joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x109ad9a0
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x20]
call fcn.10b30dd1
Function at 0x421d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
mov eax, dword [0x5bdd90]
xor eax, ebp
je 0x421ded
jne 0x421ded
mov eax, dword [0xe91580]
adc dword [ecx - 0x3deecaae], edi
mov eax, 0x106de560
lea ecx, [esi + 0x37c]
cmp byte [ebx + 0xac], 1
push 0xadae0c
push 0xa29f90
mov eax, dword [0x112ae170]
push 0xacc620
push 0x114849e0
mov dword [0x100ce454], eax
lea esi, [eax*4]
push 0x7b3480
dec ecx
cld
push eax
aaa
dec esp
cli
lds edi, [edi]
cmc
push esp
loope 0x421d9c
jmp 0x52fb2ea1
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [edi]
mov ecx, dword [edi + 4]
jmp 0x4227a3
shr eax, 8
push 0x421e83
ret
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
jmp 0x4224c7
push edx
pop eax
jmp 0x421e39
mov eax, 0x473530
xchg edx, eax
ja 0x4225b9
pushal
mov al, byte [0x28c496de]
popal
cli
shr eax, 8
je 0x422b79
jne 0x422b79
mov eax, 0x4a0944
push str.H_fVM
push 0x47e334
call dword [0x9a8358]
mov dword [0x445268], 0x445238
xor eax, 0x46e53b96
xchg esi, eax
cmp esp, ebp
inc esi
jno 0x42257a
outsb dx, byte [esi]
into
mov al, 0xb3
mov eax, dword [0xf681827]
mov dh, 0x47
invalid
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
push ecx
pop eax
shr eax, 0x10
mov byte [ebp - 0xb], al
lea edx, [esi*8]
mov eax, ecx
je 0x42258a
jne 0x42258a
mov edi, 0x4752e0
push 0xa00ddc
cmp dword [ebp - 0x264], edi
fld qword [ebx + 0x10]
push 0xd2c
add byte [0xcc00623c], ch
mov dword [edi + esi + 0x5d], eax
cmp dword [ebp - 0x114c], 0x449
add byte [ebp - 0x15], al
jmp dword [ecx*4 + 0x4b0f00]
mov eax, esi
shr eax, 0x1d
shl ecx, 3
or ecx, eax
je 0x422608
jne 0x422608
push 0x902
mov ecx, 0x103e3618
or dword [0xe482a8], 1
push 0xb50ad0
push 0x11470d40
mov edx, dword [ebp - 0x9cf8]
push 0xa8b5f0
jmp dword [ecx*4 + 0x4286f0]
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
je 0x421f93
jne 0x421f93
add ax, 0x30
call dword [0x45e178]
push 0xb14744
mov dword [ebx], 0x1010a530
adc dword [edx - 0x6deec0e8], edx
add eax, 0xe453a0
push 0x100e0cd0
push 0xb129e0
push 0xaeb480
mov edi, 0x45160a
fld dword [esp + 0x1c]
jmp dword [0x106e0370]
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x23001d13
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x549f2c66
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7dbf0c04
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x40487529
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40d058], 1
mov dword [0x40d054], 1
mov dword [0x40d050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40d00c], eax
mov eax, dword [0x40d064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40d078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40d060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x409014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4017c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x773205be
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x516f6f11
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x97c167d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..text
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x24f1cf7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x44d7a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [0x5560e0]
push edi
push esi
push ebx
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test ecx, ecx
je 0x44d7f8
test edi, edi
je 0x44d7dd
mov edx, dword [esp + 0x10]
mov eax, dword [ebx]
lea esi, [edx + edi]
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5560e0]
cmp esi, edx
mov dword [ebx], eax
jne 0x44d7c2
pop ebx
pop esi
pop edi
ret
xor eax, 0xff000000
mov dword [ecx*4 + 0x5560e0], eax
add ecx, 1
cmp ecx, 0x100
je 0x44d7b5
mov eax, ecx
mov esi, 8
nop
mov edx, eax
and edx, 1
cmp edx, 1
sbb edx, edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
sub esi, 1
jne 0x44d800
jmp 0x44d7e1
Function at 0x4a6c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x557280]
test esi, esi
jle 0x4a6d20
mov edi, dword [0x557284]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4a6c44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4a6cc5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4a6c30
mov dword [esp], eax
mov ebx, eax
call fcn.004a7500
test eax, eax
mov edi, eax
je 0x4a6d47
mov eax, dword [0x557284]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004a7600
add eax, dword [edi + 0xc]
mov edx, dword [0x557284]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4a6d27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4a6cbe
sub eax, 4
and eax, 0xfffffffb
jne 0x4a6cd0
add dword [0x557280], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x557284]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4a6cbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004cf550
lea esi, [esi]
xor esi, esi
jmp 0x4a6c4e
mov eax, dword [0x557284]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004cf550
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004cf550
mov esi, esi
lea edi, [edi]

Function at 0x4a7180
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x557298
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x557290]
sub esp, 4
test ebx, ebx
je 0x4a71d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4a71ce
test esi, esi
je 0x4a71ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4a71b0
mov dword [esp], 0x557298
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a7eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ecx, dword [esi]
mov dword [ebx], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0xc]
mov dword [ebx + 0xc], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x10]
mov dword [ebx + 0x10], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x14]
mov dword [ebx + 0x14], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x18]
mov dword [ebx + 0x18], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x1c]
mov dword [ebx + 0x1c], ecx
call fcn.004ca9b0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x50]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x48], vtable.actSocket.0
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x4c], eax
call fcn.004ca9b0
mov ecx, dword [esi + 0x54]
mov dword [ebx + 0x54], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x58]
mov dword [ebx + 0x58], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x5c]
mov dword [ebx + 0x5c], ecx
call fcn.004ca9b0
mov ecx, dword [esi + 0x60]
mov dword [ebx + 0x60], ecx
call fcn.004ca9b0
mov edx, dword [esi + 0x6c]
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x70]
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x70], ecx
call fcn.004ca9b0
mov eax, dword [esi + 0x78]
mov edx, dword [esi + 0x7c]
mov ecx, dword [esi + 0x90]
mov dword [ebx + 0x78], eax
movzx eax, byte [esi + 0x80]
mov dword [ebx + 0x7c], edx
mov byte [ebx + 0x80], al
mov eax, dword [esi + 0x84]
mov dword [ebx + 0x84], eax
movzx eax, byte [esi + 0x88]
mov dword [ebx + 0x90], ecx
mov byte [ebx + 0x88], al
call fcn.004ca9b0
mov eax, dword [esi + 0x94]
mov dword [ebx + 0x94], eax
add esp, 4
pop ebx
pop esi
ret 4
Function at 0x4cf550
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004a7e40
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004a7e40
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
pop ebp
jmp fcn.004014e0
Function at 0x401470
Capabilities:
Set environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x430
lea edi, [esp + 0x32c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], 0x5c
lea esi, [esp + 0x1f]
mov dword [esp], edi
lea ebx, [esp + 0x228]
call sub.msvcrt.dll_strrchr
lea edx, [eax + 1]
mov dword [eax + 1], 0x65646f63
mov word [edx + 4], 0x7363
mov byte [edx + 6], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_strrchr
lea edx, [eax + 1]
mov dword [eax + 1], 0x65646f63
mov word [edx + 4], 0x7363
mov byte [edx + 6], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0xaee030
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xaee036
mov dword [esp + 4], 6
mov dword [esp], 0xf
call fcn.00405fb0
mov dword [esp + 4], esi
mov dword [esp], 0xaee04a
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
test eax, eax
jne 0x401580
mov dword [esp + 8], 0xaee04f
mov dword [esp + 4], 2
mov dword [esp], 0xf
call fcn.00405fb0
add esp, 0x430
pop ebx
pop esi
pop edi
ret
Function at 0x401590
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x13c
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], edi
mov edi, dword [esp + 0x140]
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x138], ebp
mov dword [esp], 0xaee060
call sub.msvcrt.dll_getenv
test eax, eax
mov esi, eax
je 0x4016b3
mov dword [0xaaa468], 0xaee06d
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ebx, eax
mov eax, dword [0xaaa468]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
test edi, edi
lea ebx, [ebx + eax + 1]
je 0x401684
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
je 0x401680
mov ebx, eax
mov eax, dword [0xaaa468]
mov dword [esp + 0x10], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0xaee078
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0xaee080
mov dword [esp + 4], 6
mov dword [esp], 0
call fcn.00405fb0
mov eax, ebx
mov esi, dword [esp + 0x130]
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x134]
mov ebp, dword [esp + 0x138]
add esp, 0x13c
ret
xor ebx, ebx
jmp 0x40165b
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
test eax, eax
nop
je 0x401680
mov ebx, eax
mov eax, dword [0xaaa468]
mov dword [esp + 8], esi
mov dword [esp + 4], 0xaee073
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_sprintf
jmp 0x401637
mov dword [esp], 0xaee06e
call sub.msvcrt.dll_getenv
test eax, eax
mov esi, eax
jne 0x4015d9
lea esi, [esp + 0x28]
xor ebx, ebx
mov dword [esp + 8], 0x104
xor ebp, ebp
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov ecx, esi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x4016ee
test edx, 0x8080
jne 0x401713
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, esi
cmp ecx, ebx
ja 0x401728
mov byte [esp + ebp + 0x28], 0
jmp 0x4015d9
cmp byte [ebx + esi], 0x5c
je 0x401733
add ebx, 1
jmp 0x4016ec
mov ebp, ebx
mov byte [ebx + esi], 0x2f
jmp 0x40172e
Function at 0x401740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
test eax, eax
mov dword [esp + 0x20], edx
je 0x40192a
mov edi, dword [eax + 0x64]
test edi, edi
je 0x40192a
mov eax, dword [eax + 0x18]
add eax, dword [ebx]
sub eax, dword [edi + 0x38]
sub eax, dword [ebx + 4]
push eax
mov eax, dword [edi + 0x78]
fild dword [esp]
add esp, 4
fild dword [edi + 0x2c]
fdivp st(1)
test eax, eax
fadd qword [ebx + 0x10]
jne 0x4018b8
mov eax, dword [edi + 0x9c]
mov esi, 1
test eax, eax
je 0x4018cc
test eax, eax
movzx esi, word [eax + 0xc]
je 0x4018cc
mov eax, dword [eax + 8]
mov dword [esp + 0x24], eax
fcom dword [esp + 0x60]
fnstsw ax
sahf
jae 0x4018b0
ftst
fnstsw ax
test esi, esi
setne dl
mov ebp, edx
sahf
jne 0x40182f
test dl, dl
jne 0x4018e7
nop
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [edi + 4]
fstp dword [esp + 0x10]
mov dword [esp], eax
call fcn.004c53f0
test eax, eax
fld dword [esp + 0x10]
jle 0x4018b0
fstp st(0)
test ebx, ebx
je 0x4018d8
mov edx, dword [ebx + 0x64]
test edx, edx
je 0x4018d8
mov eax, dword [ebx + 0x18]
add eax, dword [ebx]
sub eax, dword [ebx + 4]
sub eax, dword [edx + 0x38]
push eax
fild dword [esp]
add esp, 4
fild dword [edx + 0x2c]
fdivp st(1)
fadd qword [ebx + 0x10]
fcom dword [esp + 0x60]
fnstsw ax
sahf
jae 0x4018b0
mov edx, ebp
test dl, dl
je 0x4017d0
fld dword [esp + 0x60]
fsub st(1)
fld st(0)
fcomp dword [0xaf0588]
fnstsw ax
sahf
jbe 0x401850
fstp st(0)
fld dword [0xaf0588]
fnstcw word [esp + 0x2e]
fild dword [esp + 0x24]
fmulp st(1)
movzx eax, word [esp + 0x2e]
mov ah, 0xc
mov word [esp + 0x2c], ax
fldcw word [esp + 0x2c]
fistp dword [esp + 0x28]
fldcw word [esp + 0x2e]
mov edx, dword [esp + 0x28]
mov eax, edx
sar edx, 0x1f
idiv esi
test eax, eax
jle 0x4018e0
imul eax, esi
mov edx, dword [esp + 0x20]
fstp dword [esp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x24]
mov dword [esp + 4], eax
mov eax, dword [edi + 4]
mov dword [esp], eax
call fcn.004c54c0
test eax, eax
fld dword [esp + 0x10]
jg 0x4017f3
nop
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi + 0x9c]
mov esi, dword [edi + 0x90]
test eax, eax
jne 0x4017a4
mov eax, dword [edi + 0x2c]
mov dword [esp + 0x24], eax
jmp 0x4017ab
fldz
jmp 0x401822
mov eax, 1
jmp 0x401881
mov edx, dword [esp + 0x20]
fstp dword [esp + 0x10]
mov dword [esp + 8], esi
mov eax, dword [edx + 0x24]
mov dword [esp + 4], eax
mov eax, dword [edi + 4]
mov dword [esp], eax
call fcn.004c54c0
test eax, eax
fld dword [esp + 0x10]
jle 0x4018b0
fstp st(0)
test ebx, ebx
je 0x4018d8
mov edx, dword [ebx + 0x64]
test edx, edx
je 0x4018d8
mov eax, dword [ebx + 0x18]
add eax, dword [ebx]
sub eax, dword [edx + 0x38]
sub eax, dword [ebx + 4]
jmp 0x401813
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
fldz
ret
Function at 0x405f50
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
mov dword [esp], 0xaf0610
call sub.msvcrt.dll_getenv
test eax, eax
je 0x405f70
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0xc10260], eax
mov dword [0xf6c5d0], 0xfffffffe
mov eax, 1
nop
mov dword [eax*4 + 0xf6c5d0], 0xfffffffe
add eax, 1
cmp eax, 0x40
jne 0x405f80
mov dword [0xf6c674], 0xffffffff
add esp, 0xc
ret
Function at 0x427c10
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
test eax, eax
je 0x427ca8
mov eax, dword [0xc10ba0]
xor esi, esi
mov edx, dword [0xc10c30]
test eax, eax
je 0x427c92
cmp edx, 0x2000
mov dword [esp + 0xc], eax
mov eax, edx
jbe 0x427c41
mov eax, 0x2000
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0xf6e210
call sub.msvcrt.dll_fread
add dword [0xc10c10], eax
sub dword [0xc10c30], eax
cmp eax, 0xffffffff
mov esi, eax
je 0x427c92
mov eax, dword [0xc10c60]
test eax, eax
je 0x427c92
cmp eax, 0x13
jle 0x427c92
test esi, esi
je 0x427c92
xor ebx, ebx
lea eax, [ebx + 0xf6e210]
add ebx, 0x10
call fcn.004275c0
cmp esi, ebx
ja 0x427c80
mov dword [0xf707a0], esi
mov dword [0xf70790], 0
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0xf701f0]
and dword [0xf70790], 0x1f
mov edx, dword [0xc10c30]
mov dword [0xf6e210], eax
mov eax, dword [0xf701f4]
mov dword [0xf6e214], eax
mov eax, dword [0xf701f8]
mov dword [0xf6e218], eax
mov eax, dword [0xf701fc]
mov dword [0xf6e21c], eax
mov eax, dword [0xf70200]
mov dword [0xf6e220], eax
mov eax, dword [0xf70204]
mov dword [0xf6e224], eax
mov eax, dword [0xf70208]
mov dword [0xf6e228], eax
mov eax, dword [0xf7020c]
mov dword [0xf6e22c], eax
mov eax, dword [0xc10ba0]
test eax, eax
je 0x427d84
cmp edx, 0x1fe0
mov dword [esp + 0xc], eax
mov eax, edx
jbe 0x427d21
mov eax, 0x1fe0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0xf6e230
call sub.msvcrt.dll_fread
add dword [0xc10c10], eax
sub dword [0xc10c30], eax
cmp eax, 0xffffffff
mov ebx, eax
je 0x427d84
mov eax, dword [0xc10c60]
test eax, eax
je 0x427d72
cmp eax, 0x13
jle 0x427d72
test ebx, ebx
je 0x427d72
xor esi, esi
lea eax, [esi + 0xf6e230]
add esi, 0x10
call fcn.004275c0
cmp ebx, esi
ja 0x427d60
test ebx, ebx
jle 0x427d84
lea eax, [ebx + 0x20]
mov dword [0xf707a0], eax
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0xf70790]
mov dword [0xf707a0], eax
add esp, 0x14
pop ebx
pop esi
ret