joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10194c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x10194ff
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10194f5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1019501
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10194e5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x101ae6d
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x10501c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x101ae7e
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x10229f5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10501c8]
sub esp, 0x14
cmp eax, 0xffffffff
push ebx
push esi
push edi
jne 0x1022a14
mov edi, 0x80004005
jmp 0x1022b26
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
cmp eax, ebx
je 0x1022a29
inc dword [eax + 4]
jmp 0x1022b33
push 0x28
call fcn.0101acdf
mov esi, eax
cmp esi, ebx
jne 0x1022a40
mov edi, 0x8007000e
jmp 0x1022ad2
push esi
push dword [0x10501c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 8]
push eax
push ebx
push 0x30
push 0x1c
call fcn.01023390
mov edi, eax
cmp edi, ebx
jl 0x1022ad2
lea eax, [esi + 0xc]
push eax
call fcn.0101ce71
mov edi, eax
cmp edi, ebx
jl 0x1022ad2
lea eax, [esi + 0x10]
push eax
push 8
call fcn.01030fa0
mov edi, eax
cmp edi, ebx
jl 0x1022ad2
push esi
call fcn.010244a7
mov edi, eax
cmp edi, ebx
jl 0x1022ad2
mov dword [esi + 4], 1
mov byte [esi + 0x15], bl
mov dword [esi + 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], ebx
call sub.DUser.dll_InitGadgets
cmp eax, ebx
mov dword [esi], eax
jne 0x1022b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebx
je 0x1022b26
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x1022ae2
call fcn.0102327b
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1022aef
push eax
call fcn.010239e3
mov eax, dword [esi]
cmp eax, ebx
je 0x1022afb
push eax
call sub.DUser.dll_DeleteHandle
cmp dword [esi + 0x20], ebx
je 0x1022b06
push esi
call fcn.01024483
cmp dword [0x105c42c], ebx
je 0x1022b13
call fcn.01028cc0
push esi
call fcn.01019800
push ebx
push dword [0x10501c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
jmp 0x1022b35
add esi, 0x24
push esi
call fcn.01028dcf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1022b41
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10501c8]
cmp eax, 0xffffffff
jne 0x1022b51
mov eax, 0x80004005
ret
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x1022b69
mov eax, 0x8004000a
jmp 0x1022be2
dec dword [esi + 4]
cmp dword [esi + 4], ebx
jg 0x1022be0
call sub.DUser.dll_DUserFlushMessages
call sub.DUser.dll_DUserFlushDeferredMessages
push dword [esi]
call sub.DUser.dll_DeleteHandle
push esi
call fcn.01024483
cmp byte [esi + 0x15], bl
je 0x1022b93
call dword [sym.imp.UxTheme.dll_BufferedPaintUnInit]
cmp byte [esi + 0x14], bl
je 0x1022b9e
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esi + 0x10]
call fcn.0102327b
push dword [esi + 0xc]
call fcn.010239e3
cmp dword [0x105c42c], ebx
je 0x1022bc5
call fcn.01028ec6
call fcn.01028cc0
call fcn.010312f7
mov ecx, dword [esi + 8]
call fcn.0102327b
push esi
call fcn.01019800
push ebx
push dword [0x10501c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
pop ebx
ret

Function at 0x1026ec5
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x1026efe
push 0x20
lea ecx, [ebp - 0x44]
or eax, 0x200
push ecx
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x1003848
push dword [ebp + 0x10]
push esi
call fcn.0101a2be
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop esi
call fcn.010193f0
leave
ret 0xc

Function at 0x1028dcf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push 0x20019
push edi
push 0x10038c4
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebx], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x1028e49
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push edi
push edi
push 0x10038a0
push dword [ebp - 8]
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x1028e3c
xor eax, eax
cmp dword [ebp + 8], edi
setne al
mov dword [0x105c42c], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x1028e5e
jle 0x1028e57
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
mov dword [ebp - 4], esi
jl 0x1028e75
cmp dword [0x105c42c], edi
je 0x1028e70
push ebx
push edi
call fcn.01028d8c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jge 0x1028e89
mov eax, dword [ebx]
cmp eax, edi
je 0x1028e81
push eax
call fcn.010239e3
mov dword [ebx], edi
mov dword [0x105c42c], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10291e6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1029269
push 0x1005200
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1029262
push 8
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x102924c
xor eax, eax
jmp 0x102926e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102926e
and eax, 0xffff
or eax, 0x80070000
jmp 0x102926e
mov eax, 0x80004005
jmp 0x102926e
mov eax, 0x8007007a
mov ecx, dword [ebp - 4]
mov dword [esi], edi
pop edi
xor ecx, ebp
pop esi
call fcn.010193f0
leave
ret 4

Function at 0x102c4c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10501c4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, ecx
or edx, eax
je 0x102c4f2
push 1
push eax
push ecx
push 1
push 0x100338c
call fcn.0101e4a1
mov esi, dword [ebp + 0xc]
push 0x100580c
push dword [ebp + 8]
mov dword [edi + 0xc], esi
push esi
mov dword [ebp + 0xc], 0x8004005a
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x102c55e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x102c55e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp + 0xc]
call fcn.01029667
mov esi, eax
test esi, esi
je 0x102c557
push dword [edi + 0xc]
mov ecx, edi
push esi
call fcn.0102c43b
push esi
mov dword [ebp + 0xc], eax
call fcn.01019800
jmp 0x102c55e
mov dword [ebp + 0xc], 0x8007000e
mov eax, dword [0x10501c4]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
pop edi
mov edx, ecx
or edx, eax
pop esi
pop ebx
je 0x102c582
push 2
push eax
push ecx
push 1
push 0x100338c
call fcn.0101e4a1
mov eax, dword [ebp + 0xc]
pop ebp
ret 8
Function at 0x102ef76
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test byte [edi + 0x6c], 1
jne 0x102f08a
test byte [edi + 0xb0], 8
je 0x102f08a
push esi
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
call fcn.010197e1
test eax, eax
mov dword [ebp - 0x210], eax
je 0x102f089
and dword [ebp - 0x214], 0
push esi
push eax
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
test al, al
mov ecx, edi
jne 0x102effa
lea eax, [ebp - 0x214]
push eax
call fcn.0101e295
test eax, eax
jne 0x102f01a
jmp 0x102f015
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0101f8fb
test eax, eax
lea eax, [ebp - 0x20c]
jge 0x102f01a
mov eax, 0x1001760
mov ecx, dword [ebp - 0x210]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x102f048
test si, si
je 0x102f044
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x102f048
add ecx, 4
add edx, 4
test si, si
jne 0x102f022
xor ecx, ecx
jmp 0x102f04d
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x102f05b
push eax
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x102f06c
call fcn.01017d55
jmp 0x102f07e
mov ecx, 0x104
lea eax, [ebp - 0x20c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x102f077
push dword [ebp - 0x210]
call fcn.01019800
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.010193f0
leave
ret
Function at 0x10326f8
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x105c488], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x103281f
lea eax, [ebp - 0x210]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x210], edi
call fcn.01031ea4
test eax, eax
jl 0x103281f
push edi
push 0x1006178
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010326a8
test eax, eax
jl 0x103281f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [0x105c47c], eax
je 0x103281f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [edi + 0x1051aa8]
lea esi, [edi + 0x1051aac]
push dword [0x105c47c]
call ebx
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], 0
je 0x103282f
add edi, 8
cmp edi, 0x30
jb 0x1032795
call fcn.0103132b
mov edi, eax
test edi, edi
je 0x103281e
mov eax, dword [ebp - 0x210]
xor edi, edi
test eax, eax
je 0x103281e
and word [ebp + eax*2 - 0x20c], di
push edi
push 0x1006160
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010326a8
test eax, eax
jl 0x103281e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x105c480], eax
je 0x103281e
push 0x1006144
push eax
call ebx
test eax, eax
mov dword [0x105c460], eax
je 0x103281e
inc edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010193f0
leave
ret
xor edi, edi
jmp 0x103281e

Function at 0x1037840
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push esi
mov dword [esi], 0x1007778
mov dword [esi + 8], 0x100775c
mov dword [esi + 0xc], 0x1007738
call fcn.01032b4c
mov ecx, dword [esi + 0x14]
call fcn.01024298
lea eax, [esi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esi], 0x1003484
pop esi
jmp fcn.01024761
Function at 0x104a729
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x104a74d
mov edx, eax
mov eax, dword [ebp + 8]
xor ecx, dword [eax]
add eax, 4
dec edx
jne 0x104a745
mov eax, ecx
push 0x7f
xor edx, edx
pop ecx
div ecx
mov eax, edx
pop ebp
ret 8
Function at 0x401170
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ecx + 0x14], 0xf
jbe 0x40117e
mov ecx, dword [ecx]
cmp dword [edx + 0x14], 0xf
jbe 0x401186
mov edx, dword [edx]
push 0
push 0
push ecx
push edx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push 0x4018e0
push ecx
test eax, eax
js 0x4011bd
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Downloaded_file
call fcn.004016c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_download_file
call fcn.004016c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esp, ebp
pop ebp
ret
Function at 0x40238a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4023c9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4023c9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4023c9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4023c9
cmp dword [ecx + 0x74], 0xe
jbe 0x4023c9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0xd390fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd39106
pushal
call 0xd3910c
pop ebp
sub ebp, 0x10
sub ebp, 0x9390fc
jmp 0xd39122
mov eax, 0x9390fc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d4
mov edx, 0x296a1513
xor byte [eax], dl
inc eax
dec ecx
jne 0xd39139
test esi, esi
invalid
jmp 0xd3914c
cwde
ficomp word [eax + 0x13132f9a]
adc edx, dword [edx + 0x1313ebd2]
adc edx, dword [eax]
fisubr word [ebx + 0x13131316]
test eax, 0x1313133b
in al, 0xf1
adc bl, bl
cwde
xchg edx, eax
pop ds
adc edx, dword [ebx]
adc edx, dword [eax]
salc
inc ebx
sahf
ja 0xd391ad
out dx, eax
lcall 0xccd, 0xbf7b3717
adc edi, dword [ebx + 0x5d]
mov eax, dword [0x3f121360]
aaa
jnp 0xd3913e
inc esi
popfd
invalid
adc dword [edx], esp
adc dword [eax + 0x1c5a17d1], edx
xchg esi, eax
out 0xec, eax
in al, dx
in al, dx
dec esi
rcr dword [edi], 1
adc ebx, dword [eax + 0x1317379f]
adc edx, dword [ebx]
jnp 0xd39186
int 0xc
adc edi, dword [ebx + 0x5d]
mov eax, dword [0x3f121360]
aaa
inc edx
sti
push ss
adc edx, dword [ebx]
adc edi, edx
inc esp
adc dword [ebx], edx
adc ebx, dword [esi - 0x6510c889]
aas
aaa
cwde
invalid
Function at 0x484255
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x53966c]
cmp eax, 0xffffffff
jne 0x484361
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa45640
call sub.msvcrt.dll_memset
mov dword [0xa45640], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa45684
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa45684
mov dword [esp + 0x20], 0xa45640
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x484357
mov eax, dword [0xa45684]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa45684]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa45688]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x53966c], 1
jmp 0x484361
mov dword [0x53966c], 0
mov eax, dword [0x53966c]
leave
ret
Function at 0x49534e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00494f4a
test eax, eax
sete al
test al, al
je 0x49537a
mov eax, 0xfffffffe
mov edx, 0xffffffff
jmp 0x49542d
mov edx, dword [0x6aaedc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov edi, ecx
sub edi, eax
mov eax, edi
add eax, edx
mov dword [0xa3494c], eax
mov eax, dword [0xa3494c]
movzx eax, byte [eax + 0x70]
test al, al
je 0x4953b1
mov eax, 0xfffffffc
mov edx, 0xffffffff
jmp 0x49542d
mov eax, dword [0x6aaed8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa34950], eax
mov edi, 0xa34958
mov eax, dword [0xa34950]
mov eax, dword [eax]
mov dword [esp + 4], 0xa3495c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [edi], eax
mov eax, dword [0xa34958]
mov edx, dword [0xa3495c]
mov ebx, eax
and bh, 0xff
mov esi, edx
and esi, 0
mov eax, ebx
xor eax, 0xffffffff
or eax, esi
test eax, eax
jne 0x495422
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x495422
mov eax, 0xfffffffd
mov edx, 0xffffffff
jmp 0x49542d
mov eax, dword [0xa34958]
mov edx, dword [0xa3495c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x496dd3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00494f4a
test eax, eax
sete al
test al, al
je 0x496e11
mov eax, 0xfffffffe
jmp 0x496fcb
mov edx, dword [0x6aaedc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov ebx, ecx
sub ebx, eax
mov eax, ebx
add eax, edx
mov dword [0xa34894], eax
mov eax, dword [0xa34894]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x496e46
mov eax, 0xfffffffd
jmp 0x496fcb
cmp dword [ebp - 0x14], 0
jns 0x496e56
mov eax, 0xfffffffc
jmp 0x496fcb
mov eax, dword [ebp - 0xc]
mov edx, eax
xor edx, 0xffffffff
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
or eax, edx
test eax, eax
je 0x496ea0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00496c99
mov dword [0xa34898], eax
mov eax, dword [0xa34898]
test eax, eax
setne al
test al, al
je 0x496ea0
mov eax, dword [0xa34898]
jmp 0x496fcb
mov eax, dword [0x6aaed8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa3489c], eax
jmp 0x496fb1
cmp dword [ebp - 0x14], 0
jle 0x496ed1
mov dword [0xa348a0], 0xffffffff
add dword [ebp - 0x18], 1
adc dword [ebp - 0x14], 0xffffffff
jmp 0x496ee7
mov eax, dword [ebp - 0x18]
mov dword [0xa348a0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [0xa348a0]
mov eax, dword [0xa3489c]
mov eax, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xa348a8
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x496f53
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [0xa348b0], eax
mov eax, dword [0xa348b0]
cmp eax, 5
je 0x496f45
mov eax, dword [0xa348b0]
cmp eax, 0x21
jne 0x496f4c
mov eax, 0xfffffff9
jmp 0x496fcb
mov eax, 0xfffffff7
jmp 0x496fcb
mov eax, dword [0xa348a8]
mov edx, dword [0xa348ac]
add dword [ebp + 0x14], eax
mov esi, dword [0xa34894]
mov eax, dword [0xa34894]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov eax, dword [0xa348a8]
mov edx, dword [0xa348ac]
add eax, ecx
adc edx, ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0xa348a0]
mov ecx, eax
mov ebx, 0
mov eax, dword [0xa348a8]
mov edx, dword [0xa348ac]
mov esi, ebx
xor esi, edx
xor eax, ecx
or eax, esi
test eax, eax
je 0x496fb1
mov eax, 0xffffffff
jmp 0x496fcb
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
or eax, edx
test eax, eax
setne al
test al, al
jne 0x496eb7
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4ade7f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4adec9
mov dword [esp], 7
call fcn.00461298
mov eax, dword [ebp - 0x14]
jmp 0x4adf64
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov edx, eax
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne al
test al, al
je 0x4adf25
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.004629b2
mov dword [ebp - 0x14], eax
mov dword [esp], 0x33
call fcn.00461298
mov eax, dword [ebp - 0x14]
jmp 0x4adf64
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004629b2
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x4b64f0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [0xa56fe0], eax
jmp fcn.004b5ce0