joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c33be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0x10], 0xf
je 0x4c33d7
mov eax, 1
jmp 0x4c34e6
cmp dword [ebp + 0x10], 0
je 0x4c34e4
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
add dword [ebp + 0xc], 4
sub dword [ebp + 0x10], 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
sub edi, dword [ecx + 0xb4]
sub ebx, dword [eax + 0xb0]
mov dword [ebp - 0x10], 0x14
mov edx, dword [ebp + 8]
lea ecx, [edx + 0xac]
mov dword [ebp - 0x14], ecx
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov edi, esi
mov esi, eax
push 5
mov eax, dword [ebp - 0xc]
add eax, eax
inc eax
imul dword [ebp - 0xc]
push eax
call fcn.004c34ed
mov edx, esi
add esp, 8
add edx, edx
mov dword [ebp - 8], eax
inc edx
push 5
imul edx, esi
push edx
call fcn.004c34ed
add esp, 8
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
sub edi, dword [ecx]
push edi
call fcn.004c3510
add esp, 8
xor eax, dword [ebp - 8]
mov edi, eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x14]
sub ebx, dword [eax - 4]
push ebx
call fcn.004c3510
xor eax, dword [ebp - 4]
dec dword [ebp - 0x10]
add dword [ebp - 0x14], 0xfffffff8
add esp, 8
mov ebx, eax
cmp dword [ebp - 0x10], 0
jg 0x4c3431
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
sub dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
sub esi, dword [eax + 8]
mov dword [edx], ebx
add dword [ebp + 0x14], 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], esi
add dword [ebp + 0x14], 4
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
add dword [ebp + 0x14], 4
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
add dword [ebp + 0x14], 4
cmp dword [ebp + 0x10], 0
jne 0x4c33e1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov byte [esp], 0x4f
mov byte [esp + 2], 0x4c
mov byte [esp + 4], 0x44
mov byte [esp + 6], 0x47
mov byte [esp + 8], 0x45
mov byte [esp + 0xa], 0x45
mov byte [esp + 1], 0x4c
mov byte [esp + 3], 0x59
mov byte [esp + 5], 0x42
mov byte [esp + 7], 0x2e
mov byte [esp + 9], 0x58
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xe], 0x50
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x12], 0x53
mov byte [esp + 0x14], 0x45
mov byte [esp + 0x16], 0x45
mov byte [esp + 0xd], 0x45
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x11], 0x44
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x15], 0x58
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x1a], 0x32
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x20], 0x45
mov byte [esp + 0x22], 0x45
mov byte [esp + 0x19], 0x33
mov byte [esp + 0x1b], 0x44
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x21], 0x58
mov byte [esp + 0x23], 0
push 0
push 2
call fcn.004beccb
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c8097
xor eax, eax
jmp 0x4c81af
mov dword [esp + 0x24], 0x128
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.004bed79
add esp, 8
test eax, eax
jne 0x4c80bf
push ebx
call fcn.004bea58
pop ecx
xor eax, eax
jmp 0x4c81af
call fcn.004bebbb
cmp eax, dword [esp + 0x2c]
jne 0x4c80ce
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.004bedff
add esp, 8
test eax, eax
jne 0x4c80bf
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.004bed79
add esp, 8
test eax, eax
jne 0x4c8100
push ebx
call fcn.004bea58
pop ecx
xor eax, eax
jmp 0x4c81af
cmp esi, dword [esp + 0x2c]
jne 0x4c818d
lea edx, [esp + 0x48]
push edx
call fcn.004be401
pop ecx
lea ecx, [esp + 0x48]
push ecx
call fcn.004be3de
pop ecx
push esp
call fcn.004be401
pop ecx
lea eax, [esp + 0xc]
push eax
call fcn.004be401
pop ecx
lea edx, [esp + 0x18]
push edx
call fcn.004be401
pop ecx
push 0xc
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x50]
push eax
call fcn.004be395
add esp, 0xc
mov edi, eax
push 0xc
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.004be395
add esp, 0xc
mov ebp, eax
push 0xd
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.004be395
add esp, 0xc
test edi, edi
je 0x4c8189
test ebp, ebp
je 0x4c8189
test eax, eax
jne 0x4c818d
xor eax, eax
jmp 0x4c81af
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.004bedff
add esp, 8
test eax, eax
jne 0x4c8100
push ebx
call fcn.004bea58
pop ecx
mov eax, 1
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c8328
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4c833d
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x4c8351
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret
Function at 0x4cedc1
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff18
push ebx
push esi
cmp dword [ebp + 0xc], 0x40
jle 0x4cee1a
lea eax, [ebp - 0xe8]
push eax
call fcn.004c247f
pop ecx
lea edx, [ebp - 0xe8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call fcn.004c24aa
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
lea eax, [ebp - 0x90]
push eax
call fcn.004c2553
add esp, 8
lea edx, [ebp - 0x90]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], 0x10
xor eax, eax
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x80]
xor ebx, ebx
mov byte [edx], bl
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x4cee22
xor eax, eax
lea esi, [ebp - 0x40]
lea ecx, [ebp - 0x80]
mov edx, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jge 0x4cee4f
mov bl, byte [edx]
mov byte [ecx], bl
mov byte [esi], bl
inc eax
inc esi
inc ecx
inc edx
cmp eax, dword [ebp + 0xc]
jl 0x4cee40
xor eax, eax
lea ecx, [ebp - 0x80]
lea edx, [ebp - 0x40]
jmp 0x4cee5a
xor byte [edx], 0x36
xor byte [ecx], 0x5c
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x4cee57
lea eax, [ebp - 0xe8]
push eax
call fcn.004c247f
pop ecx
push 0x40
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.004c24aa
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, edx
lea edx, [ebp - 0xe8]
xor eax, eax
jmp 0x4cee9a
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x4cee97
lea eax, [ebp - 0xe8]
push eax
call fcn.004c247f
pop ecx
push 0x40
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.004c24aa
mov edx, dword [ebp + 0x10]
add esp, 0xc
xor eax, eax
lea ecx, [edx + 0x10]
lea edx, [ebp - 0xe8]
jmp 0x4ceedd
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x4ceeda
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d12cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x542fe0
call fcn.004fe1c4
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.004fd758
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4d1341
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x4d1341
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004fd778
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4d1341
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x4d135e
cmp dword [ebp - 0x34], 0
je 0x4d135e
mov edx, dword [ebp - 0x34]
jmp 0x4d1363
mov edx, 0x542c54
lea eax, [ebp - 4]
call fcn.0051d108
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.004fd768
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0051d3d0
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0051d3a0
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x4d13e1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e6cdc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x555ae0
cmp dword [edi], 0
jne 0x4e6d58
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x555adc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x544288
mov ecx, 2
call fcn.004f9528
mov edx, 0x4e6cb4
lea eax, [esi + 5]
call fcn.004e6cd4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004e6cd4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4e6d2d
mov dword [0x555adc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4ec52c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4ec565
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004fae20
jmp 0x4ec56e
mov eax, ebx
mov edx, esi
call fcn.004fad84
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ec578
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4ec599
mov al, byte [esp]
jmp 0x4ec59b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ecc20
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4eca98
mov eax, dword [0x5491ec]
cmp byte [eax], 0
je 0x4ecc8d
mov eax, dword [0x5491f0]
call fcn.004f98e4
call fcn.004f9494
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004e9e00
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4eccd4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x4eccc3
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x5490a4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5492bc]
call fcn.004fc47c
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x4edaf4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4edb58
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004faf98
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004e984c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edb5f
lea eax, [ebp - 0xc]
call fcn.004fad30
ret

Function at 0x4fa054
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5447cc]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4fa0ec
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4fa0cc
xor eax, eax
push ebp
push 0x4fa0c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4fa108
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa0cc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x5447cc]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5447cc], ax
mov esp, ebp
pop ebp
ret
Function at 0x4fabb4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x555e04], 0
je 0x4fac15
cmp word [0x555fd8], 0xd7b2
jne 0x4fabdd
cmp dword [0x555fe0], 0
jbe 0x4fabdd
mov eax, 0x555fd4
call dword [0x555ff0]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4fac3c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x5447dc], 0
jne 0x4fac31
push 0
push 0x544834
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x4fc670
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4fc8a0
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4fc6f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4fc8a0
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4fc6f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4fc8bc
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4fc77c
xor eax, eax
push ebp
push 0x4fc775
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004fc4b8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4fc75a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4fc8dc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4fc75a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc77c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4fc896
cmp byte [ebp - 0xd], 0
jne 0x4fc7c3
cmp byte [ebp - 0x12], 0
je 0x4fc896
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4fc7dc
dec ebx
cmp byte [ebx], 0x2e
je 0x4fc7eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4fc7db
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4fc896
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4fc828
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4fc896
cmp byte [ebp - 0xd], 0
je 0x4fc896
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4fc896
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fd048
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x556378], 1
jae 0x4fd0ce
mov byte [0x5447c8], 2
mov dword [0x555dc8], 0x51dd72
mov dword [0x555dcc], 0x51dd84
mov byte [0x555e06], 2
mov dword [0x555db4], 0x4fbca0
call fcn.004fa024
test al, al
je 0x4fd08b
call fcn.004fa054
call fcn.004fa118
mov word [0x555e0c], 0xd7b0
mov word [0x555fd8], 0xd7b0
mov word [0x5561a4], 0xd7b0
call fcn.004fbb80
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x555df8], eax
call fcn.004f7f60
mov dword [0x555df4], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x555dec], eax
ret

Function at 0x4ff0cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ff0e8
call fcn.00500890
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4ff104
test bl, 1
je 0x4ff104
call fcn.00504e70
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4ff2e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0050042c
test byte [ebp + 0xd], 0xc0
jne 0x4ff30c
mov eax, dword [0x545664]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4ff319
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4ff346
je 0x4ff358
sub ecx, 0x100
je 0x4ff366
sub ecx, 0x100
je 0x4ff36d
sub ecx, 0x100
je 0x4ff35f
jmp 0x4ff374
sub ecx, 0x600
je 0x4ff36d
sub ecx, 0x100
je 0x4ff358
jmp 0x4ff374
mov edi, 1
jmp 0x4ff379
mov edi, 2
jmp 0x4ff379
mov edi, 4
jmp 0x4ff379
mov edi, 5
jmp 0x4ff379
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4ff3a0
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5450dc]
test al, 0x80
je 0x4ff399
mov ebx, 0x80
jmp 0x4ff3b2
mov ebx, 1
jmp 0x4ff3b2
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ff3b2
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4ff3c4
je 0x4ff3cd
dec eax
je 0x4ff3d6
jmp 0x4ff3df
mov dword [ebp - 4], SysStringLen
jmp 0x4ff3ee
mov dword [ebp - 4], 0x40000000
jmp 0x4ff3ee
mov dword [ebp - 4], 0xc0000000
jmp 0x4ff3ee
push 1
call fcn.00500824
pop ecx
mov ebx, eax
jmp 0x4ff4de
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4ff40a
sub eax, 0x10
je 0x4ff411
sub eax, 0x10
je 0x4ff41a
sub eax, 0x10
je 0x4ff423
jmp 0x4ff423
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4ff42a
mov dword [ebp - 8], 1
jmp 0x4ff42a
mov dword [ebp - 8], 2
jmp 0x4ff42a
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4ff497
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4ff48c
test byte [ebp + 0xd], 1
je 0x4ff487
mov ebx, 0x50
jmp 0x4ff48c
mov ebx, 2
push ebx
call fcn.00500824
pop ecx
mov ebx, eax
jmp 0x4ff4de
mov edi, esi
push edi
call fcn.004ff24c
pop ecx
test eax, eax
je 0x4ff4ab
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4ff4b7
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0050054c
add esp, 8
mov ebx, eax
inc eax
jne 0x4ff4de
push 4
call fcn.00500824
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00500460
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ff97c
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x4ff998
call fcn.00500890
jmp 0x4ffa07
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x4ff9b4
call fcn.00500890
jmp 0x4ffa07
cmp dword [0x556d08], 1
je 0x4ffa05
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.00504cf0
pop ecx
cmp al, 0x41
jl 0x4ffa05
cmp al, 0x5a
jg 0x4ffa05
cmp byte [ebp - 0x107], 0x3a
jne 0x4ffa05
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x4ffa05
call fcn.00500890
jmp 0x4ffa07
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4ffa0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x4ffa3b
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x4ffa45
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x4ffa50
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x4ffab6
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x4ffab6
call fcn.00500890
jmp 0x4ffaf1
push edi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x4ffac6
call fcn.00500890
jmp 0x4ffaf1
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x4ffaec
push edi
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x4ffaea
cmp ebx, 1
je 0x4ffaea
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x4ffad7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret