joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bb4
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov eax, dword [0x48d0d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
add byte [eax], al
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.00426e3a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret

Function at 0x40c150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.00429e90
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov esi, edx
cmp dword [ecx + 0x14], 8
push edi
mov dword [ebp - 0x200c], eax
jb 0x40c17c
mov ecx, dword [ecx]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebx
cmp dword [esi + 0x14], 8
mov edi, eax
jb 0x40c1a1
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push esi
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c1d7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax]
push 0
lea eax, [ebp - 0x2008]
push eax
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c21f
push 0
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40c227
call esi
mov dword [ebp - 0x200c], eax
cmp dword [ebp - 0x2008], 0x1000
je 0x40c1e0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
mov eax, dword [ebp - 0x200c]
test eax, eax
mov ecx, dword [ebp - 4]
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.00429e52
mov esp, ebp
pop ebp
ret
Function at 0x40cd90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0
push 0
mov edi, ecx
mov esi, edx
push edi
push 0
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
js 0x40ce2e
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40ce20
cmp word [ebp - 0x20c], 0
jne 0x40cdf3
xor ecx, ecx
jmp 0x40ce0f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ce00
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401e90
mov bl, 1
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x40ce76
push 1
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40ce76
cmp word [ebp - 0x20c], 0
jne 0x40ce4d
xor ecx, ecx
jmp 0x40ce65
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ce56
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401e90
mov bl, 1
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40cec8
cmp dword [esi + 0x14], 8
jb 0x40ce87
mov eax, dword [esi]
jmp 0x40ce89
mov eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x40cec8
lea eax, [ecx - 1]
cmp eax, ecx
ja 0x40cebc
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x40cea3
mov esi, dword [esi]
xor ecx, ecx
pop edi
mov word [esi + eax*2], cx
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
mov esp, ebp
pop ebp
ret
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040ccd0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429e52
mov esp, ebp
pop ebp
ret

Function at 0x40d090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x2b
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40d0ce
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
mov esp, ebp
pop ebp
ret
push 0x4829b4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044cb9b
add esp, 0xc
cmp word [ebp - 0x20c], 0
jne 0x40d0f5
xor ecx, ecx
jmp 0x40d10f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d100
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401e90
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00429e52
mov esp, ebp
pop ebp
ret
Function at 0x40d130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x1c
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40d16e
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
mov esp, ebp
pop ebp
ret
push 0x4829b4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044cb9b
add esp, 0xc
cmp word [ebp - 0x20c], 0
jne 0x40d195
xor ecx, ecx
jmp 0x40d1af
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d1a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401e90
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00429e52
mov esp, ebp
pop ebp
ret

Function at 0x40d200
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x26
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40d23e
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x20c], 0
jne 0x40d24c
xor ecx, ecx
jmp 0x40d264
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d255
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401e90
push 0x1b
push str.AdobeAdobe_Creative_Cloud
mov ecx, esi
call fcn.0040a360
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00429e52
mov esp, ebp
pop ebp
ret
Function at 0x40d7f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x40d801
mov eax, dword [esi]
jmp 0x40d803
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d825
cmp dword [esi + 0x14], 8
jb 0x40d816
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
pop esi
setne al
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x40d82d
mov esi, dword [esi]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
test esi, esi
je 0x40d8c7
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d86e
mov ecx, dword [eax]
push esi
push str.SHCreateDirectoryEx_failed._Error:__d
push str.FileUtils
push 0x47fb68
push 0x32
push eax
call dword [ecx + 0x34]
add esp, 0x18
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
mov eax, dword [0x490788]
test eax, eax
je 0x40d8a2
push esi
push str.SHCreateDirectoryEx_failed._Error:__d
push 0x47fb68
push 0x47fb68
push str.FileUtils
push str.OOBEUtils
push 0x32
call eax
add esp, 0x1c
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
mov ecx, dword [0x49078c]
test ecx, ecx
je 0x40d8c7
mov eax, dword [ecx]
push esi
push str.SHCreateDirectoryEx_failed._Error:__d
push str.FileUtils
push 0x47fb68
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
xor eax, eax
test esi, esi
pop esi
sete al
pop ebp
ret
Function at 0x40f4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464538
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push 0x20019
push 0
push str.SoftwareAdobeALCID
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40f58d
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ab50
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x40f64a
inc ecx
push ecx
jmp 0x40f63f
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], 0
push eax
push 0
push str.CCLangPref
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f60e
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40f60e
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00429ebd
mov edi, eax
add esp, 4
test edi, edi
je 0x40f60e
lea eax, [ebp - 0x30]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push str.CCLangPref
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f605
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401c40
push edi
call fcn.00429ec6
add esp, 4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ab50
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x40f64a
inc eax
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00402340
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429e52
mov esp, ebp
pop ebp
ret
Function at 0x4146d0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464bf5
mov eax, dword fs:[0]
push eax
sub esp, 0x418
push esi
push edi
lea edi, [ebp - 0x424]
mov ecx, 0x106
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x48f420], 0
je 0x414727
mov eax, dword [0x48f420]
jmp 0x4147d8
mov esi, esp
lea eax, [ebp - 0x414]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.00429e23
mov esi, esp
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp esi, esp
call fcn.00429e23
test eax, eax
jne 0x414774
mov esi, esp
push 0
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, esp
call fcn.00429e23
push 0x94
call fcn.00429d85
add esp, 4
mov dword [ebp - 0x420], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x420], 0
je 0x4147aa
mov ecx, dword [ebp - 0x420]
call fcn.00414160
mov dword [ebp - 0x424], eax
jmp 0x4147b4
mov dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x41c]
mov dword [0x48f420], ecx
mov eax, dword [0x48f420]
push edx
mov ecx, ebp
push eax
lea edx, [0x414814]
call fcn.00429dcb
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429e52
add esp, 0x424
cmp ebp, esp
call fcn.00429e23
mov esp, ebp
pop ebp
ret
Function at 0x4191c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov ecx, dword [ebp + 0x10]
call fcn.00401c30
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.00429e23
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x419250
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00429e23
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00401c30
push eax
push str.Failed_to_create_file_at_path_:_s_Error:_d_n
push 0x46ca4c
call fcn.004146d0
push eax
call fcn.00414b70
add esp, 0x14
xor al, al
jmp 0x4192de
mov dword [ebp - 0x10], 0
mov esi, esp
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.00429e23
test eax, eax
je 0x41928a
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00419330
add esp, 4
jmp 0x4192c9
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00429e23
push eax
push str.Failed_to_write_in_file_ERROR_VAL:_d_n
push str.AAMEEUtilities
call fcn.004146d0
push eax
call fcn.00414b70
add esp, 0x10
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00429e23
xor al, al
jmp 0x4192de
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00429e23
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x419308]
call fcn.00429dcb
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
add esp, 0x14
cmp ebp, esp
call fcn.00429e23
mov esp, ebp
pop ebp
ret

Function at 0x4193c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
lea edi, [ebp - 0x214]
mov ecx, 0x85
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, esp
call fcn.00429e23
test eax, eax
jne 0x419425
push str.Unable_to_retreive_Path_from_Win_library:_n
push 0x46bcf0
call fcn.004146d0
push eax
call fcn.00414b70
add esp, 0xc
xor al, al
jmp 0x419436
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401c40
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x419464]
call fcn.00429dcb
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
add esp, 0x214
cmp ebp, esp
call fcn.00429e23
mov esp, ebp
pop ebp
ret
Function at 0x419f80
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
lea edi, [ebp - 0x410]
mov ecx, 0x104
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x48d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov esi, esp
lea eax, [ebp - 0x40c]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.00429e23
test eax, eax
je 0x41a013
mov esi, esp
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp esi, esp
call fcn.00429e23
test eax, eax
jne 0x41a000
mov esi, esp
push 0
lea edx, [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, esp
call fcn.00429e23
test eax, eax
je 0x41a013
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401c40
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
push edx
mov ecx, ebp
push eax
lea edx, [0x41a044]
call fcn.00429dcb
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429e52
add esp, 0x410
cmp ebp, esp
call fcn.00429e23
mov esp, ebp
pop ebp
ret
Function at 0x420550
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov byte [ebp - 1], 1
mov dword [ebp - 8], 0
push 0xfffe
call fcn.00429ebd
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov esi, esp
push 0x7fff
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401c30
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp esi, esp
call fcn.00429e23
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4205d2
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00429e23
cmp eax, 0xcb
jne 0x4205d2
mov byte [ebp - 1], 0
jmp 0x4205de
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00401c40
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00429ec6
add esp, 4
mov al, byte [ebp - 1]
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.00429e23
mov esp, ebp
pop ebp
ret

Function at 0x420a80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [ebp + 8], 0
jne 0x420a9e
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00429e23
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x48f438]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp esi, esp
call fcn.00429e23
mov esi, esp
push 0
mov edx, dword [0x48f434]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.00429e23
mov esi, esp
push 0
mov eax, dword [0x48f430]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.00429e23
mov esi, esp
push 5
mov ecx, dword [0x48f42c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.00429e23
mov esi, esp
push 5
mov edx, dword [0x48f438]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.00429e23
mov byte [section..data], 0
pop esi
cmp ebp, esp
call fcn.00429e23
pop ebp
ret
Function at 0x4283d8
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x465c8d
call fcn.0042a80e
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4284f5
cmp byte [ebx + 0x3e], 0
je 0x4284f5
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0042a7ae
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x428424
xor al, al
jmp 0x4284f7
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040cc00
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x428454
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.0042a7ae
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x428489
sub eax, 1
je 0x42848d
dec eax
sub eax, 1
je 0x4284e3
xor bl, bl
jmp 0x4284e5
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x42849d
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x4284c5
cmp eax, 0x10
jae 0x4284ac
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0044f028
add esp, 0x10
cmp esi, eax
jne 0x428485
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x4284e3
test esi, esi
jne 0x428448
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040a620
jmp 0x428442
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004020b0
mov al, bl
jmp 0x4284f7
mov al, 1
call fcn.0042a7c9
ret
Function at 0x428971
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x465ce2
call fcn.0042a80e
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x428996
xor eax, eax
jmp 0x428b0f
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4289c2
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4289c2
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x428b0f
cmp dword [esi + 0x4c], 0
je 0x428b0c
mov ecx, esi
call fcn.004285e1
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4289f5
push dword [esi + 0x4c]
push edi
call fcn.004281a0
pop ecx
pop ecx
test al, al
je 0x428b0c
movzx ebx, di
jmp 0x428b0c
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040cc00
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x428a2d
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.0042a7ae
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x428b00
cmp eax, 1
jg 0x428adb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x428a76
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x428aa3
cmp eax, 0x10
jae 0x428a85
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.0044f028
add esp, 0x10
cmp edi, eax
jne 0x428ad6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x428aa6
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x428ad0
test edi, edi
jne 0x428a21
cmp dword [ebp - 0x18], 0x20
jae 0x428afa
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040a620
jmp 0x428a1b
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x428afa
cmp eax, 3
jne 0x428b00
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004281a0
pop ecx
pop ecx
test al, al
je 0x428afa
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004020b0
mov ax, bx
call fcn.0042a7c9
ret 4

Function at 0x42d62f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x45725b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00456f1e

Function at 0x457266
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045709f
Function at 0x45b148
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045ae08