joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f50
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
call fcn.0040d5d0
test ax, ax
jne 0x401f98
mov eax, dword [0x439a54]
xor ebp, ebp
test eax, eax
jne 0x401fa9
mov esi, 0x439a70
cmp byte [esi], 0
je 0x401fb0
mov ebx, 1
mov eax, esi
mov edx, ebx
call fcn.004020a0
test al, al
jne 0x401fad
mov edi, esi
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
add esi, ecx
jmp 0x401f70
movsx ecx, ax
and ch, 0xbf
push ecx
push 0x404033
jmp fcn.00403f30
mov esi, eax
jmp 0x401f70
inc ebp
jmp 0x401f87
test ebp, ebp
je 0x401fbb
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
call fcn.0040d780
push 0x403fdb
jmp fcn.00403f30

Function at 0x4020a0
Capabilities:
Terminate process

Disassembly:
push ecx
sub esp, 4
mov ecx, eax
mov byte [esp], dl
call fcn.0040d630
mov edx, eax
test ax, ax
je 0x4020f7
cmp byte [esp], 0
je 0x4020c1
cmp ax, 0x4009
je 0x4020f0
test bl, bl
je 0x4020d9
movsx eax, dx
call fcn.00402100
push eax
push ecx
push 0x404066
jmp fcn.00403f30
movsx eax, dx
call fcn.00402100
push eax
push ecx
push 0x404066
call fcn.00403f10
add esp, 0xc
xor al, al
add esp, 4
pop ecx
ret
mov al, 1
add esp, 4
pop ecx
ret

Function at 0x403980
Capabilities:
Terminate process

Disassembly:
call fcn.0040fc50
test ax, ax
jne 0x40398b
ret
push 0x404575
jmp fcn.00403f30

Function at 0x4039d0
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
push esi
sub esp, 0x100
mov esi, eax
mov eax, dword [0x43b110]
cmp word [eax + 0x87], 0
jne 0x4039f5
push 0x40463d
jmp fcn.00403f30
mov eax, dword [0x43b110]
mov ax, word [eax + 0x87]
mov ebx, 0x100
movzx ecx, ax
mov edx, esp
mov eax, ecx
movzx esi, si
call fcn.004101e0
mov eax, dword [0x43b110]
xor ebx, ebx
xor edx, edx
mov word [eax + 0x87], 0
mov eax, ecx
and si, 0xbfff
call fcn.0040fca0
lea eax, [esi - 5]
cmp eax, 7
ja case.default.0x403a3b
jmp dword [eax*4 + 0x4039ac]
push ecx
push 0x404620
call fcn.00403f10
add esp, 8
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, esp
push eax
push 0x4045fe
call fcn.00403f10
add esp, 8
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, esp
push eax
push 0x4045d9
call fcn.00403f10
add esp, 8
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
push 0x403705
push 0x403f80
call fcn.00403f10
add esp, 8
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
push 0x4045c8
call fcn.00403f10
add esp, 4
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
push 0x4045b7
call fcn.00403f10
add esp, 4
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
push 0x4045a6
call fcn.00403f10
add esp, 4
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret
push 0x404159
call fcn.00403f10
add esp, 4
add esp, 0x100
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x403b60
Capabilities:
Terminate process

Disassembly:
push ecx
push edx
mov edx, eax
mov eax, edx
call fcn.00431e20
mov ecx, eax
test eax, eax
je 0x403b7a
test ecx, ecx
je 0x403b89
mov eax, ecx
pop edx
pop ecx
ret
mov eax, edx
call fcn.0040d7e0
cmp ax, 1
je 0x403b71
jmp 0x403b64
push 0x404159
jmp fcn.00403f30
Function at 0x403ba0
Capabilities:
Terminate process

Disassembly:
push ecx
push edx
mov edx, eax
mov eax, edx
call fcn.00431e20
mov ecx, eax
test eax, eax
je 0x403bba
test ecx, ecx
je 0x403b89
mov eax, ecx
pop edx
pop ecx
ret
mov eax, edx
call fcn.0040d7e0
cmp ax, 1
je 0x403bb1
jmp 0x403ba4

Function at 0x403bd0
Capabilities:
Terminate process

Disassembly:
push ecx
push edx
mov edx, eax
mov eax, edx
call fcn.00431e20
mov ecx, eax
test eax, eax
je 0x403bea
test ecx, ecx
je 0x403b89
mov eax, ecx
pop edx
pop ecx
ret
mov eax, edx
call fcn.0040d7e0
cmp ax, 1
je 0x403be1
jmp 0x403bd4

Function at 0x403c70
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
mov ebx, eax
mov ecx, edx
mov edx, ecx
mov eax, ebx
call fcn.00432010
mov edx, eax
test eax, eax
je 0x403c8e
test edx, edx
je 0x403c9d
mov eax, edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.0040d7e0
cmp ax, 1
je 0x403c85
jmp 0x403c76
push 0x404167
jmp fcn.00403f30

Function at 0x403cb0
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
mov ebx, eax
mov ecx, edx
mov edx, ecx
mov eax, ebx
call fcn.00432010
mov edx, eax
test eax, eax
je 0x403cce
test edx, edx
je 0x403c9d
mov eax, edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.0040d7e0
cmp ax, 1
je 0x403cc5
jmp 0x403cb6

Function at 0x403d50
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
mov ebx, eax
mov eax, ebx
call fcn.00431e20
mov ecx, eax
test eax, eax
je 0x403d79
test ecx, ecx
je 0x403b89
mov eax, ecx
xor edx, edx
call fcn.00432090
mov eax, ecx
pop edx
pop ecx
pop ebx
ret
mov eax, ebx
call fcn.0040d7e0
cmp ax, 1
je 0x403d62
jmp 0x403d55
Function at 0x40cc40
Capabilities:
Terminate process

Disassembly:
push edx
sub esp, 0x100
call fcn.00403b50
mov byte [0x43b544], 0
call fcn.00408cc0
mov eax, 0x40cc10
call fcn.00432ec0
test eax, eax
je 0x40cc6b
call fcn.0040cce0
mov eax, esp
call fcn.00433050
mov eax, esp
call fcn.0040cce0
mov dl, al
mov eax, 0x40cc1a
call fcn.00413520
mov byte [0x439a50], 1
call fcn.00403980
call fcn.00401f50
test dl, dl
jne 0x40cca2
add esp, 0x100
pop edx
ret
call fcn.00403490
test al, al
je 0x40ccb0
call fcn.00405550
xor eax, eax
jmp 0x4320d3

Function at 0x40cce0
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0xc
mov dword [esp], eax
mov byte [esp + 8], 0
mov eax, dword [esp]
call fcn.0040ceb0
mov dword [esp], eax
mov edx, eax
cmp byte [eax], 0
je 0x40ce9c
mov bl, byte [eax]
cmp bl, 0x2d
je 0x40cd17
cmp bl, 0x2f
jne 0x40cdae
mov eax, esp
inc dword [esp]
call fcn.0040cf10
mov ebx, eax
cmp ebx, 2
jne 0x40ce06
xor edx, edx
cmp dword [0x439a38], 0
je 0x40cd52
mov ebx, dword [edx + 0x439a38]
push ebx
add edx, 4
call fcn.00403f10
add esp, 4
cmp dword [edx + 0x439a38], 0
jne 0x40cd37
xor eax, eax
jmp 0x4320d3
mov eax, dword [esp]
call fcn.0040ceb0
mov dword [esp], eax
cmp byte [eax], 0x3d
jne 0x40cd72
inc eax
call fcn.0040ceb0
mov dword [esp], eax
mov esi, dword [esp]
mov eax, esi
call fcn.0040ced0
mov dword [esp], eax
cmp byte [eax], 0
jne 0x40ce33
mov ebp, dword [0x439a54]
test ebp, ebp
je 0x40ccf1
mov eax, ebp
call fcn.00403c60
xor eax, eax
mov dword [0x439a54], eax
mov dword [0x439a58], eax
jmp 0x40ccf1
cmp bl, 0x3f
je 0x40cd2c
mov byte [esp + 4], 0
mov esi, eax
call fcn.0040cef0
mov dword [esp], eax
sub eax, edx
xor ebx, ebx
mov edx, eax
cmp eax, 0x103
jbe 0x40cdd8
mov edx, 0x103
mov edi, 0x43b544
mov ecx, edx
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [edx + 0x43b544], 0
cmp byte [esp + 4], 0
jne 0x40cd23
jmp 0x40ccf1
cmp ebx, 1
je 0x40cd59
test ebx, ebx
jne 0x40ccf1
mov eax, dword [esp]
dec eax
push eax
push 0x4044e7
call fcn.00403f10
add esp, 8
push 0x4041a9
jmp fcn.00403f30
sub eax, esi
je 0x40cd88
mov ebx, dword [0x439a58]
mov ebp, eax
add eax, ebx
inc eax
mov dword [0x439a58], eax
test ebx, ebx
jne 0x40ce99
lea edi, [eax + 1]
mov dword [0x439a58], edi
mov edx, dword [0x439a58]
mov eax, dword [0x439a54]
call fcn.00403c70
mov ecx, ebp
mov dword [0x439a54], eax
lea edi, [eax + ebx]
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, ebp
mov eax, dword [0x439a54]
mov edx, ebx
mov byte [edx + eax], 0
mov byte [ebx + eax + 1], 0
jmp 0x40ccf1
dec ebx
jmp 0x40ce58
mov al, byte [esp + 8]
add esp, 0xc
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4142f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ecx
push esi
sub esp, 8
mov esi, eax
mov ecx, edx
lea ebx, [esp + 4]
call fcn.0041f9d0
test al, al
je 0x41431d
cmp byte [esp + 4], 6
jne 0x414334
mov ebx, esp
mov edx, ecx
mov eax, esi
call fcn.00414380
test al, al
jne 0x414326
xor eax, eax
add esp, 8
pop esi
pop ecx
pop ebx
ret
mov ebx, dword [esp]
mov edx, ecx
mov eax, esi
call fcn.004143d0
jmp 0x41431f
push ecx
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.DLL_GetDlgItem]
mov esi, eax
test eax, eax
je 0x41431f
push eax
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
test eax, eax
jle 0x41431d
lea ecx, [eax + 1]
mov eax, ecx
call fcn.00403ba0
mov ebx, eax
test eax, eax
je 0x414368
push ecx
push eax
push esi
call dword [sym.imp.USER32.DLL_GetWindowTextA]
mov eax, ebx
add esp, 8
pop esi
pop ecx
pop ebx
ret
Function at 0x416210
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 0x24
mov esi, eax
mov edi, edx
mov dword [eax + 0xe4], 3
mov dword [eax + 0x104], 3
mov dword [eax + 0x10], ebx
xor eax, eax
mov dword [esp + 0x20], eax
test ebx, ebx
jne 0x4163d2
xor ebp, ebp
test byte [edx + 0x19], 0x10
jne 0x41624c
or byte [esi + 0x33], 8
lea eax, [esp + 0x1c]
lea ebx, [esp + 0x14]
xor ecx, ecx
push eax
mov edx, edi
mov dword [esp + 0x20], ecx
push ebp
lea ecx, [esp + 0x14]
mov eax, esi
call fcn.0041ef10
test al, al
je 0x4163ca
test byte [esi + 0x2d], 0x80
jne 0x416289
cmp dword [edi], 0
je 0x4163eb
or byte [esp + 0x22], 0xc0
or byte [esi + 0x33], 2
test byte [edi + 0x18], 8
je 0x416294
or byte [esp + 0x22], 4
test byte [edi + 0x14], 1
je 0x41629f
or byte [esp + 0x22], 0x10
test byte [edi + 0x14], 2
je 0x4162aa
or byte [esp + 0x22], 0x20
test byte [esi + 0x33], 2
je 0x4163f5
test byte [edi + 0x18], 0x10
je 0x4162bf
or byte [esp + 0x22], 1
test byte [edi + 0x18], 0x20
je 0x4162ca
or byte [esp + 0x22], 2
test byte [edi + 0x18], 0x80
je 0x4162d5
or byte [esp + 0x22], 8
test byte [edi + 0x19], 0x10
je 0x4162e0
or byte [esp + 0x23], 0x80
test byte [edi + 0x19], 2
je 0x416402
or byte [esp + 0x20], 0x80
mov ecx, 0x439d28
call fcn.0041f8b0
lea edx, [edi + 0x20]
xor ebx, ebx
mov dword [esi + 0x14], eax
mov eax, esi
call fcn.00424660
mov eax, esi
call fcn.0041b890
mov dword [esp], 0xc
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov eax, 4
test byte [edi + 0x1a], 1
je 0x416333
mov eax, 0x204
and byte [esp + 0x22], 0x7f
mov edx, esp
push edx
mov edx, dword [0x43c924]
push edx
mov ebx, dword [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push ebp
mov edx, dword [esp + 0x20]
push edx
mov ebx, dword [esp + 0x30]
push ebx
mov ebp, dword [esp + 0x30]
push ebp
mov edx, dword [esp + 0x40]
push edx
mov ebx, dword [edi]
push ebx
push ecx
push eax
call dword [sym.imp.USER32.DLL_CreateWindowExA]
mov ecx, eax
test eax, eax
je 0x41640c
mov eax, esi
mov edx, dword [edi + 0x38]
call fcn.0041c6a0
test byte [edi + 0x19], 0x60
je 0x4163b8
mov eax, esi
xor edx, edx
call fcn.0041f030
mov bh, byte [edi + 0x19]
test bh, 0x20
je 0x416416
mov eax, esi
call fcn.0041c990
mov edx, 1
mov eax, esi
call fcn.0041f030
test byte [esi + 0x2d], 4
je 0x4163b8
push 0
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
test byte [esi + 0x2d], 4
jne 0x4163c5
mov eax, esi
call fcn.00416090
test esi, esi
setne al
add esp, 0x24
pop ebp
pop edi
pop esi
pop ecx
ret
mov ebp, dword [ebx]
test byte [edx + 0x19], 0x10
jne 0x41624c
mov dword [esp + 0x20], 0x44000000
jmp 0x41624c
or byte [esp + 0x22], 0x80
jmp 0x416289
and byte [esi + 0x2c], 0x4f
and byte [edi + 0x18], 0x4f
jmp 0x4162d5
mov ecx, 0x43c928
jmp 0x4162f4
xor al, al
add esp, 0x24
pop ebp
pop edi
pop esi
pop ecx
ret
test bh, 0x40
je 0x41639d
mov eax, esi
call fcn.0041c970
jmp 0x41639d
Function at 0x420a00
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
push 0x420990
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x43a008], eax
test eax, eax
jne 0x420a21
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
push 2
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x15
mov dword [0x439fd4], eax
mov eax, dword [0x43a008]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 1
mov edx, dword [0x43a008]
push edx
mov dword [0x439fd8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 5
mov ecx, dword [0x43a008]
push ecx
mov dword [0x439fdc], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 4
mov ebx, dword [0x43a008]
push ebx
mov dword [0x439fe0], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x12
mov esi, dword [0x43a008]
push esi
mov dword [0x439fe4], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 6
mov edi, dword [0x43a008]
push edi
mov dword [0x439fe8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 3
mov ebp, dword [0x43a008]
push ebp
mov dword [0x439fec], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x14
mov dword [0x439ff0], eax
mov eax, dword [0x43a008]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x10
mov edx, dword [0x43a008]
push edx
mov dword [0x439ff4], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0xc
mov ecx, dword [0x43a008]
push ecx
mov dword [0x439ff8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0xd
mov ebx, dword [0x43a008]
push ebx
mov dword [0x439ffc], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x16
mov esi, dword [0x43a008]
push esi
mov dword [0x43a000], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x43a004], eax
cmp dword [0x439fd4], 0
je 0x420ba5
cmp dword [0x439fd8], 0
je 0x420ba5
cmp dword [0x439fdc], 0
je 0x420ba5
cmp dword [0x439fe0], 0
je 0x420ba5
cmp dword [0x439fe4], 0
je 0x420ba5
cmp dword [0x439fe8], 0
je 0x420ba5
cmp dword [0x439fec], 0
je 0x420ba5
cmp dword [0x439ff0], 0
je 0x420ba5
cmp dword [0x439ff4], 0
je 0x420ba5
cmp dword [0x439ff8], 0
je 0x420ba5
cmp dword [0x439ffc], 0
je 0x420ba5
cmp dword [0x43a000], 0
je 0x420ba5
test eax, eax
je 0x420ba5
mov eax, 1
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
call fcn.004209a0
xor eax, eax
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4222f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ecx
push edx
push 0x10
mov byte [0x43a130], 0
call dword [sym.imp.USER32.DLL_GetKeyState]
push 0x14
test ax, ax
setl bl
call dword [sym.imp.USER32.DLL_GetKeyState]
cwde
test eax, eax
jl 0x422358
test al, 1
setne al
movzx eax, al
test eax, eax
setne al
mov ah, al
test bl, bl
je 0x42235f
test al, al
jne 0x42235f
or byte [0x43a130], 2
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
test ax, ax
jge 0x422347
or byte [0x43a130], 4
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
test ax, ax
jl 0x422369
pop edx
pop ecx
pop ebx
ret
test al, 1
sete al
jmp 0x42231a
test ah, ah
je 0x422333
test bl, bl
je 0x42232c
jmp 0x422333
or byte [0x43a130], 1
pop edx
pop ecx
pop ebx
ret
Function at 0x42c240
Capabilities:
Get common file path

Disassembly:
push ecx
push edx
sub esp, 0x104
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
xor eax, eax
mov al, byte [esp]
call fcn.00433171
sub eax, 0x60
add esp, 0x104
pop edx
pop ecx
ret

Function at 0x42c270
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push ecx
push edx
sub esp, 0x104
mov ebx, eax
add al, 0x60
mov byte [esp], al
mov eax, esp
mov byte [esp + 1], 0x3a
push eax
mov word [esp + 6], 0x2e
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
xor eax, eax
mov al, byte [esp]
call fcn.00433171
sub eax, 0x60
cmp eax, ebx
sete al
and eax, 0xff
dec eax
add esp, 0x104
pop edx
pop ecx
pop ebx
ret

Function at 0x42c3f0
Capabilities:
Terminate process

Disassembly:
jmp 0x42cf50
push ebx
push ecx
push edx
push ebp
mov ebp, esp
sub esp, 8
mov eax, 1
call fcn.0042d0b0
mov eax, dword [0x43a59c]
add eax, 3
and al, 0xfc
xor edx, edx
sub esp, eax
mov ecx, esp
mov ebx, dword [0x43a59c]
mov eax, ecx
call fcn.00432090
mov eax, dword [0x43a59c]
mov dword [ecx + 0x104], eax
mov eax, ecx
mov edx, ecx
call fcn.0042d160
lea eax, [ebp - 8]
call fcn.0042d4b0
mov ecx, dword [0x43a568]
add ecx, 3
and cl, 0xfc
call fcn.00432170
cmp ecx, eax
jb 0x42cfe2
xor eax, eax
mov ecx, dword [0x43a568]
add eax, ecx
mov dword [0x43a56c], eax
call fcn.0042d560
push 0xa
mov eax, dword [0x43a548]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call fcn.00423ab0
jmp 0x4320d3
push ecx
call fcn.004321c8
mov eax, dword [0x43a568]
add eax, 3
and al, 0xfc
sub esp, eax
mov eax, esp
jmp 0x42cfb3
Function at 0x42d210
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x43d03c], eax
mov dword [0x43a5e4], edx
call fcn.0042e620
xor eax, eax
mov dword [0x43d65c], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x43a581], al
shr eax, 0x10
mov word [0x43a583], ax
xor eax, eax
mov ax, word [0x43a583]
and edx, 0xffff
mov dword [0x43a585], eax
xor eax, eax
sar edx, 8
mov al, byte [0x43a581]
and edx, 0xff
mov dword [0x43a589], eax
xor eax, eax
mov al, dl
mov byte [0x43a582], dl
mov dword [0x43a58d], eax
mov eax, dword [0x43a589]
mov edx, dword [0x43a58d]
shl eax, 8
or eax, edx
mov dword [0x43a591], eax
cmp byte [0x43a581], 4
jae 0x42d337
mov eax, 0x42d1a8
push eax
xor edx, edx
push 0x42d1d5
mov dword [0x43a57d], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
je 0x42d2ca
call edx
mov dword [0x43a57d], eax
push 0x104
push 0x43d040
push 0
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x43d144
xor eax, eax
mov dword [0x43a54c], 0x43d040
call fcn.0042e750
mov dword [0x43a558], 0x43d144
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0042e7f0
mov edx, eax
mov bl, byte [eax]
mov dword [0x43d034], eax
cmp bl, 0x22
je 0x42d341
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x433071], 2
je 0x42d359
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x433071], 2
je 0x42d360
inc eax
jmp 0x42d327
mov eax, 0x42d1be
jmp 0x42d2a2
inc eax
cmp bl, byte [eax]
je 0x42d351
cmp byte [eax], 0
je 0x42d351
inc eax
cmp byte [eax], 0x22
jne 0x42d346
cmp byte [eax], 0
je 0x42d327
inc eax
jmp 0x42d327
test dl, dl
je 0x42d327
inc eax
jmp 0x42d31a
mov dword [0x43a548], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x42d3d6
call fcn.0042e830
mov edx, eax
mov bx, word [eax]
mov dword [0x43d038], eax
cmp bx, 0x22
je 0x42d3a9
xor eax, eax
mov ax, word [edx]
call fcn.0042e857
test eax, eax
je 0x42d3cb
xor eax, eax
mov ax, word [edx]
call fcn.0042e857
test eax, eax
je 0x42d3db
add edx, 2
jmp 0x42d396
lea edx, [eax + 2]
cmp bx, word [edx]
je 0x42d3c0
cmp word [edx], 0
je 0x42d3c0
add edx, 2
cmp word [edx], 0x22
jne 0x42d3b1
cmp word [edx], 0
je 0x42d396
add edx, 2
jmp 0x42d396
cmp word [edx], 0
je 0x42d396
add edx, 2
jmp 0x42d388
mov edx, 0x42d1e2
mov dword [0x43a554], edx
test edi, edi
jne 0x42d3ee
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x43d34c
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x43d450
mov eax, esi
mov dword [0x43a550], 0x43d34c
call fcn.0042e750
mov dword [0x43a55c], 0x43d450
mov eax, 1
pop edi
pop esi
pop ecx
ret

Function at 0x4303d9
Capabilities:
Terminate process
Write file on windows

Disassembly:
push edx
mov edx, 0xff
mov eax, 0x4303b0
jmp fcn.00430160
Function at 0x430670
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x18
mov ebp, eax
mov dword [esp], 2
mov edx, 0x3d
mov dword [esp + 4], 1
call fcn.00430820
mov ebx, eax
test eax, eax
je 0x43069e
cmp eax, ebp
jne 0x4306ad
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
sub eax, ebp
mov dword [esp + 0xc], eax
inc eax
call fcn.00431e20
mov edx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x43069e
mov ecx, dword [esp + 0xc]
mov esi, ebp
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0xc]
lea esi, [ebx + 1]
mov byte [edx + eax], 0
mov eax, esi
call fcn.00430880
mov dword [esp + 0x14], eax
test eax, eax
je 0x430776
inc eax
call fcn.00431e20
mov ebx, eax
mov dword [esp + 0x10], eax
test eax, eax
je 0x430760
mov ecx, dword [esp + 0x14]
mov edi, eax
add ebx, dword [esp + 0x14]
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [ebx], 0
mov edi, dword [esp + 0x10]
push edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, dword [esp + 8]
call fcn.00431f10
mov eax, edi
call fcn.00431f10
test edx, edx
jne 0x43077c
test edi, edi
jne 0x43069e
xor eax, eax
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, edx
call fcn.00431f10
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov dword [esp + 0x10], eax
jmp 0x430726
mov eax, ebp
call fcn.004308b0
test eax, eax
jne 0x43069e
cmp dword [0x43d660], 0
je 0x4306a3
mov eax, ebp
call fcn.00430880
lea ebx, [eax + 1]
mov eax, dword [esp]
imul eax, ebx
call fcn.00431e20
mov ecx, eax
test eax, eax
je 0x4307e7
imul ebx, dword [esp + 4]
mov edx, ebp
call fcn.00430940
cmp eax, 0xffffffff
jne 0x430803
mov eax, ecx
call fcn.00431f10
call dword [0x43a5e8]
mov dword [eax + 4], 0xe
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
call dword [0x43a5e8]
mov dword [eax + 4], 5
mov eax, 0xffffffff
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.004309c0
add esp, 0x18
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x431ad5
Capabilities:
Get disk information

Disassembly:
push ebx
push ecx
push esi
push edi
enter 0x348, 0
sub ebp, 0x39a
mov edi, eax
mov esi, edx
xor ecx, ecx
cmp byte [eax], 0
je 0x431afc
mov edx, 0x4319d0
call fcn.00433c30
test eax, eax
je 0x431b13
call dword [0x43a5e8]
mov dword [eax + 4], 1
mov eax, 0xffffffff
jmp 0x431c74
mov edx, 0x104
lea eax, [ebp + 0x296]
mov ebx, 0x104
call fcn.00433c80
lea eax, [ebp + 0x192]
mov edx, edi
call fcn.00433db0
test eax, eax
je 0x431b69
movzx eax, byte [ebp + 0x192]
test byte [eax + 0x433071], 0xc0
je 0x431b69
cmp byte [ebp + 0x193], 0x3a
jne 0x431b69
cmp byte [ebp + 0x194], 0x5c
jne 0x431b69
cmp byte [ebp + 0x195], 0
jne 0x431b69
mov ecx, 1
mov eax, edi
mov edx, edi
call fcn.00430ad0
cmp byte [eax], 0x3a
jne 0x431b7a
lea edx, [edi + 2]
mov al, byte [edx]
cmp al, 0x2f
je 0x431b84
cmp al, 0x5c
jne 0x431b8a
cmp byte [edx + 1], 0
je 0x431b8e
test ecx, ecx
je 0x431bbb
lea eax, [ebp + 0x192]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
test eax, eax
je 0x431afc
mov ebx, 0x140
lea eax, [ebp + 0x52]
xor edx, edx
call fcn.00432090
mov dword [ebp + 0x52], 0x10
jmp 0x431bdb
lea edx, [ebp + 0x52]
mov eax, edi
call fcn.00433e20
cmp eax, 0xffffffff
jne 0x431bd4
call fcn.00433ec0
jmp 0x431c74
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, edi
call fcn.00430ad0
cmp byte [eax], 0x3a
jne 0x431bec
movzx eax, byte [edi]
jmp 0x431bf3
movzx eax, byte [ebp + 0x296]
call fcn.00433171
movsx eax, al
sub eax, 0x61
mov dword [esi], eax
mov eax, dword [esi]
mov dword [esi + 0x12], eax
mov eax, dword [ebp + 0x72]
lea edx, [ebp + 0x7e]
mov dword [esi + 0x16], eax
mov ebx, edi
mov eax, dword [ebp + 0x52]
call fcn.004319e2
mov word [esi + 8], ax
lea eax, [ebp + 0x66]
call fcn.00433ef0
mov dword [esi + 0x1e], eax
lea eax, [ebp + 0x56]
call fcn.00433ef0
mov dword [esi + 0x22], eax
lea eax, [ebp + 0x5e]
call fcn.00433ef0
mov word [esi + 0x10], 0
mov dword [esi + 0x1a], eax
mov ax, word [esi + 0x10]
mov word [esi + 0xa], 1
cwde
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x52]
mov dword [esi + 0x2e], 0
mov dword [esi + 0x32], 0
mov word [esi + 0x36], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x2a], eax
xor eax, eax
lea esp, [ebp + 0x39a]
pop ebp
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x433670
Capabilities:
Read file on windows

Disassembly:
push ecx
sub esp, 4
test eax, eax
jl 0x4336a1
cmp eax, dword [0x43a610]
jae 0x4336a1
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push edx
call fcn.0042e550
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4336b8
mov eax, dword [esp]
add esp, 4
pop ecx
ret
call dword [0x43a5e8]
mov dword [eax + 4], 4
mov eax, 0xffffffff
add esp, 4
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
call fcn.00433e70
cmp edx, 0x6d
jne 0x4336d0
cmp dword [esp], 0
je 0x433699
mov eax, 0xffffffff
add esp, 4
pop ecx
ret