joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461920
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ced13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004c1490
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004c6b2f
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004c8188
test eax, eax
je 0x461a3c
mov ecx, dword [esp + 0x3c]
call fcn.004c6b5c
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x461a00
push edi
mov ecx, esi
call fcn.004c41c0
mov ecx, esi
call fcn.00461be0
cmp dword [esp + 0x38], 1
jne 0x461a35
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004c42fb
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x463c20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x463c53
push esi
call fcn.00471ec0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x463c4c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x463cd9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x463cc2
mov eax, dword [esi + 8]
test eax, eax
je 0x463c77
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x463cbe
cmp eax, 2
je 0x463cc2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x463c6a
cmp eax, 3
je 0x463c9d
cmp eax, 1
jne 0x463c6a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x463c6a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x463c6a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00463d00
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x463ce8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00463d00
add esp, 4
pop esi
ret

Function at 0x464580
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4645a1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4645a1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4645a1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x482c60
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x482d03
test eax, eax
jbe 0x482d03
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x482d03
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x482cae
xor esi, esi
jmp 0x482cb4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x482cdf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0041c210
add esi, eax
push esi
mov ebx, esi
call fcn.0041c210
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x482cc0
pop ebp
test edi, edi
pop edi
jne 0x482d03
test ebx, ebx
je 0x482d03
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004af1c0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x482e25
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x482f3d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x482f3d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004c18e2
mov esi, eax
test esi, esi
je 0x482f3d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x482f3d
mov ecx, esi
call fcn.00482db0
cmp edi, eax
jge 0x482f3d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x482ec3
mov dword [esp + 0x34], 1
jmp 0x482f1e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x482f3d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00482360
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x489a80
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x489ac9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x489f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cf5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00489af0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00489b70
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00489b70
lea ecx, [esi + 0xc]
call fcn.004bfe6d
lea ecx, [esi + 0x10]
call fcn.004bfe6d
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0048b100
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0048b100
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0048b100
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004bfee2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004bfee2
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x48b2f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x48b356
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x48b356
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x48b337
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x48e290
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x658e00]
xor edx, edx
cmp eax, edx
jne 0x48e2b6
xor eax, eax
mov byte [eax + 0x658d00], al
inc eax
cmp eax, 0x100
jl 0x48e29e
mov dword [0x658e00], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x658d00
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x48e347
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x48e31a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x48e2e8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x48e350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x48e3a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x48e38a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cf9be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00495670
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x52d28c
call fcn.004bfc23
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x494de3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004bfc23
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x494ddc
push 0
mov ecx, eax
call fcn.0048bec0
mov dword [esi + 0xc], eax
jmp 0x494de5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x494de5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4c2286
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c22be
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c033d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c0315
jmp 0x4c22ca
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c3978
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c39ba
call fcn.004c962e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c39ba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c39b1
xor eax, eax
jmp 0x4c39c2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c39c8
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c9b5e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c9b8c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c9baa
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c9ac4
jmp 0x4c9baa
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c9baa
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c9ac4
test edi, edi
mov eax, edi
jne 0x4c9b94
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c004]
jne 0x40100a
repz ret
jmp fcn.004013ce

Function at 0x408bb4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040568f
and dword [ebp - 4], 0
cmp dword [0x41e280], 0
mov ebx, eax
jne 0x408c65
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408d16
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408d16
push eax
call fcn.0040561d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41e280], eax
call esi
push eax
call fcn.0040561d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41e284], eax
call esi
push eax
call fcn.0040561d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41e288], eax
call esi
push eax
call fcn.0040561d
pop ecx
mov dword [0x41e290], eax
test eax, eax
je 0x408c65
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040561d
pop ecx
mov dword [0x41e28c], eax
mov eax, dword [0x41e28c]
cmp eax, ebx
je 0x408cbd
cmp dword [0x41e290], ebx
je 0x408cbd
push eax
call fcn.00405698
push dword [0x41e290]
mov esi, eax
call fcn.00405698
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408cbd
test edi, edi
je 0x408cbd
call esi
test eax, eax
je 0x408cb4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408cb4
test byte [ebp - 0xc], 1
jne 0x408cbd
or dword [ebp + 0x10], 0x200000
jmp 0x408cf6
mov eax, dword [0x41e284]
cmp eax, ebx
je 0x408cf6
push eax
call fcn.00405698
pop ecx
test eax, eax
je 0x408cf6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408cf6
mov eax, dword [0x41e288]
cmp eax, ebx
je 0x408cf6
push eax
call fcn.00405698
pop ecx
test eax, eax
je 0x408cf6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41e280]
call fcn.00405698
pop ecx
test eax, eax
je 0x408d16
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408d18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4199f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp esi, 0x19f
jne 0x419a11
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edx, edx
test esi, esi
jle 0x419a32
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
call fcn.004199eb
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edx
xor byte [eax], cl
inc edx
cmp edx, esi
jl 0x419a17
cmp esi, 0x2d
jne 0x419a48
or dword [0x4a768c], 0xffffffff
mov dword [0x4a7688], 0xa62e7790
leave
ret
Function at 0x13a628dd
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x3c], bl
lea edi, [ebp - 0x3b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
xor eax, eax
push 0x80
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 3
stosd dword es:[edi], eax
push ebx
push 1
stosd dword es:[edi], eax
push 0x80000000
push ecx
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0x17], 0x41
mov byte [ebp - 0x16], 0x58
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x4f
mov byte [ebp - 0x13], 0x56
mov byte [ebp - 0x12], 0x45
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x2d
mov byte [ebp - 0xf], 0x56
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x52
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 9], 0x77
mov byte [ebp - 8], 0x87
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
stosd dword es:[edi], eax
call fcn.13a6518c
mov esi, eax
mov dword [ebp - 0x40], esi
cmp esi, 0xffffffff
jne 0x13a62991
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x13a02598
call fcn.13a64941
pop ecx
pop ecx
jmp 0x13a629e9
push ebx
lea eax, [ebp - 0x44]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x13a629bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x13a0256c
call fcn.13a64941
pop ecx
pop ecx
push esi
jmp 0x13a629e3
cmp dword [ebp - 0x44], 0x24
jne 0x13a629e0
push 5
pop ecx
lea edi, [ebp - 0x3c]
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x13a629e0
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x13a629eb
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret 4

Function at 0x13a62a01
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x13a62a24
xor eax, eax
jmp 0x13a62a7f
push 0x40
call fcn.13a65818
test eax, eax
je 0x13a62a20
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x13a0266c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x13a62a67
cmp eax, esi
ja 0x13a62a67
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 8
push eax
push edi
call dword [sym.imp.USER32.dll_WinHelpW]
xor eax, eax
jmp 0x13a62a7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x13a02620
call fcn.13a64941
pop ecx
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.13a619a5
leave
ret 8
Function at 0x13a62a93
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x13a6e0f4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x13a6e004]
mov esi, 0x13a6e004
mov ebx, 0x13a0255c
cmp eax, esi
je 0x13a62b00
test byte [eax + 0x1c], 2
je 0x13a62b00
cmp byte [eax + 0x19], 5
jb 0x13a62b00
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a58cc1
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x214], eax
test eax, eax
jge 0x13a62b51
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a62b48
test byte [eax + 0x1c], 2
je 0x13a62b48
cmp byte [eax + 0x19], 2
jb 0x13a62b48
push dword [ebp - 0x214]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
movzx eax, word [ebp - 0x214]
jmp 0x13a62b91
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.13a66477
mov edi, eax
test edi, edi
jge 0x13a62b9a
mov eax, dword [0x13a6e004]
cmp eax, esi
je 0x13a62b8e
test byte [eax + 0x1c], 2
je 0x13a62b8e
cmp byte [eax + 0x19], 2
jb 0x13a62b8e
movzx ecx, di
push ecx
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.13a5a529
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x13a62ba4
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.13a619a5
leave
ret 0xc
Function at 0x408963
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ecx
call fcn.00408991
sub ebx, 0x436086c9
xor dword [esi], ecx
inc esi
and ebx, ebx
sub esp, 4
mov dword [esp], 0x94efa3b4
mov ebx, dword [esp]
add esp, 4
cmp esi, edx
jne fcn.00408963
and edi, edi
dec edi
ret
Function at 0x402110
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x460]
push edi
mov edi, dword [esp + 0x18]
add ebx, edi
xor ecx, ecx
cmp eax, 1
mov dword [esi + 8], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
je 0x402140
cmp eax, 2
jne 0x4021d1
lea eax, [esp + 0xc]
push eax
push edi
push ebx
mov ecx, esi
call section..text
test al, al
je 0x4021bf
mov ecx, esi
call fcn.00401cc0
test al, al
je 0x402205
cmp dword [esi + 0x460], 4
je 0x40222f
cmp dword [esi + 0x24], 8
jb 0x402179
mov eax, dword [esi + 0x10]
jmp 0x40217c
lea eax, [esi + 0x10]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4021af
pop edi
mov dword [esi + 0x464], 6
pop esi
xor al, al
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x460], 3
jmp 0x4021d1
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x4021d1
mov dword [esi + 0x460], 2
cmp dword [esi + 0x460], 3
jne 0x40222f
mov eax, dword [esi]
push 0
lea edx, [esp + 0x1c]
push edx
sub edi, ecx
push edi
add ecx, ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40220e
mov ecx, esi
mov dword [esi + 0x464], 7
call fcn.004019c0
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 8
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 4]
jne 0x40222f
mov ecx, esi
call fcn.004019c0
mov dword [esi + 0x460], 5
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret 8