joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad5f
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 2
push 0
xor eax, eax
mov dword [ebp - 8], ecx
push 0
push dword [ebp + 0x10]
xor bl, bl
cmp dword [ebp + 0xc], eax
sete al
push eax
push edx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindFirstFileExW]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x40adc4
push dword [ebp + 8]
mov eax, dword [ebp - 8]
push dword [ebp + 0x10]
cmp eax, fcn.0040aea0
jne 0x40ae37
call fcn.0040aea0
test eax, eax
je 0x40ae73
and dword [0x443d00], 0
mov bl, 1
cmp dword [esi], 0xffffffff
je 0x40adf3
mov ecx, dword [0x443d04]
test ecx, ecx
je 0x40ae16
mov edx, dword [0x42d5e4]
cmp edx, dword [0x443d08]
jge 0x40ae49
test ecx, ecx
je 0x40adf1
mov eax, dword [esi]
mov dword [ecx + edx*4], eax
inc edx
mov dword [0x42d5e4], edx
mov bl, 1
test bl, bl
jne 0x40ae02
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret 0x10
push 0x14
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
mov edx, dword [0x42d5e4]
mov dword [0x443d04], ecx
jmp 0x40ade1
mov ecx, eax
call dword [0x4494a0]
mov ecx, dword [ebp - 8]
call ecx
jmp 0x40adb3
lea eax, [edx*4 + 4]
push eax
push ecx
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapReAlloc]
mov ecx, eax
test ecx, ecx
je 0x419378
inc dword [0x443d08]
jmp 0x40ae29
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindNextFileW]
test eax, eax
je 0x40ae90
cmp dword [esi], 0xffffffff
jne 0x40ad9a
jmp 0x40adc4
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindClose]
or dword [esi], 0xffffffff
jmp 0x40adc4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
push dword [esi]
mov dword [0x443d00], eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindClose]
or dword [esi], 0xffffffff
xor al, al
jmp 0x40ae04
Function at 0x40bbb2
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x104
mov byte [ebp - 0x1c], 1
xor esi, esi
mov dword [ebp - 0x18], ebx
push ebx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x20], esi
push esi
push eax
mov di, cx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x228]
add esp, 0xc
cmp byte [ebp - 0x1c], al
sete al
dec eax
and eax, 0x7ee3
add eax, ebx
push eax
call fcn.0040fba0
test eax, eax
js 0x40bc68
push 0x3a
pop eax
mov word [ebp - 0xe], ax
push 0x5c
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], di
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40bc8d
cmp eax, 2
je 0x40bc68
cmp eax, 5
je 0x40bc68
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40bc85
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x230]
push ecx
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeInformationW]
test eax, eax
je 0x41c1a8
push dword [ebp - 0x20]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x228]
jmp 0x40bc47
xor esi, esi
inc esi
jmp 0x40bc68
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 5
jne 0x40bc68
jmp 0x40bc8d
Function at 0x40c10f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x218]
xor edi, edi
mov dword [ebp - 8], esi
push esi
xor ebx, ebx
mov dword [ebp - 0x10], edi
push edi
inc ebx
push eax
mov byte [ebp - 0xc], bl
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x218]
add esp, 0xc
cmp byte [ebp - 0xc], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040fba0
test eax, eax
js 0x41c4ec
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41c4fd
push dword [ebp - 8]
push eax
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov esi, 0x402120
mov ecx, esi
call fcn.0040c222
test eax, eax
je 0x41c508
mov esi, 0x402364
mov ecx, esi
call fcn.0040c222
test eax, eax
je 0x41c519
mov esi, 0x402148
mov ecx, esi
call fcn.0040c222
test eax, eax
je 0x40c20d
mov ecx, 0x40212c
call fcn.0040c222
test eax, eax
je 0x41c52a
mov ecx, 0x40213c
call fcn.0040c222
test eax, eax
jne 0x41c5d7
mov ecx, dword [0x443cc8]
test ecx, ecx
je 0x40c21b
mov edx, ebx
call fcn.00412904
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
mov edx, 0x401fd4
mov ecx, esi
call fcn.00412faa
jmp 0x40c1bd
mov ecx, 0x443ac0
jmp 0x40c1eb
push edi
call fcn.00413eb0
test eax, eax
je 0x41c4ec
push ebx
call dword [sym.imp.msvcrt.dll_exit]
lea eax, [ebp - 0x218]
jmp 0x40c17a
mov edx, 0x40263c
mov ecx, esi
call fcn.00412faa
jmp 0x40c199
mov edx, 0x403750
mov ecx, esi
call fcn.00412faa
jmp 0x40c1ad
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x41c537
lea ecx, [ebp - 0x218]
push 0x2e
pop edx
call fcn.004115ed
test eax, eax
jne 0x41c5bb
push 0x40379e
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
mov ecx, dword [ebp - 0x10]
mov esi, ecx
test ecx, ecx
jne 0x41c55e
lea esi, [ebp - 0x218]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x41c561
sub esi, edx
mov edi, ecx
sar esi, 1
test ecx, ecx
jne 0x41c57e
lea edi, [ebp - 0x218]
mov ecx, edi
push 0x5c
pop edx
call fcn.004111d9
lea ecx, [esi - 1]
lea ecx, [edi + ecx*2]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
je 0x41c5a4
test ecx, ecx
jne 0x41c59d
lea ecx, [ebp - 0x218]
push 0x40379c
jmp 0x41c5b3
test ecx, ecx
jne 0x41c5ae
lea ecx, [ebp - 0x218]
push 0x40379e
mov edx, dword [ebp - 8]
call fcn.00410770
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x41c5c8
lea edx, [ebp - 0x218]
mov ecx, 0x40212c
call fcn.00412faa
jmp 0x40c1cf
push 0x40396c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40c1e1
mov dword [0x44852c], ebx
jmp 0x40c1e1
Function at 0x40c222
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x42f840
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x42f840], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40c258
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x443cd9], 0
je 0x40c311
push 0x4021d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40c355
push 0x4021e0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40c33b
push 0x40221c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40c373
push 0x402204
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41c5f8
push 0x4021f8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40c365
push 0x402238
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40c318
push 0x402158
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41c603
push 0x402168
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41c60f
xor eax, eax
jmp 0x40c251
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00404cc0
add eax, eax
cmp eax, 0x4000
jae 0x40c377
xor ecx, ecx
mov word [eax + 0x42f840], cx
jmp 0x40c24f
push dword [0x43b8c0]
push 0x402118
push ebx
push edi
call fcn.0040c4ef
add esp, 0x10
jmp 0x40c24f
push 0
mov edx, ebx
mov ecx, edi
call fcn.00412c1e
jmp 0x40c24f
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00405c94
jmp 0x40c324
push 2
jmp 0x40c341
call fcn.00416e2a
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCommandLineW]
jmp 0x40c251
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x40c341
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
push dword [esp + 0xc]
jmp 0x40c341
Function at 0x40c56b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x448474], 0
pop ecx
mov dword [ebp - 4], eax
jne 0x41c6b2
push edi
mov edi, dword [ebp + 0xc]
mov eax, 0x2000
cmp esi, eax
ja 0x41c6c5
test esi, esi
je 0x40c5e2
push 0
push 0
push eax
push 0x42d630
push 0xffffffffffffffff
push ebx
push 0
push dword [0x433864]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
lea esi, [eax - 1]
push esi
push 0x42d630
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x40c5f3
cmp dword [edi], esi
jne 0x40c5f3
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x40c5ea
push 0
push dword [ebp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
jmp 0x40c5eb
push 0
push 0
push eax
push 0x42d630
push 0x1000
push ebx
push 0
push dword [0x433864]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
push eax
push 0x42d630
push dword [ebp - 4]
mov ecx, 0x2000
mov dword [ebp - 8], eax
add ebx, ecx
sub esi, ecx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x40c5f3
mov eax, dword [ebp - 8]
cmp dword [edi], eax
jne 0x40c5f3
jmp 0x40c599
Function at 0x40ff3c
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x40ff56
cmp dword [0x443cd4], 0
je 0x40ff5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x443cdc], 0
jne 0x40ff56
jmp 0x41db3f
mov ecx, 0x20c
call fcn.0040f4e0
mov edi, eax
test edi, edi
je 0x40ff56
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleTitleW]
mov edx, eax
test edx, edx
je 0x40ff56
and dword [ebp - 8], 0
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41db72
mov eax, dword [0x42d578]
sub ecx, esi
sar ecx, 1
add edx, 0xa
add eax, ecx
mov ecx, edi
add eax, edx
mov dword [ebp - 4], eax
lea edx, [eax + eax]
call fcn.00412650
mov esi, eax
test esi, esi
je 0x41dc01
cmp byte [0x42d5a4], 0
mov edi, esi
mov edx, dword [ebp - 4]
je 0x41dbc1
mov eax, dword [0x42d578]
sub edx, eax
push ebx
lea ecx, [esi + eax*2]
call fcn.00410820
jmp 0x41dbfa
push 0x403b84
mov ecx, esi
call fcn.00410770
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41dbd2
sub ecx, edx
mov edx, dword [ebp - 4]
sar ecx, 1
mov dword [0x42d578], ecx
mov ecx, esi
push ebx
call fcn.00410770
mov byte [0x42d5a4], 1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_SetConsoleTitleW]
mov ecx, edi
call fcn.0040f480
jmp 0x40ff56
Function at 0x411b8b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3a
pop eax
mov word [ebp - 0xe], ax
push 0x5c
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], cx
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
Function at 0x41236c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 0x104
mov byte [ebp - 0x22c], 1
push eax
xor ebx, ebx
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x230], ebx
push ebx
push eax
mov esi, edx
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], ebx
mov eax, 0x104
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x220]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x448], ebx
mov eax, 0x104
mov byte [ebp - 0x444], 1
mov dword [ebp - 0x440], eax
push eax
lea eax, [ebp - 0x650]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x438]
add esp, 0xc
cmp byte [ebp - 0x22c], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040fba0
test eax, eax
js 0x41ecbb
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040fba0
test eax, eax
js 0x41ecbb
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040fba0
test eax, eax
js 0x41ecbb
mov eax, dword [ebp - 0x448]
mov dword [0x443d00], ebx
test eax, eax
jne 0x41248a
lea eax, [ebp - 0x650]
push dword [ebp - 0x440]
mov edx, esi
mov ecx, edi
push eax
call fcn.0041424b
test al, al
je 0x412524
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x4124b2
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040fcb9
push 0x402374
lea ecx, [ebp - 0x220]
call fcn.0040fc22
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x41ec81
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41255b
push dword [ebp - 0x228]
push ecx
push ebx
lea ecx, [ebp - 0x654]
push ecx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeInformationW]
test eax, eax
je 0x41ec9e
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x412563
push 0x402690
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ec8c
push dword [ebp - 0x448]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [ebp - 0x230]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
jmp 0x4124e3
lea eax, [ebp - 0x438]
jmp 0x41250e
lea ecx, [ebp - 0x438]
jmp 0x4124dc
cmp dword [ebp - 0x654], 0xc
jne 0x412524
xor eax, eax
inc eax
jmp 0x41ecc7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
lea ecx, [eax - 0x90]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x443d00], ecx
jmp 0x412524
mov dword [0x443d00], 8
mov al, bl
mov bl, al
jmp 0x412524
Function at 0x412c1e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0xc], eax
cmp word [ebp + 8], 0
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x412c5e
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
call fcn.00416ce0
mov esp, ebp
pop ebp
ret 4
push 0x3d
pop eax
push dword [ebp + 8]
mov word [esp + 0xc], ax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esp + 0xa], ax
lea ecx, [esp + 8]
push 0x3a
pop eax
mov word [esp + 0xc], ax
xor eax, eax
mov word [esp + 0xe], ax
call fcn.0040c222
test eax, eax
je 0x41eff5
push eax
mov edx, edi
mov ecx, esi
call fcn.00410820
jmp 0x412c49
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esi], ax
push 0x3a
pop eax
mov word [esi + 2], ax
push 0x5c
pop eax
mov word [esi + 4], ax
xor eax, eax
mov word [esi + 6], ax
inc eax
jmp 0x412c4b
Function at 0x412faa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov byte [0x4378a6], bl
push esi
test edx, edx
je 0x412fd6
mov esi, edx
push edi
lea edi, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x412fc0
sub esi, edi
sar esi, 1
neg esi
pop edi
sbb esi, esi
and edx, esi
push edx
push ecx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetEnvironmentVariableW]
push dword [0x433844]
mov esi, eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
call fcn.00413008
mov dword [0x433844], eax
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
ret

Function at 0x413008
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetEnvironmentStringsW]
mov esi, eax
xor edi, edi
test esi, esi
je 0x41304d
push ebx
mov ecx, esi
call fcn.00413060
mov ebx, eax
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x413045
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x413fd9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x14], 1
mov esi, 0x104
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x10], esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x220]
add esp, 0xc
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040fba0
test eax, eax
js 0x414153
push 0x24
pop ecx
call fcn.0040f4e0
mov esi, eax
test esi, esi
je 0x41ffb8
mov ecx, esi
mov dword [esi], edi
call fcn.004126c9
mov eax, dword [esi + 0x18]
mov ecx, 0xffce
mov ebx, dword [esi]
mov edi, dword [esi + 0xc]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], ebx
call fcn.0040f4e0
test eax, eax
je 0x41ffb8
push 0
mov edx, 0x7fe7
mov dword [0x443cfc], eax
mov ecx, eax
call fcn.00412c1e
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41ffca
mov edx, dword [ebp - 0x10]
push ebx
call fcn.00411ef2
test eax, eax
jne 0x414153
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41ffd5
push 0x5c
pop eax
mov edx, eax
call fcn.004111d9
xor ecx, ecx
mov word [eax + 2], cx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41ffe0
push eax
mov ecx, 0x443ac0
call fcn.0040fcb9
test edi, edi
je 0x414177
movzx eax, word [edi]
push 0x3a
pop edx
cmp ax, dx
je 0x414177
push 0x5c
pop ecx
cmp ax, cx
jne 0x414123
cmp edi, ebx
je 0x414189
mov eax, ebx
xor ecx, ecx
cmp word [eax], cx
je 0x414113
mov ecx, eax
add eax, 2
cmp eax, edi
jne 0x414103
movzx eax, word [ecx]
cmp ax, dx
je 0x414189
push 0x5c
pop ecx
cmp ax, cx
je 0x414189
movzx ebx, word [edi]
xor eax, eax
push dword [ebp - 0x224]
mov word [edi], ax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x414173
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [0x443d00], eax
mov word [edi], bx
cmp dword [0x443d00], 0
je 0x414177
xor esi, esi
inc esi
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x414142
mov ecx, esi
call fcn.004126c9
mov eax, dword [ebp - 0x228]
mov dword [esi + 0x18], eax
jmp 0x414156
add edi, 2
jmp 0x414123
call fcn.0042904e
push 1
push 0x43b8c8
call dword [sym.imp.msvcrt.dll_longjmp]
lea ecx, [ebp - 0x220]
jmp 0x414098
lea ecx, [ebp - 0x220]
jmp 0x4140b4
lea eax, [ebp - 0x220]
jmp 0x4140cf
Function at 0x415f40
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, dword [esi]
neg esi
sbb esi, esi
and dword [edi], 0
add esi, 3
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l2_1_1.dll_MoveFileExW]
test eax, eax
je 0x420e81
xor eax, eax
inc eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0xb7
jne 0x420ecb
push 0x400023d4
mov edx, 0x400023d3
mov ecx, ebx
call fcn.00429348
sub eax, 0
je 0x420ec3
dec eax
sub eax, 1
jne 0x420eb0
mov eax, dword [ebp + 8]
and dword [eax], 0
or esi, 1
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l2_1_1.dll_MoveFileExW]
jmp 0x415f76
xor eax, eax
inc eax
jmp 0x415f78
xor eax, eax
jmp 0x415f78
Function at 0x417034
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x42bc78
call fcn.00417398
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x417094
cmp eax, 0xffffffff
je 0x417094
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41708d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41708d
cmp edx, 0x10000000
jae 0x41708d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41708a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004173dd
ret 4

Function at 0x4170e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41711e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x417116
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x417120
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x417106
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4171f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x417206
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x417221
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret