joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b542
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x1005b632
mov eax, 0x94
call fcn.10056840
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1005b6a7
mov ecx, dword [esi + 0x10]
mov dword [0x1008a6bc], ecx
mov eax, dword [esi + 4]
mov dword [0x1008a6c8], eax
mov edx, dword [esi + 8]
mov dword [0x1008a6cc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1008a6c0], esi
je 0x1005b5ad
or esi, 0x8000
mov dword [0x1008a6c0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1008a6c4], eax
call fcn.1005d56c
test eax, eax
pop ecx
je 0x1005b6a7
call fcn.1005e7c4
test eax, eax
jne 0x1005b5da
call fcn.1005d5bd
jmp 0x1005b6a7
call fcn.10061ce3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1008af94], eax
call fcn.10062d20
mov dword [0x1008a730], eax
call fcn.10061a99
test eax, eax
jl 0x1005b62b
call fcn.10062c7e
test eax, eax
jl 0x1005b626
call fcn.10062a4b
test eax, eax
jl 0x1005b626
push 0
call fcn.1005a663
test eax, eax
pop ecx
jne 0x1005b626
inc dword [0x1008a72c]
jmp 0x1005b6b8
call fcn.10061c97
call fcn.1005e5ad
jmp 0x1005b5d0
test eax, eax
jne 0x1005b662
cmp dword [0x1008a72c], eax
jle 0x1005b6a7
dec dword [0x1008a72c]
cmp dword [0x1008a6f8], eax
jne 0x1005b651
call fcn.1005a7a1
call fcn.10061c97
call fcn.1005e5ad
call fcn.1005d5bd
jmp 0x1005b6b8
cmp eax, 2
jne 0x1005b6ab
push 0x8c
push 1
call fcn.10061d6b
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1005b6a7
push esi
push dword [0x10084d58]
call dword [0x1008a904]
test eax, eax
push esi
je 0x1005b6a1
call fcn.1005e5ca
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1005b6b8
call fcn.100564da
pop ecx
xor eax, eax
jmp 0x1005b6bb
cmp eax, 3
jne 0x1005b6b8
push 0
call fcn.1005e795
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x100601d5
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x10084500]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10084e88]
je 0x1006020a
inc eax
cmp eax, 0x13
jb 0x100601fb
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10084e88]
jne 0x10060330
mov eax, dword [0x1008a738]
cmp eax, 1
je 0x10060308
cmp eax, edx
jne 0x1006023a
cmp dword [0x1008a73c], 1
je 0x10060308
cmp ecx, 0xfc
je 0x10060330
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10060270
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10057da0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10056d60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100602a4
mov eax, edi
push eax
call fcn.10056d60
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10075d04
push edi
call fcn.10057be0
add esp, 0x10
push edi
call fcn.10056d60
push dword [esi + 0x10084e8c]
mov ebx, eax
call fcn.10056d60
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10056840
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10057da0
push edi
push ebx
call fcn.10057db0
push 0x10075d00
push ebx
call fcn.10057db0
push dword [esi + 0x10084e8c]
push ebx
call fcn.10057db0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100647b0
add esp, 0x2c
jmp 0x10060330
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x10084e8c]
push dword [esi]
call fcn.10056d60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.100568ae
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10061395
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x10061569
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x1008ac20]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x10061569
test cl, 0x48
je 0x10061400
cmp byte [eax + 5], 0xa
je 0x10061400
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10061452
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x1006143a
call fcn.100596a0
mov dword [eax], 9
call fcn.100596a9
mov dword [eax], esi
jmp 0x1006144a
cmp eax, 0x6d
je 0x10061569
push eax
call fcn.100596b2
pop ecx
or eax, 0xffffffff
jmp 0x1006156b
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x10061564
test eax, eax
je 0x10061479
cmp byte [ebx], 0xa
jne 0x10061479
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x10061482
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x1006155e
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x1006154e
cmp al, 0xd
je 0x100614b4
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x10061540
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x100614ce
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x100614c9
add dword [ebp + 0x10], 2
jmp 0x10061522
mov dword [ebp + 0x10], eax
jmp 0x1006153c
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100614f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1006153c
cmp dword [ebp - 0xc], 0
je 0x1006153c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x10061517
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10061522
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1006153f
cmp ebx, dword [ebp + 0xc]
jne 0x10061527
cmp byte [ebp - 1], 0xa
jne 0x10061527
mov byte [ebx], 0xa
jmp 0x1006153f
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10061195
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10061540
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x10061498
jmp 0x1006155e
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x1006155e
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x1006156b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10061764
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x10084500]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x10061795
xor eax, eax
jmp 0x1006191e
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x1008ac20]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100617d1
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.100655e8
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100618ac
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x100618ea
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x10061835
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x10061826
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x10061806
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10061875
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x1006187e
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x100617f7
jmp 0x10061880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x10061919
cmp dword [ebp - 0x6c], edi
je 0x100618ea
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x100618df
call fcn.100596a0
mov dword [eax], 9
call fcn.100596a9
mov dword [eax], esi
jmp 0x10061914
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100618d4
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x10061880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x10061880
push dword [ebp - 0x6c]
call fcn.100596b2
pop ecx
jmp 0x10061914
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x10061902
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x10061902
xor eax, eax
jmp 0x1006191c
call fcn.100596a0
mov dword [eax], 0x1c
call fcn.100596a9
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x1006191c
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.100568ae
add ebp, 0x3a0
leave
ret
Function at 0x100647b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1008abc0], ebx
push esi
push edi
jne 0x10064830
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1006486b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10077758
push edi
call esi
test eax, eax
mov dword [0x1008abc0], eax
je 0x1006486b
push 0x10077748
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1008abc4], eax
call esi
cmp dword [0x1008a6bc], 2
mov dword [0x1008abc8], eax
jne 0x10064830
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1008abd0], eax
je 0x10064830
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1008abcc], eax
mov eax, dword [0x1008abcc]
test eax, eax
je 0x10064875
call eax
test eax, eax
je 0x1006485c
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1008abd0]
test eax, eax
je 0x1006485c
test byte [ebp - 8], 1
jne 0x10064875
cmp dword [0x1008a6c8], 4
jb 0x1006486f
or byte [ebp + 0x12], 0x20
jmp 0x10064894
xor eax, eax
jmp 0x100648a4
or byte [ebp + 0x12], 4
jmp 0x10064894
mov eax, dword [0x1008abc4]
test eax, eax
je 0x10064894
call eax
mov ebx, eax
test ebx, ebx
je 0x10064894
mov eax, dword [0x1008abc8]
test eax, eax
je 0x10064894
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1008abc0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10065b5d
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x100777a0
call fcn.100566e8
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x1008abd8], edi
jne 0x10065ba1
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10065b8c
mov dword [0x1008abd8], ebx
jmp 0x10065ba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10065ba1
mov dword [0x1008abd8], 2
mov eax, dword [0x1008abd8]
cmp eax, ebx
jne 0x10065bc1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10065c84
cmp eax, 2
je 0x10065bca
cmp eax, edi
jne 0x10065bf2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x10065bdd
mov eax, dword [0x1008ab5c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x10065bf9
xor eax, eax
jmp 0x10065c84
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.10056840
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x10065c2c
cmp esi, edi
jne 0x10065c42
push dword [ebp - 0x20]
call fcn.100565f2
pop ecx
mov esi, eax
cmp esi, edi
je 0x10065bf2
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10065c75
cmp dword [ebp + 0x14], edi
jne 0x10065c5f
push edi
push edi
jmp 0x10065c65
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x10065c81
push esi
call fcn.100564da
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.10056723
ret
Function at 0x10065c8d
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x100777b0
call fcn.100566e8
xor esi, esi
cmp dword [0x1008abdc], esi
jne 0x10065cd1
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10065cbc
mov dword [0x1008abdc], edi
jmp 0x10065cd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10065cd1
mov dword [0x1008abdc], 2
mov eax, dword [0x1008abdc]
cmp eax, 2
je 0x10065db2
cmp eax, esi
je 0x10065db2
cmp eax, 1
jne 0x10065d16
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x10065cff
mov eax, dword [0x1008ab5c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x10065d1d
xor eax, eax
jmp 0x10065dc4
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10056840
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x10065d53
cmp edi, esi
jne 0x10065d6e
lea eax, [ebx + ebx]
push eax
call fcn.100565f2
pop ecx
mov edi, eax
cmp edi, esi
je 0x10065d16
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10065da1
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x10065d8b
push esi
push esi
jmp 0x10065d91
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x10065dad
push edi
call fcn.100564da
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x10065dc4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.10056723
ret
Function at 0x1006635a
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.10056840
mov eax, dword [0x10084500]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.10061195
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x1006648d
push 2
push esi
push dword [ebp + 8]
call fcn.10061195
add esp, 0xc
cmp eax, ebx
je 0x1006648d
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x1006642d
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.10056960
push 0x8000
push dword [ebp + 8]
call fcn.10066d76
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x100663e3
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.10061764
add esp, 0xc
cmp eax, 0xffffffff
je 0x10066403
sub edi, eax
test edi, edi
jg 0x100663db
jmp 0x1006641b
call fcn.100596a9
cmp dword [eax], 5
jne 0x10066418
call fcn.100596a0
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.10066d76
pop ecx
pop ecx
jmp 0x10066475
jge 0x10066475
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10061195
push dword [ebp + 8]
call fcn.10061fbc
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x10066475
call fcn.100596a0
mov dword [eax], 0xd
call fcn.100596a9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.10061195
add esp, 0xc
mov eax, esi
pop edi
jmp 0x1006648f
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.100568ae
leave
ret
Function at 0x10066ba1
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x10066bba
or eax, 0xffffffff
jmp 0x10066c1b
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x10066c17
push 0x3d
push esi
call fcn.10066e0d
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x10066c17
cmp esi, eax
je 0x10066c17
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x1008a6dc]
sete cl
cmp eax, dword [0x1008a6e0]
mov dword [ebp - 8], ecx
jne 0x10066bfd
mov edi, eax
call fcn.10066b40
mov dword [0x1008a6dc], eax
cmp eax, ebx
jne 0x10066c56
cmp dword [ebp + 0xc], ebx
je 0x10066c1f
cmp dword [0x1008a6e4], ebx
je 0x10066c1f
call fcn.10065e84
test eax, eax
je 0x10066c56
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x10066c28
xor eax, eax
jmp 0x10066c1a
push 4
call fcn.100565f2
cmp eax, ebx
pop ecx
mov dword [0x1008a6dc], eax
je 0x10066c17
mov dword [eax], ebx
cmp dword [0x1008a6e4], ebx
jne 0x10066c56
push 4
call fcn.100565f2
cmp eax, ebx
pop ecx
mov dword [0x1008a6e4], eax
je 0x10066c17
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x1008a6dc]
call fcn.10066af3
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x10066cb7
cmp dword [esi], ebx
je 0x10066cb7
lea esi, [esi + edi*4]
push dword [esi]
call fcn.100564da
cmp dword [ebp - 8], ebx
pop ecx
jne 0x10066c9a
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x10066cf8
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x10066c91
mov eax, edi
shl eax, 2
push eax
push dword [0x1008a6dc]
call fcn.1005b7da
cmp eax, ebx
pop ecx
pop ecx
je 0x10066cf8
jmp 0x10066cf3
cmp dword [ebp - 8], ebx
jne 0x10066d63
cmp edi, ebx
jge 0x10066cc6
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x1008a6dc]
call fcn.1005b7da
cmp eax, ebx
pop ecx
pop ecx
je 0x10066c17
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x1008a6dc], eax
cmp dword [ebp + 0xc], ebx
je 0x10066d4d
push dword [ebp - 4]
call fcn.10056d60
inc eax
inc eax
push eax
call fcn.100565f2
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x10066d4d
push dword [ebp - 4]
push esi
call fcn.10057da0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x10066d46
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.100564da
pop ecx
cmp dword [ebp - 8], ebx
je 0x10066d5b
push dword [ebp - 4]
call fcn.100564da
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x10066c1a
push dword [ebp - 4]
call fcn.100564da
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x10066c24
Function at 0x401a18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test eax, eax
je 0x401a27
push ebx
push esi
push eax
mov esi, eax
xor ebx, ebx
xor eax, eax
jmp 0x401a2d
mov dword [edx], eax
inc dword [edx]
ret
inc esi
movzx ecx, byte [esi]
cmp cl, 0x20
je 0x401a2c
cmp cl, 0x30
jle 0x401a72
test cl, 0x87
je 0x401a98
sub cl, 0x30
cmp cl, 9
ja 0x401a60
cmp eax, 0xccccccc
ja 0x401ad6
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
inc esi
mov bl, 1
movzx ecx, byte [esi]
jmp 0x401a3f
cmp eax, 0x80000000
jb 0x401ad6
jne 0x401a6d
test ebx, ebx
js 0x401ad6
dec esi
mov bl, 0
jmp 0x401ad6
cmp cl, 0x2b
je 0x401a7c
cmp cl, 0x2d
jne 0x401a86
mov bl, 0x2c
sub ebx, ecx
inc esi
mov bl, 0
movzx ecx, byte [esi]
cmp cl, 0x24
je 0x401aa2
cmp cl, 0x30
jne 0x401a3a
inc esi
mov bl, 1
movzx ecx, byte [esi]
jmp 0x401a3a
mov bh, cl
or bh, 0x20
cmp bh, 0x78
jne 0x401a3f
mov bl, 0
inc esi
movzx ecx, byte [esi]
cmp cl, 0x61
jb 0x401ab0
sub cl, 0x20
sub cl, 0x30
cmp cl, 9
jbe 0x401ac3
sub cl, 0x11
cmp cl, 5
ja 0x401ad3
add cl, 0xa
cmp eax, 0xfffffff
ja 0x401ad6
shl eax, 4
mov bl, 1
add eax, ecx
jmp 0x401aa4
add cl, 0x11
mov ch, bl
sar ebx, 0x1f
dec ch
xor eax, ebx
sub eax, ebx
or cl, ch
cmp cl, 0xd0
jne 0x401af0
xor esi, esi
pop ecx
mov dword [edx], esi
pop esi
pop ebx
ret
inc esi
pop ecx
sub esi, ecx
jmp 0x401aeb

Function at 0x402b80
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x44f048], 0
je 0x402be1
cmp word [0x44f21c], 0xd7b2
jne 0x402ba9
cmp dword [0x44f224], 0
jbe 0x402ba9
mov eax, 0x44f218
call dword [0x44f234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x44d084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402c08
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x44d030], 0
jne 0x402bfd
push 0
push 0x44d07c
push 0x44d084
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret