joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6cb759
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6cb791
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006c97e3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006c97bb
jmp 0x6cb79d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6cce4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6cce8d
call fcn.006d2900
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6cce8d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6cce84
xor eax, eax
jmp 0x6cce95
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006cce9b
pop edi
pop esi
pop ebx
ret 4

Function at 0x6d2e30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x6d2e5e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x6d2e7c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006d2d96
jmp 0x6d2e7c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6d2e7c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006d2d96
test edi, edi
mov eax, edi
jne 0x6d2e66
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x94ad0c], 1
mov dword [0x94ad10], 1
mov dword [0x94ad14], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x4054e0
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x83a9dc
call fcn.006e3e70
test eax, eax
je 0x4055ba
mov eax, dword [0x75571c]
mov dword [esp], eax
call fcn.00525180
mov dword [esp], 0
call fcn.00525190
mov dword [esp], 0
call fcn.005251a0
mov dword [esp], 0x14
call fcn.005251b0
mov eax, dword [0x755320]
mov dword [esp], eax
call fcn.00507940
mov dword [esp], 0
call fcn.00507960
mov dword [esp], 0
call fcn.00507970
mov dword [esp], 0x14
call fcn.00507990
mov dword [esp], 3
call fcn.00651e10
mov dword [esp], 0x8de1ec
call fcn.006e4080
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll__access
test eax, eax
jne 0x4055c8
mov dword [esp + 4], 0x76da9c
mov dword [esp], 0x8de1ec
call fcn.006e41e0
mov ebx, eax
test eax, eax
je 0x4055b5
mov dword [esp + 4], 0x7ff0c0
mov dword [esp], eax
call fcn.0043d320
test eax, eax
je 0x405630
call fcn.00670040
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0x7ff0c0
call fcn.0043e140
test eax, eax
jne 0x405640
mov eax, dword [esp + 0x20]
call fcn.00402c90
mov ebx, eax
test eax, eax
je 0x4055ba
mov dword [esp], 0x8de1e0
call fcn.006e4080
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov dword [esp + 4], 0x76da43
mov dword [esp], 0x8de1ec
call fcn.006e41e0
mov esi, eax
test eax, eax
je 0x405629
mov dword [esp + 4], 0x7ff0c0
mov dword [esp], eax
call fcn.0043caf0
test eax, eax
je 0x405650
call fcn.00670070
jmp 0x4055ba
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x4055d8
call fcn.006700a0
jmp 0x4055ba
mov dword [esp], esi
call sub.msvcrt.dll_fclose
cmp ebx, 1
je 0x405667
mov eax, 1
jmp 0x4055bc
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], 0x7ff0c0
mov dword [esp + 8], eax
call fcn.0043a620
test eax, eax
je 0x40565d
call fcn.00670070
jmp 0x40565d
Function at 0x47ced0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
mov ebp, dword [esp + 0x78]
mov eax, dword [eax]
sub eax, 1
cmp eax, 3
ja 0x47d0c4
mov dword [0x8417cc], 1
lea edx, [eax + eax*8]
mov eax, dword [edx*4 + 0x7546c0]
mov edx, dword [edx*4 + 0x7546cc]
mov dword [0x8417d8], 1
lea edx, [edx + edx*4 - 5]
mov dword [0x8417dc], eax
add eax, eax
mov esi, dword [edx*4 + 0x7544b0]
mov edx, dword [edx*4 + 0x7544c0]
mov dword [0x8417d0], eax
mov dword [esp + 0x3c], esi
mov dword [0x8417d4], esi
mov dword [0x8417c8], edx
test esi, esi
jle 0x47d0ad
lea esi, [esi]
nop
lea eax, [edx*8 + 0x751458]
mov edi, dword [esp + 0x74]
mov dword [esp + 0x20], 0x8417c0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], 0x94b7e0
mov dword [esp], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 0x8417dc
mov dword [esp + 8], 0x8417dc
mov dword [esp + 4], 0x779808
call fcn.0047ac60
mov eax, dword [esp + 0x74]
mov eax, dword [eax]
test eax, eax
jne 0x47d0b7
fldz
mov esi, dword [0x8417dc]
mov dword [0x8417ac], 1
fst qword [0x8417b8]
mov dword [0x8417a8], 1
fst qword [0x8417b0]
mov dword [0x8417a4], 1
test esi, esi
jle 0x47d0c0
mov eax, dword [esp + 0x6c]
mov ecx, esi
fld st(0)
mov edx, dword [esp + 0x68]
shl ecx, 4
mov edi, dword [eax]
mov eax, 0x94b7e0
add ecx, eax
lea ebx, [edi*8]
lea esi, [esi]
fld qword [eax]
fmul qword [edx]
add eax, 0x10
fld qword [edx + 0x10]
fmul qword [eax - 8]
faddp st(1)
faddp st(2)
fld qword [eax - 8]
fmul qword [edx + 8]
fld qword [eax - 0x10]
fmul qword [edx + 0x10]
add edx, ebx
faddp st(1)
faddp st(1)
cmp ecx, eax
jne 0x47d008
fxch st(1)
imul edi, esi
lea eax, [esi + esi + 1]
fst qword [0x8417b8]
fxch st(1)
mov dword [0x8417ac], eax
fst qword [0x8417b0]
fxch st(1)
lea eax, [edi + 1]
mov dword [0x8417a8], eax
lea eax, [esi + 1]
mov dword [0x8417a4], eax
mov eax, dword [esp + 0x70]
mov edx, dword [0x8417cc]
mov edi, dword [0x8417d8]
mov eax, dword [eax]
fstp qword [ebp + edx*8 - 8]
fstp qword [ebp + edx*8]
lea ecx, [edi + 1]
add edx, eax
mov dword [0x8417d8], ecx
mov dword [0x8417cc], edx
mov edx, dword [0x8417d0]
add edx, dword [0x8417c8]
mov dword [0x8417c8], edx
cmp dword [esp + 0x3c], ecx
jge 0x47cf50
cmp dword [0x8417d4], 1
je 0x47d0d6
mov eax, dword [esp + 0x74]
mov dword [eax], 0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
fld st(0)
jmp 0x47d05d
mov eax, dword [esp + 0x74]
mov dword [eax], 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x8417cc], eax
mov dword [0x8417d8], 2
cmp esi, 1
jle 0x47d0ad
lea ebx, [eax*8]
lea edi, [esi - 1]
xor ecx, ecx
lea edx, [ebp + ebx + 8]
lea esi, [esi]
fld qword [ebp]
add ecx, 1
fstp qword [edx - 8]
fld qword [ebp + 8]
fstp qword [edx]
add edx, ebx
cmp edi, ecx
jne 0x47d100
mov dword [0x8417a0], 3
lea edx, [esi - 2]
add esi, 1
imul edx, eax
mov dword [0x8417d8], esi
lea eax, [edx + eax*2]
mov dword [0x8417cc], eax
mov eax, dword [esp + 0x74]
mov dword [eax], 0
jmp 0x47d0b7
Function at 0x628750
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1fc
call fcn.00654cf0
mov eax, dword [0x8d3610]
test eax, eax
je 0x6288a0
cmp eax, 2
jle 0x6287a4
mov ebx, 2
lea esi, [esi]
lea esi, [esi]
mov eax, dword [ebx*4 + 0x8d3160]
add ebx, 1
mov dword [esp], eax
call fcn.00719704
cmp dword [0x8d3610], ebx
jg 0x628780
mov dword [0x8d3610], 2
mov dword [esp], 0x7a30c9
mov ebx, 1
lea edi, [esp + 0xeb]
lea esi, [esp + 0x23]
call sub.msvcrt.dll_getenv
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x628855
jmp 0x628894
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call sub.msvcrt.dll_fgets
mov eax, dword [0x8d3610]
mov dword [esp + 4], 0x7a30a4
mov dword [esp], ebp
lea eax, [eax*4 + 0x8d2ca0]
mov dword [esp + 8], eax
call fcn.00628720
mov dword [esp + 4], esi
mov eax, dword [0x8d3610]
mov dword [esp], ebp
mov dword [eax*4 + 0x8d27e0], ebx
add ebx, 1
call fcn.006e9400
mov dword [esp], esi
mov ecx, dword [0x8d3610]
mov dword [esp + 0x18], ecx
call sub.msvcrt.dll__strdup
mov ecx, dword [esp + 0x18]
mov dword [esp], ebp
mov dword [ecx*4 + 0x8d3160], eax
add ecx, 1
mov dword [0x8d3610], ecx
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x7a3095
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.006286f0
mov dword [esp + 4], 0x7a30ce
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov ebp, eax
test eax, eax
jne 0x6287d8
mov eax, dword [0x8d27c4]
test eax, eax
je 0x628900
add esp, 0x1fc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x7a30a8
call sub.msvcrt.dll__strdup
mov dword [esp], 0x7a30bd
mov dword [0x8d3160], eax
mov dword [0x8d2ca0], 0x13
mov dword [0x8d27e0], 0
call sub.msvcrt.dll__strdup
mov dword [0x8d2ca4], 0x12
mov dword [0x8d3164], eax
mov dword [0x8d27e4], 0
mov dword [0x8d3610], 2
jmp 0x6287a4
mov dword [esp], 0x7a30bd
call sub.msvcrt.dll__strdup
mov dword [0x8d27c4], eax
add esp, 0x1fc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x651c40
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x23c
call fcn.00651890
test eax, eax
je 0x651c5a
mov dword [eax + 4], 0
mov dword [esp], 0x7ab49c
call sub.msvcrt.dll_getenv
test eax, eax
je 0x651dc8
lea ebx, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x46
add eax, ebx
mov dword [eax], 0x44414e5c
mov dword [eax + 4], 0x43452d73
mov dword [eax + 8], 0x45442e32
mov word [eax + 0xc], dx
mov dword [esp + 4], 0x7ab4a1
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x651dc8
lea ebx, [esp + 0x12c]
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 8], esi
mov dword [esp + 4], 0xc8
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
test eax, eax
je 0x651dc0
cmp dword [ebx], 0x44414e23
jne 0x651cd0
call fcn.00651890
mov edi, eax
test eax, eax
je 0x651dc0
mov dword [esp + 8], eax
lea ebp, [edi + 0x678]
mov dword [esp + 4], 0x7ab4a8
mov dword [esp], esi
call fcn.00651040
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.006e9400
lea eax, [edi + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov byte [esp + 0x145], 0
call sub.msvcrt.dll_strcpy
lea edx, [edi + 0x28]
mov dword [esp], edx
mov dword [esp + 0x1c], edx
call fcn.00636560
lea eax, [edi + 0x588]
mov dword [esp], eax
mov dword [esp + 0x18], eax
call fcn.006480b0
mov dword [esp], ebp
call fcn.006486c0
mov edx, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.00639550
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00647e60
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.00648e30
lea edx, [edi + 0x820]
mov eax, esi
call fcn.006510d0
jmp 0x651cd0
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [0x8d4f54]
mov dword [0x8d4f4c], eax
test eax, eax
jne 0x651dea
jmp 0x651df4
mov eax, dword [eax + 0xb04]
test eax, eax
je 0x651df4
cmp dword [eax], 0x12
jne 0x651de0
mov dword [0x8d4f4c], eax
mov dword [0x8d4f48], 1
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x652280
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x220
mov dword [esp], 0x7ab536
call sub.msvcrt.dll_getenv
test eax, eax
je 0x652360
mov edx, dword [esp + 0x230]
lea ebx, [esp + 0x11b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x7ab528
mov dword [esp + 0xc], edx
mov dword [esp], ebx
call fcn.00652210
mov dword [esp + 4], 0x7ab53b
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x652360
mov dword [esp + 8], eax
lea ebx, [esp + 0x1b]
mov dword [esp + 4], 0x100
mov dword [esp], 0x8d5400
call sub.msvcrt.dll_fgets
mov dword [esp], 0x8d5400
call sub.msvcrt.dll_strlen
mov byte [eax + 0x8d53ff], 0
mov esi, eax
nop
mov dword [esp + 8], edi
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
test eax, eax
je 0x652370
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, ebx
lea ecx, [ebx + eax]
test eax, eax
je 0x652310
lea esi, [esi]
cmp byte [edx], 0x3c
jne 0x652350
movzx eax, word [edx + 1]
mov word [esi + 0x8d53fd], ax
add edx, 1
cmp edx, ecx
jne 0x652340
jmp 0x652310
add esp, 0x220
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x220
mov eax, 0x8d5400
pop ebx
pop esi
pop edi
ret
Function at 0x66a540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x13
ja 0x66a560
imul edx, eax, 0x78
mov edx, dword [edx + 0x75ea68]
test edx, edx
js 0x66a560
jmp fcn.00664590
ret

Function at 0x670a20
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
movsx eax, word [eax]
mov dword [esp + 4], eax
jmp fcn.00672280

Function at 0x670f40
Capabilities:
Delete file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x30]
mov dword [esp], esi
call sub.msvcrt.dll_remove
mov ebx, dword [0x8deb90]
test ebx, ebx
je 0x670fd0
xor ebx, ebx
jmp 0x670f6c
add ebx, 1
cmp ebx, 0x14
je 0x670ff0
cmp dword [ebx*4 + 0x8deb40], 0xffffffff
jne 0x670f60
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx*4 + 0x8deb40], eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x670ff0
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov edx, 0x8deb40
mov ecx, 0x14
mov eax, 0xffffffff
mov dword [0x8deb90], 1
mov edi, edx
rep stosd dword es:[edi], eax
jmp 0x670f76
mov ebx, 0xffffffff
jmp 0x670fbe

Function at 0x671000
Capabilities:
Delete file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
cmp eax, 1
je 0x6710e8
cmp eax, 2
je 0x6710d0
test eax, eax
jne 0x671108
mov esi, 3
mov edx, 1
mov ebp, 0x80000000
mov ebx, dword [0x8deb90]
test ebx, ebx
je 0x6710b0
xor ebx, ebx
jmp 0x671054
add ebx, 1
cmp ebx, 0x14
je 0x671108
cmp dword [ebx*4 + 0x8deb40], 0xffffffff
jne 0x671048
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx*4 + 0x8deb40], eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x671108
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x14
mov eax, 0xffffffff
mov edi, 0x8deb40
mov dword [0x8deb90], 1
rep stosd dword es:[edi], eax
jmp 0x67105e
mov esi, 4
xor edx, edx
mov ebp, 0xc0000000
jmp 0x671034
mov eax, dword [esp + 0x40]
mov esi, 2
mov ebp, 0x40000000
mov dword [esp], eax
call sub.msvcrt.dll_remove
xor edx, edx
jmp 0x671034
mov ebx, 0xffffffff
jmp 0x67109e

Function at 0x671240
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
mov edx, dword [0x8deb90]
mov eax, dword [esp + 0x40]
test edx, edx
je 0x6712a0
cmp eax, 0x13
ja 0x6712a0
mov eax, dword [eax*4 + 0x8deb40]
cmp eax, 0xffffffff
je 0x6712a0
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x6712a0
mov eax, dword [esp + 0x2c]
add esp, 0x3c
ret
mov eax, 0xffffffff
jmp 0x671296
Function at 0x6712b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
mov edx, dword [0x8deb90]
mov eax, dword [esp + 0x40]
test edx, edx
je 0x671310
cmp eax, 0x13
ja 0x671310
mov eax, dword [eax*4 + 0x8deb40]
cmp eax, 0xffffffff
je 0x671310
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x671310
mov eax, dword [esp + 0x2c]
add esp, 0x3c
ret
mov eax, 0xffffffff
jmp 0x671306
Function at 0x671f30
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
test esi, esi
setle al
test ebp, ebp
setle dl
or al, dl
jne 0x67204c
mov eax, dword [esp + 0x40]
test eax, eax
je 0x67204c
mov ebx, dword [0x8decac]
test ebx, ebx
je 0x6720e0
mov ebx, dword [0x8deca8]
cmp ebx, 9
jg 0x67204c
mov edi, dword [ebx*4 + 0x8dec80]
test edi, edi
je 0x672062
lea eax, [ebx + 1]
cmp ebx, 9
je 0x67204c
mov ecx, dword [eax*4 + 0x8dec80]
test ecx, ecx
je 0x672060
lea eax, [ebx + 2]
cmp ebx, 8
je 0x67204c
mov edx, dword [eax*4 + 0x8dec80]
test edx, edx
je 0x672060
lea eax, [ebx + 3]
cmp ebx, 7
je 0x67204c
mov edi, dword [eax*4 + 0x8dec80]
test edi, edi
je 0x672060
lea eax, [ebx + 4]
cmp ebx, 6
je 0x67204c
mov ecx, dword [eax*4 + 0x8dec80]
test ecx, ecx
je 0x672060
lea eax, [ebx + 5]
cmp ebx, 5
je 0x67204c
mov edx, dword [eax*4 + 0x8dec80]
test edx, edx
je 0x672060
lea eax, [ebx + 6]
cmp ebx, 4
je 0x67204c
mov edi, dword [eax*4 + 0x8dec80]
test edi, edi
je 0x672060
lea eax, [ebx + 7]
cmp ebx, 3
je 0x67204c
mov ecx, dword [eax*4 + 0x8dec80]
test ecx, ecx
je 0x672060
lea eax, [ebx + 8]
cmp ebx, 2
je 0x67204c
mov edx, dword [eax*4 + 0x8dec80]
test edx, edx
je 0x672060
add ebx, 9
cmp ebx, 0xa
je 0x67204c
mov eax, dword [ebx*4 + 0x8dec80]
test eax, eax
je 0x672062
mov ebx, 0xffffffff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov dword [ebx*4 + 0x8dec40], 0
cmp ebx, 0xffffffff
je 0x67204c
lea edx, [ebp + 1]
mov edi, dword [0x75f580]
imul edx, esi
lea ebp, [edx - 1]
mov dword [ebx*4 + 0x8dec40], ebp
test edi, edi
js 0x672140
cmp ebp, edi
jg 0x67204c
mov dword [esp], ebp
call sub.msvcrt.dll_malloc
mov ecx, eax
test eax, eax
je 0x67204c
sub edi, ebp
mov dword [0x75f580], edi
mov eax, ecx
sub eax, dword [esp + 0x40]
lea eax, [esi + eax - 1]
cdq
idiv esi
mov edx, dword [esp + 0x4c]
mov dword [edx], eax
mov dword [ebx*4 + 0x8dec80], ecx
cmp dword [0x8deca8], ebx
jne 0x672051
lea eax, [ebx + 1]
mov dword [0x8deca8], eax
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x8dec80
mov ecx, 0xa
mov eax, ebx
mov dword [0x8decac], 1
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp], str.PCAEMEM
call sub.msvcrt.dll_getenv
test eax, eax
je 0x672127
lea edx, [esp + 0x1c]
mov dword [esp + 4], str.__ld
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.00671f00
cmp eax, 1
je 0x672160
mov dword [0x75f580], 0xffffffff
lea edx, [ebp + 1]
imul edx, esi
lea ebp, [edx - 1]
mov dword [0x8dec40], ebp
mov dword [esp], ebp
call sub.msvcrt.dll_malloc
mov ecx, eax
test eax, eax
jne 0x6720aa
jmp 0x67204c
mov edi, dword [esp + 0x1c]
test edi, edi
jle 0x672127
lea edx, [ebp + 1]
shl edi, 0x14
imul edx, esi
mov dword [0x75f580], edi
lea ebp, [edx - 1]
mov dword [0x8dec40], ebp
jmp 0x672090
Function at 0x6987d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
mov edx, dword [esp + 0x20]
fld qword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
test edx, edx
je 0x698818
mov ecx, 0x28
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
test ebx, ebx
je 0x698820
test esi, esi
je 0x698828
mov dword [esp + 0x18], 0xff
mov ecx, edx
mov eax, ebx
mov edx, esi
fstp qword [esp + 0x10]
pop ebx
pop esi
pop edi
jmp fcn.006982c0
fstp st(0)
jmp 0x69882a
fstp st(0)
jmp 0x69882a
fstp st(0)
pop ebx
xor eax, eax
pop esi
pop edi
ret
Function at 0x6afb50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x114
fld qword [esp + 0x120]
lea eax, [esp + 0x4c]
lea edx, [esp + 0x78]
mov dword [esp], 0x6b57f0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x98]
fstp qword [esp + 0x68]
fld qword [esp + 0x128]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
fstp qword [esp + 0x70]
fld qword [0x8e0398]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x58]
fsqrt
mov dword [esp + 0x18], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x68]
mov dword [esp + 0x14], eax
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0x3c], 2
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x48], 0x32
fmul qword [0x7b5840]
fstp qword [esp + 0x50]
call fcn.006a87d0
fld qword [esp + 0x68]
mov eax, dword [esp + 0x40]
add eax, 1
fstp qword [esi]
fld qword [esp + 0x70]
and eax, 0xfffffffd
sete al
movzx eax, al
fstp qword [ebx]
add esp, 0x114
pop ebx
pop esi
ret
Function at 0x6e44a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, 0x105
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x94a8e4]
mov ebx, dword [esp + 0x30]
cmp eax, ebp
cmovbe ebp, eax
test eax, eax
jne 0x6e4558
test ebx, ebx
je 0x6e4500
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov ecx, eax
lea eax, [ebp + eax]
cmp eax, 0x105
jbe 0x6e44e7
mov ecx, 0x105
mov eax, 0x105
sub ecx, ebp
test ecx, ecx
jne 0x6e4528
mov eax, ebp
cmp eax, 0x105
jne 0x6e4500
mov byte [0x94a864], 0
xor eax, eax
jmp 0x6e450c
mov byte [eax + 0x94a760], 0
mov eax, 0x94a760
mov dword [esp], eax
call sub.msvcrt.dll_remove
test eax, eax
setne al
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ebp + 0x94a760]
cmp ecx, 4
jae 0x6e45d8
test ecx, ecx
je 0x6e44ed
movzx edx, byte [ebx]
mov byte [ebp + 0x94a760], dl
test cl, 2
je 0x6e44ed
movzx edx, word [ebx + ecx - 2]
mov word [esi + ecx - 2], dx
jmp 0x6e44ed
mov edi, 0x94a760
mov esi, 0x94aa20
cmp ebp, 4
jae 0x6e45c0
xor edx, edx
test ebp, 2
jne 0x6e45a8
test ebp, 1
jne 0x6e4590
test ebx, ebx
jne 0x6e44c6
jmp 0x6e44eb
movzx eax, byte [esi + edx]
mov byte [edi + edx], al
test ebx, ebx
jne 0x6e44c6
jmp 0x6e44eb
movzx eax, word [esi]
mov edx, 2
mov word [edi], ax
test ebp, 1
je 0x6e4579
jmp 0x6e4590
mov ecx, ebp
xor edx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
test ebp, 2
je 0x6e4571
jmp 0x6e45a8
mov edx, dword [ebx]
lea edi, [esi + 4]
and edi, 0xfffffffc
mov dword [ebp + 0x94a760], edx
mov edx, dword [ebx + ecx - 4]
mov dword [esi + ecx - 4], edx
sub esi, edi
mov edx, esi
mov esi, ebx
add ecx, edx
sub esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x6e44ed