joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4485f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ecx
ret

Function at 0x449994
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
call fcn.0040c968
mov dword [esp], eax
push dword [esp + 0x24]
lea eax, [esp + 4]
call fcn.0040ca74
push dword [esp + 0x28]
push dword [esp + 0x28]
lea eax, [esp + 0x18]
call fcn.0044f040
lea eax, [esp + 0x10]
call fcn.0044f0ac
xor al, 1
je 0x4499f3
lea eax, [esp + 0x10]
call fcn.0044f0c8
push eax
lea eax, [esp + 4]
call fcn.00410e98
lea eax, [esp + 0x10]
call fcn.0044f1e0
lea eax, [esp + 0x10]
call fcn.0044f0ac
xor al, 1
jne 0x4499ca
lea eax, [esp]
call fcn.0040cab0
add esp, 0x20
ret 8

Function at 0x449f48
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0044fb68
xor al, 1
je 0x449f83
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0044bb68
push eax
mov eax, ebx
call fcn.0040cda0
lea eax, [esp + 8]
call fcn.0044bb84
lea eax, [esp + 8]
call fcn.0044fb68
xor al, 1
jne 0x449f58
pop ebx
ret 8

Function at 0x44b30c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.00432f34
xor al, 1
je 0x44b343
lea eax, [esp + 8]
call fcn.00432f98
push eax
mov eax, ebx
call fcn.00410e98
lea eax, [esp + 8]
call fcn.00432f58
lea eax, [esp + 8]
call fcn.00432f34
xor al, 1
jne 0x44b31c
pop ebx
ret 0x1c

Function at 0x44c938
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esi], 0
mov eax, dword [ebx]
call fcn.00439214
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edi, eax
cmp eax, 0xea
je 0x44c99c
mov eax, edi
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret 0xc
mov dword [esp + 8], ebx
mov ecx, dword [ebx]
add ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0x4805f0
call fcn.0042b634
mov eax, dword [ebx]
call fcn.00439214
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edi, eax
cmp eax, 0xea
jne 0x44c984
jmp 0x44c99c
Function at 0x44c9e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], esi
mov esi, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esi], 0
mov eax, dword [ebx]
call fcn.00439214
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumValueW
mov edi, eax
cmp eax, 0xea
je 0x44ca44
mov eax, edi
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret 0xc
mov dword [esp + 8], ebx
mov ecx, dword [ebx]
add ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], 0x4805f0
call fcn.0042b634
mov eax, dword [ebx]
call fcn.00439214
push 0
push 0
push 0
push 0
push esi
mov dword [esi], eax
push dword [ebx + 4]
push ebp
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegEnumValueW
mov edi, eax
cmp eax, 0xea
jne 0x44ca2c
jmp 0x44ca44

Function at 0x44e828
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.0040b29c
xor al, 1
je 0x44e84f
inc ebx
lea eax, [esp + 8]
call fcn.0040ae34
lea eax, [esp + 8]
call fcn.0040b29c
xor al, 1
jne 0x44e838
mov eax, ebx
pop ebx
ret 8
Function at 0x450cf8
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0040b29c
xor al, 1
je 0x450d33
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0040ad38
push eax
mov eax, ebx
call fcn.00456d88
lea eax, [esp + 8]
call fcn.0040ae34
lea eax, [esp + 8]
call fcn.0040b29c
xor al, 1
jne 0x450d08
pop ebx
ret 8

Function at 0x4512ac
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.00456e10
lea esi, [esp + 0x30]
lea edi, [esp + 0x18]
mov dword [esp + 8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
call fcn.00451158
xor al, 1
je 0x451303
lea eax, [esp + 0x18]
call fcn.004510f8
push edx
push eax
lea eax, [esp + 0x10]
call fcn.00456e44
lea eax, [esp + 0x18]
call fcn.00451170
lea eax, [esp + 0x18]
call fcn.00451158
xor al, 1
jne 0x4512d9
lea eax, [esp + 8]
call fcn.00457070
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 0x2c
ret 0x14
Function at 0x452bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], edi
mov edi, 0xffff
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov esi, dword [ecx]
cmp esi, dword [esp + 0x30]
jae 0x452dc3
mov ecx, dword [esp + 0x34]
movzx ebx, byte [ecx + esi]
test bl, 0x80
je 0x452d5d
mov byte [esp + 0x24], bl
mov edx, 1
movzx ecx, byte [esp + 0x24]
mov ebx, ecx
mov al, bl
mov cl, dl
shl al, cl
test al, 0x80
jne 0x452c52
mov bl, byte [esp + 0x24]
cmp edx, 1
je 0x452d7b
jmp 0x452c5e
inc edx
cmp edx, 4
ja 0x452d7b
jmp 0x452c39
mov ecx, 7
mov edi, 1
sub ecx, edx
shl edi, cl
dec edi
movzx ecx, bl
and edi, ecx
lea ecx, [edx + esi - 1]
cmp ecx, dword [esp + 0x30]
jae 0x452d7b
lea ecx, [esi + 1]
cmp ecx, dword [esp + 0x30]
jae 0x452deb
mov ecx, dword [esp + 0x34]
add ecx, esi
movzx eax, byte [ecx + 1]
mov cl, bl
and cl, 0xfe
cmp cl, 0xc0
je 0x452d7b
cmp bl, 0xe0
jne 0x452cbb
mov cl, al
and cl, 0xe0
cmp cl, 0x80
je 0x452d7b
cmp bl, 0xf0
jne 0x452cce
mov cl, al
and cl, 0xf0
cmp cl, 0x80
je 0x452d7b
cmp bl, 0xf8
jne 0x452ce1
mov cl, al
and cl, 0xf8
cmp cl, 0x80
je 0x452d7b
cmp bl, 0xfc
jne 0x452cf4
mov cl, al
and cl, 0xfc
cmp cl, 0x80
je 0x452d7b
mov ebx, 1
cmp edx, ebx
je 0x452d35
lea ecx, [ebx + esi]
cmp ecx, dword [esp + 0x30]
jae 0x452e13
lea ecx, [ebx + esi]
mov eax, dword [esp + 0x34]
movzx ecx, byte [ecx + eax]
mov byte [esp + 0x24], cl
and cl, 0xc0
cmp cl, 0x80
jne 0x452d7b
mov cl, byte [esp + 0x24]
shl edi, 6
inc ebx
and ecx, 0x3f
or edi, ecx
cmp ebx, edx
jne 0x452cfd
cmp edi, 0xd800
jb 0x452d4f
lea ecx, [edi - 0xe000]
cmp ecx, 0x101fff
jbe 0x452d4f
xor ecx, ecx
jmp 0x452d54
mov ecx, 1
xor cl, 1
jne 0x452d7b
add esi, edx
jmp 0x452d61
movzx edi, bl
inc esi
mov edx, dword [esp + 0x28]
mov eax, edi
mov dword [edx], esi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x2c
ret 8
mov ecx, 0x47cf50
mov ebx, 0x17
mov edx, 0x4856a0
mov dword [esp + 0x14], 0x124
mov eax, 0x16
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00433554
mov eax, edi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x2c
ret 8
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xdf
mov dword [esp], 0x47cf50
call fcn.0041bd28
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x107
mov dword [esp], 0x47cf50
call fcn.0041bd28
mov dword [esp + 8], 0
mov edx, dword [esp + 0x30]
lea ecx, [esi + ebx]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x111
mov dword [esp], 0x47cf50
call fcn.0041bd28
int3
Function at 0x453f18
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x10], esi
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], edi
mov dword [esp + 4], 0x300
mov dword [esp], 1
call fcn.004688d4
test eax, eax
mov dword [esi + 0xc], eax
jne 0x453f4d
call fcn.00457e1c
mov ebx, dword [esi + 0xc]
mov ecx, 0xc0
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
lea ebp, [ebx + 0x88]
push ebp
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov edx, dword [ebp + 4]
mov eax, dword [ebp]
imul edx, edx, 0xdeece66d
lea ecx, [eax + eax*4]
add ecx, edx
mov edx, 0xdeece66d
mul edx
add edx, ecx
add eax, 0xb
adc edx, 0
and edx, 0xffff
mov dword [ebp + 4], edx
lea edx, [ebx + 0x98]
mov dword [ebp], eax
mov dword [esp + 0x18], edx
push edx
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 4]
imul edx, edx, 0xdeece66d
mov eax, dword [ecx]
lea edi, [eax + eax*4]
add edi, edx
mov edx, 0xdeece66d
mul edx
add edx, edi
add eax, 0xb
adc edx, 0
and edx, 0xffff
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor ecx, ecx
mov dword [ebx + 0xf0], 0
mov dword [ebx + 0xf8], ecx
fld dword [ebx + 0xf0]
mov dword [ebx + 0xf4], ecx
fstp dword [ebx + 0xec]
mov dword [ebx + 0xfc], ecx
cmp dword [0x47e57c], ecx
je 0x454015
mov ebx, dword [0x47e57c]
shl ebx, 0x14
mov eax, dword [esi + 0xc]
push ebx
call fcn.004588f0
cmp byte [0x47e570], 0
je 0x454027
mov edx, dword [esi + 0xc]
inc dword [edx + 0xa0]
mov eax, esi
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esp, 0x1c
ret

Function at 0x45725c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0045e2f0
xor al, 1
je 0x457297
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0044bb68
push eax
mov eax, ebx
call fcn.0040cda0
lea eax, [esp + 8]
call fcn.0044bb84
lea eax, [esp + 8]
call fcn.0045e2f0
xor al, 1
jne 0x45726c
pop ebx
ret 8

Function at 0x457e1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, eax
call fcn.00439748
mov dword [esp], eax
call fcn.0041de30
Function at 0x460b50
Capabilities:
Resume thread

Disassembly:
sub esp, 0x38
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov dword [esp], 8
call fcn.00465f7c
mov ecx, eax
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
mov edx, dword [esp + 0x28]
mov dword [ecx + 4], edx
mov dword [esp + 0x2c], 0
cmp byte [0x49c278], 0
jne 0x460bd4
lea ebx, [esp + 0x2c]
mov esi, 0x460ccc
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call fcn.00468308
test eax, eax
mov dword [esp + 0x34], eax
jne 0x460be8
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x38
xor eax, eax
ret 0x14
mov edx, 0x49c25c
push edx
call sub.KERNEL32.DLL_EnterCriticalSection
inc dword [0x49c248]
mov eax, dword [0x49c248]
lea ecx, [eax + eax*2]
lea ecx, [ecx*4]
mov dword [esp + 4], ecx
mov ebx, dword [0x49c24c]
mov dword [esp], ebx
call fcn.00465f38
mov dword [0x49c24c], eax
mov edx, dword [0x49c248]
lea edi, [edx + edx*2]
lea edi, [edi*4]
add edi, eax
mov esi, dword [esp + 0x2c]
mov dword [edi - 0xc], esi
mov ecx, dword [0x49c248]
lea ebx, [ecx + ecx*2]
lea ebx, [ebx*4]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
add ebx, dword [0x49c24c]
mov dword [ebx - 8], eax
mov dword [ebx - 4], edx
push dword [esp + 0x34]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x460c89
mov edx, 0x4790e0
mov esi, 0x15
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.00430838
push dword [esp + 0x34]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp + 0x40]
or eax, dword [esp + 0x3c]
je 0x460ca1
call fcn.004631b4
mov ecx, dword [esp + 0x2c]
mov ebx, 0x49c25c
mov dword [esp + 0x30], ecx
push ebx
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x38
ret 0x14

Function at 0x460f54
Capabilities:
Terminate thread

Disassembly:
push eax
push eax
mov dword [esp], ebx
push dword [esp + 4]
push 0
push 0x10004a
call sub.KERNEL32.DLL_OpenThread
mov ebx, eax
test eax, eax
jne 0x460f76
mov ebx, dword [esp]
add esp, 8
ret
cmp byte [0x49c278], 0
je 0x460f91
push 1
push ebx
call sub.KERNEL32.DLL_TerminateThread
push 0xa
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
jmp 0x460f99
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov ebx, dword [esp]
add esp, 8
ret

Function at 0x461a44
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.00437d40
xor al, 1
je 0x461a6b
inc ebx
lea eax, [esp + 8]
call fcn.00437d5c
lea eax, [esp + 8]
call fcn.00437d40
xor al, 1
jne 0x461a54
mov eax, ebx
pop ebx
ret 0x44
Function at 0x462334
Capabilities:
Resume thread

Disassembly:
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov ecx, dword [edi + 0xc]
push ecx
call sub.KERNEL32.DLL_GetCurrentThreadId
pop ecx
cmp ecx, eax
je 0x462393
push dword [edi + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x462393
mov eax, edi
call fcn.004289dc
xor al, 1
je 0x462386
mov eax, edi
call fcn.00428c80
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x10
ret
mov edx, 0x48a490
push edx
push 0x17
call fcn.00430838
movsx ebx, byte [edi + 0x4c]
xor bl, 1
je 0x4623a4
mov esi, dword [edi + 0x48]
mov ecx, dword [esi]
mov dword [esi + 4], ecx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0xc]
mov ecx, 8
xor eax, eax
add edi, 0x54
rep stosd dword es:[edi], eax
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x10
ret
Function at 0x464384
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.00437d40
xor al, 1
je 0x4643bb
lea eax, [esp + 8]
call fcn.00437d50
push eax
mov eax, ebx
call fcn.00410e98
lea eax, [esp + 8]
call fcn.00437d5c
lea eax, [esp + 8]
call fcn.00437d40
xor al, 1
jne 0x464394
pop ebx
ret 0x44

Function at 0x46547c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x48a6c4
push 0x46a34c
push edx
mov dword fs:[0], esp
sub esp, 8
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
jmp 0x4654ca
call fcn.0046a880
mov eax, esp
mov dword [0x49e92c], eax
call fcn.0046a9f4
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x49e934], eax
call fcn.0046a9d8
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x49e930], eax
call fcn.00465d18
call fcn.0046a8c0
call fcn.0046a594
call fcn.00468200
push 0
push dword [0x48b59c]
push dword [0x48b0e9]
push dword [0x48b0e5]
call fcn.0041bd10
add esp, 0x10
push eax
call fcn.004688f0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x468308
Capabilities:
Create thread
Resume thread

Disassembly:
push eax
push eax
push ebx
push esi
push edi
mov dword [0x48bc90], 1
push 0x48bc98
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
xor ebx, ebx
mov eax, dword [0x49e938]
cmp dword [eax + ebx*4], 0
je 0x468338
inc ebx
cmp ebx, 0x400
jb 0x468324
cmp ebx, 0x400
jne 0x46834e
push 0xb
call fcn.0046ad7c
xor ebx, ebx
jmp 0x4683e7
push 1
push 0x2a8
call fcn.004688d4
add esp, 8
mov esi, eax
test eax, eax
jne 0x46836e
push 0xc
call fcn.0046ad7c
xor ebx, ebx
jmp 0x4683e7
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x28]
or edx, 4
push ecx
push edx
push dword [esp + 0x2c]
push 0x4683fc
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test eax, eax
jne 0x4683ad
push esi
call fcn.00465f1c
call fcn.0046b73c
xor ebx, ebx
add esp, 4
jmp 0x4683e7
test dword [esp + 0x28], 4
mov ecx, dword [0x49e938]
mov dword [ecx + ebx*4], esi
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0x1c], edi
jne 0x4683e5
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ebx, edi
push 0x48bc98
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x468794
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
je 0x4687f1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x4687f1
lea ecx, [edi + 1]
push ecx
call fcn.00465f7c
add esp, 4
mov ebx, eax
test eax, eax
je 0x4687f1
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jne 0x4687de
push ebx
call fcn.00465f1c
xor ebx, ebx
add esp, 4
jmp 0x4687f1
push ebx
push esi
call fcn.0046c10c
add esp, 4
push eax
call fcn.004686a4
add esp, 8
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x46bcc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0x3c
jae 0x46bd0a
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x46bd06
test byte [ebx + 0x48a6dc], 0x10
jne 0x46bd1b
mov edx, dword [ebp + 0xc]
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x48a718]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x46bd0a
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x46bd01
push 9
call fcn.0046ad7c
mov eax, 0xffffffff
jmp 0x46bd01
push esi
push edi
mov edi, dword [ebp + 0xc]
and byte [ebx + 0x48a6dc], 0xfe
cld
push ds
pop es
mov edx, edi
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x48a718]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x46bdf9
mov eax, dword [ebp - 8]
add edx, eax
cmp eax, ecx
je 0x46bd5e
or byte [ebx + 0x48a6dc], 1
mov ecx, eax
or ecx, ecx
je 0x46bea0
push edi
mov al, 0x1a
repne scasb al, byte es:[edi]
je 0x46bdc8
pop edi
mov ecx, edx
sub ecx, edi
mov al, 0xd
xor esi, esi
repne scasb al, byte es:[edi]
jne 0x46bea0
cmp edi, edx
jae 0x46be0d
cmp byte [edi], 0xa
jne 0x46bd76
mov esi, edi
mov dword [ebp - 4], edi
dec dword [ebp - 4]
mov ecx, edx
sub ecx, edi
mov al, 0xd
repne scasb al, byte es:[edi]
jne 0x46be6a
cmp edi, edx
jae 0x46be0d
cmp byte [edi], 0xa
jne 0x46bd99
mov ecx, edi
dec ecx
sub ecx, esi
mov eax, edi
mov edi, dword [ebp - 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
mov edi, eax
inc esi
jmp 0x46bd93
dec edi
test byte [ebx + 0x48a6dc], 8
jne 0x46bdeb
sub edx, edi
push 1
push 0
push edx
push dword [ebx*4 + 0x48a718]
call sub.KERNEL32.DLL_SetFilePointer
cmp ax, 0xffff
je 0x46bdf9
or byte [ebx + 0x48a6dc], 1
mov edx, edi
jmp 0x46bd6d
push 9
call fcn.0046ad7c
mov eax, 0xffffffff
jmp 0x46bea5
test byte [ebx + 0x48a6dc], 1
jne 0x46be6a
dec edx
mov ecx, 1
push ecx
push edx
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push dword [ebx*4 + 0x48a718]
call sub.KERNEL32.DLL_ReadFile
pop edx
pop ecx
or eax, eax
je 0x46bdf9
mov eax, dword [ebp - 8]
or eax, eax
je 0x46be63
cmp byte [edi - 1], 0xa
je 0x46be6a
mov byte [edi - 1], 0xd
push 1
push 0
push 0xffffffffffffffff
push dword [ebx*4 + 0x48a718]
call sub.KERNEL32.DLL_SetFilePointer
cmp ax, 0xffff
je 0x46bdf9
jmp 0x46be6a
or byte [ebx + 0x48a6dc], 1
cmp esi, 0
je 0x46bea0
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebx + 0x48a6dc], 8
jne 0x46bea0
mov ecx, esi
sub ecx, edi
je 0x46bea0
test byte [ebx + 0x48a6dc], 1
je 0x46bd2a
mov eax, edi
sub eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403203
pop dword [ebp - 0x2c]
mov eax, 0x20ab2e1a
add eax, 0xdf9503e9
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6a7cb4d8
add dword [ebp - 0x3c], 0xe3d59073
mov dword [ebp - 0x38], 0x2285368d
add dword [ebp - 0x38], 0xfae15b8
mov dword [ebp - 0x34], 0x7a67c847
add dword [ebp - 0x34], 0xd1e47be7
mov dword [ebp - 0x30], 0x2e40eff5
add dword [ebp - 0x30], 0xd1bf100b
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x9a7b92f7
sub eax, 0x9a3b2293
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x306ad680
add dword [ebp - 0x3c], 0x440792d6
mov dword [ebp - 0x38], 0x579d3f13
sub dword [ebp - 0x38], 0x1630dd9e
mov dword [ebp - 0x34], 0x6abeb1b
add dword [ebp - 0x34], 0x5cc38151
mov dword [ebp - 0x30], 0x4995a472
sub dword [ebp - 0x30], 0x4995a472
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x36051
push 0
call eax
mov ecx, 0x45b4
mov edi, eax
mov esi, 0x99900238
sub esi, 0x994f0238
add esi, dword [ebp - 0x2c]
mov ebx, 0xaedee8a3
add ebx, 0x3ea7917f
xor dword [ebp - 0x20], edx
mov edx, dword [esi]
xor dword [ebp - 4], 0x4cf0a071
add edx, ebx
sub dword [ebp - 0x10], 0x9284e6bf
mov dword [edi], edx
add dword [ebp - 0x18], 0x6a64102a
add edi, 4
add esi, 4
loop 0x40331a
add eax, 0xcddb8c75
add eax, 0x32257d2e
xor ebx, ebx
add ebx, eax
add eax, 0x14fbe24c
sub eax, 0x14fbe247
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret