joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403e59
pop dword [ebp - 0x4c]
mov eax, 0x403e59
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x2bd06bce
sub dword [ebp - 0x5c], 0xdd7e2683
mov dword [ebp - 0x58], 0x6d187f7c
add dword [ebp - 0x58], 0xc51accc9
mov dword [ebp - 0x54], 0x16f2b148
add dword [ebp - 0x54], 0x355992e6
mov dword [ebp - 0x50], 0xc89e5bdc
add dword [ebp - 0x50], 0x3761a424
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xd299db42
sub eax, 0xd2596ade
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x920a4d48
add dword [ebp - 0x5c], 0xe2681c0e
mov dword [ebp - 0x58], 0x35f7c4f
sub dword [ebp - 0x58], 0xc1f31ada
mov dword [ebp - 0x54], 0xa9e6a2bb
sub dword [ebp - 0x54], 0x4677364f
mov dword [ebp - 0x50], 0x3e5337bb
add dword [ebp - 0x50], 0xc1acc845
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x33015
push 0
call eax
mov ecx, 0xdd426d7e
sub ecx, 0xdd423476
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x4c]
mov edi, 0x791063ee
sub edi, 0x7ec66b98
xor dword [ebp - 0x2c], esi
mov esi, dword [ebx]
sub dword [ebp - 0x28], esi
add esi, edi
xor dword [ebp - 0x14], ebx
mov dword [edx], esi
sub dword [ebp - 0x1c], esi
add edx, 4
add ebx, 4
loop 0x403f6d
add eax, 0xadba95a5
add eax, 0x5246414e
xor ebx, ebx
add ebx, eax
add eax, 0x56f029c2
add eax, 0xa90fd643
mov ecx, 0x4d17cede
add ecx, 0xb3283122
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4044c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
push ebx
push esi
mov eax, dword [eax + ecx + 0x78]
push edi
mov dword [ebp - 8], ecx
mov edx, dword [eax + ecx + 0x1c]
mov dword [ebp - 0x10], edx
lea ebx, [edx + ecx]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [eax + ecx + 0x20]
mov eax, dword [eax + ecx + 0x24]
add ebx, ecx
add eax, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 4], eax
test edx, edx
je 0x404554
nop
mov edi, dword [ebx + eax*4]
mov ebx, 0x35
add edi, ecx
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404511
sub ecx, esi
je 0x40453d
nop dword [eax]
movsx ecx, byte [edx + edi]
lea ebx, [ebx + ebx*2]
mov eax, edi
add ebx, ecx
inc edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404530
sub eax, esi
cmp edx, eax
jb 0x404520
mov eax, dword [ebp - 4]
cmp ebx, dword [ebp - 0xc]
je 0x40455d
mov ecx, dword [ebp - 8]
inc eax
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x10]
jb 0x404500
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x405bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x405bfb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004067d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x405c1d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x405c1f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x405cbe
jg 0x405c3c
test esi, esi
je 0x405cbe
test ecx, ecx
jl 0x405c89
jg 0x405c46
test eax, eax
je 0x405c89
cmp ebx, ecx
jg 0x405c5a
jl 0x405c50
cmp esi, eax
jae 0x405c5a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00445760
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x405c90
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x405cbe
jg 0x405c9a
test esi, esi
je 0x405cbe
cmp dword [edi + 0x4c], 0
je 0x405cbe
mov ecx, edi
call fcn.00408430
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.00490af0
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4092e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcc50
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x517070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x4b
push str.d:program_filesmicrosoft_visual_studio2022community_vc_toolsmsvc14.16.27023includexlocale
push 2
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0048f530
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4093c9
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040e7f0
mov dword [edi + 4], eax
lea ecx, [esi + 8]
lea eax, [esi + 4]
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], eax
add esp, 4
lea eax, [esi + 0x14]
mov dword [esi + 0x34], edi
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov ecx, esi
mov eax, dword [esi + 0x20]
push 0
push dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.004085c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0040f390
int3

Function at 0x409ba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcd50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x517070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x4b
push str.d:program_filesmicrosoft_visual_studio2022community_vc_toolsmsvc14.16.27023includexlocale
push 2
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0048f530
mov edi, eax
add esp, 0x10
test edi, edi
je 0x409ca2
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040e7f0
add esp, 4
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], edi
push 0x20
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
call fcn.00409ee0
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x409c80
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.00403440
cmp byte [ebp + 0xc], 0
je 0x409c8f
push esi
call fcn.0040f500
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.0040f390
int3
Function at 0x44a060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.00449c30
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44a08c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call dword [0x4e318c]
call dword [ebp - 8]
jmp 0x44a096
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x4aedf0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004ae490
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4aee24
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4e318c]
call dword [ebp - 8]
jmp 0x4aee2a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4aee80
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004ae4d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4aeeb4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4e318c]
call dword [ebp - 8]
jmp 0x4aeebe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x4aeed0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004ae4f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4aef08
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x4e318c]
call dword [ebp - 8]
jmp 0x4aef16
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x4aefe0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004ae590
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4af020
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4e318c]
call dword [ebp - 8]
jmp 0x4af03e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004af3a0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b09c0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.004db810
mov eax, dword [0x517070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x519e58]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x4b0b98
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x4b0ae7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x4b0ae7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x4b0ac5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x4b0a49
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b0b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x4b0bb8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x4b0b93
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4b0bb8
jmp 0x4b0a22
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442f60
mov esp, ebp
pop ebp
ret
Function at 0x4b0bd0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.004db810
mov eax, dword [0x517070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x519e58]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x4b0dbb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x4b0d06
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x4b0d06
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x4b0ce2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x4b0c59
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b0d74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4b0ddb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x4b0db6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x4b0ddb
jmp 0x4b0c32
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00442f60
mov esp, ebp
pop ebp
ret
Function at 0x4c4590
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.004c4430
lea ecx, [ebp - 4]
call fcn.004c4560
movzx eax, al
test eax, eax
jne 0x4c45cd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x18]
jmp 0x4c46f5
lea ecx, [ebp - 4]
call fcn.004c4530
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004c44f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.004c4530
push eax
push 0
push 0
call fcn.004be940
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4c4633
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x20]
jmp 0x4c46f5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0048f530
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00447390
lea ecx, [ebp - 8]
call fcn.00447430
movzx edx, al
test edx, edx
jne 0x4c467c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.004473d0
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x24]
jmp 0x4c46f5
lea ecx, [ebp - 8]
call fcn.004474f0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.004c4530
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.004be940
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4c46d7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.004473d0
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x34]
jmp 0x4c46f5
lea ecx, [ebp - 8]
call fcn.0048fe90
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.004473d0
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x4c4700
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.004c4430
lea ecx, [ebp - 4]
call fcn.004c4470
movzx eax, al
test eax, eax
jne 0x4c473d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x14]
jmp 0x4c47f7
lea ecx, [ebp - 4]
call fcn.004c4530
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004c44f0
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.0048f530
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00491800
lea ecx, [ebp - 8]
call fcn.004a2dd0
movzx ecx, al
test ecx, ecx
jne 0x4c47ad
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.00491820
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x1c]
jmp 0x4c47f7
lea ecx, [ebp - 4]
call fcn.004c4530
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.00491b30
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00445760
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.0049bea0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.00491820
lea ecx, [ebp - 4]
call fcn.004c4450
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x4d8bf0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.0049ae40
lea ecx, [ebp - 0x34]
call fcn.0049ae40
call fcn.004ab3c0
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049ad90
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d8c43
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.0049aee0
lea ecx, [ebp - 0x4c]
call fcn.0049aee0
mov eax, dword [ebp - 8]
jmp 0x4d8cb8
call fcn.004ab3c0
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049ad90
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d8c7e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.0049aee0
lea ecx, [ebp - 0x4c]
call fcn.0049aee0
mov eax, dword [ebp - 0x10]
jmp 0x4d8cb8
lea ecx, [ebp - 0x34]
call fcn.0049b1d0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.0049b1d0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.0049aee0
lea ecx, [ebp - 0x4c]
call fcn.0049aee0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040d73f
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040d73f
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040d73f
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040d73f
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040d73f
mov dword [0x41203c], eax
call fcn.0040d73f
test eax, eax
jge 0x402550
push 8
call fcn.0040d73f
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040d73f
pop ecx
push 1
call fcn.0040d73f
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040d73f
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040d73f
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040d73f
jmp 0x402495

Function at 0x40d73f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d74e
pop dword [ebp - 0x1c]
mov eax, 0xa59c523d
sub eax, 0xa55b7aef
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x36b17
push 0
mov eax, 0xa66c7022
add eax, 0x59d470b6
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3df0
xor edi, edi
add edi, eax
mov ebx, 0xab68a476
add ebx, 0x54d8974e
add ebx, dword [ebp - 0x1c]
mov esi, 0x5a34559b
add esi, 0xffd9b308
xor dword [ebp - 4], 0xc4c16c9a
mov edx, dword [ebx]
mov dword [ebp - 0x10], 0x263c0f51
add edx, esi
xor dword [ebp - 0xc], 0xfbcc9df1
mov dword [edi], edx
sub dword [ebp - 0xc], 0x9b34187e
add edi, 0x73590c8f
add edi, 0x8ca6f375
add ebx, 0x2e92cdc0
add ebx, 0xd16d3244
loop 0x40d7a9
add eax, 0x78bd8ab9
add eax, 0x87435fda
xor ebx, ebx
add ebx, eax
add eax, 0x787e7064
add eax, 0x87818fa1
mov ecx, 0xc99ed3b4
add ecx, 0x36a12c4c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret