joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4589a4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0043e6a0
mov eax, dword [0x4e11d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00456445
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4589e6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x458b42
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0043ee00
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4e8030]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004599a1
mov ecx, dword [esi*4 + 0x4e8030]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x458b3b
cmp eax, dword [ecx + edi + 0x24]
jne 0x458b3b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x458b3b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004599a1
add esp, 0x14
test edx, edx
jl 0x458b3b
jg 0x458ab1
test eax, eax
jb 0x458b3b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x458b3b
jl 0x458acb
cmp dword [ebp - 0x1008], eax
ja 0x458b3b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x458ae9
test ebx, ebx
je 0x458b22
cmp ecx, edi
jae 0x458b22
mov al, byte [ecx]
cmp al, 0xd
jne 0x458b03
lea eax, [edi - 1]
cmp ecx, eax
jae 0x458b0f
cmp byte [ecx + 1], 0xa
jne 0x458b0f
inc ecx
jmp 0x458b0f
movzx eax, al
movsx eax, byte [eax + 0x4e1468]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x458ae9
cmp edx, ebx
jne 0x458ae9
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x458b40
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043e584
leave
ret
Function at 0x458e39
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4e8030]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x458e79
cmp byte [ebx], 0xa
jne 0x458e79
or byte [edi + eax + 0x28], 4
jmp 0x458e7e
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x458f7d
mov dl, byte [eax]
cmp dl, 0x1a
je 0x458f60
inc eax
cmp dl, 0xd
je 0x458eaa
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x458ed0
cmp eax, ecx
jae 0x458ede
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x458e92
jmp 0x458f7d
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x458f5b
cmp dword [ebp - 0x10], 0
je 0x458f5b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4e8030]
test byte [eax + edi + 0x28], 0x48
je 0x458f35
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x458f20
mov byte [esi], dl
jmp 0x458f31
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e8030]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x458f7d
cmp byte [ebp - 1], 0xa
jne 0x458f44
cmp esi, ebx
jne 0x458f44
mov byte [esi], 0xa
jmp 0x458f7c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004599bf
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x458f7d
mov byte [esi], 0xd
jmp 0x458f7c
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4e8030]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x458f7a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x458f7d
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x458f86
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4e8030]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x458fcc
cmp word [ebx], dx
jne 0x458fcc
or byte [eax + edi + 0x28], 4
jmp 0x458fd1
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x459134
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x459114
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x459012
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x459048
cmp eax, edx
jae 0x459056
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x458fed
jmp 0x459134
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45910f
cmp dword [ebp - 0x18], 0
je 0x45910f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4e8030]
test byte [eax + edi + 0x28], 0x48
je 0x4590e5
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4590a9
mov word [esi], cx
jmp 0x4590e0
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4e8030]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4e8030]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4e8030]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x459134
pop eax
cmp word [ebp - 4], ax
jne 0x4590f5
cmp esi, ebx
jne 0x4590f5
mov word [esi], ax
jmp 0x459131
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004599bf
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x459134
push 0xd
pop eax
jmp 0x4590f0
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4e8030]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x45912e
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x459134
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45d66d
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4e11d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x45d6b8
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0045d808
test al, al
jne 0x45d6b2
sub edx, 2
cmp edx, edi
jne 0x45d698
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x45d6da
lea eax, [edi + 2]
cmp edx, eax
je 0x45d6da
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0045d5b9
add esp, 0x10
jmp 0x45d7d4
push esi
lea ecx, [ebp - 0x255]
call fcn.0045d808
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45d71d
push dword [ebp - 0x25c]
jmp 0x45d6ca
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x45d75a
cmp word [ebp - 0x226], 0
je 0x45d77b
cmp word [ebp - 0x226], ax
jne 0x45d75a
cmp word [ebp - 0x224], 0
je 0x45d77b
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0045d5b9
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x45d7c7
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x45d734
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x45d7af
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x45d7d4
push 0x45d3e9
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004644c0
add esp, 0x10
jmp 0x45d7a4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e584
leave
ret

Function at 0x45e0ea
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x45e0fb
pop esi
ret
push ebx
push edi
push esi
call fcn.0045e0b3
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00455545
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45e123
push ebx
push esi
push edi
call fcn.00441170
add esp, 0xc
push 0
call fcn.0045550b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x45e4f3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045e138
Function at 0x46091c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00455220
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x46098b
cmp esi, dword [ebp - 4]
je 0x460986
cmp dword [ebp + 0xc], 0
je 0x460986
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x460963
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0046046e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x46098d
xor eax, eax
inc eax
jmp 0x46098d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4609f2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e11d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00455220
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00455220
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x460a69
cmp word [ecx], dx
je 0x460a69
mov eax, dword [0x4d098c]
push edi
dec eax
push eax
push 0x4d0878
call fcn.00460991
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x460adc
cmp word [eax], dx
je 0x460adc
mov eax, dword [edi]
test eax, eax
je 0x460a8d
cmp word [eax], dx
je 0x460a8d
lea eax, [ebp - 0x10]
push eax
call fcn.00460374
jmp 0x460a96
lea eax, [ebp - 0x10]
push eax
call fcn.0046040f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x460b06
mov eax, dword [0x4d0874]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4d0568
call fcn.00460991
add esp, 0xc
test al, al
je 0x460b06
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x460ad1
cmp word [eax], di
je 0x460ad1
lea eax, [ebp - 0x10]
push eax
call fcn.00460374
pop ecx
jmp 0x460b08
lea eax, [ebp - 0x10]
push eax
call fcn.0046040f
jmp 0x460ace
mov eax, dword [edi]
test eax, eax
je 0x460af3
cmp word [eax], dx
je 0x460af3
lea eax, [ebp - 0x10]
push eax
call fcn.00460329
pop ecx
jmp 0x460b06
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x460bd1
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00460816
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x460bd1
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x460bd1
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x460bd1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x460b5e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0045723c
test ebx, ebx
je 0x460bcc
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0045723c
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x460bd1
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x460bd1
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00464c5a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x460bd3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e584
leave
ret
Function at 0x4652d5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00465251
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x465444
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x465444
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4653f9
jg 0x465331
test eax, eax
je 0x4653ef
push 1
push 0x1000
call fcn.00456b0c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x465354
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4653e6
push 0x8000
push ebx
call fcn.0045213c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46537d
jg 0x465378
cmp ecx, 0x1000
jb 0x46537d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004581f3
add esp, 0x10
cmp eax, 0xffffffff
je 0x4653c2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x465378
jl 0x4653a9
test ecx, ecx
jne 0x46536a
push dword [ebp - 0xc]
push ebx
call fcn.0045213c
push esi
call fcn.0045550b
add esp, 0xc
xor ebx, ebx
jmp 0x465452
cmp byte [edi + 0x24], 0
je 0x4653d9
cmp dword [edi + 0x20], 5
jne 0x4653d9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4653e4
mov ebx, dword [edi + 0x18]
jmp 0x4653e6
xor ebx, ebx
push esi
call fcn.0045550b
pop ecx
jmp 0x465452
test ecx, ecx
jg 0x4653bb
jl 0x4653f9
test eax, eax
jae 0x4653bb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004599bf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x465419
cmp byte [edi + 0x1c], 0
je 0x4653bb
jmp 0x46544a
push ebx
call fcn.0045e8ed
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4653bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x465452
cmp byte [edi + 0x1c], 0
je 0x46544f
mov ebx, dword [edi + 0x18]
jmp 0x465452
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004599bf
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x465e50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x465e7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x465e7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x476089
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x478f10
call fcn.004767c8
push 1
call fcn.0047632c
pop ecx
test al, al
jne 0x475f32
push 7
call fcn.00476593
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004762f7
mov byte [ebp - 0x24], al
mov eax, dword [0x49dd84]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x475f2b
test eax, eax
jne 0x475f9c
mov dword [0x49dd84], ecx
push 0x4783d8
push 0x4783c8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x475f7f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x476083
push 0x4783c4
push 0x4783bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49dd84], 2
jmp 0x475fa1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00476489
pop ecx
call fcn.00476587
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x475fd1
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fd1
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004767c2
call esi
call fcn.0047658d
mov esi, eax
cmp dword [esi], edi
je 0x475fef
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fef
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004766a8
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004766db
test al, al
jne 0x476028
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x476031
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004764a6
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x476083
call fcn.0047680e
ret
call fcn.00475da3
jmp 0x475f13

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x50c2efd
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xefe4a0a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401008
Capabilities:
Query environment variable

Disassembly:
enter 0x2c, 0
mov ebx, 0x4031f0
sbb edx, 0x58
call sub.KERNEL32.dll_GetEnvironmentStringsA
push ebx
push dword [ebx + 0x2c]
push eax
push dword [ebx + 0x11c]
call fcn.00401a94
pop ebx
mov edx, 0xfffffff5
push edx
call sub.KERNEL32.dll_GetStdHandle
add esp, 0x2c
pop ebp
ret 0xc

Function at 0x401074
Capabilities:
Query environment variable

Disassembly:
enter 0x20, 0
lea edi, [0x4031b4]
adc ecx, eax
push edi
push edx
push edx
call fcn.004017a4
pop edi
call sub.KERNEL32.dll_GetCurrentProcessId
call sub.KERNEL32.dll_GetEnvironmentStringsA
add esp, 0x20
pop ebp
ret 0x10

Function at 0x401390
Capabilities:
Get disk information

Disassembly:
enter 0x1c, 0
lea ecx, [esi + 0xbc]
sub eax, dword [ecx - 0xc]
push ecx
push dword [ecx + 0x9c]
push dword [ecx + 0x19c]
call fcn.00401200
pop ecx
push ecx
lea edi, [ecx - 0x15c]
push edi
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
jne 0x4013b1
pop ecx
push ecx
call sub.KERNEL32.dll_GetLogicalDrives
pop ecx
add esp, 0x1c
pop ebp
ret 0x10

Function at 0x401688
Capabilities:
Query environment variable

Disassembly:
enter 0x24, 0
lea eax, [0x403188]
sbb edi, dword [eax + 0x1c]
push eax
push dword [eax + 0xbc]
push ebx
call fcn.0040109c
pop eax
push eax
call sub.USER32.dll_GetFocus
pop eax
push eax
call sub.KERNEL32.dll_GetEnvironmentStringsA
pop eax
add esp, 0x24
pop ebp
ret 0x10

Function at 0x401760
Capabilities:
Get disk information

Disassembly:
enter 0x24, 0
mov eax, 0x403004
or ebx, edx
push eax
call sub.KERNEL32.dll_GetCurrentThread
pop eax
push eax
push esi
push dword [eax + 0x1cc]
push dword [eax + 0x94]
call fcn.00401008
pop eax
push eax
call sub.KERNEL32.dll_GetLogicalDrives
pop eax
add esp, 0x24
pop ebp
ret 0xc

Function at 0x401870
Capabilities:
Encode data using xor

Disassembly:
enter 0x40, 0
lea edx, [eax - 0x7c]
adc eax, dword [edx + 0x94]
push edx
push edi
mov ebx, esp
push ebx
mov ecx, 0x26
push ecx
xor dword [esp], 0x66
push 0x385
add dword [esp], 0x5e3
push 0x403224
mov ebx, 0x1ec5c345
mov ebx, dword [ebx - 0x1e85a321]
call ebx
pop edx
pop edx
push 0x403224
pop eax
mov dword [edx + 0x120], eax
mov edi, eax
sub edi, 0x1cf
sub eax, eax
add eax, 0x4020f9
xor ecx, ecx
add ecx, 0x568
mov esi, dword [eax]
add eax, 3
inc eax
push esi
pop dword [edi + 0x1cf]
add edi, 4
xor dword [ebp - 0x2c], ecx
xor dword [edi + 0x1cb], 0x8473a658
sub dword [edi + 0x1cb], 0x4eac6723
sub ecx, 4
cmp ecx, 0
jne 0x4018cf
push edx
call sub.KERNEL32.dll_GetCurrentProcessId
pop edx
add esp, 0x40
pop ebp
ret 0xc

Function at 0x401ac4
Capabilities:
Get disk information

Disassembly:
enter 0x38, 0
lea ecx, [0x403150]
sbb dword [ebp - 0x38], 0xf2cc89f7
push ecx
push dword [ecx + 0x48]
push esi
push dword [ecx + 0x1e4]
push dword [ecx + 0x40]
call fcn.00401688
pop ecx
push ecx
call sub.KERNEL32.dll_GetLogicalDrives
pop ecx
push ecx
call sub.KERNEL32.dll_GetCurrentProcessId
pop ecx
add esp, 0x38
pop ebp
ret 0x10