joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x38], 0x1a9
mov dword [ebp - 0x3c], 0x1d0
mov dword [ebp - 0x14], 0x296
mov dword [ebp - 0x40], 0x163
mov dword [ebp - 8], 0x22c
mov dword [ebp - 0x18], 0x3be
mov dword [ebp - 0x44], 0x20d
mov dword [ebp - 0x48], 0x1c4
mov dword [ebp - 0x28], 0x336
mov dword [ebp - 0x1c], 0x370
mov dword [ebp - 0x4c], 0x33c
mov dword [ebp - 0x50], 0xfe
mov dword [ebp - 0x10], 0x11b
mov dword [ebp - 0x54], 0xa6
mov dword [ebp - 0x58], 0x21a
mov dword [ebp - 0x24], 0x92
mov dword [ebp - 0x30], 0x20e
mov dword [ebp - 0x20], 0x208
mov dword [ebp - 0x2c], 0xcb
mov dword [ebp - 0x34], 0x25d
mov dword [ebp - 0x5c], 0x11c
mov dword [ebp - 0x60], 0xc5
mov dword [ebp - 0x64], 0x188
mov dword [ebp - 4], 0
jmp 0x408a69
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x18936
cmp dword [ebp - 4], ecx
jge 0x408a93
mov edx, dword [ebp - 8]
xor edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x14]
jge 0x408a91
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x408a60
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x349
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1d7
push edx
mov eax, dword [ebp - 0x24]
add eax, 0xa4
push eax
mov ecx, dword [ebp + 0x18]
sub ecx, 0x226
push ecx
mov edx, dword [ebp + 0x14]
add edx, 0x14f
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x85
push eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x13f
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x33
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x1a2
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x13d
push ecx
call fcn.00422e40
add esp, 0x28
mov dword [ebp - 0xc], 0
jmp 0x408b0b
mov eax, dword [ebp + 0xc]
sub eax, 0x18828
cmp dword [ebp - 0xc], eax
jge 0x408b2c
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x409df0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x30], 0x346
mov dword [ebp - 0x34], 0x3a1
mov dword [ebp - 0x38], 0x36a
mov dword [ebp - 0x3c], 0x11f
mov dword [ebp - 0x10], 0x1aa
mov dword [ebp - 0x20], 0x123
mov dword [ebp - 0x28], 0x213
mov dword [ebp - 0x40], 0x161
mov dword [ebp - 0x44], 0x3b4
mov dword [ebp - 0x48], 0x306
mov dword [ebp - 0x18], 0x2cb
mov dword [ebp - 8], 0x36b
mov dword [ebp - 0x4c], 0x2f8
mov dword [ebp - 0x50], 0x3d8
mov dword [ebp - 0xc], 0x1c4
mov dword [ebp - 0x54], 0x135
mov dword [ebp - 0x58], 0xf9
mov dword [ebp - 0x5c], 0x1f
mov dword [ebp - 0x24], 0x18f
mov dword [ebp - 0x2c], 0x37a
mov dword [ebp - 0x14], 0x161
mov dword [ebp - 0x60], 0x367
mov dword [ebp - 0x1c], 0x56
mov dword [ebp - 0x64], 0x3e1
mov dword [ebp - 0x68], 0xb7
mov eax, dword [ebp - 0x14]
add eax, 0x9f
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x28a
push ecx
call fcn.00413af0
add esp, 8
mov edx, dword [ebp - 0x1c]
add edx, 0x1a8
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x226
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 6
push ecx
mov edx, dword [ebp - 0x28]
add edx, 0x62
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0x19c
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x216
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x3b
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x46
push eax
call fcn.0041ea60
add esp, 0x20
mov dword [ebp - 4], 0
jmp 0x409f1c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x18864
cmp dword [ebp - 4], edx
jge 0x409f3b
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x409f13
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
call fcn.0041b100
mov esp, ebp
pop ebp
ret

Function at 0x40c0f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x18], 0x2a2
mov dword [ebp - 0x1c], 0xce
mov dword [ebp - 0x20], 0x65
mov dword [ebp - 0x24], 0x5b
mov dword [ebp - 0x28], 0x1ba
mov dword [ebp - 0x2c], 0x5a
mov dword [ebp - 0x30], 0xba
mov dword [ebp - 0x34], 0x176
mov dword [ebp - 0x38], 0x2fc
mov dword [ebp - 0x3c], 0x70
mov dword [ebp - 0x40], 0x295
mov dword [ebp - 0x10], 0x2e7
mov dword [ebp - 0x44], 0x1d2
mov dword [ebp - 0x14], 0x6e
mov dword [ebp - 0x48], 0x3ca
mov dword [ebp - 0x4c], 0x1bd
mov dword [ebp - 0x50], 0xef
mov dword [ebp - 8], 0x2fe
mov dword [ebp - 0x54], 0x11c
mov dword [ebp - 0x58], 0xa8
mov dword [ebp - 0x5c], 0x1bf
mov dword [ebp - 0x60], 0x1ca
mov dword [ebp - 0xc], 0x328
mov dword [ebp - 4], 0
jmp 0x40c1a9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x18987
cmp dword [ebp - 4], ecx
jge 0x40c1c8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x40c1a0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
add ecx, 0x16a
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xb8
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x2c2
push eax
call fcn.0040b9d0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4149f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x68], 0x160
mov dword [ebp - 0xc], 0x1cd
mov dword [ebp - 0x6c], 0x393
mov dword [ebp - 0x60], 0x395
mov dword [ebp - 0x3c], 0xe6
mov dword [ebp - 0x30], 0x7e
mov dword [ebp - 0x34], 0x27c
mov dword [ebp - 0x10], 0x16b
mov dword [ebp - 0x70], 0x145
mov dword [ebp - 0x44], 0x34a
mov dword [ebp - 0x74], 0x33d
mov dword [ebp - 0x38], 0x19c
mov dword [ebp - 0x78], 0xb9
mov dword [ebp - 0x40], 0x1de
mov dword [ebp - 0x7c], 0x2c6
mov dword [ebp - 0x50], 0x16d
mov dword [ebp - 8], 0x221
mov dword [ebp - 0x2c], 0x374
mov dword [ebp - 0x80], 0x3ae
mov dword [ebp - 0x28], 0x1e9
mov dword [ebp - 4], 0x1f5
mov dword [ebp - 0x64], 0x5b
mov dword [ebp - 0x54], 0x278
mov dword [ebp - 0x58], 0x28
mov dword [ebp - 0x5c], 0x17
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x34]
and ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x38]
je 0x414b3d
mov edx, dword [ebp + 0x18]
cmp edx, dword [ebp - 0x3c]
jge 0x414ad1
mov dword [ebp - 0x1c], 1
jmp 0x414ad8
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jge 0x414af2
mov dword [ebp - 0x20], 1
jmp 0x414af9
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x4c]
jge 0x414b22
mov dword [ebp - 0x24], 1
jmp 0x414b29
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x24]
je 0x414b3d
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
jmp 0x414b58
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x18]
sub ecx, 0xff
cmp dword [ebp - 0x14], ecx
jge 0x414b71
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x414b4f
mov eax, dword [ebp - 0x50]
sub eax, 0x15d
push eax
mov ecx, dword [ebp - 0x54]
sub ecx, 0x6b
push ecx
mov edx, dword [ebp - 0x58]
add edx, 0x22b
push edx
mov eax, dword [ebp - 0x5c]
add eax, 0x187
push eax
mov ecx, dword [ebp - 0x60]
sub ecx, 0x1db
push ecx
call fcn.00411bc0
add esp, 0x14
mov dword [ebp - 0x18], 0
jmp 0x414bb8
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x64]
sub eax, 0x186fb
cmp dword [ebp - 0x18], eax
jge 0x414bd6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x414baf
mov esp, ebp
pop ebp
ret
Function at 0x416690
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x30], 0x291
mov dword [ebp - 0x28], 0x2f1
mov dword [ebp - 0x48], 0x3db
mov dword [ebp - 0x14], 0x385
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x50], 0xb0
mov dword [ebp - 0x40], 0x18d
mov dword [ebp - 0x54], 0x1e3
mov dword [ebp - 0x58], 0x1f9
mov dword [ebp - 0x5c], 0x1ba
mov dword [ebp - 0x60], 0x248
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2c], 0x2bd
mov dword [ebp - 0x64], 0x123
mov dword [ebp - 0x34], 0x137
mov dword [ebp - 0x68], 0x344
mov dword [ebp - 0x20], 0x34
mov dword [ebp - 0x6c], 0x3a2
mov dword [ebp - 0x3c], 0x3e7
mov dword [ebp - 0x70], 0x2ad
mov dword [ebp - 0x74], 0x3b3
mov dword [ebp - 0x44], 0xc6
mov dword [ebp - 0x18], 0x18b
mov dword [ebp - 0x38], 0x36f
mov dword [ebp - 8], 0
jmp 0x416750
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1895d
cmp dword [ebp - 8], ecx
jge 0x41676f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
jmp 0x416747
mov dword [ebp - 0xc], 0
jmp 0x416781
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x290
cmp dword [ebp - 0xc], ecx
jge 0x4167ba
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x34]
jge 0x4167a0
mov dword [ebp - 0x1c], 1
jmp 0x4167a7
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
je 0x4167b8
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x416778
mov dword [ebp - 0x10], 0
jmp 0x4167cc
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x18991
cmp dword [ebp - 0x10], eax
jge 0x416818
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x38]
jge 0x4167ea
mov dword [ebp - 0x24], 1
jmp 0x4167f1
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x3c]
or edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x24]
je 0x416816
call dword [sym.imp.KERNEL32.dll_GetACP]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x14]
jge 0x416816
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x4167c3
mov edx, dword [ebp - 0x44]
add edx, 0x26a
push edx
mov eax, dword [ebp - 0x28]
add eax, 0xa6
push eax
call fcn.00425b90
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x421740
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x30], 0x26a
mov dword [ebp - 0x34], 0x252
mov dword [ebp - 0x1c], 0x1a7
mov dword [ebp - 0x38], 0x164
mov dword [ebp - 0x3c], 0xe0
mov dword [ebp - 0x40], 0x2c2
mov dword [ebp - 0x44], 0x22a
mov dword [ebp - 0x48], 0x99
mov dword [ebp - 0x4c], 0x3b0
mov dword [ebp - 0x20], 0x3de
mov dword [ebp - 4], 0x327
mov dword [ebp - 0x50], 0x246
mov dword [ebp - 0x54], 0x363
mov dword [ebp - 0xc], 0x252
mov dword [ebp - 0x58], 0x3a
mov dword [ebp - 0x18], 0xe7
mov dword [ebp - 0x5c], 0x1e0
mov dword [ebp - 0x14], 0x271
mov dword [ebp - 0x2c], 0x1e0
mov dword [ebp - 0x60], 0x146
mov dword [ebp - 0x24], 0x33b
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x64], 0x2c2
mov dword [ebp - 0x68], 0x22e
mov dword [ebp - 0x6c], 0x27c
mov eax, dword [ebp - 0x20]
sub eax, 0x6d
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x81
push ecx
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xbc
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x16c
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x17f
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x16e
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xd1
push ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xa2
push edx
call fcn.0041da90
add esp, 0x24
mov dword [ebp - 8], 0
jmp 0x421861
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x186a1
cmp dword [ebp - 8], ecx
jge 0x421880
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x421858
mov eax, dword [ebp - 0x2c]
add eax, 0x135
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xcc
push ecx
call fcn.00421d30
add esp, 8
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x4218b6
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x188f2
cmp dword [ebp - 0x10], ecx
jge 0x4218d5
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x4218ad
mov esp, ebp
pop ebp
ret
Function at 0x4227e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x38], 0x28c
mov dword [ebp - 0x3c], 0x6b
mov dword [ebp - 0x34], 0x294
mov dword [ebp - 0x40], 0xce
mov dword [ebp - 4], 0x3e3
mov dword [ebp - 0x44], 0x368
mov dword [ebp - 0x1c], 0x109
mov dword [ebp - 0x48], 0x242
mov dword [ebp - 0x30], 0x6f
mov dword [ebp - 0x4c], 0x126
mov dword [ebp - 0x50], 0x97
mov dword [ebp - 0x54], 0x1f8
mov dword [ebp - 0x58], 0x358
mov dword [ebp - 0x24], 0x182
mov dword [ebp - 0x18], 0x3af
mov dword [ebp - 0x5c], 0xc2
mov dword [ebp - 0x60], 0x199
mov dword [ebp - 0x2c], 0x3cb
mov dword [ebp - 0x28], 0x3b8
mov dword [ebp - 0x20], 0x19
mov dword [ebp - 0x64], 0xa3
mov dword [ebp - 0x68], 0x132
mov dword [ebp - 8], 0
jmp 0x422892
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x1870a
cmp dword [ebp - 8], ecx
jge 0x4228b1
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x422889
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
jge 0x4228c2
mov dword [ebp - 0xc], 1
jmp 0x4228c9
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 4]
and ecx, dword [ebp - 0xc]
je 0x422920
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jge 0x422920
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jge 0x4228ed
mov dword [ebp - 0x10], 1
jmp 0x4228f4
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x30]
jge 0x422905
mov dword [ebp - 0x14], 1
jmp 0x42290c
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x34]
or edx, dword [ebp - 0x10]
or edx, dword [ebp - 0x14]
je 0x422920
mov eax, dword [ebp + 0x10]
add eax, 1
mov dword [ebp + 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x4237f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x40], 0x3c7
mov dword [ebp - 0x30], 0x3c3
mov dword [ebp - 0x14], 0x209
mov dword [ebp - 0xc], 0x24b
mov dword [ebp - 0x10], 0x1a4
mov dword [ebp - 0x44], 0x15f
mov dword [ebp - 0x34], 0x274
mov dword [ebp - 0x18], 0x291
mov dword [ebp - 0x24], 0x1f5
mov dword [ebp - 0x48], 0x3b8
mov dword [ebp - 0x38], 0x159
mov dword [ebp - 0x28], 0x3a7
mov dword [ebp - 0x2c], 0x14
mov dword [ebp - 0x4c], 0x2c1
mov dword [ebp - 0x50], 0x289
mov dword [ebp - 0x54], 0x2ab
mov dword [ebp - 0x58], 0x20a
mov dword [ebp - 0x5c], 0x265
mov dword [ebp - 4], 0x20d
mov dword [ebp - 0x3c], 0x3a1
mov dword [ebp - 0x60], 0x2da
mov dword [ebp - 0x64], 0x2dc
mov dword [ebp - 0x68], 0x18a
mov dword [ebp - 0x6c], 0x29f
mov dword [ebp - 0x70], 0x27b
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jge 0x42390f
mov ecx, dword [ebp - 0x30]
xor ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x4238df
mov dword [ebp - 0x1c], 1
jmp 0x4238e6
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 0x18]
cmp edx, dword [ebp - 0x34]
jge 0x4238f7
mov dword [ebp - 0x20], 1
jmp 0x4238fe
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
je 0x42390f
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
jmp 0x423921
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x188ae
cmp dword [ebp - 8], eax
jge 0x423947
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x3c]
jge 0x42393f
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x423918
mov esp, ebp
pop ebp
ret
Function at 0x46ecf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x24], 0x1e2
mov dword [ebp - 0x28], 0x118
mov dword [ebp - 0x2c], 0x1be
mov dword [ebp - 0x14], 0x18e
mov dword [ebp - 0x30], 0xba
mov dword [ebp - 0x34], 0x88
mov dword [ebp - 0x38], 0xdb
mov dword [ebp - 0x3c], 0x378
mov dword [ebp - 0x20], 0x371
mov dword [ebp - 0x40], 0x2df
mov dword [ebp - 0x44], 0x18f
mov dword [ebp - 0x48], 0x12
mov dword [ebp - 0x4c], 0x136
mov dword [ebp - 0x50], 0x272
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x54], 0x333
mov dword [ebp - 0x58], 0x21f
mov dword [ebp - 0xc], 0x1ca
mov dword [ebp - 0x5c], 0x3e7
mov dword [ebp - 0x60], 0x255
mov dword [ebp - 0x10], 0x109
mov dword [ebp - 0x1c], 0x29
mov dword [ebp - 0x64], 0x5c
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0x46edb2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x1882e
cmp dword [ebp - 4], edx
jge 0x46edcf
mov eax, dword [0x50c468]
add eax, 1
mov dword [0x50c468], eax
jmp 0x46eda9
mov dword [ebp - 8], 0
jmp 0x46ede1
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x186a1
cmp dword [ebp - 8], edx
jge 0x46edfe
mov eax, dword [0x50c44c]
add eax, 1
mov dword [0x50c44c], eax
jmp 0x46edd8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x47f34f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x47f38e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47f38e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47f38e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x47f38e
cmp dword [ecx + 0x74], 0xe
jbe 0x47f38e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x48ba14
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48ba53
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48ba53
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48ba53
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48ba53
cmp dword [ecx + 0x74], 0xe
jbe 0x48ba53
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4ab699
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ab56d
Function at 0x4ac194
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5155c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4ac1df
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004ac634
test al, al
jne 0x4ac1d9
sub edx, 2
cmp edx, edi
jne 0x4ac1bf
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4ac201
lea eax, [edi + 2]
cmp edx, eax
je 0x4ac201
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004abe5b
add esp, 0x10
jmp 0x4ac2fb
push esi
lea ecx, [ebp - 0x255]
call fcn.004ac634
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ac244
push dword [ebp - 0x25c]
jmp 0x4ac1f1
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4ac281
cmp word [ebp - 0x226], 0
je 0x4ac2a2
cmp word [ebp - 0x226], ax
jne 0x4ac281
cmp word [ebp - 0x224], 0
je 0x4ac2a2
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004abe5b
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4ac2ee
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4ac25b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4ac2d6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4ac2fb
push 0x4ab8ab
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004b7410
add esp, 0x10
jmp 0x4ac2cb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f8c9
leave
ret
Function at 0x4adb7b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4adc18
push ebx
push esi
call fcn.004adb37
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004ada74
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4adbc5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4adc17
push edi
push eax
call fcn.004b037e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4adbe5
call fcn.004ab859
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4adc16
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004ada74
add esp, 0x20
test eax, eax
jne 0x4adc04
push edi
call fcn.004ab859
jmp 0x4adc0c
push ebx
call fcn.004ab859
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4adc1b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4adc2c
pop esi
ret
push ebx
push edi
push esi
call fcn.004adb37
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004b037e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4adc54
push ebx
push esi
push edi
call fcn.00488480
add esp, 0xc
push 0
call fcn.004ab859
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4ae543
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004adec9

Function at 0x4b2696
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004aabb3
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4b2705
cmp esi, dword [ebp - 4]
je 0x4b2700
cmp dword [ebp + 0xc], 0
je 0x4b2700
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4b26dd
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004b21e8
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4b2707
xor eax, eax
inc eax
jmp 0x4b2707
xor eax, eax
pop edi
pop esi
leave
ret