joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x4092ed
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4092b0
mov eax, dword [esi]
jmp 0x4093cb
cmp eax, 0x4e0
jb 0x4093cb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x409306
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x409351
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bd40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x40bd60
jl 0x40bd57
cmp dword [ebp + 0xc], 0
ja 0x40bd60
xor eax, eax
xor edx, edx
jmp 0x40bea2
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x40bd82
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040beb0
jmp 0x40bea2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call fcn.0040a890
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40bdf2
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00407ea0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0040b000
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00405ae0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.0040afc0
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x40be93
mov ecx, dword [ebp - 8]
call fcn.0040ac20
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x40be62
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042b960
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x40be60
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x40bea2
jmp 0x40be0e
cmp dword [ebp - 4], 0
jbe 0x40be93
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0042b960
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00416870
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x416c92
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x45d1c8]
call dword [ebp - 8]
jmp 0x416c9c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x43c000
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0043b760
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c034
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x45d1c8]
call dword [ebp - 8]
jmp 0x43c03a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x43c090
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0043b7a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c0c4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x45d1c8]
call dword [ebp - 8]
jmp 0x43c0ce
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x43c0e0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0043b7c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c118
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x45d1c8]
call dword [ebp - 8]
jmp 0x43c126
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x43c130
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0043b840
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c170
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x45d1c8]
call dword [ebp - 8]
jmp 0x43c18e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0043c380
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43dc90
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0045b090
mov eax, dword [0x478080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x47a5b0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x43de68
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x43ddb7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x43ddb7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x43dd95
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x43dd19
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43de21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x43de88
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x43de63
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x43de88
jmp 0x43dcf2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004111f0
mov esp, ebp
pop ebp
ret
Function at 0x43dea0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0045b090
mov eax, dword [0x478080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x47a5b0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x43e08b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x43dfd6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x43dfd6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x43dfb2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x43df29
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43e044
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x43e0ab
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x43e086
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x43e0ab
jmp 0x43df02
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004111f0
mov esp, ebp
pop ebp
ret
Function at 0x441570
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x478080]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00413a80
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x104
ja 0x4415d3
lea edx, [ebp - 0x210]
push edx
call fcn.00441520
add esp, 4
jmp 0x4416b1
push 0x25
push str.minkernelcrtsucrt_srcdesktopcrtmiscdrive.cpp
push 2
push 2
mov eax, dword [ebp - 0x218]
add eax, 1
push eax
call fcn.00427ab0
add esp, 0x14
push eax
lea ecx, [ebp - 0x214]
call fcn.00419100
lea ecx, [ebp - 0x214]
call fcn.00417ff0
test eax, eax
jne 0x441633
call fcn.0042eb90
mov dword [eax], 0xc
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x214]
call fcn.00419120
mov eax, dword [ebp - 0x21c]
jmp 0x4416b1
lea ecx, [ebp - 0x214]
call fcn.00417ff0
push eax
mov ecx, dword [ebp - 0x218]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x441686
call fcn.0042eb90
mov dword [eax], 0xc
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x214]
call fcn.00419120
mov eax, dword [ebp - 0x224]
jmp 0x4416b1
lea ecx, [ebp - 0x214]
call fcn.00417ff0
push eax
call fcn.00441520
add esp, 4
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x214]
call fcn.00419120
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004111f0
mov esp, ebp
pop ebp
ret
Function at 0x44d610
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00419100
lea ecx, [ebp - 4]
call fcn.0044d5e0
movzx eax, al
test eax, eax
jne 0x44d64d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x18]
jmp 0x44d775
lea ecx, [ebp - 4]
call fcn.00417ff0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0044d5a0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.00417ff0
push eax
push 0
push 0
call fcn.0044a0c0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44d6b3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x20]
jmp 0x44d775
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00427c70
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00410730
lea ecx, [ebp - 8]
call fcn.004111a0
movzx edx, al
test edx, edx
jne 0x44d6fc
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00411180
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x24]
jmp 0x44d775
lea ecx, [ebp - 8]
call fcn.004107a0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.00417ff0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.0044a0c0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x44d757
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00411180
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x34]
jmp 0x44d775
lea ecx, [ebp - 8]
call fcn.00419140
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00411180
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x44d780
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00419100
lea ecx, [ebp - 4]
call fcn.0044d520
movzx eax, al
test eax, eax
jne 0x44d7bd
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x14]
jmp 0x44d877
lea ecx, [ebp - 4]
call fcn.00417ff0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044d5a0
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.00427c70
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00419100
lea ecx, [ebp - 8]
call fcn.00433b40
movzx ecx, al
test ecx, ecx
jne 0x44d82d
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.00419120
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x1c]
jmp 0x44d877
lea ecx, [ebp - 4]
call fcn.00417ff0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.00417ff0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00413450
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00419140
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.00419120
lea ecx, [ebp - 4]
call fcn.0044d500
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x4564d0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x478080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x1a
jbe 0x456566
call fcn.0042eb60
mov dword [eax], 0xf
xor eax, eax
je 0x456500
mov dword [ebp - 0x14], 1
jmp 0x456507
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x456536
push str.__Invalid_Drive_Index___0_
push 0x45e4c8
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push 2
call fcn.004179d0
add esp, 0x18
cmp eax, 1
jne 0x456536
int3
cmp dword [ebp - 0x18], 0
jne 0x456566
call fcn.0042eb90
mov dword [eax], 0xd
push 0
push 0x1f
push str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
push str.is_valid_drive
push str.__Invalid_Drive_Index___0_
call fcn.00418230
add esp, 0x14
xor eax, eax
jmp 0x4565bf
cmp dword [ebp + 8], 0
jne 0x456573
mov eax, 1
jmp 0x4565bf
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0x10], ax
mov cx, word [ebp - 0x10]
mov word [ebp - 0xc], cx
mov edx, 0x3a
mov word [ebp - 0xa], dx
mov eax, 0x5c
mov word [ebp - 8], ax
xor ecx, ecx
mov word [ebp - 6], cx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4565b6
cmp dword [ebp - 0x1c], 1
jne 0x4565ba
xor eax, eax
jmp 0x4565bf
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004111f0
mov esp, ebp
pop ebp
ret

Function at 0x458240
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.004289d0
lea ecx, [ebp - 0x34]
call fcn.004289d0
call fcn.00428b00
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00428220
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x458293
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.00428a60
lea ecx, [ebp - 0x4c]
call fcn.00428a60
mov eax, dword [ebp - 8]
jmp 0x458308
call fcn.00428b00
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00428220
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4582ce
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.00428a60
lea ecx, [ebp - 0x4c]
call fcn.00428a60
mov eax, dword [ebp - 0x10]
jmp 0x458308
lea ecx, [ebp - 0x34]
call fcn.00428ed0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.00428ed0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.00428a60
lea ecx, [ebp - 0x4c]
call fcn.00428a60
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1001680
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
xor eax, eax
shr ecx, 3
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], eax
test ecx, ecx
je 0x100174a
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, dword [edx + eax*8]
lea ecx, [edx + eax*8]
lea eax, [eax*8 + 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
add eax, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0xc], 0x20
mov esi, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 8]
shl eax, 4
add eax, dword [ebp - 0xc]
xor ecx, eax
lea eax, [ebx + edi]
xor ecx, eax
sub esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [ebx + esi]
xor ecx, eax
lea ebx, [ebx + 0x61c88647]
sub edi, ecx
sub dword [ebp + 0xc], 1
jne 0x10016e1
mov eax, dword [ebp - 0x18]
mov dword [eax], edi
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x20]
jb 0x10016a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219