joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c778
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c7dc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004085b8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c7e3
lea eax, [ebp - 0xc]
call fcn.00404274
ret

Function at 0x475008
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x475025
add esp, 0xfffffff0
call fcn.00403704
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4751c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0046b814
test al, al
jne 0x475062
mov ecx, 0x4751f4
mov dl, 1
mov eax, dword [0x45ff10]
call fcn.0040ba24
call fcn.00403c30
xor eax, eax
push ebp
push 0x47508e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0046a2c0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0046a1ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4750ae
mov eax, dword [ebp - 0x10]
mov edx, 0x475230
call fcn.00404bcc
je 0x4750cb
mov eax, esi
mov edx, 0x475230
call fcn.00404bcc
jne 0x4750ef
mov eax, edi
mov edx, 0x475240
call fcn.00404bcc
je 0x4750ef
mov ecx, 0x475218
mov dl, 1
mov eax, dword [0x4601b8]
call fcn.0040ba24
call fcn.00403c30
mov eax, edi
xor edx, edx
call fcn.00404bcc
jne 0x47511c
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404bcc
je 0x47511c
mov ecx, 0x475218
mov dl, 1
mov eax, dword [0x4601b8]
call fcn.0040ba24
call fcn.00403c30
mov eax, dword [ebp - 0x10]
mov edx, 0x475280
call fcn.00404bcc
jne 0x47514f
mov eax, edi
mov edx, 0x47528c
call fcn.00404bcc
je 0x47514f
mov ecx, 0x475218
mov dl, 1
mov eax, dword [0x4601b8]
call fcn.0040ba24
call fcn.00403c30
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004730f8
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404960
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00404960
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404960
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404960
lea eax, [ebx + 8]
call fcn.00404924
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x4752d8]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4751c8
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040493c
ret
Function at 0x476abc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x476ad9
add esp, 0xfffffff0
call fcn.00403704
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x476c74
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0046b814
test al, al
jne 0x476b16
mov ecx, 0x476ca8
mov dl, 1
mov eax, dword [0x45ff10]
call fcn.0040ba24
call fcn.00403c30
xor eax, eax
push ebp
push 0x476b42
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0046a2c0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0046a1ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x476b62
mov eax, edi
xor edx, edx
call fcn.00404bcc
jne 0x476b8f
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404bcc
je 0x476b8f
mov ecx, 0x476ccc
mov dl, 1
mov eax, dword [0x4601b8]
call fcn.0040ba24
call fcn.00403c30
mov eax, dword [ebp - 0x10]
mov edx, 0x476ce4
call fcn.00404bcc
jne 0x476bc2
mov eax, edi
mov edx, 0x476cf0
call fcn.00404bcc
je 0x476bc2
mov ecx, 0x476ccc
mov dl, 1
mov eax, dword [0x4601b8]
call fcn.0040ba24
call fcn.00403c30
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004730f8
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404960
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00404960
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404960
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404960
lea eax, [ebx + 8]
call fcn.00404924
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41945c]
call fcn.004033a8
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41945c]
call fcn.004033a8
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41945c]
call fcn.004033a8
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x476d3c]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x462f34]
call fcn.00472350
mov dword [ebx + 0x3c], eax
mov ax, word [0x476d40]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476c7b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040493c
ret
Function at 0x4796d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4796f2
add esp, 0xfffffff0
call fcn.00403704
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x47985d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0046b814
test al, al
jne 0x47972f
mov ecx, 0x479890
mov dl, 1
mov eax, dword [0x45ff10]
call fcn.0040ba24
call fcn.00403c30
push dword [0x4c5d7c]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x4c5d7c]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b84
mov eax, dword [ebp - 0xc]
call fcn.0046c2ec
test al, al
jne 0x479801
push dword [0x4c5d78]
push dword [ebp + 8]
push dword [0x4c5d78]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404b84
mov eax, dword [ebp - 0x14]
call fcn.0046c2ec
test al, al
jne 0x479801
push dword [0x4c5d7c]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x4c5d7c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404b84
mov eax, dword [ebp - 0x18]
call fcn.0046c404
test al, al
jne 0x479801
push dword [0x4c5d78]
push edi
push dword [0x4c5d78]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404b84
mov eax, dword [ebp - 0x20]
call fcn.0046c404
test al, al
jne 0x479801
mov ecx, 0x479890
mov dl, 1
mov eax, dword [0x45ff10]
call fcn.0040ba24
call fcn.00403c30
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004730f8
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404960
lea eax, [ebx + 8]
call fcn.00404924
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.00404960
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.00404960
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4798ac]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479864
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.0040493c
ret

Function at 0x4ae360
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ae3db
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4ae3c2
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004044e4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00408018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae3e2
lea eax, [ebp - 0x104]
call fcn.00404274
ret
Function at 0x405d43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x405d52
pop dword [ebp - 0xc]
mov eax, 0x83a685f3
add eax, 0x7c99d75f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x44ed800d
sub dword [ebp - 0x1c], 0xf69b3ac2
mov dword [ebp - 0x18], 0x1833c55a
sub dword [ebp - 0x18], 0xe6007915
mov dword [ebp - 0x14], 0x5a129e91
sub dword [ebp - 0x14], 0xdc65a63
mov dword [ebp - 0x10], 0xed4a9f9f
add dword [ebp - 0x10], 0x12b56061
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x160cfd0
add eax, 0xfedfa174
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x6cf43d7d
sub dword [ebp - 0x1c], 0xf881d427
mov dword [ebp - 0x18], 0xcfa47d5f
add dword [ebp - 0x18], 0x71c7e416
mov dword [ebp - 0x14], 0xe0ef242f
sub dword [ebp - 0x14], 0x7d7fb7c3
mov dword [ebp - 0x10], 0x7a3630b7
add dword [ebp - 0x10], 0x85c9cf49
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x1e4cc6dc
add eax, 0xe1f3aa34
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3aa71
push 0
call eax
mov ecx, 0xc6f17ed0
sub ecx, 0xc6f127fe
mov esi, eax
mov edx, 0x436000
add edx, dword [ebp - 0xc]
mov ebx, 0xa485410d
add ebx, 0x6671e66b
sub dword [ebp - 4], 0x8f6a196a
mov edi, dword [edx]
xor edi, ebx
xor dword [ebp - 8], ebx
mov dword [esi], edi
xor dword [ebp - 8], 0x7f69e74f
add esi, 4
add edx, 0x9152d06e
add edx, 0x6ead2f96
loop 0x405e6e
add eax, 0x82d7f878
sub eax, 0x82d6aa5d
mov ebx, eax
add eax, 0x3c6c98b5
add eax, 0xc3936750
mov ecx, 0x87e8a803
sub ecx, 0x87a8a803
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc
Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
jmp 0x50a204

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7c8051e3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section._RDATA
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x274514bb
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42859d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x438ef0
call fcn.004290e4
push 1
call fcn.00428707
pop ecx
test al, al
jne 0x428454
push 7
call fcn.00428eac
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004286d2
mov byte [ebp - 0x24], al
mov eax, dword [0x43f814]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42844d
test eax, eax
jne 0x4284be
mov dword [0x43f814], ecx
push 0x42c30c
push 0x42c2f4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4284a1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x428597
push 0x42c2f0
push 0x42c2c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x43f814], 2
jmp 0x4284c3
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00428874
pop ecx
call fcn.00428ea0
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4284f3
push esi
call fcn.004287ea
pop ecx
test al, al
je 0x4284f3
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00428e38
call esi
call fcn.00428ea6
mov esi, eax
cmp dword [esi], edi
je 0x428511
push esi
call fcn.004287ea
pop ecx
test al, al
je 0x428511
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00428fc2
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00428ff5
test al, al
jne 0x42853c
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x428545
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00428891
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x428597
call fcn.00429129
ret
call fcn.004282db
jmp 0x428435

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10049985
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10049994
pop dword [ebp - 0x2c]
mov eax, 0xa127479d
add eax, 0x6edd51f7
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6d9a66c8
add dword [ebp - 0x3c], 0xe0b7de83
mov dword [ebp - 0x38], 0xbf8da68a
sub dword [ebp - 0x38], 0x8d5a5a45
mov dword [ebp - 0x34], 0xe22d0587
sub dword [ebp - 0x34], 0x95e0c159
mov dword [ebp - 0x30], 0x8e34ac3a
sub dword [ebp - 0x30], 0x8e34ac3a
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x68a7928
add dword [ebp - 0x3c], 0x6de7f02e
mov dword [ebp - 0x38], 0x477e841b
sub dword [ebp - 0x38], 0x61222a6
mov dword [ebp - 0x34], 0xd19ba410
add dword [ebp - 0x34], 0x91d3c85c
mov dword [ebp - 0x30], 0x490a442d
add dword [ebp - 0x30], 0xb6f5bbd3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x55805
push 0
call eax
mov ecx, 0x46b3
xor edi, edi
add edi, eax
mov ebx, 0x1008bc00
add ebx, dword [ebp - 0x2c]
mov esi, 0x341ba3cf
add esi, 0x868a4c71
add dword [ebp - 8], ecx
mov edx, dword [ebx]
sub dword [ebp - 4], 0x2a5e9cea
xor edx, esi
add dword [ebp - 0xc], 0xbfd16a26
mov dword [edi], edx
add dword [ebp - 0x20], edi
add edi, 4
add ebx, 0x482aae6a
add ebx, 0xb7d5519a
loop 0x10049aa2
add eax, 0x84aad7b8
add eax, 0x7b5635e7
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x7813480f
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ebx, ebx
push ebx
push ebx
mov ebp, str.__MSVCRT_HEAP_SELECT
push ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x78134961
push esi
push ebx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x7813495f
push esi
push ebx
push ebp
call edi
test eax, eax
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
jbe 0x78134953
cmp eax, esi
ja 0x78134953
cmp byte [ebx], 0
mov ecx, ebx
je 0x78134889
mov al, byte [ecx]
cmp al, 0x61
jl 0x78134883
cmp al, 0x7a
jg 0x78134883
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x78134875
push 0x16
push ebx
push str.__GLOBAL_HEAP_SELECTED
call sym.MSVCR80.dll__mbscat_s_l
add esp, 0xc
test eax, eax
jne 0x781348a1
mov edi, ebx
jmp 0x781348fc
push 0x105
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78134953
push 3
push esi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
cmp byte [esi], 0
mov ecx, esi
je 0x781348e5
mov al, byte [ecx]
cmp al, 0x61
jl 0x781348df
cmp al, 0x7a
jg 0x781348df
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x781348d1
push esi
push ebx
call sym.MSVCR80.dll_strstr
pop ecx
pop ecx
push esi
push 0
mov edi, eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
test edi, edi
je 0x78134953
push 0x2c
push edi
call sym.MSVCR80.dll_strchr
test eax, eax
pop ecx
pop ecx
je 0x78134953
inc eax
cmp byte [eax], 0x20
je 0x7813490e
mov cl, byte [eax]
xor esi, esi
cmp cl, 0x30
jl 0x78134953
cmp cl, 0x39
jg 0x78134934
imul esi, esi, 0xa
movsx ecx, cl
inc eax
lea esi, [esi + ecx - 0x30]
mov cl, byte [eax]
cmp cl, 0x30
jge 0x7813491d
cmp esi, 2
je 0x78134943
cmp esi, 3
je 0x78134943
cmp esi, 1
jne 0x78134953
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov eax, esi
jmp 0x781349c1
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
call sym.MSVCR80.dll__get_osplatform
test eax, eax
pop ecx
je 0x7813497d
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call sym.MSVCR80.dll__get_winmajor
test eax, eax
pop ecx
je 0x78134999
push ebx
push ebx
push ebx
push ebx
push ebx
call sym.MSVCR80.dll__invoke_watson
add esp, 0x14
cmp dword [esp + 0x10], 2
jne 0x781349ac
cmp dword [esp + 0x14], 5
jb 0x781349ac
xor eax, eax
inc eax
jmp 0x781349c1
lea eax, [esp + 0x18]
push eax
call fcn.781347e2
cmp byte [esp + 0x1c], 6
pop ecx
sbb eax, eax
add eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x78138894
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.MSVCR80.dll__invalid_parameter
Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__mbscat_s_l
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__mbscat_s_l
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret

Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__mbscat_s_l
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret