joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b5e21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edi, 0x659680
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x3c], ebx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x5158bf
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
mov esi, 0x659680
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov esi, dword [esp + 0x40]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x515915
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov edi, dword [ecx + 0xbc]
lea esi, [ecx + 0xb8]
mov ecx, esi
mov edx, dword [edi + 4]
push edx
push edi
call fcn.00518600
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
mov dword [ecx], eax
add eax, 8
push edx
push eax
call fcn.00518630
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
add esp, 8
inc edx
mov dword [esi + 8], edx
mov esi, dword [eax + 0xc0]
dec esi
cmp ecx, ebx
je 0x51598c
mov al, byte [ecx - 1]
cmp al, bl
je 0x515982
cmp al, 0xff
je 0x515982
dec al
mov byte [ecx - 1], al
jmp 0x51598c
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x54ae10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b69b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0054bcb0
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x54aebb
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x54aeb2
cmp al, 0xff
je 0x54aeb2
dec al
mov byte [ecx], al
jmp 0x54aebb
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x54aeec
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x54aee3
cmp al, 0xff
je 0x54aee3
dec al
mov byte [ecx], al
jmp 0x54aeec
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4a4a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x4a4b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x4a4b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x4a4b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a4b71
test eax, eax
je 0x4a4b67
add ebx, 0x14
jmp 0x4a4b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x4a4b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x4a4ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x4a4ddd
mov eax, 1
test eax, eax
je 0x4a4ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x4a4ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x4a4dd3
mov ebx, eax
and eax, 0x80000000
jne 0x4a4d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x4a4ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x4a4ddd
mov eax, 1
test eax, eax
je 0x4a4ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x4a4ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x4a4ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x4a4ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x4a4b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x4a4ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x4a4ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x4a4e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x4a4fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x4a4fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.004a4ff8
test eax, eax
je 0x4a4fee
add ebx, 0x28
dec ecx
jne 0x4a4fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x4a509e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x4a50c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x4a512e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x4a50e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x4a512e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x4a5105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x4a512e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x4a5123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x4a512e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x4a516b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x4a5172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4a51a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4a51a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x4a5dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.004a5f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.004a5f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.004a5eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004a5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004a5ecb
push ecx
push dword [ebp + 8]
call fcn.004a5f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004a5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004a5ecb
push ecx
push dword [ebp + 8]
call fcn.004a5f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004a5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004a5ecb
push ecx
push dword [ebp + 8]
call fcn.004a5f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.004a5f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.004a5ecb
cmp ecx, 0x2b
jne 0x4a5e0f
leave
ret 0xc

Function at 0x4a74b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x4a7544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x532f0
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4a75d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x532f0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x532f0
call fcn.004a73fa
push 0x532f0
push dword [ebp + 0xc]
call fcn.004a51a8
test eax, eax
jne 0x4a75b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x532f0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004a75dd
test eax, eax
je 0x4a75d6
jmp 0x4a7574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4a75d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x4a760b
Capabilities:
Terminate process

Disassembly:
call fcn.004a7618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x93049c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9304a2
pop ebp
sub ebp, 6
sub ebp, 0x53049c
jmp 0x930500
jmp 0x930509
mov eax, 0x53049c
add eax, ebp
add eax, 0x93
mov ecx, 0x630
mov edx, 0x6f05e9e9
xor byte [eax], dl
inc eax
dec ecx
jne 0x930520
jmp 0x930533
sub dword [ecx - 0x1606167f], 0xffffffe9
sub ecx, 0xdae9c525
sub dword [ecx - 0x576e83ea], edi
mov al, byte [0x2462b9e9]
bound esp, qword [eax - 0x2b]
jmp 0x28fbef3c

Function at 0x10631058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106311a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1063107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063106a
add dl, dl
jne 0x10631089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106310dc
xor eax, eax
add dl, dl
jne 0x10631096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063117d
add dl, dl
jne 0x106310a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106310b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106310bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106310c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106310d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10631075
mov eax, 1
add dl, dl
jne 0x106310ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106310f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106310e1
sub eax, ebx
mov ebx, 1
jne 0x10631128
mov ecx, 1
add dl, dl
jne 0x1063110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10631119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10631105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10631075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1063113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1063114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10631136
cmp eax, 0x7d00
jae 0x1063116d
cmp eax, 0x500
jb 0x10631168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10631075
cmp eax, 0x7f
ja 0x10631170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10631075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1063119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10631075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x104a6ab
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x65c
mov eax, dword [0x111121c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x654], ecx
xor ebx, ebx
xor eax, eax
cmp esi, ebx
mov word [ebp - 0x440], bx
mov ecx, 0x103
lea edi, [ebp - 0x43e]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x658], esi
mov dword [ebp - 0x650], 0x80004005
stosw word es:[edi], ax
je 0x104a8c6
push 0x208
lea eax, [ebp - 0x440]
push eax
push 0x9d42
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x104a8c6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, 0x209
lea eax, [esi + esi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x64c], eax
je 0x104a8c6
mov ecx, dword [ebp - 0x658]
mov dword [ebp - 0x65c], ecx
lea ecx, [ebp - 0x65c]
push ecx
push esi
push eax
push ebx
push ebx
lea eax, [ebp - 0x440]
push eax
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp + 0xc], ebx
jne 0x104a7cb
push 0xa
pop ecx
mov esi, 0x1008400
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x64c]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x104a7cb
push 0x1004414
add esi, 0x28
push esi
call edi
cmp eax, ebx
je 0x104a7cb
sub eax, esi
sar eax, 1
cmp eax, ebx
jle 0x104a7cb
mov ecx, dword [ebp - 0x64c]
sub esi, ecx
mov edx, esi
sar edx, 1
inc esi
inc esi
dec eax
mov word [ecx + edx*2], 0x30
jne 0x104a7bc
mov eax, dword [ebp - 0x658]
cmp word [eax], bx
je 0x104a85a
mov esi, dword [ebp - 0x654]
add esi, 0x3b8
cmp word [esi], bx
jne 0x104a85a
lea eax, [ebp - 0x648]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x104a85a
push esi
push ebx
push 0x10083f8
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x10083ec
push esi
call edi
cmp eax, ebx
jne 0x104a836
push 0x10083e8
push esi
call edi
mov ecx, eax
sub ecx, dword [ebp - 0x654]
mov edx, 0x104
sub ecx, 0x3b8
sar ecx, 1
sub edx, ecx
push edx
push 0x10083dc
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, dword [ebp - 0x654]
add eax, 0x3b8
cmp eax, ebx
je 0x104a8ba
cmp word [eax], bx
je 0x104a8ba
push ebx
push 0x102
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x104a8ba
push ebx
lea eax, [ebp - 0x650]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp - 0x64c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x650], ebx
push dword [ebp - 0x64c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x650]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret 8
Function at 0x104cfaf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x111121c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x104d023
push eax
mov esi, 0x1004d0c
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push 0x1007208
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x218]
push 0x104
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
test eax, eax
je 0x104d023
mov ecx, dword [0x1113528]
push 1
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.0104b05e
push eax
call fcn.01060869
cmp eax, 0x20
ja 0x104d12e
mov ebx, 0x20019
push ebx
push 0
mov edi, 0x80000002
push edi
push 0x10072fc
lea ecx, [ebp - 0x250]
call fcn.01064103
mov esi, 0x1001bc8
push esi
lea ecx, [ebp - 0x250]
call fcn.01064159
push eax
push 0x1007328
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push ebx
xor ebx, ebx
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.01064103
push esi
lea ecx, [ebp - 0x234]
call fcn.01064159
cmp dword [ebp - 0x230], ebx
mov edi, eax
jne 0x104d118
cmp word [edi], 0x22
jne 0x104d0bb
inc edi
inc edi
push 0x22
lea eax, [edi + 2]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x104d0c6
mov word [esi], bx
inc esi
inc esi
jmp 0x104d0c6
push 0x20
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
push 0x410
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x104d0f8
and word [ebx], 0
test esi, esi
je 0x104d0f8
cmp word [esi], 0x20
jne 0x104d0eb
and word [esi], 0
inc esi
inc esi
push 0x208
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [0x1113528]
push 1
push 0
push ebx
push edi
push 0
call fcn.0104b05e
push eax
call fcn.01060869
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x234]
call fcn.0106413d
lea ecx, [ebp - 0x250]
call fcn.0106413d
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105eca9
leave
ret 4