joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f9b20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x5f9b39
mov edi, ebx
mov ebx, eax
jmp 0x5f9b3b
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jg 0x5f9b4b
mov eax, esi
jmp 0x5f9b55
push eax
push esi
call fcn.005bd830
add esp, 8
test eax, eax
jne 0x5f9b5d
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x5f9b81
push ebp
mov ecx, dword [ebx]
mov ebp, dword [ecx + eax*4]
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x5f9b67
pop ebp
cmp eax, dword [edi + 4]
jge 0x5f9b98
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x5f9b86
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x5f9bbe
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x5f9bbe
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
test ecx, ecx
mov dword [esi + 4], edx
jg 0x5f9ba8
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x608ec8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x608eed
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x608f05
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x608f34
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x608f76
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x60904a
sub edx, 0x10000
js 0x60904a
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x608f5c
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x608f5c
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x608fcd
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x608fca
add edx, 8
jne 0x608fb1
jmp 0x60903b
add edx, 4
test eax, 0xffff
jne 0x608fda
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x60903b
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x60900e
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x608f5c
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x60904a
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x608f5c
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x60905b
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x60a336
Capabilities:
Terminate process

Disassembly:
push 8
push 0x656ac8
call fcn.0060e93c
push 8
call fcn.0060dde5
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x7624c4], esi
jne 0x60a36a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x7624c0], esi
mov al, byte [ebp + 0x10]
mov byte [0x7624bc], al
cmp dword [ebp + 0xc], edi
jne 0x60a3b4
cmp dword [0x763d8c], edi
je 0x60a3a4
mov eax, dword [0x763d88]
sub eax, 4
mov dword [0x763d88], eax
cmp eax, dword [0x763d8c]
jb 0x60a3a4
mov eax, dword [eax]
cmp eax, edi
je 0x60a385
call eax
jmp 0x60a385
push 0x65b410
mov eax, 0x65b404
call fcn.0060a2b4
pop ecx
push 0x65b41c
mov eax, 0x65b414
call fcn.0060a2b4
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x60a3e5
cmp dword [ebp + 0x10], edi
jne 0x60a3f3
mov dword [0x7624c4], esi
push dword [ebp + 8]
call fcn.0060a272
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x60a3f2
push 8
call fcn.0060dd30
pop ecx
ret
call fcn.0060e977
ret

Function at 0x610cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x672e50]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x672ff0]
je 0x610d05
inc eax
cmp eax, 0x13
jb 0x610cf6
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x672ff0]
jne 0x610e2b
mov eax, dword [0x762478]
cmp eax, 1
je 0x610e03
cmp eax, edx
jne 0x610d35
cmp dword [0x6728c4], 1
je 0x610e03
cmp ecx, 0xfc
je 0x610e2b
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x610d6b
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00614460
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0060f6c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x610d9f
mov eax, edi
push eax
call fcn.0060f6c0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x65760c
push edi
call fcn.0060aac0
add esp, 0x10
push edi
call fcn.0060f6c0
push dword [esi + 0x672ff4]
mov ebx, eax
call fcn.0060f6c0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00609610
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00614460
push edi
push ebx
call fcn.00614470
push 0x61ebc4
push ebx
call fcn.00614470
push dword [esi + 0x672ff4]
push ebx
call fcn.00614470
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00616853
add esp, 0x2c
jmp 0x610e2b
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x672ff4]
push dword [esi]
call fcn.0060f6c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0060f80c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x61312a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x6132fe
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x762c40]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x6132fe
test cl, 0x48
je 0x613195
cmp byte [eax + 5], 0xa
je 0x613195
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6131e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x6131cf
call fcn.0060b282
mov dword [eax], 9
call fcn.0060b28b
mov dword [eax], esi
jmp 0x6131df
cmp eax, 0x6d
je 0x6132fe
push eax
call fcn.0060b294
pop ecx
or eax, 0xffffffff
jmp 0x613300
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x6132f9
test eax, eax
je 0x61320e
cmp byte [ebx], 0xa
jne 0x61320e
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x613217
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x6132f3
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x6132e3
cmp al, 0xd
je 0x613249
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x6132d5
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x613263
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x61325e
add dword [ebp + 0x10], 2
jmp 0x6132b7
mov dword [ebp + 0x10], eax
jmp 0x6132d1
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x61328b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x6132d1
cmp dword [ebp - 0xc], 0
je 0x6132d1
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x6132ac
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x6132b7
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x6132d4
cmp ebx, dword [ebp + 0xc]
jne 0x6132bc
cmp byte [ebp - 1], 0xa
jne 0x6132bc
mov byte [ebx], 0xa
jmp 0x6132d4
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00613a5f
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x6132d5
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x61322d
jmp 0x6132f3
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x6132f3
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x613300
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6133b0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x672e50]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x6133e1
xor eax, eax
jmp 0x61356a
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x762c40]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x61341d
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00617752
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x6134f8
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x613536
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x613481
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x613472
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x613452
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x6134c1
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x6134ca
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x613443
jmp 0x6134cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x613565
cmp dword [ebp - 0x6c], edi
je 0x613536
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x61352b
call fcn.0060b282
mov dword [eax], 9
call fcn.0060b28b
mov dword [eax], esi
jmp 0x613560
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x613520
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x6134cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x6134cc
push dword [ebp - 0x6c]
call fcn.0060b294
pop ecx
jmp 0x613560
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x61354e
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x61354e
xor eax, eax
jmp 0x613568
call fcn.0060b282
mov dword [eax], 0x1c
call fcn.0060b28b
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x613568
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0060f80c
add ebp, 0x3a0
leave
ret
Function at 0x6140f9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x614127
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x61412e
cmp ebx, dword [eax + 4]
jae 0x61412e
xor eax, eax
jmp 0x61431e
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x61413f
xor eax, eax
inc eax
jmp 0x61431d
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x614155
cmp ecx, edx
jae 0x61429a
cmp dword [eax + 4], 0
je 0x61415e
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x614146
cmp dword [ebp + 8], 0
je 0x614180
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x61429a
cmp eax, esi
jae 0x61429a
mov eax, dword [0x762860]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x6141a5
cmp dword [esi*4 + 0x762868], edi
je 0x61429e
inc esi
cmp esi, eax
jl 0x614193
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x61431a
cmp dword [ebp - 8], 0x1000000
jne 0x61431a
test byte [ebp - 0xc], 0xcc
je 0x614223
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x61431a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x61431a
cmp word [eax + 0x18], 0x10b
jne 0x61431a
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x61431a
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x614223
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x614223
test byte [ecx + 0x27], 0x80
jne 0x61429a
push 1
push 0x7628a8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x614137
mov ecx, dword [0x762860]
test ecx, ecx
mov edx, ecx
jle 0x614257
lea eax, [ecx*4 + 0x762864]
cmp dword [eax], edi
je 0x614257
dec edx
sub eax, 4
test edx, edx
jg 0x61424b
test edx, edx
jne 0x614288
push 0xf
pop ebx
cmp ecx, ebx
jg 0x614264
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x61427c
lea eax, [edx*4 + 0x762868]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x61426a
cmp ecx, 0x10
jge 0x614288
inc ecx
mov dword [0x762860], ecx
push 0
push 0x7628a8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x614137
xor eax, eax
jmp 0x61431d
test esi, esi
jle 0x614137
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x7628a8
call ebx
test eax, eax
jne 0x614137
cmp dword [esi*4 + 0x762868], edi
je 0x6142f4
mov eax, dword [0x762860]
lea esi, [eax - 1]
test esi, esi
jl 0x6142e2
cmp dword [esi*4 + 0x762868], edi
je 0x6142de
dec esi
jns 0x6142d2
test esi, esi
jge 0x6142f2
cmp eax, 0x10
jge 0x6142ed
inc eax
mov dword [0x762860], eax
lea esi, [eax - 1]
jmp 0x6142f4
je 0x61430c
xor ecx, ecx
test esi, esi
jl 0x61430c
lea eax, [ecx*4 + 0x762868]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x6142fa
push 0
push 0x7628a8
call ebx
jmp 0x614137
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x61436e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00609610
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x614409
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x762484]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x614409
cmp eax, 1
je 0x61442a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x614409
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x6143d6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x614405
xor eax, eax
inc eax
jmp 0x614449
cmp edi, eax
jae 0x61440d
xor eax, eax
jmp 0x614449
cmp eax, esi
jae 0x614414
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x762484]
jmp 0x61442d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x615ab9
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x615ad2
or eax, 0xffffffff
jmp 0x615b33
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x615b2f
push 0x3d
push esi
call fcn.006179b8
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x615b2f
cmp esi, eax
je 0x615b2f
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x7624a4]
sete cl
cmp eax, dword [0x7624a8]
mov dword [ebp - 8], ecx
jne 0x615b15
mov edi, eax
call fcn.00615a58
mov dword [0x7624a4], eax
cmp eax, ebx
jne 0x615b6e
cmp dword [ebp + 0xc], ebx
je 0x615b37
cmp dword [0x7624ac], ebx
je 0x615b37
call fcn.0060f74b
test eax, eax
je 0x615b6e
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x615b40
xor eax, eax
jmp 0x615b32
push 4
call fcn.00609592
cmp eax, ebx
pop ecx
mov dword [0x7624a4], eax
je 0x615b2f
mov dword [eax], ebx
cmp dword [0x7624ac], ebx
jne 0x615b6e
push 4
call fcn.00609592
cmp eax, ebx
pop ecx
mov dword [0x7624ac], eax
je 0x615b2f
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x7624a4]
call fcn.00615a0b
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x615bcf
cmp dword [esi], ebx
je 0x615bcf
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0060947a
cmp dword [ebp - 8], ebx
pop ecx
jne 0x615bb2
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x615c10
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x615ba9
mov eax, edi
shl eax, 2
push eax
push dword [0x7624a4]
call fcn.0060b41f
cmp eax, ebx
pop ecx
pop ecx
je 0x615c10
jmp 0x615c0b
cmp dword [ebp - 8], ebx
jne 0x615c7b
cmp edi, ebx
jge 0x615bde
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x7624a4]
call fcn.0060b41f
cmp eax, ebx
pop ecx
pop ecx
je 0x615b2f
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x7624a4], eax
cmp dword [ebp + 0xc], ebx
je 0x615c65
push dword [ebp - 4]
call fcn.0060f6c0
inc eax
inc eax
push eax
call fcn.00609592
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x615c65
push dword [ebp - 4]
push esi
call fcn.00614460
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x615c5e
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0060947a
pop ecx
cmp dword [ebp - 8], ebx
je 0x615c73
push dword [ebp - 4]
call fcn.0060947a
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x615b32
push dword [ebp - 4]
call fcn.0060947a
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x615b3c
Function at 0x6177d5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x617803
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x617808
cmp eax, 1
je 0x617808
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x61780c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x672e50]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x617884
push ebx
call fcn.006177d5
test eax, eax
pop ecx
jne 0x617853
call fcn.0060b28b
mov dword [eax], 0xf
call fcn.0060b282
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0060f80c
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x617896
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x617846
inc eax
cmp eax, 0x104
ja 0x617846
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x6178ce
cmp eax, dword [ebp + 0x10]
jg 0x6178b1
mov eax, dword [ebp + 0x10]
push eax
call fcn.00609592
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x6178e3
call fcn.0060b282
mov dword [eax], 0xc
jmp 0x617846
cmp eax, dword [ebp + 0x10]
jle 0x6178e3
call fcn.0060b282
mov dword [eax], 0x22
jmp 0x617846
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.00614460
pop ecx
pop ecx
jmp 0x617848
Function at 0x617a33
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00609610
mov eax, dword [0x672e50]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00613a5f
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x617b66
push 2
push esi
push dword [ebp + 8]
call fcn.00613a5f
add esp, 0xc
cmp eax, ebx
je 0x617b66
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x617b06
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0060d750
push 0x8000
push dword [ebp + 8]
call fcn.0060c0e6
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x617abc
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.006133b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x617adc
sub edi, eax
test edi, edi
jg 0x617ab4
jmp 0x617af4
call fcn.0060b28b
cmp dword [eax], 5
jne 0x617af1
call fcn.0060b282
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0060c0e6
pop ecx
pop ecx
jmp 0x617b4e
jge 0x617b4e
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00613a5f
push dword [ebp + 8]
call fcn.006137e0
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x617b4e
call fcn.0060b282
mov dword [eax], 0xd
call fcn.0060b28b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.00613a5f
add esp, 0xc
mov eax, esi
pop edi
jmp 0x617b68
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0060f80c
leave
ret