joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038df3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10038f62
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
cmp dword [eax], 0xffffffff
jne 0x10038e42
mov dword [ebp - 0x10], 1
jmp 0x10038e46
and dword [ebp - 0x10], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.10012a38
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov esi, eax
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov ecx, dword [esi]
sub ecx, dword [eax]
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x10], 0x18e9934b
jl 0x10038e89
mov dword [ebp - 8], 1
jmp 0x10038e8d
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov esi, dword [ebp - 8]
neg esi
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
cmp esi, dword [eax]
je 0x10038eb1
mov dword [ebp - 0x14], 1
jmp 0x10038eb5
and dword [ebp - 0x14], 0
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14]
jge 0x10038ecf
mov dword [ebp - 0x18], 1
jmp 0x10038ed3
and dword [ebp - 0x18], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
jg 0x10038eed
mov dword [ebp - 0x1c], 1
jmp 0x10038ef1
and dword [ebp - 0x1c], 0
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
jg 0x10038f0b
mov dword [ebp - 0x20], 1
jmp 0x10038f0f
and dword [ebp - 0x20], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov ecx, dword [ebp - 0x20]
sub ecx, dword [eax]
cmp ecx, 0x89bdd777
jbe 0x10038f2f
mov dword [ebp - 0x24], 1
jmp 0x10038f33
and dword [ebp - 0x24], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
jg 0x10038f4d
mov dword [ebp - 0x28], 1
jmp 0x10038f51
and dword [ebp - 0x28], 0
push 2
mov ecx, dword [ebp - 4]
call fcn.10012a38
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
jmp 0x10038f90
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10038f90
push 0
push 0x610
push 0
push 0
push 0x193d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100395bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10039629
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100395ec
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x10039627
mov dword [ebp - 8], 0
jmp 0x10039604
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x10039617
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10], 0xfffffffe
jmp 0x100395fd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10], 3
jmp 0x100395e1
jmp 0x1003963a
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1005d8e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.1005d980
movzx eax, al
test eax, eax
je 0x1005d911
push 0x100015c4
push 0x1066cdb8
call fcn.10058730
add esp, 8
push 0
call fcn.100657d1
mov ecx, dword [ebp - 4]
call fcn.1005dc40
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.1005da70
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10077635
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10081330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006881c
mov dword [ebp - 0x14], eax
cmp dword [0x1066dda0], esi
jne 0x10077728
push 0x800
push esi
push 0x10007a8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100776b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10077808
push esi
push esi
push 0x10007a8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10077808
push 0x10007aa4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10077808
push eax
call ebx
push 0x10007ab0
push edi
mov dword [0x1066dda0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ac0
push edi
mov dword [0x1066dda4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ad4
push edi
mov dword [0x1066dda8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066ddb0], eax
test eax, eax
je 0x10077725
push 0x10007af0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066ddac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007774d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10077740
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10077762
push 4
pop eax
jmp 0x1007780a
cmp dword [ebp - 0x14], esi
je 0x10077762
push dword [0x1066dda0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10077747
mov eax, dword [0x1066ddac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100777c0
cmp dword [0x1066ddb0], edi
je 0x100777c0
push eax
call ebx
push dword [0x1066ddb0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100777c0
test eax, eax
je 0x100777c0
call ecx
test eax, eax
je 0x100777b5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100777b5
test byte [ebp - 8], 1
jne 0x100777c0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100777f0
mov eax, dword [0x1066dda4]
cmp eax, edi
je 0x100777ed
push eax
call ebx
test eax, eax
je 0x100777ed
call eax
mov esi, eax
test esi, esi
je 0x100777ed
mov eax, dword [0x1066dda8]
cmp eax, edi
je 0x100777ed
push eax
call ebx
test eax, eax
je 0x100777ed
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066dda0]
call ebx
test eax, eax
je 0x10077808
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007780a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0xa5eac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4ab000]
push edi
or ebp, 0xffffffff
jmp 0xa5eae2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa5eae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa5ead8
mov eax, 1
add ebx, ebx
jne 0xa5eafb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa5eb0c
jne 0xa5eb2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa5eb2b
dec eax
add ebx, ebx
jne 0xa5eb18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa5eaf0
add ebx, ebx
jne 0xa5eb27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa5eb7d
xor ecx, ecx
sub eax, 3
jb 0xa5eb43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa5ebb2
sar eax, 1
mov ebp, eax
jmp 0xa5eb4e
add ebx, ebx
jne 0xa5eb4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa5eb1c
inc ecx
add ebx, ebx
jne 0xa5eb5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa5eb1c
add ebx, ebx
jne 0xa5eb69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa5eb5e
jne 0xa5eb7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa5eb5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa5eb9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa5eb8e
jmp 0xa5eade
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa5eb9c
add edi, ecx
jmp 0xa5eade
pop esi
mov edi, esi
mov ecx, 0x1b293
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa5ebba
cmp byte [edi], 0xa6
jne 0xa5ebba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa5ebbf
lea edi, [esi + 0x659000]
mov eax, dword [edi]
or eax, eax
je 0xa5ec2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x66ad78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x66aee0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa5ebec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x66aee4]
or eax, eax
je 0xa5ec28
mov dword [ebx], eax
add ebx, 4
jmp 0xa5ec09
call dword [esi + 0x66aef4]
mov ebp, dword [esi + 0x66aee8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa5ec62
sub esp, 0xffffff80
jmp 0x7b7db0
Function at 0x857af0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x857af6
pop ebp
sub ebp, 6
sub ebp, 0x457af0
jmp 0x857b54
jmp 0x857b5d
mov eax, 0x457af0
add eax, ebp
add eax, 0x93
mov ecx, 0x5b6
mov edx, 0x6c71403c
xor byte [eax], dl
inc eax
dec ecx
jne 0x857b74
jmp 0x857b87
mov bh, 0xf1
mov bh, 0xb5
add byte [esp + edi], bh
cmp al, 0xbd
std
les edi, [esp + edi]
cmp al, 0x3f
int1
test byte [edx], bh
cmp al, 0x3c
cmp al, 0x86
adc al, 0x3c
cmp al, 0x3c
retf
Function at 0x10011be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10011bef
pop dword [ebp - 0x2c]
mov eax, 0x95b3d229
add eax, 0x7a4d49c6
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xc17697b5
add dword [ebp - 0x3c], 0x8cdbad96
mov dword [ebp - 0x38], 0x51b82a3a
add dword [ebp - 0x38], 0xe07b220b
mov dword [ebp - 0x34], 0xaf15ba17
add dword [ebp - 0x34], 0x9d368a17
mov dword [ebp - 0x30], 0x6ebe13b6
add dword [ebp - 0x30], 0x9141ec4a
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x846aeb18
sub eax, 0x74675a24
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x442ddc2d
add dword [ebp - 0x3c], 0x30448d29
mov dword [ebp - 0x38], 0x4c5b6574
add dword [ebp - 0x38], 0xf510fc01
mov dword [ebp - 0x34], 0x8fac0b9
add dword [ebp - 0x34], 0x5a74abb3
mov dword [ebp - 0x30], 0x7922cef6
add dword [ebp - 0x30], 0x86dd310a
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x22242ae
add eax, 0xde14e4a
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x468f5
push 0
call eax
mov ecx, 0xcdc20ed5
sub ecx, 0xcdc1b204
mov esi, eax
mov edi, 0x10051200
add edi, dword [ebp - 0x2c]
mov ebx, 0x11277970
sub dword [ebp - 0x28], eax
mov edx, dword [edi]
add dword [ebp - 8], 0x3cf4887d
sub edx, ebx
xor dword [ebp - 0xc], 0xd3f5f88b
mov dword [esi], edx
mov dword [ebp - 8], 0x47449c9a
add esi, 4
add edi, 0x4c9a247a
add edi, 0xb365db8a
loop 0x10011d05
add eax, 0xbcce686c
sub eax, 0xbccd0255
mov ebx, eax
add eax, 0x5c81ce70
add eax, 0xa37e3195
mov ecx, 0x1a421fc1
add ecx, 0xf5bde03f
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10030836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047018]
jne 0x10030840
repz ret
jmp fcn.10030e15
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47b004]
jne 0x40100a
repz ret
jmp fcn.004016ac

Function at 0x409144
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403d07
and dword [ebp - 4], 0
cmp dword [0x4811e0], 0
mov ebx, eax
jne 0x4091f5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092a6
push eax
call fcn.00403c95
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4811e0], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4811e4], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4811e8], eax
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x4811f0], eax
test eax, eax
je 0x4091f5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x4811ec], eax
mov eax, dword [0x4811ec]
cmp eax, ebx
je 0x40924d
cmp dword [0x4811f0], ebx
je 0x40924d
push eax
call fcn.00403d10
push dword [0x4811f0]
mov esi, eax
call fcn.00403d10
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40924d
test edi, edi
je 0x40924d
call esi
test eax, eax
je 0x409244
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409244
test byte [ebp - 0xc], 1
jne 0x40924d
or dword [ebp + 0x10], 0x200000
jmp 0x409286
mov eax, dword [0x4811e4]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409286
mov eax, dword [0x4811e8]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4811e0]
call fcn.00403d10
pop ecx
test eax, eax
je 0x4092a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49e441
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x55366c]
cmp eax, 0xffffffff
jne 0x49e54d
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa60a40
call sub.msvcrt.dll_memset
mov dword [0xa60a40], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa60a84
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa60a84
mov dword [esp + 0x20], 0xa60a40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x49e543
mov eax, dword [0xa60a84]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa60a84]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa60a88]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x55366c], 1
jmp 0x49e54d
mov dword [0x55366c], 0
mov eax, dword [0x55366c]
leave
ret
Function at 0x4af53a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004af136
test eax, eax
sete al
test al, al
je 0x4af566
mov eax, 0xfffffffe
mov edx, 0xffffffff
jmp 0x4af619
mov edx, dword [0x6c62dc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov edi, ecx
sub edi, eax
mov eax, edi
add eax, edx
mov dword [0xa4fd4c], eax
mov eax, dword [0xa4fd4c]
movzx eax, byte [eax + 0x70]
test al, al
je 0x4af59d
mov eax, 0xfffffffc
mov edx, 0xffffffff
jmp 0x4af619
mov eax, dword [0x6c62d8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa4fd50], eax
mov edi, 0xa4fd58
mov eax, dword [0xa4fd50]
mov eax, dword [eax]
mov dword [esp + 4], 0xa4fd5c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [edi], eax
mov eax, dword [0xa4fd58]
mov edx, dword [0xa4fd5c]
mov ebx, eax
and bh, 0xff
mov esi, edx
and esi, 0
mov eax, ebx
xor eax, 0xffffffff
or eax, esi
test eax, eax
jne 0x4af60e
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x4af60e
mov eax, 0xfffffffd
mov edx, 0xffffffff
jmp 0x4af619
mov eax, dword [0xa4fd58]
mov edx, dword [0xa4fd5c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b0fbf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004af136
test eax, eax
sete al
test al, al
je 0x4b0ffd
mov eax, 0xfffffffe
jmp 0x4b11b7
mov edx, dword [0x6c62dc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov ebx, ecx
sub ebx, eax
mov eax, ebx
add eax, edx
mov dword [0xa4fc94], eax
mov eax, dword [0xa4fc94]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x4b1032
mov eax, 0xfffffffd
jmp 0x4b11b7
cmp dword [ebp - 0x14], 0
jns 0x4b1042
mov eax, 0xfffffffc
jmp 0x4b11b7
mov eax, dword [ebp - 0xc]
mov edx, eax
xor edx, 0xffffffff
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
or eax, edx
test eax, eax
je 0x4b108c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004b0e85
mov dword [0xa4fc98], eax
mov eax, dword [0xa4fc98]
test eax, eax
setne al
test al, al
je 0x4b108c
mov eax, dword [0xa4fc98]
jmp 0x4b11b7
mov eax, dword [0x6c62d8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa4fc9c], eax
jmp 0x4b119d
cmp dword [ebp - 0x14], 0
jle 0x4b10bd
mov dword [0xa4fca0], 0xffffffff
add dword [ebp - 0x18], 1
adc dword [ebp - 0x14], 0xffffffff
jmp 0x4b10d3
mov eax, dword [ebp - 0x18]
mov dword [0xa4fca0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [0xa4fca0]
mov eax, dword [0xa4fc9c]
mov eax, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xa4fca8
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4b113f
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [0xa4fcb0], eax
mov eax, dword [0xa4fcb0]
cmp eax, 5
je 0x4b1131
mov eax, dword [0xa4fcb0]
cmp eax, 0x21
jne 0x4b1138
mov eax, 0xfffffff9
jmp 0x4b11b7
mov eax, 0xfffffff7
jmp 0x4b11b7
mov eax, dword [0xa4fca8]
mov edx, dword [0xa4fcac]
add dword [ebp + 0x14], eax
mov esi, dword [0xa4fc94]
mov eax, dword [0xa4fc94]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov eax, dword [0xa4fca8]
mov edx, dword [0xa4fcac]
add eax, ecx
adc edx, ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0xa4fca0]
mov ecx, eax
mov ebx, 0
mov eax, dword [0xa4fca8]
mov edx, dword [0xa4fcac]
mov esi, ebx
xor esi, edx
xor eax, ecx
or eax, esi
test eax, eax
je 0x4b119d
mov eax, 0xffffffff
jmp 0x4b11b7
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
or eax, edx
test eax, eax
setne al
test al, al
jne 0x4b10a3
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4c806b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c80b5
mov dword [esp], 7
call fcn.0047b484
mov eax, dword [ebp - 0x14]
jmp 0x4c8150
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov edx, eax
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne al
test al, al
je 0x4c8111
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.0047cb9e
mov dword [ebp - 0x14], eax
mov dword [esp], 0x33
call fcn.0047b484
mov eax, dword [ebp - 0x14]
jmp 0x4c8150
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0047cb9e
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x4d06d0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [0xa723e0], eax
jmp fcn.004cfec0