joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
sub esp, 0xc
mov edi, 1
mov dword [ebp - 0x10], 0
xor esi, esi
push 1
push 0x4fb210
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4396d4
mov eax, 0x66666667
imul edi
sar edx, 2
lea ecx, [edx + edx*4]
add ecx, ecx
cmp ecx, edi
jne 0x4396d4
cmp edi, 0x2710
jle 0x4396cd
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4396e4
inc edi
cmp edi, 0x7ffffff
jl 0x439696
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4396fe
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.0045de10
add esp, 4
mov eax, dword [0x4fb214]
test eax, eax
jne 0x439734
cmp dword [0x4ef9e4], 1
je 0x4397f1
xor edi, edi
xor esi, esi
call fcn.00439810
mov dword [0x4fb214], 1
cmp dword [0x4ef9e4], 1
je 0x4397d9
push dword [0x4fb20c]
mov dword [0x4fb210], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
je 0x43975e
mov eax, dword [ebp + 8]
mov dword [eax], edx
xor eax, eax
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x74
call fcn.00460c10
add esp, 0xc
test eax, eax
je 0x439785
mov edx, dword [ebp + 8]
mov dword [edx], 0
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4ef9b0]
mov dword [edx + 0x70], eax
mov eax, 0x70
mov ecx, dword [eax + 0x4ef93c]
mov dword [edx + eax - 4], ecx
mov esi, dword [eax + 0x4ef938]
mov dword [edx + eax - 8], esi
mov edi, dword [eax + 0x4ef934]
mov dword [edx + eax - 0xc], edi
mov ecx, dword [eax + 0x4ef930]
mov dword [edx + eax - 0x10], ecx
sub eax, 0x10
jne 0x439795
push dword [ebp - 0x10]
push dword [0x4fb20c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [ebp - 0x10]
jmp 0x439750
push esi
push 2
call fcn.004acfd2
push edi
push 0x16
call fcn.004acfd2
add esp, 0x10
jmp 0x439734
push 1
push 2
call fcn.004acfd2
mov esi, eax
push 1
push 0x16
call fcn.004acfd2
mov edi, eax
add esp, 0x10
jmp 0x439718

Function at 0x439810
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4fb200], 0
jne 0x43983e
mov dword [0x4fb200], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4fb20c], eax
cmp eax, 0xffffffff
jne 0x439842
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret
push 0x439660
call fcn.004a91b7
push 0x439620
call fcn.004a91b7
add esp, 8
jmp 0x43983e
Function at 0x439860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
sub esp, 0xc
mov edi, 1
mov dword [ebp - 0x10], 0
xor esi, esi
push 1
push 0x4fb210
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4398b4
mov eax, 0x66666667
imul edi
sar edx, 2
lea ecx, [edx + edx*4]
add ecx, ecx
cmp ecx, edi
jne 0x4398b4
cmp edi, 0x2710
jle 0x4398ad
mov esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4398c4
inc edi
cmp edi, 0x7ffffff
jl 0x439876
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4398de
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.0045de10
add esp, 4
mov eax, dword [0x4fb214]
test eax, eax
jne 0x439914
cmp dword [0x4ef9e4], 1
je 0x4399f7
xor edi, edi
xor esi, esi
call fcn.00439810
mov dword [0x4fb214], 1
cmp dword [0x4ef9e4], 1
je 0x4399df
push dword [0x4fb20c]
mov dword [0x4fb210], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x439967
mov eax, dword [ebp + 8]
mov dword [eax], esi
cmp dword [0x4ef9e4], 1
je 0x43994a
xor eax, eax
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
push 1
push 2
call fcn.004acfd2
push 1
push 0x16
mov dword [esi + 0x64], eax
call fcn.004acfd2
add esp, 0x10
mov dword [esi + 0x68], eax
jmp 0x439941
lea eax, [ebp - 0x10]
push eax
push 0
push 0x74
call fcn.00460c10
add esp, 0xc
test eax, eax
je 0x43998b
mov edx, dword [ebp + 8]
mov dword [edx], 0
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4ef9b0]
mov dword [edx + 0x70], eax
mov eax, 0x70
mov ecx, dword [eax + 0x4ef93c]
mov dword [edx + eax - 4], ecx
mov esi, dword [eax + 0x4ef938]
mov dword [edx + eax - 8], esi
mov edi, dword [eax + 0x4ef934]
mov dword [edx + eax - 0xc], edi
mov ecx, dword [eax + 0x4ef930]
mov dword [edx + eax - 0x10], ecx
sub eax, 0x10
jne 0x43999b
push dword [ebp - 0x10]
push dword [0x4fb20c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp - 0x10]
jmp 0x439933
push esi
push 2
call fcn.004acfd2
push edi
push 0x16
call fcn.004acfd2
add esp, 0x10
jmp 0x439914
push 1
push 2
call fcn.004acfd2
mov esi, eax
push 1
push 0x16
call fcn.004acfd2
mov edi, eax
add esp, 0x10
jmp 0x4398f8
Function at 0x445720
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0xe4
lea eax, [ebp - 0xf0]
push 0xd0
push 0
push eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
call fcn.004a08c0
add esp, 0xc
xor eax, eax
push eax
push eax
push str.FOR_TYPE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
push eax
push str.FOR_PRINT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
push eax
push str.FOR_ACCEPT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
push eax
push str.FOR_READ
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x18d]
mov dword [ebp - 0x14], eax
and eax, 0x18
shr eax, 3
test eax, eax
je 0x4458da
cmp eax, 2
je 0x445a25
mov eax, dword [edx + 0x118]
add eax, 4
cmp eax, 0xa
ja 0x4457e5
movzx eax, word [eax*2 + 0x4c6d7c]
add eax, 0x4457d4
jmp eax
push 0x4ba
push str.for_open.c
push 2
push 8
call fcn.00464d00
mov edx, dword [ebp + 8]
add esp, 0x10
jmp 0x4458da
test byte [edx + 0x190], 0x10
jne 0x445901
jmp 0x445939
mov eax, dword [edx + 0x114]
mov ecx, dword [edx + 0xf0]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xb4], ecx
mov eax, dword [edx + 0x68]
movsx ecx, byte [edx + 0x17d]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xf0], edi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x6c], 1
cmp ebx, 1
je 0x445976
jmp 0x445a0d
movsx eax, byte [edx + 0x17f]
test eax, eax
je 0x44599d
cmp eax, 0x27
jne 0x44598f
mov dword [ebp - 0x7c], 1
jmp 0x4459a4
cmp eax, 0x22
jne 0x4459a4
mov dword [ebp - 0x7c], 3
jmp 0x4459a4
mov dword [ebp - 0x7c], 2
test byte [edx + 0x18f], 0x20
je 0x4459b9
mov dword [ebp - 0xe4], 2
jmp 0x4459c3
mov dword [ebp - 0xe4], 0
test byte [edx + 0x192], 2
jne 0x4459d5
test byte [edx + 0x18c], 2
je 0x4459de
mov dword [ebp - 0x78], 2
jmp 0x4459e5
mov dword [ebp - 0x78], 1
movzx eax, byte [edx + 0x185]
movzx ecx, byte [edx + 0x187]
movzx ebx, byte [edx + 0x189]
movzx esi, byte [edx + 0x18b]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
push edx
lea eax, [ebp - 0xf0]
push eax
call fcn.00473390
add esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
cmp edi, 0xffffffff
jne 0x4458da
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x45de10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor esi, esi
push esi
push esi
call fcn.00478090
add esp, 8
mov ebx, dword [ebp + 8]
cmp dword [0x508060], 0
jne 0x45de37
test ebx, ebx
je 0x45de31
mov esi, dword [ebx]
push esi
call fcn.004adb02
test ebx, ebx
je 0x45de47
push dword [ebx]
call fcn.004a89d0
add esp, 4
jmp 0x45de2f
push 0
call fcn.004a89d0
add esp, 4
jmp 0x45de31
Function at 0x467a90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10c
mov eax, dword [0x4f195c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x5060dc
call fcn.00439a70
add esp, 4
mov eax, dword [0x5060e0]
test eax, eax
jne 0x467b22
push 0x105
mov dword [0x5060e0], 1
lea edi, [ebp - 0x114]
push edi
push str.FORT0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x467af0
cmp eax, 0x105
jae 0x467af0
movsx eax, byte [ebp - 0x114]
jmp 0x467af9
mov byte [ebp - 0x114], 0
xor eax, eax
test eax, eax
je 0x467b22
cmp dword [0x4f1980], 0
je 0x467b45
mov ebx, dword [0x4f1ae8]
mov eax, dword [0x4f1998]
call eax
add eax, 0x40
push eax
push 0x4cd9dc
push edi
call ebx
add esp, 0xc
mov dword [0x5060dc], 0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x467b40
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
call fcn.004a91cc
call fcn.004a0af0
mov ebx, dword [0x4f1ae8]
cmp dword [0x4f1980], 0
jne 0x467b0c
call fcn.004a0af0
jmp 0x467b0c
Function at 0x46b420
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
test edx, edx
je 0x46b43a
sub ebx, edx
jmp 0x46b43f
mov edx, dword [esi + 0x48]
sub ebx, edx
lea edx, [ebx + 4]
cmp edx, dword [esi + 0x104]
ja 0x46b8bf
movzx edx, word [esi + 0x178]
test edx, edx
jg 0x46b674
movsx edx, byte [esi + 0x17a]
cmp edx, 8
ja 0x46b60a
movzx eax, word [edx*2 + 0x4cdc3c]
add eax, 0x46b47c
jmp eax
push 0x324
push str.for_put.c
push 2
push 8
call fcn.00464d00
add esp, 0x10
mov edx, dword [esi + 0x50]
test edx, edx
je 0x46b89d
mov eax, esi
mov ecx, ebx
call fcn.0046b98c
and byte [esi + 0x190], 0xbf
cmp eax, 0xffffffff
je 0x46b884
test byte [esi + 0x191], 8
je 0x46b691
push dword [esi + 0xfc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x46b86e
xor eax, eax
and byte [esi + 0x191], 0xf7
test eax, eax
jne 0x46b951
jmp 0x46b691
mov edx, dword [esi + 0x50]
test edx, edx
je 0x46b8ae
mov eax, esi
mov ecx, ebx
call fcn.0046b98c
cmp eax, 0xffffffff
je 0x46b884
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov eax, 0x26
jmp 0x46b663
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x100], eax
mov eax, 0x26
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x48]
call fcn.0046b98c
jmp 0x46b634
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x48]
call fcn.0046b98c
jmp 0x46b688
push 0x200
push esi
call fcn.0046f520
add esp, 8
test eax, eax
je 0x46b44e
push 4
push esi
call fcn.0046f520
add esp, 8
test eax, eax
je 0x46b44e
cmp ebx, dword [esi + 0x104]
ja 0x46b8fd
cmp byte [esi + 0x17a], 1
je 0x46b44e
mov edx, dword [esi + 0x20]
test edx, edx
je 0x46b959
test byte [edx + 0x44], 2
je 0x46b934
mov ecx, 0x42
mov dword [edx + 0x38], ecx
mov edx, dword [esi + 0x20]
mov dword [edx + 0x3c], ecx
mov edx, dword [esi + 0x78]
test edx, edx
je 0x46b927
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x78], ecx
mov eax, 0x42
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov edx, 0x42
push edx
movzx ecx, byte [esi + 0x190]
push edx
and ecx, 7
push ecx
push 0xffffffffffffffff
push esi
call fcn.0046e340
add esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
mov eax, 0x42
push eax
push eax
push 1
call fcn.00463630
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x46b980
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x46f7a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x114
mov eax, dword [0x4f195c]
mov edx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 8], eax
test edx, edx
je 0x46f89f
push 0x105
lea ebx, [ebp - 0x110]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x46f7e0
cmp eax, 0x105
jae 0x46f7e0
inc eax
jmp 0x46f7e7
mov byte [ebp - 0x110], 0
test eax, eax
je 0x46f833
movsx eax, byte [ebp - 0x110]
test eax, eax
je 0x46f833
push eax
call fcn.004ad566
movsx eax, al
add esp, 4
cmp eax, 0x74
je 0x46f88c
cmp eax, 0x79
je 0x46f88c
mov eax, ebx
mov dword [ebp - 0x114], edi
mov edi, eax
jmp 0x46f81d
inc edi
movsx edx, byte [edi]
test edx, edx
je 0x46f852
push edx
call fcn.004aecbd
add esp, 4
test eax, eax
je 0x46f848
jmp 0x46f81c
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x46f89a
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x114]
xor eax, eax
jmp 0x46f835
mov edi, dword [ebp - 0x114]
mov dword [ebp - 0x118], 0
cmp dword [0x4f1980], 0
je 0x46f893
mov edx, dword [0x4f1a00]
lea eax, [ebp - 0x118]
push eax
push 0x4ce6f4
push ebx
call edx
add esp, 0xc
cmp dword [ebp - 0x118], 0
je 0x46f833
mov eax, 1
jmp 0x46f835
call fcn.004a0af0
jmp 0x46f86b
call fcn.004a91cc
mov ecx, dword [ebp - 8]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x46f89a
xor eax, eax
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x47af50
Capabilities:
Encrypt data using rc4 prga
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x24
mov edx, 0xfffffffc
mov eax, dword [0x4f195c]
mov esi, 0x506180
xor eax, ebp
mov edi, 0xfffffffd
mov dword [ebp - 0x10], eax
movzx eax, byte [0x5064cd]
and eax, 0xffffffe7
add eax, 8
mov byte [0x5064cd], al
movzx ecx, byte [0x50630d]
movzx ebx, byte [0x50668d]
and ecx, 0xffffffe7
movzx eax, byte [0x50684d]
and ebx, 0xffffffe7
and eax, 0xffffffe7
add ecx, 8
mov dword [0x506298], edx
add ebx, 8
mov dword [0x5061a8], edx
mov edx, 0x506340
add eax, 8
mov byte [0x50630d], cl
mov ecx, 0xffffffff
mov dword [0x4fb72c], esi
mov dword [0x50bf48], esi
mov esi, 0x506500
mov dword [0x506458], edi
mov dword [0x506368], edi
mov edi, 0xfffffffe
mov dword [0x4fb754], edx
mov dword [0x50bf4c], edx
mov edx, 0x5066c0
mov dword [0x506618], ecx
mov dword [0x506528], ecx
mov byte [0x50668d], bl
mov dword [0x4fb7a4], esi
mov dword [0x50bf54], esi
mov dword [0x5067d8], edi
mov dword [0x5066e8], edi
mov byte [0x50684d], al
mov dword [0x4fb77c], edx
mov dword [0x50bf50], edx
cmp dword [0x4f1980], 0
je 0x47b195
mov eax, dword [0x4f19f0]
push 0
push str.FORT_d
lea ebx, [ebp - 0x30]
push ebx
call eax
add esp, 0xc
xor esi, esi
push esi
push esi
push ebx
mov dword [0x506998], esi
mov dword [0x5068a8], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
mov edx, esi
movzx eax, byte [0x506a0d]
setne dl
and eax, 0xffffffe7
lea ecx, [edx*8 + 8]
or eax, ecx
mov byte [0x506a0d], al
mov eax, 0x506880
mov dword [0x4fb7cc], eax
mov dword [0x50bf58], eax
cmp dword [0x4f1980], 0
je 0x47b18b
mov eax, dword [0x4f19f0]
push 5
push str.FORT_d
push ebx
call eax
add esp, 0xc
push esi
push esi
mov eax, 5
push ebx
mov dword [0x506b58], eax
mov dword [0x506a68], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
mov edx, esi
movzx eax, byte [0x506bcd]
setne dl
and eax, 0xffffffe7
lea ecx, [edx*8 + 8]
or eax, ecx
mov byte [0x506bcd], al
mov eax, 0x506a40
mov dword [0x4fb894], eax
mov dword [0x50bf6c], eax
cmp dword [0x4f1980], 0
je 0x47b184
mov eax, dword [0x4f19f0]
push 6
push str.FORT_d
push ebx
call eax
add esp, 0xc
push esi
push esi
mov eax, 6
push ebx
mov dword [0x506d18], eax
mov dword [0x506c28], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
mov edx, esi
movzx eax, byte [0x506d8d]
mov ebx, 0x506c00
setne dl
and eax, 0xffffffe7
mov dword [0x4fb8bc], ebx
mov dword [0x50bf70], ebx
lea ecx, [edx*8 + 8]
or eax, ecx
mov byte [0x506d8d], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x47b17f
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.004a91cc
call fcn.004a0af0
jmp 0x47b10e
call fcn.004a0af0
jmp 0x47b0ab
call fcn.004a0af0
jmp 0x47b042
Function at 0x47b1a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x10c
mov edx, dword [0x505e74]
or edx, dword [0x505e78]
or edx, dword [0x505e6c]
mov eax, dword [0x4f195c]
xor eax, ebp
mov dword [ebp - 8], eax
or edx, dword [0x505e70]
jne 0x47b3ba
push 0x104
lea edi, [ebp - 0x10c]
push edi
push str.FORT_BLOCKSIZE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x47b205
cmp edx, 0x104
jae 0x47b1fc
inc edx
je 0x47b20e
jmp 0x47b21a
mov byte [ebp - 0x10c], 0
jmp 0x47b21a
mov byte [ebp - 0x10c], 0
jne 0x47b21a
mov dword [0x505e74], 0xffffffff
jmp 0x47b25a
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.00484ab0
add esp, 0x10
test eax, eax
jne 0x47b23f
mov eax, dword [ebp - 0x110]
cmp eax, 0x7fffc000
jbe 0x47b24b
mov dword [0x505e74], 0xfffffffe
jmp 0x47b25a
add eax, 0x1ff
and eax, 0xfffffe00
mov dword [0x505e74], eax
push 0x104
push edi
push str.FORT_BUFFERCOUNT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x47b287
cmp edx, 0x104
jae 0x47b27e
inc edx
je 0x47b290
jmp 0x47b29c
mov byte [ebp - 0x10c], 0
jmp 0x47b29c
mov byte [ebp - 0x10c], 0
jne 0x47b29c
mov dword [0x505e78], 0xffffffff
jmp 0x47b2d0
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.00484ab0
add esp, 0x10
test eax, eax
jne 0x47b2bf
mov eax, dword [ebp - 0x110]
cmp eax, 0x7f
jbe 0x47b2cb
mov dword [0x505e78], 0xfffffffe
jmp 0x47b2d0
mov dword [0x505e78], eax
push 0x104
push edi
push str.FORT_FMT_RECL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x47b2fd
cmp edx, 0x104
jae 0x47b2f4
inc edx
je 0x47b306
jmp 0x47b312
mov byte [ebp - 0x10c], 0
jmp 0x47b312
mov byte [ebp - 0x10c], 0
jne 0x47b312
mov dword [0x505e6c], 0xffffffff
jmp 0x47b345
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.00484ab0
add esp, 0x10
test eax, eax
jne 0x47b33b
mov eax, dword [ebp - 0x110]
test eax, eax
jl 0x47b33b
mov dword [0x505e6c], eax
jmp 0x47b345
mov dword [0x505e6c], 0xfffffffe
push 0x104
push edi
push str.FORT_UFMT_RECL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x47b372
cmp edx, 0x104
jae 0x47b369
inc edx
je 0x47b37b
jmp 0x47b387
mov byte [ebp - 0x10c], 0
jmp 0x47b387
mov byte [ebp - 0x10c], 0
jne 0x47b387
mov dword [0x505e70], 0xffffffff
jmp 0x47b3ba
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.00484ab0
add esp, 0x10
test eax, eax
jne 0x47b3b0
mov eax, dword [ebp - 0x110]
test eax, eax
jl 0x47b3b0
mov dword [0x505e70], eax
jmp 0x47b3ba
mov dword [0x505e70], 0xfffffffe
mov ecx, dword [ebp - 8]
xor ecx, ebp
cmp ecx, dword [0x4f195c]
jne 0x47b3cd
lea esp, [ebp - 4]
pop edi
pop ebp
ret
call fcn.004a91cc
lea esi, [esi]
lea edi, [edi]
Function at 0x49c220
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x58
mov eax, dword [ebp + 0xc]
push 1
lea esi, [eax + 0x112]
push esi
call fcn.004afa38
mov ebx, eax
add esp, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x49c261
push ebx
call fcn.004adb94
add esp, 4
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov edi, ebx
mov edx, str.cmd.exe__c
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x49c272
mov ecx, ebx
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x49c295
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x49c280
dec eax
mov esi, eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
push edx
push dword [ebp + 8]
push ebx
call fcn.004afa50
add esp, 0xc
mov eax, dword [ebp + 0xc]
lea edx, [eax + ebx]
lea edx, [edx + esi - 1]
cmp byte [edx], 0x20
jne 0x49c2bf
dec edx
cmp byte [edx], 0x20
je 0x49c2b9
xor eax, eax
mov byte [edx + 1], al
mov edx, 0x40
mov dword [ebp - 0x20], eax
mov dword [ebp + edx - 0x64], eax
mov dword [ebp + edx - 0x68], eax
mov dword [ebp + edx - 0x6c], eax
mov dword [ebp + edx - 0x70], eax
sub edx, 0x10
jne 0x49c2cc
mov dword [ebp - 0x60], 0x44
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x60]
push ecx
push eax
push eax
push eax
push 1
push eax
push eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x49c329
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x49c33f
push ebx
call fcn.004adb94
add esp, 4
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.004adb94
add esp, 4
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x49c378
push ebx
call fcn.004adb94
add esp, 4
mov eax, dword [ebp - 0x64]
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.004adb94
add esp, 4
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4a0af0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
sub esp, 0x110
xor ebx, ebx
mov eax, dword [0x4f195c]
lea ebp, [esp + 4]
xor eax, esp
mov dword [ebp + 0x108], eax
mov dword [esp], ebx
push 0x105
push ebx
push ebp
call fcn.004a08c0
add esp, 0xc
cmp dword [0x507154], 0
je 0x4a0c71
push 0x507154
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4f1980], 0xffffffff
je 0x4a0c4a
push 0x105
push ebp
push str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4a0b6a
push str._system32_
push 0x105
push ebp
call fcn.004b0ccb
add esp, 0xc
push str.msvcrt.dll
push 0x105
push ebp
call fcn.004b0ccb
add esp, 0xc
lea eax, [esp]
push eax
push ebp
push 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
cmp dword [esp], 0
je 0x4a0c2c
mov ebp, 1
push dword [ebp*8 + 0x4f1984]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a0bf1
mov dword [ebp*8 + 0x4f1980], eax
inc ebp
cmp ebp, 0x32
jl 0x4a0b99
mov dword [0x4f1980], 0xffffffff
push 0x507154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10c]
xor ecx, esp
cmp ecx, dword [0x4f195c]
jne 0x4a0bec
mov eax, ebx
add esp, 0x110
pop ebp
pop ebx
ret
call fcn.004a91cc
mov eax, dword [ebp*8 + 0x4f1980]
test eax, eax
je 0x4a0c10
cmp eax, ebp
jge 0x4a0bb5
mov eax, dword [eax*8 + 0x4f1980]
mov dword [ebp*8 + 0x4f1980], eax
jmp 0x4a0bb5
mov eax, dword [0x4f1988]
test eax, eax
je 0x4a0bb5
push dword [ebp*8 + 0x4f1984]
push str.Warning:_Missing__s_function_during_Intel_Library_Wrapper_initialization._n
call eax
add esp, 8
jmp 0x4a0bb5
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [esp], eax
test eax, eax
jne 0x4a0b94
mov ebx, 0xffffffff
jmp 0x4a0bbb
push 0x507154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x10c]
xor ecx, esp
cmp ecx, dword [0x4f195c]
jne 0x4a0bec
xor eax, eax
add esp, 0x110
pop ebp
pop ebx
ret
push 0x507154
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x4a0b2a