joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3480
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4f823b
mov eax, dword fs:[0]
push eax
mov eax, 0x6060
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x605c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x6074]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6088]
mov ebp, dword [esp + 0x6084]
push eax
mov edi, ecx
call fcn.00451140
mov ecx, edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4c34e0
sub ecx, esi
mov edx, eax
sar ecx, 1
lea ebx, [edx + 2]
mov si, word [edx]
add edx, 2
test si, si
jne 0x4c34f4
sub edx, ebx
sar edx, 1
lea ecx, [edx + ecx + 1]
cmp ecx, 0x1000
jae 0x4c363c
push 0x1000
lea edx, [esp + 0x4074]
push edx
push eax
push edi
call fcn.00450cd0
lea ecx, [esp + 0x14]
call fcn.00467090
mov dword [esp + 0x607c], 0
push 0x1000
push 0x4f9a98
lea eax, [esp + 0x1078]
push eax
push str.ViewerIgnoreModifications
push str.Viewer
call fcn.00496860
cmp word [esp + 0x1070], si
je 0x4c357c
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x107c]
push edx
call fcn.0049de30
push 0x800
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.00467110
test al, al
je 0x4c3628
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ecx]
push 0x800
lea ecx, [esp + 0x3074]
push ecx
lea edx, [esp + 0x78]
push edx
call edi
lea eax, [esp + 0x3072]
push 0x501ffc
push eax
call fcn.004e3d6d
mov esi, eax
add esp, 8
test esi, esi
je 0x4c3668
xor ecx, ecx
mov word [esi], cx
add esi, 4
cmp word [esi], cx
jne 0x4c35e5
mov esi, 0x4fa890
push 4
push ebp
lea edx, [esp + 0x3078]
push edx
call fcn.00446af0
test al, al
je 0x4c360d
push 4
lea eax, [esp + 0x4074]
push eax
push esi
call fcn.00446af0
test al, al
jne 0x4c3671
push 0x800
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00467110
test al, al
jne 0x4c35a0
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041cbb0
xor al, al
mov ecx, dword [esp + 0x6074]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x605c]
xor ecx, esp
call fcn.004df824
add esp, 0x606c
ret 8
lea esi, [esp + 0x3070]
jmp 0x4c35f9
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041cbb0
mov al, 1
jmp 0x4c363e

Function at 0x4c47e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x533390
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c4819
push 0x40
push 0x2bc
call fcn.004612b0
push eax
push 0x2bd
call fcn.004612b0
push eax
mov eax, dword [0x5354dc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
ret
push 0
push 0x533390
mov ecx, esi
call fcn.004c3c80
pop esi
ret
Function at 0x4c5360
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4f836e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
test byte [0x57788c], 1
jne 0x4c53b9
or dword [0x57788c], 1
mov dword [esp + 0x14], 0
mov ecx, 0x573768
call fcn.004c2af0
push 0x4f8ee0
call fcn.004e3acf
add esp, 4
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esp + 0x1c]
push 1
push esi
mov ecx, 0x573768
call fcn.004c3b60
mov bl, byte [esp + 0x20]
push 0
test bl, bl
push 0x573768
sete al
movzx ecx, al
push ecx
push 0
push 0
push esi
push 0
call fcn.004c32d0
test al, al
jne 0x4c5438
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x573770]
cmp eax, 0xffffffff
je 0x4c5411
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x573770], 0xffffffff
mov ecx, 0x57778a
call fcn.004643f0
cmp esi, 0x4c7
sete al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
test bl, bl
je 0x4c5455
push 0x573768
push 0x10000
push 0x4c4830
call fcn.004e4d01
add esp, 0xc
jmp 0x4c547a
mov eax, dword [0x573770]
cmp eax, 0xffffffff
je 0x4c5470
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x573770], 0xffffffff
mov ecx, 0x57778a
call fcn.004643f0
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x4c5490
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4f839e
mov eax, dword fs:[0]
push eax
mov eax, 0x3004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x3000], eax
push esi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x300c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x301c]
test esi, esi
je 0x4c5515
push 0x501fe8
push esi
call fcn.00451360
test al, al
jne 0x4c54ef
call fcn.004c2fb0
test al, al
je 0x4c5515
push 0x30
push 0x65
call fcn.004612b0
push eax
push 0x596
call fcn.004612b0
push eax
mov eax, dword [0x5354dc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4c567e
cmp byte [0x533389], 0
jne 0x4c5551
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.004c32d0
test al, al
jne 0x4c567e
push esi
push 0x201
call fcn.004612b0
push eax
call fcn.004bc000
add esp, 8
jmp 0x4c567e
push 1
push 0x800
lea ecx, [esp + 0x10]
push ecx
push str.Rar_EX
call fcn.004adfe0
test al, al
je 0x4c567e
push 0x800
lea edx, [esp + 0x200c]
push edx
call fcn.004ae940
lea eax, [esp + 8]
push eax
call fcn.004ae8e0
push 1
call fcn.004a9ff0
push 0x800
push 0x550b7a
mov ecx, 0x541e38
call fcn.004785d0
mov ecx, dword [0x541e3c]
mov dword [0x54db28], ecx
push 0x4fa890
mov ecx, 0x551b7c
call fcn.00466f00
push 0
push 0
mov ecx, 0x541e38
mov dword [0x54cb18], 4
call fcn.0047a6e0
cmp byte [0x533388], 0
jne 0x4c567e
lea edx, [esp + 0x1008]
push edx
push esi
call fcn.004511a0
push 0x800
lea eax, [esp + 0x100c]
push eax
mov ecx, eax
push ecx
call fcn.00451e50
test byte [0x57b9b4], 1
jne 0x4c5646
or dword [0x57b9b4], 1
mov dword [esp + 0x3014], 0
mov ecx, 0x577890
call fcn.004c2af0
push 0x4f8f30
call fcn.004e3acf
add esp, 4
mov dword [esp + 0x3014], 0xffffffff
push 0
lea edx, [esp + 0x100c]
push edx
mov ecx, 0x577890
call fcn.004c3b60
lea eax, [esp + 0x2008]
push eax
call fcn.004ae8e0
push 0x577890
push 0x10000
push 0x4c4830
call fcn.004e4d01
add esp, 0xc
mov ecx, dword [esp + 0x300c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x3000]
xor ecx, esp
call fcn.004df824
add esp, 0x3010
ret 4
Function at 0x4cb460
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push 0x59f8e0
mov esi, ecx
call fcn.00438bd0
mov edx, dword [esp + 8]
mov dword [esi + 8], 0x12345678
mov dword [esi + 0xc], 0x23456789
mov dword [esi + 0x10], 0x34567890
mov cl, byte [edx]
test cl, cl
je 0x4cb4de
lea esp, [esp]
mov eax, dword [esi + 8]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x59f8e0]
shr eax, 8
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0xc]
mov dword [esi + 8], ecx
mov ecx, dword [esi + 0x10]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0xc], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x59f8e0]
inc edx
mov dword [esi + 0x10], ecx
mov cl, byte [edx]
test cl, cl
jne 0x4cb490
pop esi
ret 4
Function at 0x4cb8d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp byte [0x54a894], 0
je 0x4cb95e
push ebx
mov ebx, dword [esp + 0xc]
imul ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
test ebx, ebx
je 0x4cb95c
push esi
push edi
movsx edx, byte [ebp]
mov edi, dword [ecx + 8]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x59f8e0]
mov eax, dword [ecx + 0x10]
shr edi, 8
xor edx, edi
mov dword [ecx + 8], edx
movzx edx, dl
add edx, dword [ecx + 0xc]
mov esi, eax
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 0xc], edx
shr edx, 0x18
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x59f8e0]
and esi, 0xfffd
mov dword [ecx + 0x10], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor byte [ebp], al
inc ebp
sub ebx, 1
jne 0x4cb8f2
pop edi
pop esi
pop ebp
pop ebx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0
push edx
mov edx, dword [esp + 0xc]
push eax
push edx
call fcn.004ca960
ret 0xc
Function at 0x4d3ef0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x4c
push esi
mov esi, dword [esp + 0x54]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d3f24
test al, 0x10
jne 0x4d3f1a
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4d3f24
pop edi
mov al, 1
pop esi
add esp, 0x4c
ret 4
mov eax, dword [edi + 0x64b3fc]
lea ecx, [esp + 8]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x48], 2
call fcn.004689f0
pop edi
xor al, al
pop esi
add esp, 0x4c
ret 4
Function at 0x4dbde0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x5b166c]
mov eax, dword [esp + 4]
mov edx, ecx
shr ecx, 8
xor edx, eax
and edx, 0xff
xor ecx, dword [edx*4 + 0x5a00f0]
mov edx, dword [0x5b1674]
mov dword [0x5b166c], ecx
movzx ecx, cl
add ecx, dword [0x5b1670]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [0x5b1670], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x5a00f0]
mov dword [0x5b1674], edx
ret 4

Function at 0x4dbe40
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
push 0x5a00f0
call fcn.00438bd0
mov edi, dword [esp + 0xc]
mov eax, 0x12345678
mov edx, 0x23456789
mov esi, 0x34567890
mov dword [0x5b166c], eax
mov dword [0x5b1670], edx
mov dword [0x5b1674], esi
mov cl, byte [edi]
test cl, cl
je 0x4dbed0
jmp 0x4dbe80
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x5a00f0]
inc edi
movzx ecx, al
add ecx, edx
imul ecx, ecx, 0x8088405
inc ecx
mov edx, ecx
shr ecx, 0x18
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x5a00f0]
mov dword [0x5b166c], eax
mov dword [0x5b1670], edx
mov dword [0x5b1674], esi
mov cl, byte [edi]
test cl, cl
jne 0x4dbe80
pop edi
pop esi
ret 4
Function at 0x4dc720
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xdc]
cmp eax, 0xffffffff
je 0x4dc791
cmp eax, 0x40
jbe 0x4dc747
lea edx, [esi + 0x40]
mov al, 1
call fcn.004dc670
mov dword [esi + 0xdc], 0x14
mov eax, dword [esi + 0xdc]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, esi
push 0
push eax
call fcn.004e0730
add esp, 0xc
xor eax, eax
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x4dc764
push edi
lea edi, [esi + 0x40]
push edi
call fcn.00465d40
push 1
push 0x40
push esi
push edi
call fcn.00465d80
mov dword [esi + 0xdc], 0xffffffff
pop edi
test ebx, ebx
je 0x4dc7a6
mov edx, dword [esp + 8]
push 1
push ebx
push edx
add esi, 0x40
push esi
call fcn.00465d80
pop esi
ret 4

Function at 0x4dc7b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x28], eax
cmp dword [edi + 0xdc], 0xffffffff
push ebx
push ebp
mov ebp, dword [esp + 0x38]
je 0x4dc7d8
push 0
mov eax, edi
xor ebx, ebx
call fcn.004dc720
push esi
lea ebx, [edi + 0x40]
mov al, 1
lea esi, [esp + 0x20]
mov edx, ebx
call fcn.004dc670
xor eax, eax
pop esi
lea esp, [esp]
xor dword [edi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x4dc7f0
push ebx
call fcn.00465d40
push 1
push 0x40
push edi
push ebx
call fcn.00465d80
push 1
push 0x14
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00465d80
push 1
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.00465e40
xor eax, eax
lea esp, [esp]
mov edx, eax
and edx, 3
mov ecx, 3
sub ecx, edx
add ecx, ecx
mov edx, eax
shr edx, 2
mov edx, dword [esp + edx*4 + 8]
add ecx, ecx
add ecx, ecx
shr edx, cl
inc eax
mov byte [esp + eax + 0x1b], dl
cmp eax, 0x14
jb 0x4dc830
mov eax, dword [esp + 0x3c]
test eax, eax
jbe 0x4dc86e
push eax
lea eax, [esp + 0x20]
push eax
push ebp
call fcn.004e03c0
add esp, 0xc
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x2c
ret 8
Function at 0x4dc890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ec
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2e8], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
push 0xe0
mov esi, ecx
lea ecx, [esp + 0x10c]
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], eax
call fcn.004e0730
mov edi, dword [ebp + 8]
add esp, 0xc
push esi
lea esi, [esp + 0x10c]
call fcn.004dc6b0
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x38
lea edi, [esp + 0x1ec]
lea eax, [esp + 0x1ec]
rep movsd dword es:[edi], dword [esi]
call fcn.004dc720
mov edx, dword [ebp + 0x18]
dec edx
mov eax, 0xcccccccd
mul edx
shr edx, 4
add edx, 1
mov dword [esp + 0x20], edx
je 0x4dca93
mov ebx, 1
lea eax, [esp + 0x2cc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x2d0], eax
mov dword [esp + 0x2d4], eax
mov dword [esp + 0x2d8], eax
mov dword [esp + 0x2dc], eax
mov eax, ebx
shr eax, 8
mov ecx, 0x38
lea esi, [esp + 0x1e8]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
mov byte [esp + 0x2e2], al
mov eax, dword [ebp + 0x10]
shr ecx, 0x18
mov byte [esp + 0x2e1], dl
mov byte [esp + 0x2e0], cl
mov byte [esp + 0x2e3], bl
mov edx, 4
test eax, eax
jbe 0x4dca54
mov dword [esp + 0x18], eax
lea ebx, [ebx]
lea ecx, [esp + 0x2e0]
push ecx
lea eax, [esp + 0x2c]
mov ebx, edx
call fcn.004dc720
push 0x14
lea edx, [esp + 0x2e4]
push edx
lea edi, [esp + 0x30]
call fcn.004dc7b0
xor edx, edx
jmp 0x4dc9e0
movzx eax, byte [esp + edx + 0x2e0]
xor byte [esp + edx + 0x2cc], al
movzx ecx, byte [esp + edx + 0x2e1]
movzx eax, byte [esp + edx + 0x2e2]
xor byte [esp + edx + 0x2cd], cl
xor byte [esp + edx + 0x2ce], al
movzx ecx, byte [esp + edx + 0x2e3]
movzx eax, byte [esp + edx + 0x2e4]
xor byte [esp + edx + 0x2cf], cl
xor byte [esp + edx + 0x2d0], al
add edx, 5
cmp edx, 0x14
jb 0x4dc9e0
sub dword [esp + 0x18], 1
mov ecx, 0x38
lea esi, [esp + 0x108]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
jne 0x4dc9b0
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, dword [ebp + 0x18]
jae 0x4dca74
mov edx, dword [esp + 0x10]
mov dl, byte [edx + eax]
mov esi, dword [esp + 0x24]
mov byte [eax + esi], dl
inc ecx
inc eax
cmp ecx, 0x14
jb 0x4dca5a
mov eax, 0x14
add dword [esp + 0x14], eax
sub dword [esp + 0x10], eax
inc ebx
lea eax, [ebx - 1]
mov dword [esp + 0x1c], ebx
cmp eax, dword [esp + 0x20]
jb 0x4dc934
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4df824
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50fb70]
jne 0x4df82e
repz ret
jmp fcn.004e6661
Function at 0x4ee36b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004e537e
and dword [ebp - 4], 0
cmp dword [0x5b4060], 0
mov ebx, eax
jne 0x4ee41c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4ee4cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4ee4cd
push eax
call fcn.004e530c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5b4060], eax
call esi
push eax
call fcn.004e530c
mov dword [esp], 0x5031d4
push edi
mov dword [0x5b4064], eax
call esi
push eax
call fcn.004e530c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5b4068], eax
call esi
push eax
call fcn.004e530c
pop ecx
mov dword [0x5b4070], eax
test eax, eax
je 0x4ee41c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004e530c
pop ecx
mov dword [0x5b406c], eax
mov eax, dword [0x5b406c]
cmp eax, ebx
je 0x4ee474
cmp dword [0x5b4070], ebx
je 0x4ee474
push eax
call fcn.004e5387
push dword [0x5b4070]
mov esi, eax
call fcn.004e5387
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4ee474
test edi, edi
je 0x4ee474
call esi
test eax, eax
je 0x4ee46b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4ee46b
test byte [ebp - 0xc], 1
jne 0x4ee474
or dword [ebp + 0x10], 0x200000
jmp 0x4ee4ad
mov eax, dword [0x5b4064]
cmp eax, ebx
je 0x4ee4ad
push eax
call fcn.004e5387
pop ecx
test eax, eax
je 0x4ee4ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4ee4ad
mov eax, dword [0x5b4068]
cmp eax, ebx
je 0x4ee4ad
push eax
call fcn.004e5387
pop ecx
test eax, eax
je 0x4ee4ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5b4060]
call fcn.004e5387
pop ecx
test eax, eax
je 0x4ee4cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4ee4cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 5
push 0
push 0
push 0x4052a8
push 0x4052c0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10092652
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x10092675
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x10092663
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100a5e37
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.100ab73b
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100a5e76
sub eax, 1
je 0x100a5e71
sub eax, 1
je 0x100a5e6d
xor eax, eax
leave
ret
push 3
jmp 0x100a5e78
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x100b5650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b567d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b567d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100b7b8f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100cecbc
push 0x100cecb4
push str.FlsAlloc
push 0x1e
call fcn.100b80eb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b7bc3
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x100b7bc9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100b7c0d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100ceccc
push 0x100cecc4
push str.FlsGetValue
push 0x20
call fcn.100b80eb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b7c44
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100bc019
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1008e800
mov eax, dword [0x100f32c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100bae48
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100bc05b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100bc1b7
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1008e6e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x100f84d0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.100bbdc0
mov ecx, dword [esi*4 + 0x100f84d0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100bc1b0
cmp eax, dword [edi + ecx + 0x24]
jne 0x100bc1b0
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100bc1b0
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100bbdc0
add esp, 0x14
test edx, edx
jl 0x100bc1b0
jg 0x100bc126
test eax, eax
jb 0x100bc1b0
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100bc1b0
jl 0x100bc140
cmp dword [ebp - 0x1008], eax
ja 0x100bc1b0
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100bc15e
test ebx, ebx
je 0x100bc197
cmp ecx, edi
jae 0x100bc197
mov al, byte [ecx]
cmp al, 0xd
jne 0x100bc178
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100bc184
cmp byte [ecx + 1], 0xa
jne 0x100bc184
inc ecx
jmp 0x100bc184
movzx eax, al
movsx eax, byte [eax + 0x100f3c90]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100bc15e
cmp edx, ebx
jne 0x100bc15e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100bc1b5
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1008e6d2
leave
ret
Function at 0x100bcae5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100bcb82
push ebx
push esi
call fcn.100bcbd3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100b5a0b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100bcb2f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100bcb81
push edi
push eax
call fcn.100b5941
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100bcb4f
call fcn.100b5907
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100bcb80
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100b5a0b
add esp, 0x20
test eax, eax
jne 0x100bcb6e
push edi
call fcn.100b5907
jmp 0x100bcb76
push ebx
call fcn.100b5907
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100bcb85
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100bcb96
pop esi
ret
push ebx
push edi
push esi
call fcn.100bcbd3
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100b5941
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100bcbbe
push ebx
push esi
push edi
call fcn.100a89e0
add esp, 0xc
push 0
call fcn.100b5907
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100bcc0a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100bcc15
Function at 0x100bddd4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100bdddf