joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5277e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea ecx, [ecx]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x52786c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00511600
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x52783f
sub eax, esi
jmp 0x527841
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x527830
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x52785f
sub eax, esi
jmp 0x527861
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x527850
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x527999
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x527899
xor eax, eax
jmp 0x5278e5
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5278b6
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00527b60
jmp 0x5278c6
cmp eax, 2
jne 0x5278cf
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00526ba0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.00511600
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x52790d
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x527921
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x5277f0
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x527999
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x527969
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp + 8], ecx
push 0
push eax
call fcn.005091d0
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x527999
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.005091d0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404b62
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00404b3e
pop esi
leave
ret 8

Function at 0x405452
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405491
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405491
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405491
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405491
cmp dword [ecx + 0x74], 0xe
jbe 0x405491
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
test esi, esi
jne 0x404bd2
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
test edx, edx
jne 0x404be9
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x404be0
sub edx, ecx
mov eax, 0xffffffff
cmp edx, 8
jb 0x404ccf
push edi
mov edi, edx
shr edi, 3
nop dword [eax]
movzx ecx, byte [esi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 1]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 2]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 3]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 4]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 5]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 6]
xor eax, 0x55555555
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
movzx ecx, byte [esi + 7]
xor eax, 0x55555555
xor ecx, eax
add esi, 8
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + str.UUUU]
xor eax, 0x55555555
sub edi, 1
jne 0x404c00
pop edi
test edx, edx
je 0x404cf2
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + str.UUUU]
xor eax, 0x55555555
sub edx, 1
jne 0x404cd3
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4053d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push ecx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor esi, esi
mov ecx, dword [ebx + 0x3c]
mov edi, dword [ecx + ebx + 0x78]
mov ecx, dword [edi + ebx + 0x24]
add edi, ebx
add ecx, ebx
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
cmp dword [edi + 0x18], esi
jbe 0x405452
nop
mov ecx, dword [eax + esi*4]
add ecx, ebx
call fcn.00405350
mov ecx, dword [ebp - 4]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405440
test dl, dl
je 0x40543c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405440
add ecx, 2
add eax, 2
test dl, dl
jne 0x405420
xor eax, eax
jmp 0x405445
sbb eax, eax
or eax, 1
test eax, eax
je 0x40545b
mov eax, dword [ebp - 8]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x405410
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
movzx eax, word [eax + esi*2]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a0a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00409cb0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a0d2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44715c]
call dword [ebp - 8]
jmp 0x40a0dc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x42ebb0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e4e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ebe4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44715c]
call dword [ebp - 8]
jmp 0x42ebea
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x42ec40
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e520
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ec74
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44715c]
call dword [ebp - 8]
jmp 0x42ec7e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x42ec90
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e540
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ecc8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x44715c]
call dword [ebp - 8]
jmp 0x42ecd6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x430130
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00445ad0
mov eax, dword [0x45a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x45b8e0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x430308
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x430257
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x430257
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x430235
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x4301b9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4302c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x430328
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x430303
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x430328
jmp 0x430192
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004071f0
mov esp, ebp
pop ebp
ret
Function at 0x430340
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00445ad0
mov eax, dword [0x45a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x45b8e0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x43052b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x430476
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x430476
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x430452
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x4303c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4304e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x43054b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x430526
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x43054b
jmp 0x4303a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004071f0
mov esp, ebp
pop ebp
ret
Function at 0x439290
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0040c560
lea ecx, [ebp - 4]
call fcn.00439260
movzx eax, al
test eax, eax
jne 0x4392cd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x18]
jmp 0x4393f5
lea ecx, [ebp - 4]
call fcn.0040c900
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00439220
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0040c900
push eax
push 0
push 0
call fcn.00434b80
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x439333
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x20]
jmp 0x4393f5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0042ae30
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00409540
lea ecx, [ebp - 8]
call fcn.00409580
movzx edx, al
test edx, edx
jne 0x43937c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00409560
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x24]
jmp 0x4393f5
lea ecx, [ebp - 8]
call fcn.004095a0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.0040c900
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.00434b80
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4393d7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00409560
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x34]
jmp 0x4393f5
lea ecx, [ebp - 8]
call fcn.0040d450
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00409560
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x439400
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0040c560
lea ecx, [ebp - 4]
call fcn.004391a0
movzx eax, al
test eax, eax
jne 0x43943d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x14]
jmp 0x4394f7
lea ecx, [ebp - 4]
call fcn.0040c900
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00439220
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.0042ae30
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.0040c560
lea ecx, [ebp - 8]
call fcn.004210d0
movzx ecx, al
test ecx, ecx
jne 0x4394ad
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.0040d430
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x1c]
jmp 0x4394f7
lea ecx, [ebp - 4]
call fcn.0040c900
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.0040c900
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00408890
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.0040d450
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.0040d430
lea ecx, [ebp - 4]
call fcn.00439180
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x100052c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x100052cf
pop dword [ebp - 4]
mov eax, 0x100052cf
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x3b7bc5a0
sub dword [ebp - 0x14], 0xed298055
mov dword [ebp - 0x10], 0x8374761c
sub dword [ebp - 0x10], 0x514129d7
mov dword [ebp - 0xc], 0xb13de50
sub dword [ebp - 0xc], 0xbec79a22
mov dword [ebp - 8], 0xed9a6b5d
add dword [ebp - 8], 0x126594a3
lea eax, [ebp - 0x14]
push eax
mov eax, 0x7fb58764
sub eax, 0x6fb18728
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x37075a3c
sub dword [ebp - 0x14], 0xc294f0e6
mov dword [ebp - 0x10], 0x26e8c0b2
sub dword [ebp - 0x10], 0xe57c5f3d
mov dword [ebp - 0xc], 0x6b23f2d9
sub dword [ebp - 0xc], 0x7b4866d
mov dword [ebp - 8], 0xa8c19501
sub dword [ebp - 8], 0xa8c19501
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xfcfbc51d
add eax, 0x13083b13
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x4767b
push 0
call eax
mov ecx, 0x9af3a5f1
sub ecx, 0x9af359c3
xor esi, esi
add esi, eax
mov edi, 0x10056e00
add edi, dword [ebp - 4]
mov ebx, 0xe8eb80c0
sub ebx, 0x28ede284
mov edx, dword [edi]
xor edx, ebx
mov dword [esi], edx
add esi, 0xa488267
sub esi, 0xa488263
add edi, 0xa73ed72
sub edi, 0xa73ed6e
loop 0x100053e8
add eax, 0xafa4df90
sub eax, 0xafa3bc05
xor ebx, ebx
add ebx, eax
add eax, 0xcb3ec5e3
add eax, 0x34c13a22
mov ecx, 0xf0789865
sub ecx, 0xe0789865
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100052c0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4