joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x801c
call fcn.0052fe90
push ebx
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.WINSPOOL.DRV_OpenPrinterA
test eax, eax
je 0x4a913c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x5ef80e
lea eax, [ebp - 0x14]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_StartDocPrinterA
test eax, eax
je 0x4a912c
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_StartPagePrinter
test eax, eax
je 0x4a911c
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x8018], eax
cmp eax, 0xffffffff
je 0x4a910c
jmp 0x4a90cf
mov eax, dword [ebp - 8]
dec eax
cmp byte [ebp + eax - 0x8014], 0x1a
jne 0x4a90b4
dec dword [ebp - 8]
lea eax, [ebp - 0x801c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x8014]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_WritePrinter
push 0
lea eax, [ebp - 8]
push eax
push 0x8000
lea eax, [ebp - 0x8014]
push eax
mov eax, dword [ebp - 0x8018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a90f8
cmp dword [ebp - 8], 0
jne 0x4a90a3
mov ebx, 1
mov eax, dword [ebp - 0x8018]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a9111
mov ebx, 0xfffffffa
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_EndPagePrinter
jmp 0x4a9121
mov ebx, 0xfffffffc
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_EndDocPrinter
jmp 0x4a9131
mov ebx, 0xfffffffd
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x4a9141
mov ebx, 0xfffffffe
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a98f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 8], 0x63
mov edx, dword [ebp + 0x14]
mov byte [edx], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a9929
cmp byte [eax], 0
je 0x4a9929
push 0x107
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00490a40
add esp, 0xc
jmp 0x4a9949
mov eax, dword [ebp + 0x14]
push eax
push 0x107
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4a9949
mov edx, dword [ebp + 0x14]
mov byte [edx], 0x2e
mov edx, dword [ebp + 0x14]
mov byte [edx + 1], 0
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x4a9979
mov edx, dword [ebp + 0x14]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4a9957
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp byte [eax + esi - 1], 0x5c
je 0x4a9979
mov eax, dword [ebp + 0x14]
mov byte [eax + esi], 0x5c
mov eax, dword [ebp + 0x14]
mov byte [eax + esi + 1], 0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a9995
push 0x107
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00490a80
add esp, 0xc
mov edx, dword [ebp + 0x14]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4a999b
mov ebx, eax
cmp ebx, 0x101
jle 0x4a99b4
or eax, 0xffffffff
jmp 0x4a9a7e
call fcn.004bc970
fst qword [ebp - 0x20]
fstp qword [ebp - 0x10]
xor edi, edi
fld qword [ebp - 0x10]
fmul qword [0x5ef894]
fst qword [ebp - 0x10]
call fcn.0052ebf0
mov esi, eax
lea eax, [ebp - 0x18]
push eax
fld qword [ebp - 0x10]
sub esp, 8
fstp qword [esp]
call fcn.00530b20
add esp, 0xc
fst qword [ebp - 0x28]
fstp qword [ebp - 0x10]
mov eax, ebx
mov dword [ebp - 0x2c], eax
lea ebx, [eax + 1]
mov edx, dword [ebp + 0x14]
cmp esi, 9
setle al
and eax, 1
dec eax
and eax, 0x27
add eax, 0x30
add eax, esi
mov ecx, dword [ebp - 0x2c]
mov byte [edx + ecx], al
inc edi
cmp edi, 6
jl 0x4a99c1
mov eax, dword [ebp + 0x14]
mov byte [eax + ebx], 0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4a9a3b
push 0x107
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00490a80
add esp, 0xc
push 0
mov eax, dword [ebp + 0x14]
push eax
call fcn.004a6250
add esp, 8
push 0x410
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.004a4b70
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4a9a6c
mov eax, dword [ebp - 4]
jmp 0x4a9a7e
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
test eax, eax
jne 0x4a9900
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a9ac1
cmp byte [eax], 0
je 0x4a9ac1
push 0x107
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00490a40
add esp, 0xc
jmp 0x4a9ae7
lea eax, [ebp - 0x108]
push eax
push 0x108
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4a9ae7
push 0
push 0
call fcn.004a6b50
add esp, 8
xor eax, eax
jmp 0x4a9b1f
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a9afd
mov esi, dword [ebp + 0x10]
jmp 0x4a9b02
mov esi, 0x5ef88c
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ebx, eax
push 0
push ebx
call fcn.004a6b50
add esp, 8
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a9d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov bx, 0xffff
mov edx, dword [ebp + 8]
mov byte [edx], 0
lea eax, [ebp - 0x108]
push eax
push 0x108
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4a9d7a
xor bx, bx
mov byte [ebp - 1], 0
push 0x107
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00490a40
add esp, 0xc
test bx, bx
jne 0x4a9db9
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x4a9db9
mov edx, dword [ebp + 8]
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4a9d8d
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [eax + esi - 1], 0x5c
je 0x4a9dcd
cmp esi, 0x107
jge 0x4a9dcd
mov eax, dword [ebp + 8]
mov byte [eax + esi], 0x5c
mov eax, dword [ebp + 8]
mov byte [eax + esi + 1], 0
jmp 0x4a9dcd
mov edx, dword [ebp + 8]
mov byte [edx], 0x2e
mov edx, dword [ebp + 8]
mov byte [edx + 1], 0x5c
mov edx, dword [ebp + 8]
mov byte [edx + 2], 0
movzx eax, bx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aaad0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
push 0x100
call fcn.00455e40
pop ecx
mov ebx, eax
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4aacea
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x9c], 0x5f113a
mov dword [ebp - 0xa0], 0x5f113a
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4aab51
push str.wine_get_version
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aab51
mov dword [ebp - 0x9c], str.__Wine_
mov eax, dword [ebp - 0x84]
cmp eax, 3
jg case.default.0x4aab60
jmp dword [eax*4 + 0x5f0098]
cmp dword [ebp - 0x90], 4
jne 0x4aab88
cmp dword [ebp - 0x8c], 0xa
jae 0x4aab88
mov dword [ebp - 0xa0], 0x5f111d
jmp case.default.0x4aab60
cmp dword [ebp - 0x90], 4
jne 0x4aaba9
cmp dword [ebp - 0x8c], 0xa
jne 0x4aaba9
mov dword [ebp - 0xa0], 0x5f1119
jmp case.default.0x4aab60
mov dword [ebp - 0xa0], 0x5f1115
jmp case.default.0x4aab60
cmp dword [ebp - 0x90], 6
jne 0x4aabd0
mov dword [ebp - 0xa0], 0x5f113a
jmp case.default.0x4aab60
cmp dword [ebp - 0x90], 5
jne 0x4aabee
cmp dword [ebp - 0x8c], 2
jb 0x4aabee
mov dword [ebp - 0xa0], str._Server_2003___XP_x64
jmp case.default.0x4aab60
cmp dword [ebp - 0x90], 5
jne 0x4aac0c
cmp dword [ebp - 0x8c], 1
jne 0x4aac0c
mov dword [ebp - 0xa0], 0x5f10fb
jmp case.default.0x4aab60
cmp dword [ebp - 0x90], 5
jne 0x4aac21
mov dword [ebp - 0xa0], str._2000
jmp case.default.0x4aab60
mov dword [ebp - 0xa0], 0x5f10f1
jmp case.default.0x4aab60
mov dword [ebp - 0xa0], str._32s
jmp case.default.0x4aab60
mov dword [ebp - 0xa0], 0x5f10e8
mov eax, dword [ebp - 0x88]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
push str.Windows_s_s__lu._lu._04u
push 0x100
push ebx
call fcn.004a2030
add esp, 0x20
lea eax, [ebp - 0x80]
test eax, eax
je 0x4aacfd
lea eax, [ebp - 0x80]
push eax
call fcn.0048f690
pop ecx
mov edi, eax
xor esi, esi
jmp 0x4aac9a
inc esi
movsx eax, byte [edi + esi]
test eax, eax
je 0x4aacb6
cmp eax, 0x20
je 0x4aac99
cmp eax, 9
je 0x4aac99
cmp eax, 0xa
je 0x4aac99
cmp eax, 0xd
je 0x4aac99
cmp byte [edi + esi], 0
je 0x4aace1
push 0xff
push 0x5f10cd
push ebx
call fcn.00490a80
add esp, 0xc
push 0xff
lea eax, [edi + esi]
push eax
push ebx
call fcn.00490a80
add esp, 0xc
push edi
call fcn.00455f20
pop ecx
jmp 0x4aacfd
push str.Windows
push 0x100
push ebx
call fcn.004a2030
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4adfa0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0x10
mov edx, dword [ebp + 8]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
je 0x4adfc9
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x4adfd7
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esp, ebp
pop ebp
ret
Function at 0x4aea60
Capabilities:
Delete registry value
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ebx, eax
test ebx, ebx
je 0x4aeb4c
cmp dword [ebp + 0x10], 0
je 0x4aeb4c
xor ebx, ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4aea9e
cmp byte [eax], 0
jne 0x4aea9e
mov dword [ebp + 0xc], 0
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aeb4c
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
test eax, eax
je 0x4aeaea
cmp eax, 2
jne 0x4aeb42
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4aeb42
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4aeb1a
mov dword [ebp - 0xc], eax
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x4aeaf9
inc eax
push eax
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4aeb28
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, str.Environment
push eax
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aeb60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x14c], 0x99999999
mov dword [ebp - 0x148], 0x9999999
push 7
call fcn.00455e40
pop ecx
mov dword [ebp - 0x150], eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x150]
push eax
call fcn.0048fa10
add esp, 0xc
push 0
push 0x5f313f
mov eax, dword [ebp - 0x150]
push eax
call fcn.0048f9b0
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x144], eax
cmp eax, 0xffffffff
je 0x4aec36
test byte [ebp - 0x140], 0x10
je 0x4aec11
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x4aec11
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], edx
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4aebd7
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x150]
push eax
call fcn.00455f20
pop ecx
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
mov esp, ebp
pop ebp
ret
Function at 0x4c6030
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
or dword [ebp - 8], 0xffffffff
mov edx, dword [ebp + 0xc]
or dword [edx], 0xffffffff
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp eax, 0x7f
je 0x4c606a
cmp eax, 0x84
je 0x4c606a
cmp eax, 0x80
je 0x4c606a
cmp eax, 0x85
jne 0x4c6073
mov dword [ebp - 0x14], 2
jmp 0x4c607a
mov dword [ebp - 0x14], 0
mov edi, dword [ebp - 0x14]
push 1
mov eax, dword [ebp + 8]
lea eax, [eax + edi + 3]
push eax
call fcn.004bf370
add esp, 8
mov esi, eax
mov bl, byte [esi]
movzx eax, bl
mov dword [ebp - 0x18], eax
cmp eax, 0x30
je case.0x4c6101.112
cmp eax, 0x31
je case.0x4c6101.112
jg 0x4c60d8
mov eax, dword [ebp - 0x18]
cmp eax, 0x1d
jl case.0x4c6101.113
cmp eax, 0x24
jg case.default.0x4c60ba
jmp dword [eax*4 + 0x5f889c]
mov eax, dword [ebp - 0x18]
cmp eax, 0x29
je 0x4c616b
cmp eax, 0x2b
je case.0x4c6101.111
jmp case.0x4c6101.113
mov eax, dword [ebp - 0x18]
cmp eax, 0x36
je 0x4c619e
cmp eax, 0x38
je case.0x4c6101.112
cmp eax, 0x36
jl case.0x4c6101.113
mov eax, dword [ebp - 0x18]
cmp eax, 0x77
jl case.0x4c6101.113
cmp eax, 0x85
jg case.0x4c6101.113
jmp dword [eax*4 + 0x5f8754]
xor eax, eax
jmp 0x4c61fa
movzx eax, bl
cmp eax, 0x77
sete al
and eax, 1
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.004c6030
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jge 0x4c6139
xor eax, eax
jmp 0x4c61fa
cmp dword [ebp - 8], 0
jge 0x4c6150
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4c61ce
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], eax
jne 0x4c6164
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
je 0x4c61ce
xor eax, eax
jmp 0x4c61fa
add esi, 2
cmp dword [ebp + 0x10], 0
jne 0x4c617b
xor eax, eax
jmp 0x4c61fa
cmp dword [ebp - 8], 0
jge 0x4c6191
movzx eax, byte [esi + 1]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x4c61ce
movzx eax, byte [esi + 1]
cmp dword [ebp - 4], eax
je 0x4c61ce
xor eax, eax
jmp 0x4c61fa
add esi, 2
cmp dword [ebp + 0x10], 0
jne 0x4c61ab
xor eax, eax
jmp 0x4c61fa
cmp dword [ebp - 8], 0
jge 0x4c61c1
movzx eax, byte [esi + 1]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
jmp 0x4c61ce
movzx eax, byte [esi + 1]
cmp dword [ebp - 4], eax
je 0x4c61ce
xor eax, eax
jmp 0x4c61fa
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 1]
shl edx, 8
movzx ecx, byte [eax + 2]
or edx, ecx
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp byte [eax], 0x71
je 0x4c604a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2fcb
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, word [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x3f2
jl 0x4f2ff8
cmp eax, 0x402
jg 0x4f3016
jmp dword [eax*4 + 0x600f94]
mov eax, dword [ebp - 8]
cmp eax, 0x3e9
je 0x4f3028
cmp eax, 0x3ec
je 0x4f3033
jmp case.0x4f3671.0
cmp dword [ebp - 8], 0x40e
je 0x4f30a1
jmp case.0x4f3671.0
mov word [ebp - 2], 0x15
jmp fcn.004f30b2
mov word [ebp - 2], 0x14
jmp fcn.004f30b2
mov word [ebp - 2], 0x29
jmp fcn.004f30b2
Function at 0x531700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
lea eax, [ebp - 0x105]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x531741
cmp byte [ebp - 0x104], 0x3a
jne 0x531741
movsx eax, byte [ebp - 0x105]
mov edx, dword [0x6bc604]
movsx eax, word [edx + eax*2]
add eax, 0xffffffc0
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x531750
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 1
jl 0x531764
cmp ebx, 0x1f
jle 0x531773
mov dword [0x6bc668], 0xd
or eax, 0xffffffff
jmp 0x5317a3
lea eax, [ebx + 0x40]
mov byte [ebp - 3], al
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
lea eax, [ebp - 3]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x5317a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00533f30
pop ecx
or eax, 0xffffffff
jmp 0x5317a3
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x532800
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
jne 0x532832
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.00532640
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.0052f180
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x532865
push 1
call fcn.00532360
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax*4]
push eax
push ebx
push esi
call fcn.00532640
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x6d3020], eax
mov dword [0x6d3024], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5328a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
jmp 0x5328d7
mov edx, ebx
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x5328c3
inc eax
mov esi, eax
cmp byte [ebx], 0x3d
je 0x5328d5
add dword [ebp - 4], esi
add ebx, esi
cmp byte [ebx], 0
jne 0x5328be
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.0052f180
pop ecx
mov edi, eax
mov dword [0x6d3028], eax
test eax, eax
jne 0x5328fa
push 1
call fcn.00532360
pop ecx
mov ebx, dword [ebp - 8]
jmp 0x532929
mov edx, ebx
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x532904
inc eax
mov esi, eax
cmp byte [ebx], 0x3d
je 0x532927
mov ecx, edi
mov edx, ebx
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x53291a
pop eax
add edi, esi
add ebx, esi
cmp byte [ebx], 0
jne 0x5328ff
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x533ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [0x6d2f1c]
cmp eax, edx
jae 0x533adf
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x6d2f20]
test byte [eax + edx*8 + 4], 1
jne 0x533af1
mov dword [0x6bc668], 9
or eax, 0xffffffff
jmp 0x533cc4
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x533b0c
xor eax, eax
jmp 0x533cc4
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x6d2f20]
test byte [eax + edx*8 + 4], 0x20
je 0x533b35
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00535430
add esp, 0xc
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x6d2f20]
test byte [eax + edx*8 + 4], 0x80
je 0x533c13
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
jmp 0x533bff
lea edi, [ebp - 0x411]
jmp 0x533b81
mov eax, esi
inc esi
mov bl, byte [eax]
cmp bl, 0xa
jne 0x533b7c
inc dword [ebp - 4]
mov eax, edi
inc edi
mov byte [eax], 0xd
mov eax, edi
inc edi
mov byte [eax], bl
lea eax, [ebp - 0x411]
mov edx, edi
sub edx, eax
mov eax, edx
cmp eax, 0x400
jge 0x533ba2
mov eax, dword [ebp + 0xc]
mov edx, esi
sub edx, eax
mov eax, edx
cmp eax, dword [ebp + 0x10]
jb 0x533b69
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x411]
mov edx, edi
sub edx, eax
mov eax, edx
push eax
lea eax, [ebp - 0x411]
push eax
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x6d2f20]
mov eax, dword [eax + edx*8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x533bf4
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], eax
lea edx, [ebp - 0x411]
mov ecx, edi
sub ecx, edx
mov edx, ecx
cmp eax, edx
jge 0x533bff
jmp 0x533c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x533c59
mov eax, dword [ebp + 0xc]
mov edx, esi
sub edx, eax
mov eax, edx
cmp eax, dword [ebp + 0x10]
jb 0x533b61
jmp 0x533c59
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x6d2f20]
mov eax, dword [eax + edx*8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x533c50
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x533c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x533cbe
cmp dword [ebp - 0x10], 0
je 0x533c8a
cmp dword [ebp - 0x10], 5
jne 0x533c7b
mov dword [0x6bc668], 9
jmp 0x533c85
mov eax, dword [ebp - 0x10]
push eax
call fcn.00533f30
pop ecx
or eax, 0xffffffff
jmp 0x533cc4
mov eax, dword [ebp + 8]
mov edx, eax
and edx, 0x1f
sar eax, 5
mov eax, dword [eax*4 + 0x6d2f20]
test byte [eax + edx*8 + 4], 0x40
je 0x533caf
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x533caf
xor eax, eax
jmp 0x533cc4
mov dword [0x6bc668], 0x1c
or eax, 0xffffffff
jmp 0x533cc4
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5383c0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0052fe90
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x6d2f1c]
cmp ebx, eax
jae 0x5383fb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x6d2f20]
test byte [edx + eax*8 + 4], 1
jne 0x53840d
mov dword [0x6bc668], 9
or eax, 0xffffffff
jmp 0x538555
push 1
push 0
push ebx
call fcn.00535430
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x538437
push 2
push 0
push ebx
call fcn.00535430
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x53843f
or eax, 0xffffffff
jmp 0x538555
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x538507
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.00531630
add esp, 8
mov dword [ebp - 0x10], eax
cmp esi, 0x1000
jl 0x53848f
mov dword [ebp - 0x1018], 0x1000
jmp 0x538495
mov dword [ebp - 0x1018], esi
mov edi, dword [ebp - 0x1018]
cmp esi, 0x1000
jl 0x5384af
mov dword [ebp - 0x101c], 0x1000
jmp 0x5384b5
mov dword [ebp - 0x101c], esi
mov eax, dword [ebp - 0x101c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call fcn.00533ab0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x5384ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x5384e5
mov dword [0x6bc668], 0xd
mov dword [ebp - 4], edi
jmp 0x5384f8
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x53847b
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.00531630
add esp, 8
jmp 0x538543
test esi, esi
jge 0x538543
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00535430
add esp, 0xc
push ebx
call fcn.00533ee0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x538543
mov dword [0x6bc668], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00535430
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret