joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ed53
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x461a80]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x44ed8f
xor eax, eax
jmp 0x44eef9
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x471d80]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x44edcd
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.004543a5
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x44ee67
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x44eeca
jmp 0x44edf1
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x44ee2c
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x44ee1d
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x44edfd
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44ee8b
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x44ee94
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x44edef
jmp 0x44ee94
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44ee8b
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x44ee94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x44eef4
cmp dword [ebp - 0x68], eax
je 0x44eec7
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x44eebc
call fcn.0044e8b1
mov dword [eax], 9
call fcn.0044e8ba
mov dword [eax], esi
jmp 0x44eeef
push dword [ebp - 0x68]
call fcn.0044e8c3
pop ecx
jmp 0x44eeef
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x44eedc
cmp byte [edi], 0x1a
jne 0x44eedc
xor eax, eax
jmp 0x44eef7
call fcn.0044e8b1
mov dword [eax], 0x1c
call fcn.0044e8ba
and dword [eax], 0
or eax, 0xffffffff
jmp 0x44eef7
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.0044f83a
add ebp, 0x3a4
leave
ret
Function at 0x44f1e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x44f3ba
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x471d80]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x44f3ba
test cl, 0x48
je 0x44f24f
cmp byte [eax + 5], 0xa
je 0x44f24f
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f2a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x44f289
call fcn.0044e8b1
mov dword [eax], 9
call fcn.0044e8ba
mov dword [eax], esi
jmp 0x44f299
cmp eax, 0x6d
je 0x44f3ba
push eax
call fcn.0044e8c3
pop ecx
or eax, 0xffffffff
jmp 0x44f3bc
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x44f3b5
test eax, eax
je 0x44f2c8
cmp byte [ebx], 0xa
jne 0x44f2c8
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x44f2d1
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x44f3af
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x44f39f
cmp al, 0xd
je 0x44f303
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x44f391
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x44f31d
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x44f318
add dword [ebp + 0x10], 2
jmp 0x44f371
mov dword [ebp + 0x10], eax
jmp 0x44f38d
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44f345
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44f38d
cmp dword [ebp - 0xc], 0
je 0x44f38d
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x44f366
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x44f371
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x44f390
cmp ebx, dword [ebp + 0xc]
jne 0x44f376
cmp byte [ebp - 1], 0xa
jne 0x44f376
mov byte [ebx], 0xa
jmp 0x44f390
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004543a5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x44f391
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x44f2e7
jmp 0x44f3af
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x44f3af
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x44f3bc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x452380
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x461a80]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x461de0]
je 0x4523b7
inc eax
cmp eax, 0x13
jb 0x4523a8
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x461de0]
jne 0x4524da
mov eax, dword [0x46341c]
cmp eax, 1
je 0x4524b5
cmp eax, edx
jne 0x4523e7
cmp dword [0x461464], 1
je 0x4524b5
cmp ecx, 0xfc
je 0x4524da
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45241d
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.004489e0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00448e50
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x452451
mov eax, edi
push eax
call fcn.00448e50
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x459aac
push edi
call fcn.00449220
add esp, 0x10
push edi
call fcn.00448e50
push dword [esi + 0x461de4]
mov ebx, eax
call fcn.00448e50
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0044ba90
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004489e0
push edi
push ebx
call fcn.004489f0
push 0x45b50c
push ebx
call fcn.004489f0
push dword [esi + 0x461de4]
push ebx
call fcn.004489f0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00454b44
add esp, 0x2c
jmp 0x4524da
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x461de4]
push dword [esi]
call fcn.00448e50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.0044f83a
add ebp, 0x90
leave
ret
Function at 0x4530ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4530fc
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x453103
cmp ebx, dword [eax + 4]
jae 0x453103
xor eax, eax
jmp 0x4532f3
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x453114
xor eax, eax
inc eax
jmp 0x4532f2
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x45312a
cmp ecx, edx
jae 0x45326f
cmp dword [eax + 4], 0
je 0x453133
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x45311b
cmp dword [ebp + 8], 0
je 0x453155
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x45326f
cmp eax, esi
jae 0x45326f
mov eax, dword [0x463818]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x45317a
cmp dword [esi*4 + 0x463820], edi
je 0x453273
inc esi
cmp esi, eax
jl 0x453168
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4532ef
cmp dword [ebp - 8], 0x1000000
jne 0x4532ef
test byte [ebp - 0xc], 0xcc
je 0x4531f8
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4532ef
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4532ef
cmp word [eax + 0x18], 0x10b
jne 0x4532ef
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4532ef
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4531f8
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4531f8
test byte [ecx + 0x27], 0x80
jne 0x45326f
push 1
push 0x463860
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x45310c
mov ecx, dword [0x463818]
test ecx, ecx
mov edx, ecx
jle 0x45322c
lea eax, [ecx*4 + 0x46381c]
cmp dword [eax], edi
je 0x45322c
dec edx
sub eax, 4
test edx, edx
jg 0x453220
test edx, edx
jne 0x45325d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x453239
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x453251
lea eax, [edx*4 + 0x463820]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x45323f
cmp ecx, 0x10
jge 0x45325d
inc ecx
mov dword [0x463818], ecx
push 0
push 0x463860
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x45310c
xor eax, eax
jmp 0x4532f2
test esi, esi
jle 0x45310c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x463860
call ebx
test eax, eax
jne 0x45310c
cmp dword [esi*4 + 0x463820], edi
je 0x4532c9
mov eax, dword [0x463818]
lea esi, [eax - 1]
test esi, esi
jl 0x4532b7
cmp dword [esi*4 + 0x463820], edi
je 0x4532b3
dec esi
jns 0x4532a7
test esi, esi
jge 0x4532c7
cmp eax, 0x10
jge 0x4532c2
inc eax
mov dword [0x463818], eax
lea esi, [eax - 1]
jmp 0x4532c9
je 0x4532e1
xor ecx, ecx
test esi, esi
jl 0x4532e1
lea eax, [ecx*4 + 0x463820]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4532cf
push 0
push 0x463860
call ebx
jmp 0x45310c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4549e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0044ba90
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x454a7b
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4633cc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x454a7b
cmp eax, 1
je 0x454a9c
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x454a7b
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x454a48
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x454a77
xor eax, eax
inc eax
jmp 0x454abb
cmp edi, eax
jae 0x454a7f
xor eax, eax
jmp 0x454abb
cmp eax, esi
jae 0x454a86
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4633cc]
jmp 0x454a9f
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x454b44
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x46386c], ebx
push esi
push edi
jne 0x454bc4
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x454bff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45a3bc
push edi
call esi
test eax, eax
mov dword [0x46386c], eax
je 0x454bff
push 0x45a3ac
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x463870], eax
call esi
cmp dword [0x4633cc], 2
mov dword [0x463874], eax
jne 0x454bc4
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x46387c], eax
je 0x454bc4
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x463878], eax
mov eax, dword [0x463878]
test eax, eax
je 0x454c09
call eax
test eax, eax
je 0x454bf0
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x46387c]
test eax, eax
je 0x454bf0
test byte [ebp - 8], 1
jne 0x454c09
cmp dword [0x4633d8], 4
jb 0x454c03
or byte [ebp + 0x12], 0x20
jmp 0x454c28
xor eax, eax
jmp 0x454c38
or byte [ebp + 0x12], 4
jmp 0x454c28
mov eax, dword [0x463870]
test eax, eax
je 0x454c28
call eax
mov ebx, eax
test ebx, ebx
je 0x454c28
mov eax, dword [0x463874]
test eax, eax
je 0x454c28
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x46386c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x455421
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0044ba90
mov eax, dword [0x461a80]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0044ea58
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x455556
push 2
push esi
push dword [ebp + 8]
call fcn.0044ea58
add esp, 0xc
cmp eax, ebx
je 0x455556
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4554f6
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00449140
push 0x8000
push dword [ebp + 8]
call fcn.0044ab9c
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4554ac
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0044ed53
add esp, 0xc
cmp eax, 0xffffffff
je 0x4554cc
sub edi, eax
test edi, edi
jg 0x4554a4
jmp 0x4554e4
call fcn.0044e8ba
cmp dword [eax], 5
jne 0x4554e1
call fcn.0044e8b1
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0044ab9c
pop ecx
pop ecx
jmp 0x45553e
jge 0x45553e
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044ea58
push dword [ebp + 8]
call fcn.0044fb41
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x45553e
call fcn.0044e8b1
mov dword [eax], 0xd
call fcn.0044e8ba
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0044ea58
add esp, 0xc
mov eax, esi
pop edi
jmp 0x455558
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f83a
leave
ret
Function at 0x455d34
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x455d4d
or eax, 0xffffffff
jmp 0x455dae
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x455daa
push 0x3d
push esi
call fcn.00455f35
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x455daa
cmp esi, eax
je 0x455daa
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x4633ec]
sete cl
cmp eax, dword [0x4633f0]
mov dword [ebp - 4], ecx
jne 0x455d90
mov edi, eax
call fcn.00455cd3
mov dword [0x4633ec], eax
cmp eax, ebx
jne 0x455de9
cmp dword [ebp + 0xc], ebx
je 0x455db2
cmp dword [0x4633f4], ebx
je 0x455db2
call fcn.004555b4
test eax, eax
je 0x455de9
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x455dbb
xor eax, eax
jmp 0x455dad
push 4
call fcn.0044960f
cmp eax, ebx
pop ecx
mov dword [0x4633ec], eax
je 0x455daa
mov dword [eax], ebx
cmp dword [0x4633f4], ebx
jne 0x455de9
push 4
call fcn.0044960f
cmp eax, ebx
pop ecx
mov dword [0x4633f4], eax
je 0x455daa
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x4633ec]
sub edi, esi
push esi
call fcn.00455c86
mov edi, eax
test edi, edi
pop ecx
jl 0x455e50
cmp dword [ebx], 0
je 0x455e50
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.00449621
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x455e30
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x455e91
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x455e27
mov eax, edi
shl eax, 2
push eax
push dword [0x4633ec]
call fcn.0044cc91
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x455e91
jmp 0x455e8c
cmp dword [ebp - 4], 0
jne 0x455ef8
test edi, edi
jge 0x455e60
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4633ec]
call fcn.0044cc91
test eax, eax
pop ecx
pop ecx
je 0x455daa
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x4633ec], eax
cmp dword [ebp + 0xc], 0
je 0x455ee3
push esi
call fcn.00448e50
inc eax
inc eax
push eax
call fcn.0044960f
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x455ee3
push esi
push edi
call fcn.004489e0
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x455edc
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.00449621
pop ecx
cmp dword [ebp - 4], 0
je 0x455ef0
push esi
call fcn.00449621
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x455dad
push esi
call fcn.00449621
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x455db7
Function at 0x7003f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x7003fa0
pop dword [ebp - 0x44]
mov eax, 0x7003fa0
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe8c02a03
add dword [ebp - 0x54], 0x65921b48
mov dword [ebp - 0x50], 0x3866731
add dword [ebp - 0x50], 0x2eace514
mov dword [ebp - 0x4c], 0x156b46fa
add dword [ebp - 0x4c], 0x36e0fd34
mov dword [ebp - 0x48], 0xc3dadfa
add dword [ebp - 0x48], 0xf3c25206
lea eax, [ebp - 0x54]
push eax
mov eax, 0x9dde1d02
add eax, 0x6923032e
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc26f5235
sub dword [ebp - 0x54], 0x4dfce8df
mov dword [ebp - 0x50], 0xe89f34ff
sub dword [ebp - 0x50], 0xa732d38a
mov dword [ebp - 0x4c], 0xe10f318a
add dword [ebp - 0x4c], 0x82603ae2
mov dword [ebp - 0x48], 0xe8430ebd
add dword [ebp - 0x48], 0x17bcf143
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xc1818070
sub eax, 0xba80603c
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc4d
push 0
call eax
mov ecx, 0x4c90
xor esi, esi
add esi, eax
mov edx, 0xc27e029a
sub edx, 0xbb7c229a
add edx, dword [ebp - 0x44]
mov edi, 0xd7634b97
add edi, 0xfa71191c
add dword [ebp - 0x38], edx
mov ebx, dword [edx]
add dword [ebp - 0x20], ebx
sub ebx, edi
xor dword [ebp - 0x10], 0x64d3e8d2
mov dword [esi], ebx
add dword [ebp - 4], 0xe18344b0
add esi, 4
add edx, 4
loop 0x70040b9
add eax, 0xe52c54ae
sub eax, 0xe52b2f9b
mov ebx, eax
add eax, 5
mov ecx, 0x28231136
sub ecx, 0x21231136
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003f91
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003f91
int3
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x403f59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403f68
pop dword [ebp - 0x38]
mov eax, 0xf6badcce
sub eax, 0xf67a9d66
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x52db500d
sub dword [ebp - 0x48], 0x4890ac2
mov dword [ebp - 0x44], 0x4411429d
sub dword [ebp - 0x44], 0x11ddf658
mov dword [ebp - 0x40], 0x175ae0e9
add dword [ebp - 0x40], 0x34f16345
mov dword [ebp - 0x3c], 0xc856e03c
add dword [ebp - 0x3c], 0x37a91fc4
lea eax, [ebp - 0x48]
push eax
mov eax, 0xb58b827b
sub eax, 0xb54ab227
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xba5dd5cc
sub dword [ebp - 0x48], 0x45eb6c76
mov dword [ebp - 0x44], 0x3fff65b0
add dword [ebp - 0x44], 0x16cfbc5
mov dword [ebp - 0x40], 0x36b4f835
add dword [ebp - 0x40], 0x2cba7437
mov dword [ebp - 0x3c], 0xbdb91795
sub dword [ebp - 0x3c], 0xbdb91795
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x2250a143
add eax, 0xddf02f09
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36298
push 0
call eax
mov ecx, 0xc0210889
add ecx, 0x3fdf31bb
mov edx, eax
mov ebx, 0x1b04607d
sub ebx, 0x1ac2b07d
add ebx, dword [ebp - 0x38]
mov edi, 0x6bd040ad
add edi, 0xa4226cc1
xor dword [ebp - 0x14], 0x44a4a9a7
mov esi, dword [ebx]
xor dword [ebp - 0x24], 0x81099317
xor esi, edi
add dword [ebp - 0xc], ecx
mov dword [edx], esi
xor dword [ebp - 4], eax
add edx, 0xb86d0f45
add edx, 0x4792f0bf
add ebx, 0x9c301b67
sub ebx, 0x9c301b63
loop 0x40408a
add eax, 0xdbe3
mov ebx, eax
add eax, 0x2956c76a
add eax, 0xd6a9389b
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret