joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ca50
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
mov al, byte [0x481160]
test al, al
je 0x40ca83
call fcn.00451290
mov eax, dword [0x481154]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x40ca83
mov ecx, dword [0x481154]
push ecx
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 0x469558
mov eax, dword [esi]
test eax, eax
je 0x40cb53
push eax
call fcn.0040c9c0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push eax
call edi
test eax, eax
jne 0x40cac6
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
push 0x451
push eax
call fcn.00431420
add esp, 0xc
mov eax, dword [esi]
test byte [eax + 4], 2
je 0x40cb02
mov eax, dword [eax + 0x10]
push 0
push 0
push 0
push eax
call ebp
test eax, eax
jne 0x40caee
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40cb02
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
push 0x451
push 0
call fcn.00431420
add esp, 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40cb25
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
push 0x451
push eax
call fcn.00431420
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40cb53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40cb53
mov edx, dword [esi]
mov eax, dword [edx]
push eax
push 0x455
push 0
call fcn.00431420
add esp, 0xc
add esi, 4
cmp esi, 0x469598
jl 0x40ca97
call fcn.0040ba40
call fcn.00410370
mov al, byte [0x4690c4]
pop edi
pop esi
pop ebp
test al, al
je 0x40cb7d
call fcn.00415100
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4102e0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
push edi
mov ecx, dword [eax + 8]
mov edi, dword [eax]
test ecx, ecx
jbe 0x410362
push ebp
push esi
mov ebp, dword [edi + 4]
mov eax, dword [edi]
mov esi, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41031e
test cl, cl
je 0x41031a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41031e
add eax, 2
add esi, 2
test cl, cl
jne 0x4102fa
xor eax, eax
jmp 0x410323
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x410349
push ebp
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
cmp eax, 0xffffffff
jne 0x410349
mov eax, dword [edi + 4]
push eax
push 0x455
push 0
call fcn.00431420
add esp, 0xc
mov edx, dword [esp + 0x14]
mov edi, dword [edi + 0x14]
inc ebx
mov eax, dword [edx + 8]
mov ecx, ebx
and ecx, 0xffff
cmp ecx, eax
jb 0x4102f3
pop esi
pop ebp
pop edi
pop ebx
ret 4
Function at 0x411a60
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x480ec4]
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x411a8d
push 0x4018f0
call fcn.004119c0
add esp, 4
sub word [0x480e70], si
pop esi
ret 8
Function at 0x414e00
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jne 0x414e23
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x414eb5
mov al, byte [esi]
mov edi, dword [sym.imp.MSVCRT.dll_isdigit]
test al, al
je 0x414e44
movsx ecx, al
push ecx
call edi
add esp, 4
test eax, eax
jne 0x414e44
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414e2f
mov ebp, dword [sym.imp.MSVCRT.dll_sscanf]
lea edx, [esp + 0x10]
push edx
push 0x401f80
push esi
call ebp
add esp, 0xc
cmp eax, 1
jne 0x414eb5
mov eax, dword [esp + 0x10]
mov byte [eax + 0x4811a0], 1
mov al, byte [esi]
test al, al
je 0x414e85
movsx ecx, al
push ecx
call edi
add esp, 4
test eax, eax
je 0x414e85
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414e70
mov al, byte [esi]
test al, al
je 0x414ea0
movsx edx, al
push edx
call edi
add esp, 4
test eax, eax
jne 0x414ea0
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414e8b
lea eax, [esp + 0x10]
push eax
push 0x401f80
push esi
call ebp
add esp, 0xc
cmp eax, 1
je 0x414e5f
pop edi
pop esi
pop ebp
ret 8
Function at 0x41f910
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
push eax
push ecx
push ebp
push esi
push ebx
push edi
push edx
call fcn.0041f100
mov ecx, eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [eax], ecx
mov ax, word [esi + 6]
mov word [edx + 0x16], ax
mov al, byte [esi + 0x12]
and al, 3
mov byte [edx + 0x18], al
mov al, byte [esi + 0x12]
shr al, 2
and al, 7
movzx ax, al
mov word [edx + 0x1a], ax
mov ax, word [esi + 0x10]
mov word [edx + 0x1c], ax
mov al, byte [esp + 0x28]
test al, al
je 0x41f9be
mov al, byte [esp + 0x2c]
test al, al
je 0x41f986
mov ax, word [edx + 0x16]
jmp 0x41f98a
mov ax, word [ebp]
push 0
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push edx
mov dl, byte [edi + 0x10]
push eax
mov eax, dword [esp + 0x48]
push ebp
push ebx
push esi
push eax
push edx
call fcn.00422630
mov byte [edi + 0x10], 0
pop edi
pop esi
pop ebp
pop ebx
ret 0x3c
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push ebp
push eax
push edx
push esi
push ebx
call fcn.0041f9f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x3c
Function at 0x425510
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x42551e
call fcn.004639b0
push 0x404488
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 8
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42f2c0
Capabilities:
Copy file
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x42f2ce
call fcn.004639b0
push 0x406a40
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 8
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42f300
Capabilities:
Copy file

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0xc]
push 1
push 0
push 0x8002
mov eax, dword [edi]
push eax
call fcn.0040b370
push eax
call fcn.0040b890
mov ebp, dword [edi + 4]
test ebp, ebp
je 0x42f399
push ebx
push esi
mov esi, dword [edi]
mov eax, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42f352
test cl, cl
je 0x42f34e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42f352
add eax, 2
add esi, 2
test cl, cl
jne 0x42f32a
xor eax, eax
jmp 0x42f357
sbb eax, eax
sbb eax, 0xffffffff
pop esi
pop ebx
test eax, eax
je 0x42f399
push 1
push 0
push 0x8002
push ebp
call fcn.0040b370
push eax
call fcn.0040b890
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x42f399
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push 0x47c
push eax
call fcn.00431420
add esp, 0xc
pop edi
pop ebp
ret 4
Function at 0x431350
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x496368]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
test al, al
jne 0x4313f8
mov al, byte [0x4690c4]
mov byte [0x496368], 1
test al, al
je 0x43137d
call fcn.00415100
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ebp
push edi
push ecx
call fcn.00431220
mov al, byte [0x481160]
mov bl, byte [esp + 0x1c]
test al, al
je 0x4313a5
test bl, bl
je 0x4313a5
call fcn.00451290
call fcn.0040ba40
call fcn.00410370
test bl, bl
pop ebx
je 0x4313f8
mov eax, dword [0x481170]
mov esi, dword [sym.imp.MSVCRT.dll__unlink]
test eax, eax
je 0x4313ce
cmp byte [eax], 0
je 0x4313ce
push eax
call esi
add esp, 4
mov al, byte [0x481160]
test al, al
je 0x4313f8
mov edx, dword [0x481154]
push 0
push edx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x4313f8
mov eax, dword [0x481154]
push eax
call esi
add esp, 4
cmp edi, 2
jne 0x43140c
push 0x4c2
push 0
call fcn.004312f0
add esp, 8
push ebp
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4320e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor edx, edx
push esi
push edi
mov eax, dword [ebp + 0xc]
shl eax, 4
div dword [ebp + 8]
cmp eax, 0x30
jbe 0x432103
mov eax, dword [esp + 0x20]
push eax
push ebp
call fcn.00432220
mov edx, dword [esp + 0x14]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x43212b
movsx ecx, cl
mov esi, eax
mov edi, ecx
shr esi, 1
shl edi, 0x12
xor esi, eax
add eax, edi
add ecx, eax
inc edx
lea eax, [ecx + esi]
mov cl, byte [edx]
test cl, cl
jne 0x43210f
xor edx, edx
mov ecx, 0x1eca9d3b
div ecx
mov edi, dword [ebp + 4]
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [ebp]
mov ecx, edx
cmp ecx, eax
jae 0x432153
lea ecx, [edi + edi]
mov eax, esi
xor edx, edx
div ecx
mov ecx, edx
mov esi, dword [ebp + 0x18]
mov eax, ecx
xor edx, edx
div esi
mov edx, dword [ebp + 0x28]
mov edi, dword [edx + eax*4]
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [edi]
mov edi, dword [eax + edx*4]
test edi, edi
lea ebx, [eax + edx*4]
je 0x4321b9
mov ecx, dword [esp + 0x20]
mov edx, dword [edi]
push ecx
push edx
call dword [ebp + 0x20]
mov esi, eax
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x4321a9
test al, al
je 0x4321a5
mov dl, byte [ecx + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x4321a9
add ecx, 2
add esi, 2
test al, al
jne 0x432185
xor eax, eax
jmp 0x4321ae
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4321ca
mov edi, dword [edi + 4]
test edi, edi
jne 0x432174
mov al, byte [esp + 0x1c]
test al, al
jne 0x4321d3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x24]
push 8
mov byte [eax], 1
mov al, byte [ebp + 0x34]
test al, al
je 0x4321ea
call fcn.00451580
jmp 0x4321f3
lea ecx, [ebp + 0x30]
push ecx
call fcn.00450e90
mov ecx, eax
xor edx, edx
pop edi
pop esi
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov edx, dword [ebx]
mov dword [eax + 4], edx
mov dword [ebx], eax
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
pop ebp
pop ebx
ret 0x14
Function at 0x432220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov edi, dword [esi]
mov eax, dword [esi + 4]
imul edx, ecx
lea ebp, [eax + edi]
cmp ebp, edx
mov dword [esp + 0x18], ebp
jb 0x43225d
push esi
call fcn.00431ef0
or al, 1
push eax
push esi
call fcn.00431ee0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov edx, dword [esi + 0x10]
mov eax, edi
inc edx
mov dword [esi + 0x10], edx
xor edx, edx
div ecx
mov edx, dword [esi + 0x28]
mov eax, dword [edx + eax*4]
xor edx, edx
mov dword [esp + 0x2c], eax
mov eax, edi
div ecx
mov eax, ebp
mov edi, edx
xor edx, edx
div ecx
mov dword [esp + 0x24], edi
test edx, edx
jne 0x4322c8
push 4
lea ecx, [esi + 0x2c]
push 1
push ecx
push esi
call fcn.00431f00
mov ecx, eax
mov eax, ebp
xor edx, edx
push 4
div dword [esi + 0x18]
mov edx, dword [esi + 0x28]
mov dword [edx + eax*4], ecx
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x30]
push eax
push ecx
push esi
call fcn.00431f00
mov ecx, eax
mov eax, ebp
xor edx, edx
div dword [esi + 0x18]
mov edx, dword [esi + 0x28]
mov eax, dword [edx + eax*4]
mov dword [eax], ecx
mov ecx, dword [esi + 0x18]
mov eax, ebp
xor edx, edx
div ecx
mov edx, dword [esi + 0x28]
mov ebx, dword [edx + eax*4]
mov eax, ebp
xor edx, edx
mov dword [esp + 0x1c], ebx
div ecx
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov ecx, eax
mov eax, dword [esi + 4]
cmp ecx, eax
mov dword [esp + 0x20], edx
jne 0x4322fe
add eax, eax
mov dword [esi], 0
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
xor ebp, ebp
inc ecx
mov dword [esp + 0x14], ebp
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ebp
mov eax, dword [ecx]
mov ecx, dword [ebx]
mov edi, dword [eax + edi*4]
mov dword [ecx + edx*4], ebp
cmp edi, ebp
je 0x4323d7
mov edx, dword [esp + 0x30]
mov eax, dword [edi]
push edx
push eax
call dword [esi + 0x20]
mov edx, eax
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x43235a
movsx ecx, cl
mov ebx, eax
mov ebp, ecx
shr ebx, 1
shl ebp, 0x12
xor ebx, eax
add eax, ebp
add ecx, eax
inc edx
lea eax, [ecx + ebx]
mov cl, byte [edx]
test cl, cl
jne 0x43233a
mov ebp, dword [esp + 0x10]
xor edx, edx
mov ecx, 0x1eca9d3b
div ecx
mov ebx, dword [esi + 4]
mov ecx, edx
xor edx, edx
mov eax, ecx
div ebx
cmp edx, dword [esi]
jae 0x43237a
add ebx, ebx
mov eax, ecx
xor edx, edx
div ebx
cmp edx, dword [esp + 0x18]
jne 0x4323c8
test ebp, ebp
jne 0x432393
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [edx]
mov dword [eax + ecx*4], edi
jmp 0x432396
mov dword [ebp + 4], edi
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4323b0
mov edx, dword [esp + 0x2c]
mov ecx, dword [edi + 4]
mov eax, dword [edx]
mov edx, dword [esp + 0x24]
mov dword [eax + edx*4], ecx
jmp 0x4323b6
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov ebp, edi
mov edi, dword [edi + 4]
mov dword [esp + 0x10], ebp
mov dword [ebp + 4], 0
jmp 0x4323cf
mov dword [esp + 0x14], edi
mov edi, dword [edi + 4]
test edi, edi
jne 0x432325
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x4393d0
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x481198]
mov dword [0x4690d8], 0x4070d0
cmp eax, 0x1b
ja case.0x4393e8.20
jmp dword [eax*4 + 0x439614]
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.15
push 0x177b
jmp 0x439448
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.15
jmp 0x439443
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.15
push 0x177c
jmp 0x439448
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.15
push 0x178a
jmp 0x439448
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.15
push 0x177e
jmp 0x439448
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.15
push 0x177d
push 0
call fcn.004314d0
add esp, 8
mov eax, dword [0x481184]
test eax, eax
je case.0x4393e8.2
push 1
push eax
call fcn.0040b890
mov dword [0x481184], 0
jmp case.0x4393e8.2
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0x177e
jmp 0x43951b
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0x177f
jmp 0x43951b
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0x1780
jmp 0x43951b
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0x1781
jmp 0x43951b
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0x1789
jmp 0x43951b
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0
push 0
push 0x177d
push 0
call fcn.004314d0
add esp, 0x10
jmp case.0x4393e8.2
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0
push 0
push 0x1783
push 0
call fcn.004314d0
add esp, 0x10
jmp case.0x4393e8.2
mov al, byte [0x480ed4]
test al, al
je case.0x4393e8.2
push 0x177d
push 0
call fcn.004314d0
add esp, 8
push ebp
mov ebp, dword [esp + 8]
mov byte [0x481161], 0
push edi
mov eax, dword [ebp]
mov edi, dword [eax + 0x29c]
test edi, edi
je 0x43958e
mov cl, byte [eax + 0x148]
test cl, cl
je 0x43958e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push esi
push ecx
push 1
call dword [sym.imp.MSVCRT.dll_calloc]
mov edx, eax
or ecx, 0xffffffff
mov dword [0x496464], edx
mov eax, dword [ebp]
add esp, 8
mov edi, dword [eax + 0x29c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 1
push ebp
call fcn.00435680
mov ecx, dword [0x481154]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
call fcn.0040ba40
call fcn.00410370
mov eax, dword [0x481164]
pop edi
test eax, eax
pop ebp
je 0x4395d2
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
cmp eax, edx
je 0x4395d2
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [0x481148]
test eax, eax
je case.0x4393e8.20
push 0x481140
call fcn.0045eef0
or eax, 0xffffffff
ret 4
mov eax, dword [0x481184]
push 1
push eax
call fcn.0040b890
mov dword [0x481184], 0
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push edx
call fcn.0044a0e0
xor eax, eax
ret 4
Function at 0x43bbb0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x4692e8]
test al, al
je 0x43bbbe
call fcn.004639b0
push 0x407118
call dword [sym.imp.MSVCRT.dll_puts]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 8
push 0x44c
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x43fb90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov al, byte [edi + 0x147]
test al, al
je 0x43fbb7
mov eax, dword [esp + 0x30]
pop edi
mov dword [eax], 0
xor eax, eax
add esp, 0x28
ret 4
mov ecx, dword [edi + 0x1c0]
push ebx
push ebp
push esi
lea edx, [esp + 0x28]
xor ebp, ebp
push ecx
push edx
xor ebx, ebx
mov dword [esp + 0x18], ebp
call fcn.0040f6f0
lea eax, [esp + 0x28]
push eax
call fcn.0040f720
test al, al
je 0x43fc66
mov esi, 1
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0040f770
lea eax, [esp + 0x18]
push eax
call fcn.0040f7a0
test al, al
je 0x43fc4a
test ebx, ebx
mov eax, ebx
je 0x43fc23
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 0x30]
cmp dword [eax + 4], ecx
je 0x43fd36
mov eax, dword [eax]
test eax, eax
jne 0x43fc14
push 0xc
call fcn.004516d0
mov dword [eax], ebx
mov edx, dword [esp + 0x24]
mov ebx, eax
inc ebp
mov ecx, dword [edx + 0x30]
mov dword [eax + 8], esi
mov dword [eax + 4], ecx
lea edx, [esp + 0x18]
push edx
call fcn.0040f7a0
test al, al
jne 0x43fc07
lea eax, [esp + 0x18]
push eax
call fcn.0040f760
lea ecx, [esp + 0x28]
push ecx
call fcn.0040f720
test al, al
jne 0x43fbea
mov dword [esp + 0x10], ebp
lea edx, [esp + 0x28]
push edx
call fcn.0040f760
mov esi, dword [edi + 0x1e0]
xor ecx, ecx
test esi, esi
mov edi, esi
jbe 0x43fc9a
mov eax, dword [esp + 0x14]
mov ebp, dword [eax + 0x1dc]
xor edx, edx
mov dl, byte [ecx + ebp]
rol edx, cl
add edi, edx
inc ecx
cmp ecx, esi
jb 0x43fc88
mov ebp, dword [esp + 0x10]
test ebx, ebx
mov eax, ebx
je 0x43fcb0
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
rol edx, cl
add edi, edx
test eax, eax
jne 0x43fca0
mov eax, edi
xor edx, edx
shr eax, 5
mov ecx, 3
div ecx
add edx, ebp
lea ebp, [edx*8 + 0x20]
push ebp
call fcn.004516f0
mov edx, dword [esp + 0x3c]
mov esi, eax
mov dword [edx], esi
mov eax, dword [0x4693b0]
xor eax, edi
mov dword [esi + 4], edi
xor eax, 0xaa559966
mov dword [esi], eax
add esi, 8
mov eax, ebx
mov dword [esi], edi
mov dword [esi + 4], edi
add esi, 8
test ebx, ebx
je 0x43fd1b
mov ecx, dword [eax + 4]
push eax
xor ecx, edi
mov dword [esi], ecx
mov edx, dword [eax + 8]
xor edx, edi
mov dword [esi + 4], edx
mov ebx, dword [eax]
add esi, 8
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebx
test ebx, ebx
jne 0x43fcf7
mov eax, dword [0x4693b4]
mov dword [esi + 4], edi
xor eax, 0xaa559966
mov dword [esi], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x28
ret 4
test eax, eax
je 0x43fc23
inc dword [eax + 8]
jmp 0x43fc3c
Function at 0x446410
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x208
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_getenv]
push 0x4077c4
call edi
add esp, 4
mov dword [0x480f08], eax
test eax, eax
je 0x446522
mov esi, dword [sym.imp.MSVCRT.dll__fullpath]
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call esi
push 0x104
lea ecx, [esp + 0x11c]
push 0x407690
push ecx
call esi
lea edx, [esp + 0x124]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x20
test eax, eax
jne 0x44649e
mov ecx, dword [0x480f08]
push ecx
push 0xfce
push eax
call fcn.004314f0
add esp, 0xc
mov dword [0x480f08], 0
pop edi
pop esi
add esp, 0x208
ret
mov edx, dword [0x480f08]
push edx
push 0xfcd
push 0
call fcn.004314f0
push 0x4077b4
call edi
add esp, 0x10
test eax, eax
jne 0x4464c4
mov eax, 0x4077a8
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x20
and ecx, 3
lea eax, [esp + 0x10]
push 0x404684
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__fsopen]
add esp, 0xc
mov dword [0x480f04], eax
test eax, eax
pop ebx
jne 0x446522
lea ecx, [esp + 8]
push ecx
push 0x478
push eax
call fcn.00431420
add esp, 0xc
pop edi
pop esi
add esp, 0x208
ret
Function at 0x446530
Capabilities:
Copy file
Query environment variable

Disassembly:
mov al, byte [0x496445]
sub esp, 0x308
test al, 1
push ebx
push ebp
push esi
push edi
jne 0x446566
mov bl, al
push 0x4077b4
or bl, 1
mov byte [0x496445], bl
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
setne al
mov byte [0x496444], al
mov eax, dword [esp + 0x31c]
lea ecx, [esp + 0x218]
lea edx, [esp + 0x118]
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, 1
not ecx
dec ecx
mov dword [esp + 0x10], ecx
mov edi, dword [0x480f08]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x4077fc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x22c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x2c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
cmp eax, 0xffffffff
jne 0x44669d
mov al, byte [0x496444]
test al, al
jne 0x4466d7
mov ecx, dword [esp + 0x10]
inc ebp
push ebp
push 0x4077f8
lea edx, [esp + ecx + 0x120]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x4465ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push 0
mov esi, dword [esp + 0x320]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov eax, 0x4028ec
jne 0x4466c7
mov eax, 0x4077ec
push eax
push esi
push 0x4077dc
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0xc
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
mov al, byte [esp + 0x324]
add esp, 4
test al, al
pop edi
pop esi
pop ebp
pop ebx
je 0x44671e
mov ecx, dword [0x480f04]
lea edx, [esp + 0x208]
lea eax, [esp + 0x108]
push edx
push eax
push 0x4077d0
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x10
add esp, 0x308
ret 8