joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432bd0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x432df0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x66f7f8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x432c0b
call fcn.0041f908
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043293c
pop ecx
lea eax, [ebp - 0x34]
call fcn.00403094
cmp dword [ebp - 0x28], 0
je 0x432c95
mov eax, dword [0x66bb38]
mov byte [eax], 1
mov eax, dword [0x66b814]
mov byte [eax], 1
push 0x432e08
lea edx, [ebp - 0x3c]
mov eax, dword [0x66f7f8]
call fcn.0042d9e0
push dword [ebp - 0x3c]
push 0x4331b0
lea ecx, [ebp - 0x40]
mov dl, 1
mov eax, dword [0x66f7f8]
call fcn.00420a9c
push dword [ebp - 0x40]
push 0x4331bc
lea eax, [ebp - 0x38]
mov edx, 5
call fcn.00406180
mov eax, dword [ebp - 0x38]
mov ecx, 0x242010
mov edx, 0x4331c8
call fcn.0042d26c
push 0xa
call sub.kernel32.dll_GetCurrentProcess
push eax
call fcn.00421e10
jmp 0x432dcd
xor eax, eax
push ebp
push 0x432d80
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [0x77545c]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x432d60
xor eax, eax
push ebp
push 0x432d59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov esi, eax
mov edi, 0x660fd0
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp - 8]
add ebx, 4
mov eax, dword [ebx]
mov edx, 4
call fcn.0041f7d4
test al, al
je 0x432d01
mov eax, dword [ebx]
mov dword [0x775458], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 0x661000
mov esi, eax
mov edi, edx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
call fcn.004325d4
mov eax, 0x660fd0
call fcn.0040354c
mov eax, dword [fcn.0042f7ac]
call fcn.0041f928
mov dword [0x774bec], eax
mov byte [0x774bea], 1
mov byte [0x774beb], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432d60
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432d87
mov eax, dword [0x77545c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x77545c], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432df7
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00405df4
lea eax, [ebp - 4]
call fcn.00407ff4
ret
Function at 0x440440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
cmp dword [0x77551c], 0
jne 0x4404a9
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x94
call fcn.0040d87c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44049f
cmp dword [ebp - 0x90], 6
jb 0x440493
mov dword [0x77551c], 1
jmp 0x4404a9
mov dword [0x77551c], 0xffffffff
jmp 0x4404a9
mov dword [0x77551c], 0xffffffff
cmp dword [0x77551c], 0
setg al
mov esp, ebp
pop ebp
ret

Function at 0x440dac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
test esi, esi
jne 0x440dc2
call fcn.00422160
mov esi, eax
xor ebx, ebx
xor ecx, ecx
push ebp
push 0x440e42
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, esi
cmp word [edx], 0x5a4d
jne 0x440e38
mov eax, edx
add eax, 0x3c
mov eax, dword [eax]
test eax, eax
je 0x440e38
mov edi, edx
add edi, eax
mov edx, dword [edi]
cmp edx, 0x4550
jne 0x440e38
lea edx, [ebp - 0x14]
add edi, 4
mov eax, edi
mov ecx, 0x14
call fcn.0040d904
test byte [ebp - 1], 0x20
je 0x440e36
push 0xa
push 0x440e58
push esi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x440e32
push 0xa
push 0x440e64
push esi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x440e32
mov bl, 3
jmp 0x440e38
mov bl, 2
jmp 0x440e38
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x440e4e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441154
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x441114
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x442094
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x442102
xor ecx, ecx
push ebp
push 0x4420fb
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4420d8
inc eax
mov byte [edx], 0x90
inc edx
dec eax
jne 0x4420d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442102
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret
Function at 0x442c24
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.00441b58
test al, al
je 0x442c6b
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x442c6b
cmp dword [eax + 0x3c], 0
je 0x442c6b
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.00441b58
test al, al
je 0x442c69
cmp dword [esi], 0x4550
je 0x442c6b
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x449120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x449172
test eax, edx
je 0x449175
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x449135
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x44915b
add ecx, 4
js 0x44914b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x449158
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x449181
test edx, edx
jne 0x449128
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x44a358
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x44a389
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x44a390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x44a3c1
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x44a448
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x44a46e
test byte [ebp - 0xc], 0x10
je 0x44a472
xor eax, eax
jmp 0x44a474
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x44a480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x44a4a6
test byte [ebp - 0xc], 0x10
jne 0x44a4aa
xor eax, eax
jmp 0x44a4ac
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x44a5e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x44b010
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x44b038
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x44e918
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x44e960
mov ecx, dword [ebp - 0x10]
dec ecx
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 8]
call fcn.00405ec0
jmp 0x44e96b
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00405e24
mov esp, ebp
pop ebp
ret 4

Function at 0x44e974
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x44e9a2
mov al, byte [ebp - 0xc]
mov byte [ebp - 0xa], al
jmp 0x44e9a8
mov al, byte [ebp - 9]
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x44f2b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x400
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0044f0fc
mov eax, dword [0x66bec8]
cmp byte [eax], 0
je 0x44f347
mov eax, dword [0x66b8e4]
call fcn.00403f28
call fcn.00403690
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x44c]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x44c]
call fcn.0044b064
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x44f38c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x44f37d
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x66b808]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x66f7f8]
call fcn.004079f8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov esp, ebp
pop ebp
ret

Function at 0x44fdec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44feca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405e68
lea eax, [ebp - 0xc]
call fcn.004062d4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040627c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44feb4
mov eax, dword [ebp - 0x10]
call fcn.00403498
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x44fead
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040627c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x44fe97
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x44fed8
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44fe97
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44feb4
mov eax, dword [ebp - 0x18]
call fcn.004034b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fed1
lea eax, [ebp - 0xc]
call fcn.00405dd0
ret
Function at 0x45212c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405dd0
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x400
jge 0x45217c
lea edx, [ebp - 0x40c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00405ec0
jmp 0x4521a5
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.0040650c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040627c
push eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret

Function at 0x4692b8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x469306
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00468fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46931f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x469328
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00468fb0
dec esi
jne 0x46934a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x46a4bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x777768
cmp dword [edi], 0
jne 0x46a538
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x777764]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x66169c
mov ecx, 2
call fcn.004037a8
mov edx, 0x46a494
lea eax, [esi + 5]
call fcn.0046a4b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0046a4b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x46a50d
mov dword [0x777764], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46bb00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test eax, eax
je 0x46bb3e
test edx, edx
je 0x46bb3e
dec edx
test edx, edx
jl 0x46bb3e
inc edx
movzx ecx, cx
shr ecx, 8
movzx ebx, byte [eax]
movzx esi, bl
xor ecx, esi
and ecx, 0xff
movzx ecx, word [ecx*2 + 0x6616d8]
movzx ebx, bl
shl ebx, 8
and bx, 0xffff
xor cx, bx
inc eax
dec edx
jne 0x46bb10
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46beb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x46beb8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c04d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x46c01b
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x46c01b
lea eax, [ebp - 8]
push eax
mov eax, 0x46c064
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
push ebp
lea eax, [ebp - 0x74]
call fcn.0046bbb8
pop ecx
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
push ebp
lea eax, [ebp - 0x78]
call fcn.0046bd34
pop ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
push ebp
lea eax, [ebp - 0x7c]
call fcn.0046bc04
pop ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
push ebp
lea eax, [ebp - 0x80]
call fcn.0046bce8
pop ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
push ebp
lea eax, [ebp - 0x84]
call fcn.0046bc50
pop ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
push ebp
lea eax, [ebp - 0x88]
call fcn.0046bd80
pop ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
push ebp
lea eax, [ebp - 0x8c]
call fcn.0046bc9c
pop ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
push ebp
lea eax, [ebp - 0x90]
call fcn.0046bdcc
pop ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
push ebp
lea eax, [ebp - 0x94]
call fcn.0046be18
pop ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
push ebp
lea eax, [ebp - 0x98]
call fcn.0046be64
pop ecx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, 0x46c078
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov eax, 0x46c078
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x70]
mov ecx, 0xc
mov eax, 0x46c08c
call fcn.0044b944
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046bb64
jmp 0x46c027
mov edx, 0x46c12c
mov eax, ebx
call fcn.0046bb64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c054
lea eax, [ebp - 0x98]
mov edx, 0xa
call fcn.00405df4
lea eax, [ebp - 8]
call fcn.00405dd0
ret
Function at 0x46d110
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00405dd0
push 0x400
lea eax, [ebp - 0x400]
push eax
mov eax, edi
call fcn.0040627c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x46d15b
lea edx, [ebp - 0x400]
mov eax, esi
mov ecx, ebx
call fcn.00405ec0
jmp 0x46d17b
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040650c
push ebx
mov eax, dword [esi]
call fcn.0040627c
push eax
mov eax, edi
call fcn.0040627c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46dfb8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00405dd0
push 0x400
lea eax, [ebp - 0x400]
push eax
mov eax, edi
call fcn.0040627c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x46e003
lea edx, [ebp - 0x400]
mov eax, esi
mov ecx, ebx
call fcn.00405ec0
jmp 0x46e023
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040650c
push ebx
mov eax, dword [esi]
call fcn.0040627c
push eax
mov eax, edi
call fcn.0040627c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46e02c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x46e048
test al, 0x10
jne 0x46e04d
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x46f574
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x452654]
call fcn.00406b00
xor eax, eax
push ebp
push 0x46f741
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6618e0], 0
jne 0x46f5ce
mov ecx, dword [0x66b5c0]
mov dl, 1
mov eax, dword [0x4480dc]
call fcn.0044f4a0
call fcn.00405728
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x10
call fcn.004040e4
mov eax, ebx
call fcn.004067b8
mov dword [ebp - 0x2c], eax
push esi
mov esi, 0x46f750
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407ff4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004067c8
test eax, eax
jle 0x46f6de
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46f6ca
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x50]
mov ecx, 0x10
call fcn.00406040
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46f65a
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00406074
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x46f67b
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x5c]
mov edx, ebx
call fcn.00406074
mov eax, dword [ebp - 0x5c]
call fcn.0040627c
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x50]
mov ecx, 0x10
call fcn.00406040
mov eax, dword [ebp - 0x60]
call fcn.0040627c
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
sete al
jmp 0x46f6cc
xor eax, eax
test al, al
je 0x46f6d7
mov ebx, 0x15
jmp 0x46f6e3
mov ebx, 0x10
jmp 0x46f6e3
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
test ebx, ebx
jns 0x46f6f6
call fcn.00404cb0
push ebx
push 0
push esi
call dword [0x6618e0]
call fcn.0046f384
mov eax, dword [ebp - 4]
call fcn.0046f384
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040800c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f748
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.00405df4
lea eax, [ebp - 0xc]
mov edx, dword [0x452654]
call fcn.00406bd0
ret