joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493b00
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [esi + 0x200]
cmp eax, 1
push edi
je 0x493b16
cmp eax, 3
jne 0x493bb1
cmp dword [esi + 0x214], 0
jne 0x493b32
mov eax, dword [esi + 0x20c]
test eax, eax
je 0x493b8f
mov eax, dword [eax + 4]
mov dword [esi + 0x214], eax
mov ecx, dword [esi + 0x20c]
mov eax, dword [esi + 0x214]
mov edx, dword [ecx + 4]
push 0
push eax
sub edx, eax
lea eax, [edx + ecx + 8]
mov ecx, dword [esi + 0x204]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x493b9e
test eax, eax
je 0x493cfd
sub dword [esi + 0x214], eax
jne 0x493b16
mov edx, dword [esi + 0x20c]
mov edi, dword [edx]
mov eax, edx
push eax
call fcn.004a4a00
test edi, edi
mov dword [esi + 0x20c], edi
jne 0x493b16
mov dword [esi + 0x210], edi
jmp 0x493b16
mov dword [esi + 0x208], 1
xor eax, eax
pop edi
pop ecx
ret
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
jne 0x493ce6
cmp dword [esi + 0x200], 2
push ebx
push ebp
jne 0x493c9e
lea ebx, [esi + 0x224]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x240]
mov edi, dword [esi + 0x218]
mov ebp, dword [esi + 0x210]
push ebx
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x493c5c
mov edi, edi
mov edx, dword [esi + 0x20c]
mov eax, dword [esi + 0x204]
push 0
sub edx, edi
push edi
add edx, ebp
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x493ca8
test ebp, ebp
je 0x493cd0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub edi, ebp
push ebx
mov dword [esi + 0x218], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x240]
mov edi, dword [esi + 0x218]
mov ebp, dword [esi + 0x210]
push ebx
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x493bf0
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x493c72
pop ebp
pop ebx
mov dword [esi + 0x208], eax
xor eax, eax
pop edi
pop ecx
ret
cmp eax, 2
jne 0x493c8d
push str.451_Transfer_aborted:_read_error._r_n
mov ecx, esi
call fcn.00492d50
add esp, 4
pop ebp
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test eax, eax
jne 0x493c9e
mov edx, dword [esi + 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebp
pop ebx
mov eax, 1
pop edi
pop ecx
ret
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x493c9e
call edi
push eax
push str.426_send_failed__d_r_n
mov ecx, esi
call fcn.00492d50
add esp, 8
pop ebp
pop ebx
xor eax, eax
pop edi
pop ecx
ret
push str.426_Connection_closed__transfer_aborted._r_n
mov ecx, esi
call fcn.00492d50
add esp, 4
pop ebp
pop ebx
xor eax, eax
pop edi
pop ecx
ret
call edi
push eax
push str.500_send_failed__d._r_n
mov ecx, esi
call fcn.00492d50
add esp, 8
xor eax, eax
pop edi
pop ecx
ret
push str.426_Connection_closed__transfer_aborted._r_n
mov ecx, esi
call fcn.00492d50
add esp, 4
xor eax, eax
pop edi
pop ecx
ret
Function at 0x496370
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
jmp 0x496380
mov eax, dword [esi + 0x160]
cmp eax, dword [esi + 0x164]
jne 0x4963d9
push 0x10000
call fcn.004a49a0
cmp dword [esi + 0x158], 0
je 0x4963ab
mov ecx, dword [esi + 0x15c]
mov dword [ecx], eax
jmp 0x4963b1
mov dword [esi + 0x158], eax
mov dword [eax], 0
add dword [esi + 0x168], 1
lea edx, [eax + 0x10000]
mov dword [esi + 0x15c], eax
add eax, 4
mov dword [esi + 0x164], edx
mov dword [esi + 0x160], eax
mov eax, dword [esi + 0x160]
mov ecx, dword [esi + 0x164]
mov edx, dword [esi + 8]
push 0
sub ecx, eax
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x496561
test eax, eax
je 0x49657a
mov ebx, dword [esi + 0x160]
xor edi, edi
mov dword [esp + 0xc], eax
add eax, ebx
mov dword [esi + 0x160], eax
lea ebx, [ebx]
cmp byte [ebx], 0xa
jne 0x496519
test edi, edi
mov byte [ebx], 0
je 0x496442
push esi
mov ecx, edi
call fcn.00495be0
add ebx, 1
mov edi, ebx
jmp 0x49651c
mov eax, dword [esi + 0x168]
cmp eax, 1
jne 0x496466
mov ecx, dword [esi + 0x15c]
add ecx, 4
push esi
call fcn.00495be0
add ebx, 1
mov edi, ebx
jmp 0x49651c
add eax, 0xffffffff
imul eax, eax, 0xfffc
sub eax, dword [esi + 0x15c]
lea ecx, [eax + ebx - 3]
push ecx
call fcn.004a49a0
mov ebp, dword [esi + 0x158]
cmp ebp, dword [esi + 0x15c]
mov dword [esp + 0x14], eax
mov edi, eax
je 0x4964c4
mov edx, dword [ebp]
push 0xfffc
lea eax, [ebp + 4]
push eax
push edi
mov dword [esp + 0x1c], edx
call fcn.00549ad0
add esp, 0xc
push ebp
add edi, 0xfffc
call fcn.004a4a00
mov ebp, dword [esp + 0x10]
cmp ebp, dword [esi + 0x15c]
jne 0x496493
mov eax, dword [esi + 0x15c]
mov ecx, ebx
sub ecx, eax
sub ecx, 4
push ecx
add eax, 4
push eax
push edi
call fcn.00549ad0
sub edi, dword [esi + 0x15c]
add esp, 0xc
mov byte [edi + ebx - 4], 0
mov edx, dword [esi + 0x15c]
mov edi, dword [esp + 0x14]
push esi
mov ecx, edi
mov dword [esi + 0x168], 1
mov dword [esi + 0x158], edx
call fcn.00495be0
push edi
call fcn.004a4a00
add ebx, 1
mov edi, ebx
jmp 0x49651c
add ebx, 1
sub dword [esp + 0xc], 1
jne 0x496420
test edi, edi
je 0x496380
mov eax, dword [esi + 0x160]
mov ecx, dword [esi + 0x15c]
sub eax, edi
push eax
add ecx, 4
push edi
push ecx
call fcn.00549760
mov edx, dword [esi + 0x15c]
sub edx, edi
add edx, 4
add esp, 0xc
add dword [esi + 0x160], edx
jmp 0x496380
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
cmp eax, 0x2733
sete cl
pop edi
pop ebp
pop ebx
mov eax, ecx
add esp, 0xc
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4a3b10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x34c
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0x348], eax
mov eax, dword [0x598188]
push ebp
push esi
push edi
xor edi, edi
cmp dword [eax + 0xc], edi
mov dword [esp + 0x10], edi
je 0x4a3b43
mov eax, dword [eax + 0xc]
cmp byte [eax], 0
je 0x4a3b43
mov esi, eax
jmp 0x4a3b52
mov eax, dword [0x597ed4]
mov cl, byte [eax]
neg cl
sbb ecx, ecx
and ecx, eax
mov esi, ecx
lea edx, [esp + 0x24]
push edx
call fcn.00401210
lea eax, [esp + 0x24]
push str.EVERYTHING_TASKBAR_NOTIFICATION
push eax
call fcn.00524170
add esp, 8
test esi, esi
je 0x4a3b9b
push 0x56c72c
lea ecx, [esp + 0x28]
push ecx
call fcn.005234f0
push esi
lea edx, [esp + 0x28]
push edx
call fcn.005234f0
push 0x55104c
lea eax, [esp + 0x28]
push eax
call fcn.005234f0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004abfe0
lea edx, [esp + 0x24]
push edx
mov ebp, eax
call fcn.00401230
test ebp, ebp
je 0x4a3d03
push ebx
lea eax, [esp + 0x138]
push eax
call fcn.00401210
lea ecx, [esp + 0x248]
push ecx
call fcn.00401210
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea edx, [esp + 0x13c]
push edx
call fcn.00523d00
lea eax, [esp + 0x248]
push eax
call fcn.004ad700
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x10]
push edx
call dword [0x58df40]
mov eax, dword [esp + 0x248]
mov ecx, dword [esp + 0x138]
lea edi, [eax + ecx + 6]
push edi
call fcn.004a49a0
mov edx, dword [esp + 0x360]
mov esi, eax
mov dword [esi], edx
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x140]
add eax, 1
push eax
push ecx
lea ebx, [esi + 4]
push ebx
call fcn.00549ad0
mov edx, dword [esp + 0x254]
mov eax, dword [esp + 0x25c]
mov ecx, dword [esp + 0x144]
add edx, 1
push edx
push eax
lea edx, [ebx + ecx + 1]
push edx
call fcn.00549ad0
push str.send_cl_n
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], esi
call fcn.0048f0d0
add esp, 0x1c
lea eax, [esp + 0x24]
push eax
push 0x7530
push 9
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x4a
push ebp
call dword [0x597e30]
test eax, eax
pop ebx
je 0x4a3cc6
push str.send_message_ok_n
push 0xff00ff00
mov edi, 1
call fcn.0048f0f0
add esp, 8
jmp 0x4a3ce3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.send_message_failed__u_n
push 0xffff0000
call fcn.0048f0f0
mov edi, dword [esp + 0x1c]
add esp, 0xc
push esi
call fcn.004a4a00
lea edx, [esp + 0x244]
push edx
call fcn.00401230
lea eax, [esp + 0x134]
push eax
call fcn.00401230
mov ecx, dword [esp + 0x354]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00549750
add esp, 0x34c
ret 4
Function at 0x4a3da0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x32c
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0x328], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
mov dword [esp + 0x10], edi
call esi
sub eax, edi
cmp eax, 0x7530
ja 0x4a3ef9
mov ebx, dword [0x597ce0]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
lea eax, [esp + 0x124]
push eax
call fcn.00401210
lea ecx, [esp + 0x14]
push ecx
call fcn.00401210
lea edx, [esp + 0x14]
push str.EVERYTHING_MUTEX
push edx
call fcn.00524170
add esp, 8
call fcn.004a3aa0
test eax, eax
je 0x4a3e2d
call fcn.004a3aa0
push eax
lea eax, [esp + 0x18]
push 0x56c75c
push eax
call fcn.00524310
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x128]
push edx
call fcn.00527550
lea eax, [esp + 0x14]
push eax
call fcn.00401230
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x598180]
cmp eax, edi
je 0x4a3e66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x598180], edi
mov eax, dword [esp + 0x12c]
cmp word [eax], di
je 0x4a3e8c
cmp word [eax], 0x5c
jne 0x4a3e7d
mov word [eax], 0x5f
add eax, 2
cmp word [eax], di
jne 0x4a3e72
mov eax, dword [esp + 0x12c]
push eax
push edi
push edi
call ebx
mov dword [0x598180], eax
call ebp
lea ecx, [esp + 0x124]
push ecx
mov esi, eax
call fcn.00401230
cmp esi, 0xb7
jne 0x4a3f0b
push str.mutex_exists_n
call fcn.0048f0d0
mov edx, dword [0x598188]
add esp, 4
test dword [edx + 4], 0x800000
jne 0x4a3efd
mov eax, dword [esp + 0x340]
push eax
call fcn.004a3b10
test eax, eax
jne 0x4a3ef9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
jbe 0x4a3de3
xor eax, eax
jmp 0x4a3f1c
mov dword [0x598184], 1
xor eax, eax
jmp 0x4a3f1c
mov ecx, dword [0x598188]
mov eax, dword [ecx + 8]
shr eax, 0x17
not eax
and eax, 1
mov ecx, dword [esp + 0x338]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00549750
add esp, 0x32c
ret 4
Function at 0x4a4aa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov ebx, eax
xor edi, edi
cmp ebx, 0x50
mov dword [esp + 0x1c], edi
push ebx
jb 0x4a4cb1
call fcn.004a4a40
mov edi, eax
test edi, edi
je 0x4a4c97
push 0
push 0
push 0
push ebp
call fcn.004af0b0
test eax, eax
je 0x4a4c70
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a4c62
mov eax, dword [esp + 0x10]
invalid

Function at 0x4a4d70
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push 0
push ebx
push ebp
push edi
call fcn.004af0b0
test eax, eax
je 0x4a4dd7
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a4dbe
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4a4dff
push esi
push eax
push str.NRFR_read_error__d____d_n
push 0xffff0000
call fcn.0048f0f0
add esp, 0x10
jmp 0x4a4dd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.NRFR_read_error__d_n
push 0xffff0000
call fcn.0048f0f0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push ebp
push str.read_error__I64x__d_n
push 0xffff0000
call fcn.0048f0f0
mov edx, dword [esp + 0x28]
push esi
push 0
push edx
call fcn.00549e40
add esp, 0x20
pop ebp
pop ebx
ret 0xc
Function at 0x4c0750
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
cmp eax, 0x203
push esi
jg 0x4c07fd
je 0x4c07dd
cmp eax, 0x7b
je 0x4c0808
cmp eax, 0x201
jne 0x4c09a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x5982f6], 0
mov esi, eax
je 0x4c07b0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ecx, esi
sub ecx, dword [0x5982d4]
cmp ecx, eax
ja 0x4c07b0
call fcn.004c06a0
mov dword [0x5982d4], esi
xor eax, eax
pop esi
add esp, 8
ret 4
cmp byte [0x597f00], 0
jne 0x4c07c2
cmp byte [0x5982f4], 0
je 0x4c07c7
call fcn.004c06a0
mov dword [0x5982d4], esi
mov byte [0x5982f6], 1
xor eax, eax
pop esi
add esp, 8
ret 4
call fcn.004c06a0
mov byte [0x5982f6], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5982d4], eax
xor eax, eax
pop esi
add esp, 8
ret 4
cmp eax, 0x205
jne 0x4c09a9
push ebx
push edi
push 0x10
call fcn.004ade80
test eax, eax
je 0x4c0824
xor edx, edx
cmp byte [0x597eff], dl
sete dl
mov edi, edx
jmp 0x4c082b
movsx edi, byte [0x597eff]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.USER32.dll_CreateMenu]
call esi
mov ebx, eax
call esi
test edi, edi
mov esi, eax
je 0x4c0875
mov ecx, dword [0x58deec]
mov edx, dword [ecx + 0x1cc]
push edx
push 0x9c41
push 0
push esi
call fcn.004aa520
mov eax, dword [0x58deec]
mov ecx, dword [eax + 0xd34]
push ecx
push 0x9c47
jmp 0x4c08a1
mov edx, dword [0x58deec]
mov eax, dword [edx + 0xd34]
push eax
push 0x9c47
push 0
push esi
call fcn.004aa520
mov ecx, dword [0x58deec]
mov edx, dword [ecx + 0x1cc]
push edx
push 0x9c41
push 0
push esi
call fcn.004aa520
push esi
call fcn.004aa5b0
mov eax, dword [0x58deec]
mov ecx, dword [eax + 0x260]
push ecx
push 0x9c44
push 0
push esi
call fcn.004b18b0
mov edx, dword [0x58deec]
mov eax, dword [edx + 0xd24]
push eax
push 0xa2e5
push 0
push esi
call fcn.004b18b0
mov ecx, dword [0x58deec]
mov edx, dword [ecx + 0xb54]
push edx
push 0xa2e4
push 0
push esi
call fcn.004b18b0
push esi
call fcn.004aa5b0
mov eax, dword [0x58deec]
mov ecx, dword [eax + 0x1dc]
push ecx
push 0x9c45
push 0
push esi
call fcn.004aa520
push esi
call fcn.004aa5b0
mov edx, dword [0x58deec]
mov eax, dword [edx + 0x1e0]
push eax
push 0x9c46
push 0
push esi
call fcn.004aa520
push 0x55065e
push esi
push 0x10
push ebx
call fcn.004aa520
test edi, edi
push 0
je 0x4c0956
push 0x9c41
jmp 0x4c095b
push 0x9c47
push esi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov ecx, dword [0x5982f8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5982f8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push edx
push 0
push eax
push ecx
push 2
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [0x5982f8]
push 0
push 0
push 0
push edx
call dword [0x597e1c]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 8
ret 4
Function at 0x4c5530
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0x60]
push edi
push eax
call fcn.004ad7d0
mov edi, eax
test edi, edi
je 0x4c5566
cmp byte [0x597e96], 0
jne 0x4c555a
cmp byte [0x58a62b], 0
jne 0x4c5566
mov ecx, dword [esi + 0x60]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x2c8], 0
je 0x4c5577
mov eax, dword [esi + 0x2c4]
jmp 0x4c5580
mov edx, dword [esi + 0x60]
push edx
call fcn.004ad780
test eax, eax
jne 0x4c55dd
test edi, edi
jne 0x4c55dd
cmp dword [esi + 0x2c8], edi
jne 0x4c55dd
mov ecx, dword [esi + 0x60]
mov edi, dword [esi + 0x2ac]
sub edi, dword [esi + 0x2a4]
push ebx
mov ebx, dword [esi + 0x2b0]
sub ebx, dword [esi + 0x2a8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2a4], eax
add eax, edi
mov dword [esi + 0x2a8], ecx
add ecx, ebx
mov dword [esi + 0x2ac], eax
mov dword [esi + 0x2b0], ecx
pop ebx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x525030
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push edi
push 1
push eax
xor edi, edi
call fcn.004a9a10
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5250dd
push esi
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.004ab7b0
test eax, eax
je 0x5250d5
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, edx
or eax, ecx
je 0x5250c6
mov eax, edx
add eax, 1
adc ecx, edi
mov esi, eax
or esi, ecx
je 0x5250d5
test ecx, ecx
jg 0x5250d5
jl 0x525086
cmp eax, 0x80000000
jae 0x5250d5
mov esi, dword [esp + 0x18]
add edx, 1
push edx
push esi
call fcn.005233c0
test eax, eax
je 0x5250d5
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5250d5
mov eax, dword [esi]
cmp dword [esp + 0x1c], eax
jne 0x5250d5
mov ecx, dword [esi + 8]
mov byte [eax + ecx], 0
jmp 0x5250d0
mov edx, dword [esp + 0x18]
push edx
call fcn.00523df0
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret 8

Function at 0x529620
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
lea ebx, [esi + 1]
jle 0x52965a
push ebp
push edi
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x596280]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x529634
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x5296e2
sub ecx, ebx
je 0x5296c7
sub ecx, ebx
je 0x5296bb
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
Function at 0x54cab0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5972f0]
je 0x54cacb
inc edi
cmp edi, 0x17
jb 0x54cabc
cmp edi, 0x17
jae 0x54cc4b
push ebp
push 3
call fcn.0054ed80
cmp eax, 1
pop ecx
je 0x54cc17
push 3
call fcn.0054ed80
test eax, eax
pop ecx
jne 0x54caff
cmp dword [0x596fc0], 1
je 0x54cc17
cmp ebx, 0xfc
je 0x54cc4a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x598868
push ebp
call fcn.0054ed1b
add esp, 0xc
test eax, eax
je 0x54cb35
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
push 0x104
mov esi, 0x598881
push esi
push 0
mov byte [0x598985], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x54cb79
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0054ed1b
add esp, 0xc
test eax, eax
je 0x54cb79
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0054bc35
add esp, 0x14
push esi
call fcn.0054ec90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x54cbbe
push esi
call fcn.0054ec90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x598b7c
push 0x56fb24
sub ecx, eax
push ecx
push eax
call fcn.0054ebdb
add esp, 0x14
test eax, eax
je 0x54cbbe
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
jmp 0x54cbc0
xor esi, esi
push 0x587018
push ebx
push ebp
call fcn.0054eb6a
add esp, 0xc
test eax, eax
je 0x54cbe0
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
push dword [edi*8 + 0x5972f4]
push ebx
push ebp
call fcn.0054eb6a
add esp, 0xc
test eax, eax
je 0x54cc02
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0054e9ad
add esp, 0xc
jmp 0x54cc4a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x54cc4a
cmp ebp, 0xffffffff
je 0x54cc4a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5972f4]
push dword [esi]
call fcn.0054ec90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10001d71
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
cmp dword [0x10166453], 0
jne 0x10001fa8
push 0x80000301
push 0
push 0x40
push 1
mov ebx, 0x184
call fcn.100732c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001dc3
push ebx
call fcn.10072734
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x10001df0
push 0xb8
push 0x40186e9
push 6
call fcn.10072740
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.10001960
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10001e35
push ebx
call fcn.10072734
add esp, 4
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 4]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001e69
push 0xb8
push 0x40186e9
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10001e79
push ebx
call fcn.10072734
add esp, 4
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10001e8c
mov eax, 0x1015e258
push eax
push 1
mov ebx, 0x164
call fcn.10073300
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fld qword [ebp - 0x14]
call fcn.1000101d
mov dword [0x10166453], eax
cmp dword [0x10166453], 0
jne 0x10001fa8
call fcn.10001fc8
mov dword [0x10166453], eax
mov dword [ebp - 8], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 8], esp
je 0x10001ef2
push 0x1c1
push 0x40186e9
push 6
call fcn.10072740
add esp, 0xc
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push str.__processStrMap_
mov ecx, 2
call fcn.10001960
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10001f37
push ebx
call fcn.10072734
add esp, 4
push 0x80000301
push 0
push dword [0x10166453]
push 1
mov ebx, 0x168
call fcn.10073010
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10001f88
push 0x1d6
push 0x40186e9
push 6
call fcn.10072740
add esp, 0xc
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10001f98
push ebx
call fcn.10072734
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10001fa8
push ebx
call fcn.10072734
add esp, 4
mov eax, dword [0x10166453]
jmp 0x10001fb2
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001fc3
push ebx
call fcn.10072734
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret