48], esi
cmp esi, 3
je 0x4ad127a8
mov byte [0x4ad2caa0], bl
call fcn.4ad02e2d
push ebx
push ebx
push esi
call fcn.4ad02aa0
mov edi, eax
mov dword [ebp - 0x40], edi
cmp edi, 1
je 0x4ad0eb4f
cmp edi, 0xffffffff
je 0x4ad127bb
call fcn.4ad02e2d
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [0x4ad289ec], eax
push 0x4ad31620
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push ebx
call fcn.4ad01e54
push edi
push ebx
call fcn.4ad01382
call fcn.4ad01e68
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov dword [0x4ad289ec], eax
push 0x4ad31620
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push ebx
call fcn.4ad01e54
jmp 0x4ad0eb4f
cmp eax, 2
jne 0x4ad0eb2a
push ebx
call fcn.4ad09f58
jmp 0x4ad0eb2a
push ebx
push 0x2729
call fcn.4ad0d276
pop ecx
pop ecx
push ebx
call fcn.4ad15bfa
push 0xff
call fcn.4ad09f58
jmp 0x4ad0eb34
push 0x8000
push ebx
call dword [sym.imp.msvcrt.dll__setmode]
pop ecx
pop ecx
jmp 0x4ad0eb4f
push ebx
call fcn.4ad09f58
jmp 0x4ad0eb4f

Function at 0x4ad0a558
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad0bd88
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ad12194
pop esi
leave
ret 4
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad15b48
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ad0a587
Function at 0x4ad0a596
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x4ad0bdf0
call fcn.4ad01ad3
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4ad0a6a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad0a6a9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x4ad15844
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad0a6a9
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4ad2ca50], 0xffffffff
or dword [0x4ad2ca4c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x4ad359f8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x4ad35a08]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4ad2ca54], eax
call fcn.4ad0a6b1
cmp dword [0x4ad359fc], edi
je 0x4ad15869
call fcn.4ad0a6f2
push 0x4ad0bdec
push 0x4ad0bde8
call sub.msvcrt.dll__initterm
mov eax, dword [0x4ad35a04]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x4ad35a00]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x4ad0bde4
push 0x4ad0bde0
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.4ad09c30
jmp 0x4ad1587a
mov dword [ebp - 0x1c], edi
jmp 0x4ad0a5ee
cmp eax, 0x20b
jne 0x4ad0a6a9
cmp dword [ecx + 0x84], 0xe
jbe 0x4ad0a6a9
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4ad0a5e8
push fcn.4ad0a6b1
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
jmp 0x4ad0a641
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x4ad1588e
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x4ad158c3
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.4ad01371
ret
Function at 0x4ad0b5d4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x4ad10915
push esi
push edi
push dword [ebp + 8]
call fcn.4ad01b82
mov esi, eax
push 0x20
push esi
mov dword [ebp + 8], esi
call fcn.4ad01b0c
cmp eax, edi
je 0x4ad0b60c
mov word [eax], di
cmp esi, edi
je 0x4ad0b695
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
cmp ebx, edi
je 0x4ad0b69a
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jbe 0x4ad0b674
cmp dword [0x4ad289e8], edi
jne 0x4ad0b69f
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x4ad0b66b
push dword [ebp + 8]
lea esi, [ebx + eax*2]
mov di, word [esi]
and word [esi], 0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov word [esi], di
je 0x4ad10939
xor edi, edi
mov eax, dword [ebp - 4]
lea ebx, [ebx + eax*2 + 2]
jmp 0x4ad0b626
cmp dword [ebp - 8], edi
je 0x4ad0b68b
push dword [ebp + 8]
push 1
push 0x23a9
call fcn.4ad0b54d
add esp, 0xc
mov eax, dword [ebp - 8]
pop esi
pop edi
pop ebx
leave
ret 4
mov dword [ebp - 0xc], edi
jmp 0x4ad0b61f
mov dword [ebp - 4], edi
jmp 0x4ad0b635
xor eax, eax
inc eax
jmp 0x4ad0b68e
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0x4ad1c2e8
add eax, 0x40
push str._nCMD_Internal_Error__s_n
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
xor eax, eax
add esp, 0xc
inc eax
jmp 0x4ad0b68f
push ebx
push str._s_r_n
call fcn.4ad03e14
and dword [ebp - 8], 0
pop ecx
pop ecx
jmp 0x4ad0b669