joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e48d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
xor eax, eax
push edi
inc eax
xor ebx, ebx
push 0x100000
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov word [ebp - 0x21c], bx
call fcn.0042aed6
mov edi, dword [ebp + 0x14]
cmp edi, ebx
jne 0x42e4e4
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
mov dword [ebp - 4], eax
lea edi, [ebp - 0x21c]
je 0x42e5f4
cmp dword [ebp - 0xc], ebx
push esi
mov esi, 0xa0000000
mov dword [ebp - 8], ebx
je 0x42e4f7
mov esi, 0xe0000000
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 3
push esi
push dword [ebp + 0xc]
call dword [0x490008]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x42e54a
cmp dword [ebp - 0xc], 1
jne 0x42e53c
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 3
and esi, 0xbfffffff
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
call dword [0x490008]
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x42e510
cmp dword [ebp + 0x14], ebx
jne 0x42e54a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x42e5e5
push edi
push dword [ebp + 0x14]
call dword [0x49000c]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x42e571
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [0x490010]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x42e58d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x42e5d7
xor esi, esi
cmp dword [ebp - 0xc], ebx
mov edi, 0x200
jne 0x42e5a0
mov esi, edi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x490014]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x42e5d7
cmp dword [ebp - 0xc], 2
jne 0x42e5cc
or esi, edi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [0x490014]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x42e5d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 8], ebx
je 0x42e5e5
push dword [ebp - 8]
call dword [0x490018]
cmp dword [ebp + 0x14], ebx
pop esi
je 0x42e5f4
push dword [ebp + 0x14]
call dword [0x490018]
lea ecx, [ebp - 0x10]
call fcn.0042602e
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x42e603
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp + 8]
push eax
movzx eax, word [0x48fb88]
or eax, 0x20019
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42e6a8
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
push 0xffe
mov ecx, edi
mov dword [esi], 0xffa
call fcn.0042adfe
mov eax, dword [edi]
push esi
mov byte [eax], bl
push dword [edi]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call ebx
cmp eax, 0xea
mov dword [ebp - 4], eax
jne 0x42e693
add dword [esi], 0xa
mov eax, dword [esi]
add eax, 4
push eax
mov ecx, edi
call fcn.0042adfe
push esi
push dword [edi]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call ebx
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
cmp dword [ebp - 4], 0
je 0x42e6b6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x42e6b1
mov dword [ecx], eax
lea eax, [ebx - 1]
jmp 0x42e6e1
xor ecx, ecx
cmp dword [esi], ecx
jge 0x42e6be
mov dword [esi], ecx
mov eax, dword [edi]
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, dword [edi]
add eax, dword [esi]
mov word [eax + 2], cx
mov word [eax], cx
mov eax, dword [esi]
add eax, 5
push eax
mov ecx, edi
call fcn.0042adfe
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e86b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0x10]
neg esi
sbb esi, esi
mov eax, 0x2000000
and esi, eax
push edi
push dword [ebp + 0x14]
mov edi, dword [ebp + 8]
add esi, eax
mov eax, dword [ebp + 0x14]
xor eax, 0xa
push edi
mov dword [ebp - 0x10], eax
call fcn.0040c2fb
and dword [ebp + 8], 0
cmp dword [ebp + 0x14], 0
pop ecx
pop ecx
lea ecx, [edi + eax*2]
mov dword [ebp - 8], ecx
mov ebx, eax
mov dword [ebp + 0x10], edi
jne 0x42e8b4
mov edi, ecx
jmp 0x42e8d7
cmp edi, dword [ebp - 8]
jae 0x42e979
mov dword [ebp + 0x10], edi
mov ax, word [edi]
inc edi
inc edi
cmp word [ebp - 0x10], ax
je 0x42e8d0
cmp edi, dword [ebp - 8]
jb 0x42e8c0
mov ebx, edi
sub ebx, dword [ebp + 0x10]
sar ebx, 1
mov eax, dword [ebp + 0x10]
cmp eax, edi
jae 0x42e8eb
mov cx, word [ebp + 0x14]
xor word [eax], cx
inc eax
inc eax
cmp eax, edi
jb 0x42e8de
push 0
push 0
push ebx
push dword [ebp + 0x10]
mov eax, 0x20804
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [eax + ecx + 1]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0042aeff
push dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx*2]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push esi
mov eax, 0x20804
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov dword [ebp - 4], eax
lea eax, [ebx + ebx]
push eax
push 0
push dword [ebp + 0x10]
call fcn.00466780
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jle 0x42e8b4
add dword [ebp + 8], eax
dec eax
js 0x42e8b4
lea ecx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dx, word [ebp + 0x14]
xor word [eax], dx
inc eax
inc eax
dec ecx
mov dword [ebp - 0xc], eax
jne 0x42e962
jmp 0x42e8b4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov esi, dword [ebp + 8]
mov dx, word [ebp + 0x14]
pop edi
mov word [ecx + esi*2], dx
mov eax, dword [eax]
pop esi
pop ebx
leave
ret

Function at 0x42ea97
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push esi
xor esi, esi
push esi
push 0x20000000
push 3
push esi
push 3
push 0x100080
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00403b3c
cmp dword [ebp - 4], esi
jne 0x42eacb
or esi, 0xffffffff
jmp 0x42eafa
or dword [ebp - 0xc], 0xffffffff
push esi
lea eax, [ebp - 0x1a0]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0x2d1080
push dword [ebp - 4]
mov dword [ebp - 0x1a0], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x42eac6
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.004029f8
mov eax, esi
pop esi
leave
ret
Function at 0x42ec9e
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
movzx eax, word [ebp + 0x10]
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 0x10]
sar ebx, 0x10
push esi
and ebx, 0xffdf
cmp dword [ebp + 0xc], 0
push edi
mov dword [ebp + 0x10], eax
jne 0x42ecda
push 0x100000
lea ecx, [ebp - 0xc]
call fcn.0042adfe
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
push 5
pop ecx
xor eax, eax
mov esi, 0x47feb8
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push 0x1b
add eax, 4
pop edx
and word [eax + 4], 0
or ecx, 0xffffffff
mov word [eax + 2], cx
mov word [eax], cx
mov word [eax - 4], cx
mov word [eax - 2], cx
add eax, 0xa
dec edx
jne 0x42ecfa
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x18], eax
xor edi, edi
xor eax, eax
cmp bx, 0x41
mov dword [ebp - 8], 0x19
jb 0x42ed40
cmp bx, 0x5a
ja 0x42ed40
movzx eax, bx
sub eax, 0x41
mov dword [ebp - 8], eax
movsx ecx, ax
cmp ecx, dword [ebp - 8]
jg 0x42ee90
lea esi, [eax + 0x41]
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 0x18]
xor eax, eax
inc eax
shl eax, cl
mov word [ebp - 0x38], si
test edx, eax
je 0x42ee7d
lea eax, [ecx + ecx*4]
mov ecx, dword [ebp + 8]
lea ebx, [ecx + eax*2]
lea eax, [ebp - 0x38]
push eax
mov word [ebx + 8], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
mov dword [ebp - 0x14], eax
je 0x42ee7d
cmp eax, 3
je 0x42ed97
cmp eax, 2
je 0x42ed97
xor al, al
jmp 0x42ed99
mov al, 1
cmp dword [ebp + 0x10], 4
je 0x42eda7
test al, al
je 0x42ee7d
push edi
push 0x20000000
push 3
push edi
push 3
push 0x80000000
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.00403b3c
cmp dword [ebp - 4], edi
jne 0x42edd8
lea ecx, [ebp - 4]
call fcn.004029f8
jmp 0x42ee7d
mov esi, dword [ebp + 0xc]
push 0x90
push edi
push esi
mov dword [ebp - 0x1d0], edi
call fcn.00466780
or dword [esi + 0x18], 0xffffffff
add esp, 0xc
push edi
lea eax, [ebp - 0x1d0]
push eax
push 0x90
push esi
push edi
push edi
push 0x70048
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x42ee1d
mov ax, word [esi + 0x18]
mov word [ebx], ax
push edi
mov dword [ebp - 0x1d0], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [esi + 4], 0xffffffff
push edi
lea eax, [ebp - 0x1d0]
push eax
push 0xc
push esi
push edi
push edi
push 0x2d1080
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x42ee55
mov ax, word [esi + 4]
mov word [ebx + 2], ax
cmp dword [ebp + 0x10], 4
jne 0x42ee6a
push dword [ebp - 4]
push edi
call fcn.0042c3bd
pop ecx
pop ecx
mov word [ebx + 6], ax
mov ax, word [ebp - 0x14]
lea ecx, [ebp - 4]
mov word [ebx + 4], ax
call fcn.004029f8
mov esi, dword [ebp - 0x10]
inc esi
lea eax, [esi - 0x41]
movsx ecx, ax
cmp ecx, dword [ebp - 8]
mov dword [ebp - 0x10], esi
jle 0x42ed52
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
call fcn.0042602e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f13c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x14], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
jg 0x42f15d
push dword [esi]
call fcn.004287a9
pop ecx
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
shl eax, 7
xor edx, edx
lea eax, [eax + ecx - 1]
div ecx
mov ebx, eax
inc ebx
inc ebx
lea edi, [ebx + 2]
imul edi, ecx
push edi
push 0
push dword [ebp + 0xc]
call fcn.00466780
xor eax, eax
push eax
push eax
push eax
push dword [esi]
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], eax
call fcn.00426f04
add esp, 0x1c
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esi]
call edi
mov eax, dword [ebp + 0xc]
push 4
lea ecx, [eax + 0x1be]
pop edx
cmp byte [ecx + 4], 0xee
jne 0x42f1c1
mov dword [ebp + 0x10], ecx
add ecx, 0x10
dec edx
jne 0x42f1b8
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42f223
mov edx, dword [ecx + 8]
xor ecx, ecx
cmp edx, 1
mov dword [ebp - 0xc], edx
jne 0x42f1df
test ecx, ecx
je 0x42f223
mov ecx, dword [ebp + 0x14]
imul ebx, ecx
push ebx
add eax, ecx
push 0
push eax
mov dword [ebp + 0xc], eax
call fcn.00466780
mov eax, dword [ebp + 0x14]
add esp, 0xc
push 0
xor ecx, ecx
push ecx
push dword [ebp - 0xc]
cdq
push edx
push eax
call fcn.00467ab0
push edx
push eax
push dword [esi]
call fcn.00426f04
add esp, 0x10
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi]
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
xor edx, edx
pop ebx
leave
ret

Function at 0x42f49f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push edi
push dword [ebp + 8]
call fcn.00426f04
add esp, 0x10
cmp eax, edi
jne 0x42f560
cmp edx, dword [ebp + 0x10]
jne 0x42f560
push esi
push ebx
lea eax, [ebp - 4]
push eax
mov esi, 0x200
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f55f
push esi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004669c0
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x36]
push eax
call fcn.004669c0
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.00426f04
add esp, 0x28
cmp eax, edi
jne 0x42f55f
cmp edx, dword [ebp + 0x10]
jne 0x42f55f
push esi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.00426123
add esp, 0xc
test eax, eax
je 0x42f55f
push ebx
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret
Function at 0x4305d7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x134
mov ecx, edi
call fcn.0042aeff
push 0xca
lea ecx, [ebp - 0x10]
call fcn.0042aed6
mov eax, dword [ebp + 0x18]
movzx esi, byte [ebp + 0x18]
and eax, 0x100
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [edi]
test esi, esi
sete bl
neg esi
sbb esi, esi
and esi, 0x19
cmp dword [ebp + 0x14], 0
mov dword [ebp - 4], eax
mov byte [ebp + 0x1b], 0
lea ebx, [ebx + ebx - 1]
mov edx, esi
je 0x4306ac
cmp dword [ebp + 0x14], 1
not dword [ebp - 4]
jle 0x4306ac
and dword [ebp - 4], 0xfffffffc
jmp 0x4306ac
test edx, edx
jl 0x4306b1
xor eax, eax
mov ecx, edx
inc eax
shl eax, cl
movsx esi, bl
mov cl, dl
add edx, esi
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
add cl, 0x41
test edx, eax
mov byte [ebp + 0x17], cl
je 0x4306a9
cmp dword [ebp - 8], 0
je 0x43067b
movsx ax, cl
push eax
call fcn.004662a2
test eax, eax
pop ecx
je 0x4306a9
mov cl, byte [ebp + 0x17]
cmp byte [ebp + 0x1b], 0
je 0x43068f
mov ax, word [ebp + 0xc]
test ax, ax
je 0x43068f
mov word [edi], ax
inc edi
inc edi
movsx ax, cl
mov word [edi], ax
inc edi
inc edi
cmp dword [ebp + 0x10], 0
mov byte [ebp + 0x1b], 1
je 0x4306a9
mov word [edi], 0x3a
inc edi
inc edi
mov edx, dword [ebp - 0xc]
cmp edx, 0x1a
jl 0x430641
mov eax, dword [ebp + 8]
and word [edi], 0
mov esi, dword [eax]
lea ecx, [ebp - 0x10]
call fcn.0042602e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x43073b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
push edi
sete byte [esp + 0x14]
cmp byte [esp + 0x14], 0
je 0x430753
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov ebp, dword [esp + 0x18]
lea eax, [eax + eax*2 + 3]
push eax
mov ecx, ebp
call fcn.0042adfe
mov eax, dword [ebp]
xor ebx, ebx
mov byte [eax], 0
mov dword [esp + 0x18], eax
xor cl, cl
jmp 0x43078f
mov dl, byte [esi]
cmp dl, 0x3d
jne 0x4307d0
test cl, cl
jle 0x43078e
mov byte [eax], bl
inc eax
xor ebx, ebx
xor cl, cl
inc esi
cmp byte [esi], 0
jne 0x43077c
push dword [esp + 0x18]
mov byte [eax], 0
call edi
cmp byte [esp + 0x14], 0
mov esi, eax
je 0x4307c8
xor ecx, ecx
test esi, esi
jle 0x4307c8
mov eax, dword [esp + 0x18]
lea edi, [ecx + eax]
mov eax, ecx
cdq
push 0x14
pop ebx
idiv ebx
mov al, byte [edx + 0x47ec1c]
xor byte [edi], al
inc ecx
cmp ecx, esi
jl 0x4307ac
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dl, 0x2b
jne 0x4307d9
xor dl, dl
jmp 0x4307ff
cmp dl, 0x2f
jne 0x4307e3
add dl, 0xd2
jmp 0x4307ff
cmp dl, 0x39
ja 0x4307ed
add dl, 0xd2
jmp 0x4307ff
cmp dl, 0x5a
ja 0x4307f7
add dl, 0xcb
jmp 0x4307ff
cmp dl, 0x7a
ja 0x430804
add dl, 0xc5
movzx edx, dl
jmp 0x430807
or edx, 0xffffffff
test edx, edx
jl 0x430833
shl edx, cl
or ebx, edx
add cl, 6
cmp cl, 8
jge 0x430828
test cl, cl
jle 0x43078e
cmp byte [esi], 0
jne 0x43078e
mov byte [eax], bl
inc eax
shr ebx, 8
add cl, 0xf8
jmp 0x430812
xor eax, eax
jmp 0x4307cb
Function at 0x430837
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea ecx, [ebp - 4]
mov ebx, edi
call fcn.0042adba
cmp byte [ebp + 0x10], 0
jne 0x4308ac
cmp edi, 0x14
jge 0x430862
push 0x14
pop ebx
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 4]
call fcn.0042adfe
mov esi, dword [ebp - 4]
lea eax, [ebx + 2]
push eax
push 0
push esi
call fcn.00466780
inc edi
push edi
push dword [ebp + 8]
push esi
call fcn.004669c0
add esp, 0x18
xor ecx, ecx
test ebx, ebx
jle 0x4308aa
mov eax, ecx
cdq
push 0x14
pop edi
idiv edi
mov edi, dword [ebp - 4]
mov al, byte [edx + 0x47ec1c]
xor byte [ecx + edi], al
inc ecx
cmp ecx, ebx
jl 0x430891
mov edi, ebx
lea eax, [edi + edi*2 + 0xd]
mov edi, dword [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0042aeff
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
mov word [eax], cx
cmp byte [esi], cl
jne 0x4308d2
mov esi, eax
jmp 0x4309ab
cmp byte [ebp + 0x10], 0
jne 0x4308df
mov word [eax], 0x23
inc eax
inc eax
lea edi, [ebx + esi]
mov word [eax], cx
movzx ebx, byte [esi]
inc esi
mov byte [ebp + 0xb], 8
cmp byte [ebp + 0xb], 6
jge 0x4308fd
cmp byte [ebp + 0xb], 0
jle 0x43095f
cmp esi, edi
jne 0x430961
mov dl, bl
and dl, 0x3f
cmp byte [ebp + 0x10], 0
je 0x430913
movzx ecx, dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x430944
test dl, dl
jne 0x43091c
add dl, 0x2b
jmp 0x430942
cmp dl, 1
jne 0x430926
add dl, 0x2e
jmp 0x430942
cmp dl, 0xc
jae 0x430930
add dl, 0x2e
jmp 0x430942
cmp dl, 0x26
jae 0x43093a
add dl, 0x35
jmp 0x430942
cmp dl, 0x40
jae 0x430942
add dl, 0x3b
mov cl, dl
movzx cx, cl
mov word [eax], cx
inc eax
inc eax
shr ebx, 6
add byte [ebp + 0xb], 0xfa
jns 0x4308ed
mov word [eax], 0x3d
inc eax
inc eax
jmp 0x4308ed
cmp esi, edi
jae 0x430998
movzx edx, byte [esi]
mov cl, byte [ebp + 0xb]
add byte [ebp + 0xb], 8
shl edx, cl
or ebx, edx
inc esi
cmp esi, edi
jae 0x430998
movzx edx, byte [esi]
mov cl, byte [ebp + 0xb]
add byte [ebp + 0xb], 8
shl edx, cl
or ebx, edx
inc esi
cmp esi, edi
jae 0x430998
movzx edx, byte [esi]
mov cl, byte [ebp + 0xb]
shl edx, cl
or ebx, edx
inc esi
add byte [ebp + 0xb], 8
cmp byte [ebp + 0xb], 0
jg 0x4308ed
and word [eax], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
lea ecx, [ebp - 4]
call fcn.0042602e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43144f
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esi]
call fcn.00426f04
add esp, 0x10
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret
Function at 0x432209
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
push 0x4901bc
push str.OLEPRO32.DLL
push str.OleLoadPicture
call fcn.00426fd9
add esp, 0x10
cmp dword [0x4901b8], esi
je 0x4322ff
cmp dword [0x4901bc], esi
je 0x4322ff
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.00403b3c
cmp dword [ebp - 4], esi
je 0x4322f3
push ebx
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
je 0x4322e1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 4]
call fcn.004029f8
lea eax, [ebp - 8]
push eax
push esi
push edi
call dword [0x4901b8]
cmp dword [ebp - 8], esi
je 0x4322da
lea eax, [ebp - 0xc]
push eax
push 0x483134
push esi
push esi
push dword [ebp - 8]
call dword [0x4901bc]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
cmp eax, esi
pop edi
pop ebx
je 0x4322f0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.004029f8
mov eax, esi
jmp 0x432301
xor eax, eax
pop esi
leave
ret
Function at 0x432696
Capabilities:
Delete file
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 4], esi
mov dword [ebp - 4], esi
jg 0x4326b5
xor eax, eax
jmp 0x432879
push 0x49062c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0043219c
lea ecx, [ebp - 0xc]
call fcn.004029bd
push dword [edi + 4]
push dword [edi]
call fcn.00429815
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x4326f4
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi
jne 0x4326f9
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp dword [ebp - 4], esi
je 0x432713
mov eax, dword [0x4901b0]
cmp eax, esi
mov edi, dword [ebp - 4]
je 0x43270c
cmp dword [ebp - 0xc], esi
jne 0x43270c
call eax
mov esi, edi
jmp 0x43286c
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x2e4]
push eax
push 0x47acf8
mov word [ebp - 0x2e4], si
call edi
cmp eax, esi
jg 0x432769
push ebx
lea eax, [ebp - 0x2e4]
push eax
push str.TEMP
call edi
cmp eax, esi
jg 0x432769
mov eax, dword [0x4901b0]
cmp eax, esi
je 0x43286b
cmp dword [ebp - 0xc], esi
jne 0x43286b
call eax
jmp 0x43286b
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 0x63
lea edi, [ebp + eax*2 - 0x2e4]
call fcn.00427c6b
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.pecmd_bmp._lu._lu.tmp
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push 0x80
push 1
push esi
push 5
push 0x40000000
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 8]
call fcn.00403b3c
cmp dword [ebp - 8], esi
jne 0x4327de
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x10]
jns 0x43277a
lea ecx, [ebp - 8]
call fcn.004029f8
jmp 0x43274c
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov dword [ebp - 0x14], esi
push dword [eax]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 8]
call fcn.004029f8
push 0x10
push esi
push esi
push esi
lea eax, [ebp - 0x2e4]
push eax
push esi
call dword [sym.imp.USER32.dll_LoadImageW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x432841
lea eax, [ebp - 0x2e4]
push eax
call fcn.00432209
mov edi, eax
cmp edi, esi
pop ecx
je 0x432841
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push edi
call dword [eax + 0xc]
cmp dword [ebp - 4], esi
jne 0x432841
mov eax, dword [edi]
push edi
call dword [eax + 8]
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.004029f8
mov eax, dword [0x4901b0]
cmp eax, esi
je 0x432869
cmp dword [ebp - 0xc], esi
jne 0x432869
call eax
mov esi, edi
pop ebx
push 0x49062c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x432a96
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x104
push edi
mov ecx, esi
call fcn.0042aeff
mov eax, dword [esi]
and word [eax], 0
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
push dword [esp + 0x18]
call edi
mov ebx, eax
test ebx, ebx
jle 0x432ae3
mov eax, dword [esi]
cmp word [eax], 0
jne 0x432ae3
lea eax, [ebx + 2]
push eax
mov ecx, esi
call fcn.0042aeff
inc ebx
push ebx
push dword [esi]
push dword [esp + 0x18]
call edi
pop edi
pop esi
pop ebx
ret