joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488bc0
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
mov al, byte [eax]
lea ecx, [esp + 0x1c]
mov byte [esp + 0xc], al
push ecx
lea edx, [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push edx
lea edx, [esp + 0x14]
push eax
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x5c
mov byte [esp + 0x1b], 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [esp]
imul eax, dword [esp + 4]
imul eax, dword [esp + 8]
shr eax, 0x14
add esp, 0x20
ret

Function at 0x48c890
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
mov eax, 0xaa756c
xor ecx, ecx
push ebx
push esi
push edi
push ebp
mov dword [eax], ecx
add eax, 8
cmp eax, 0xaa763c
mov byte [eax - 0xc], cl
jb 0x48c8a1
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
xor ebp, ebp
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], ebx
xor edx, edx
cmp byte [esp + ebx + 0x18], dl
je 0x48c8fb
xor ecx, ecx
mov al, byte [esp + ebx + 0x18]
cmp al, 0x5c
je 0x48c8ec
inc ebx
mov byte [ebp + edx + 0xaa7568], al
jmp 0x48c8f4
inc ebx
mov byte [ebp + edx + 0xaa7568], cl
inc edx
cmp byte [esp + ebx + 0x18], cl
jne 0x48c8da
lea edi, [ebp + 0xaa7568]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x118]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4cce68
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x118]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp + 0xaa756c], eax
cmp eax, 5
jne 0x48c97b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
add ebp, 8
inc ebx
inc dword [esp + 0x10]
cmp byte [esp + ebx + 0x18], 0
jne 0x48c8d0
mov eax, dword [esp + 0x14]
pop ebp
inc eax
pop edi
pop esi
cmp eax, 1
sbb eax, eax
pop ebx
inc eax
add esp, 0x208
ret
Function at 0x497b60
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [esp + 0x10]
push ebx
push esi
test al, al
push edi
push ebp
jge 0x497b82
mov di, word [esp + 0x18]
mov si, word [esp + 0x14]
push edi
push esi
call fcn.00497d00
add esp, 8
jmp 0x497b8e
mov si, word [esp + 0x14]
and al, 0xf
mov di, word [esp + 0x18]
movsx eax, al
mov ecx, dword [0xc3aba0]
lea edx, [eax + eax*2]
mov ecx, dword [ecx + 0x58]
movsx eax, byte [esp + 0x1c]
lea ebp, [ecx + edx*4 + 2]
lea edx, [eax + eax*2]
mov bx, word [ebp]
lea ecx, [ecx + edx*4 + 2]
mov dx, word [ecx + 4]
cmp dx, bx
je 0x497c01
mov ax, word [ebp + 4]
cmp ax, word [ecx]
je 0x497bf9
mov bp, word [ebp + 2]
cmp word [ecx + 6], bp
je 0x497bd1
mov bp, word [ecx + 2]
cmp word [ecx], bx
jb 0x497bdb
mov cx, word [ecx]
mov ebx, ecx
cmp ax, dx
jb 0x497be2
mov eax, edx
push eax
push ebx
mov ax, bp
or ah, 0x80
push eax
push esi
call fcn.00497c50
mov bx, ax
add esp, 0x10
jmp 0x497c2e
cmp dx, bx
je 0x497c01
mov bx, word [ecx]
mov ax, word [ecx + 2]
mov dx, word [ebp + 2]
cmp ax, dx
jb 0x497c10
mov edx, eax
mov cx, word [ecx + 6]
mov ax, word [ebp + 6]
cmp cx, ax
ja 0x497c1f
mov eax, ecx
push eax
push edx
push ebx
push edi
call fcn.00497c50
mov bp, ax
add esp, 0x10
movsx eax, bx
movsx ecx, bp
push ebp
mov dword [0xc2fcb0], eax
push ebx
mov dword [0xc2fcb4], ecx
push edi
push esi
call fcn.00497eb0
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49d030
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4ce3b8], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x49d04e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4ce3b4], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4ce3b0], bl
jne 0x49d0a8
cmp dword [0xd7133c], 0
je 0x49d096
mov edi, dword [0xd71338]
sub edi, 4
cmp edi, dword [0xd7133c]
jb 0x49d096
mov eax, dword [edi]
test eax, eax
je 0x49d08b
call eax
sub edi, 4
cmp edi, dword [0xd7133c]
jae 0x49d083
push 0x4aa084
push 0x4aa07c
call fcn.0049d0e0
add esp, 8
push 0x4aa08c
push 0x4aa088
call fcn.0049d0e0
add esp, 8
test ebx, ebx
jne 0x49d0cf
mov dword [0x4ce3b8], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x49d100
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8588
push 0x49f15c
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4ce37c], eax
xor eax, eax
mov al, byte [0x4ce37d]
mov dword [0x4ce388], eax
mov eax, dword [0x4ce37c]
shr dword [0x4ce37c], 0x10
and eax, 0xff
mov dword [0x4ce384], eax
shl eax, 8
add eax, dword [0x4ce388]
mov dword [0x4ce380], eax
call fcn.004a1ae0
test eax, eax
jne 0x49d174
push 0x1c
call fcn.0049d2a0
add esp, 4
mov dword [ebp - 4], 0
call fcn.004a03e0
call fcn.004a1ad0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0xd71334], eax
call fcn.004a1680
mov dword [0x4ce3bc], eax
test eax, eax
je 0x49d1a7
cmp dword [0xd71334], 0
jne 0x49d1b1
push 0xffffffffffffffff
call fcn.0049cff0
add esp, 4
call fcn.004a1400
call fcn.004a1310
call fcn.0049cfc0
mov esi, dword [0xd71334]
mov al, byte [esi]
cmp al, 0x22
je 0x49d1d8
cmp al, 0x20
jbe 0x49d205
inc esi
cmp byte [esi], 0x20
ja 0x49d1d0
jmp 0x49d205
inc esi
cmp byte [esi], 0x22
je 0x49d204
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x49d1ff
xor eax, eax
mov al, bl
push eax
call fcn.004a12b0
add esp, 4
test eax, eax
je 0x49d1f9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x49d1e1
cmp byte [esi], 0x22
jne 0x49d205
inc esi
cmp byte [esi], 0
je 0x49d215
cmp byte [esi], 0x20
ja 0x49d215
inc esi
cmp byte [esi], 0
jne 0x49d20a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x49d239
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0049cff0
jmp 0x49d27a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49fd60
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0xd71330], edx
push ebx
push esi
push edi
push ebp
jbe 0x49ff67
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0xd71230
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x49ff67
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x49fdc9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x49fdda
push 2
push 0
push edx
call fcn.0049fca0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x49fe76
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x49feaf
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x49fe3d
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x49fe2b
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x49fe12
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49fea5
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x49fdfd
jmp 0x49feaf
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49fea5
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x49feaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x49ff56
cmp dword [esp + 0x10], 0
je 0x49ff08
cmp dword [esp + 0x10], 5
jne 0x49feeb
mov dword [0x4ce370], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x4ce374], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.004a34c0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x49ff32
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x49ff32
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4ce370], 0x1c
mov dword [0x4ce374], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4ce370], 9
mov dword [0x4ce374], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x4a1680
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x4ce890], ebx
jne 0x4a16cf
call esi
cmp eax, ebx
mov edi, eax
je 0x4a16ad
mov dword [0x4ce890], 1
jmp 0x4a16cf
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x4a16c5
mov dword [0x4ce890], 2
jmp 0x4a16cf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4ce890], 1
jne 0x4a177e
test edi, edi
jne 0x4a16f2
call esi
mov edi, eax
test edi, edi
jne 0x4a16f2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x4a170c
add esi, 2
cmp word [esi], 0
jne 0x4a16fa
add esi, 2
cmp word [esi], 0
jne 0x4a16fa
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x4a176d
push ebp
call fcn.0049e4b0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4a176d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4a175c
push ebx
call fcn.0049e560
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4ce890], 2
jne 0x4a1802
test ebx, ebx
jne 0x4a17a1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x4a17a1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x4a17b6
inc ebp
cmp byte [ebp], 0
jne 0x4a17a8
inc ebp
cmp byte [ebp], 0
jne 0x4a17a8
sub ebp, ebx
inc ebp
push ebp
call fcn.0049e4b0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x4a17db
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4a1b60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x4ceab8
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x4a1b87
add eax, 8
inc ecx
cmp eax, 0x4ceb48
jb 0x4a1b78
cmp dword [ecx*8 + 0x4ceab8], edx
lea ebx, [ecx*8]
jne 0x4a1d4b
cmp dword [0x4ce3c8], 1
je 0x4a1d07
cmp dword [0x4ce3c8], 0
jne 0x4a1bbe
cmp dword [0x4ce3cc], 1
je 0x4a1d07
cmp edx, 0xfc
je 0x4a1d4b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x4a1bfb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x4a1c3f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4a8a30
push ebp
call fcn.004a42a0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a8a10
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x4ceabc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.004a47c0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0xd71230], 0
je 0x4a1d1d
mov eax, dword [0xd71230]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x4a1d27
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x4ceabc]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x4a5850
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.0049bb70
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0xd71330], esi
jbe 0x4a599d
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0xd71230]
test byte [edx + ecx*8 + 4], 1
je 0x4a599d
push 1
push ebx
push esi
call fcn.0049fca0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a598d
push 2
push ebx
push esi
call fcn.0049fca0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a598d
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x4a5933
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.004a6550
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x4a58f6
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0049fd60
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a5912
sub ebp, eax
test ebp, ebp
jg 0x4a58eb
jmp 0x4a5927
cmp dword [0x4ce374], 5
jne 0x4a5925
mov dword [0x4ce370], 0xd
mov ebx, eax
push edi
push esi
call fcn.004a6550
add esp, 8
jmp 0x4a5970
jge 0x4a5970
push 0
push ecx
push esi
call fcn.0049fca0
add esp, 0xc
push esi
call fcn.004a3730
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x4a5970
mov dword [0x4ce370], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ce374], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.0049fca0
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4ce370], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x4a6a20
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
cmp dword [esp + 8], 0
push ebx
push esi
push edi
push ebp
je 0x4a6c5e
mov edx, dword [esp + 0x18]
push 0x3d
push edx
call fcn.004a6d50
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x4a6c5e
cmp ebp, dword [esp + 0x18]
je 0x4a6c5e
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x4ce398]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x4ce39c], ecx
jne 0x4a6a7d
push ecx
call fcn.004a6cd0
add esp, 4
mov dword [0x4ce398], eax
cmp dword [0x4ce398], 0
jne 0x4a6b2d
cmp dword [esp + 0x1c], 0
je 0x4a6ab4
cmp dword [0x4ce3a0], 0
je 0x4a6ab4
call fcn.004a6190
test eax, eax
je 0x4a6b2d
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [esp + 0x10], 0
je 0x4a6ac5
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4ce398], 0
jne 0x4a6af9
push 4
call fcn.0049e4b0
add esp, 4
mov dword [0x4ce398], eax
test eax, eax
jne 0x4a6aee
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x4ce398]
mov dword [eax], 0
cmp dword [0x4ce3a0], 0
jne 0x4a6b2d
push 4
call fcn.0049e4b0
add esp, 4
mov dword [0x4ce3a0], eax
test eax, eax
jne 0x4a6b22
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x4ce3a0]
mov dword [eax], 0
mov esi, dword [0x4ce398]
sub ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.004a6c70
add esp, 8
mov edi, eax
test edi, edi
jl 0x4a6b95
cmp dword [esi], 0
je 0x4a6b95
cmp dword [esp + 0x10], 0
je 0x4a6b8c
lea ebx, [esi + edi*4]
mov eax, dword [ebx]
push eax
call fcn.0049e560
add esp, 4
cmp dword [ebx], 0
je 0x4a6b79
mov eax, dword [ebx + 4]
add ebx, 4
inc edi
mov dword [ebx - 4], eax
cmp dword [ebx], 0
jne 0x4a6b6a
shl edi, 2
push edi
push esi
call fcn.0049f240
add esp, 8
test eax, eax
je 0x4a6bdd
jmp 0x4a6bd8
mov edx, dword [esp + 0x18]
mov dword [esi + edi*4], edx
jmp 0x4a6bdd
cmp dword [esp + 0x10], 0
jne 0x4a6c54
test edi, edi
jge 0x4a6ba6
neg edi
lea eax, [edi*4 + 8]
push eax
push esi
call fcn.0049f240
add esp, 8
test eax, eax
jne 0x4a6bc8
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
lea ecx, [eax + edi*4]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov dword [0x4ce398], eax
cmp dword [esp + 0x1c], 0
je 0x4a6c4a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.0049e4b0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4a6c4a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.0049e560
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x44ba10
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x65dd9c]
sub esp, 0x10
push esi
push eax
mov esi, 1
call sub.WINSPOOL.DRV_StartPagePrinter
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push str.SoftwareAdobeAdobe_Acrobat11.0Security
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44ba8e
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0x65d054
push edx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44ba83
mov eax, dword [esp + 4]
test eax, eax
jne 0x44ba83
xor esi, esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4165ae
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 0xc
lea edx, [ebx + 0x1c]
lea ecx, [ebx + 0x40]
mov esi, eax
lea eax, [ebx + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x3c]
push ecx
push eax
push edi
push esi
push ecx
lea ecx, [ebp - 0x88]
call fcn.0041646f
lea ecx, [ebp - 0x30]
call fcn.0040f010
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push 0x2c
mov eax, ecx
mov dword [ebp - 4], esi
push eax
push 0x2c
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x416671
cmp dword [ebp - 0x30], 2
jne 0x416671
cmp dword [ebp - 0x2c], esi
je 0x416671
cmp dword [ebp - 0x10], esi
je 0x416671
cmp dword [ebp - 0xc], esi
je 0x416671
cmp dword [ebp - 8], esi
je 0x416671
lea ecx, [ebp - 0x5c]
call fcn.0040f010
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x5c], 3
push eax
push 0x2c
mov eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416671
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x34], eax
mov al, 1
jmp 0x416673
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx