joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4daca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5ce9b4], 0x12c
push ebx
push esi
push edi
mov esi, ecx
jg 0x4dad61
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.00507ff9
add esp, 0xc
lea edi, [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4dad30
cmp dword [ebp - 4], 0
jne 0x4dad30
cmp byte [esi + 0x48], 0
lea eax, [ebp - 4]
je 0x4dacf5
push eax
push edi
call fcn.00507ff9
pop ecx
pop ecx
test al, al
jne 0x4dad08
jmp 0x4dad30
push 0x493e0
push eax
push edi
call fcn.00523748
add esp, 0xc
test al, al
je 0x4dad61
and dword [0x5ce9b4], 0
mov ebx, dword [esi + 0x14]
mov byte [esi + 0x48], 1
test ebx, ebx
je 0x4dad30
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x55e434]
mov ecx, ebx
call esi
test al, al
jne 0x4dad5c
cmp dword [edi], 0xffffffff
je 0x4dad45
cmp dword [ebp - 4], 0
jne 0x4dad5c
push edi
call fcn.00507ff9
or dword [edi], 0xffffffff
pop ecx
cmp dword [ebp - 4], 0
je 0x4dad5c
inc dword [0x5ce9b4]
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pop edi
pop esi
pop ebx
leave
ret
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x507ff9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x508008
pop dword [ebp - 8]
mov eax, 0x55fb7bec
sub eax, 0x55aafbe4
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x8924f
push 0
mov eax, 0x4bb49bb1
sub eax, 0x4b5eb8a9
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xdd4f1fa4
add ecx, 0x22b121b1
mov edi, eax
mov ebx, 0xa30000
add ebx, dword [ebp - 8]
mov edx, 0xe3691554
sub edx, 0x9f22a05e
sub dword [ebp - 4], 0x355514a0
mov esi, dword [ebx]
mov dword [ebp - 4], 0x1390b4c1
xor esi, edx
mov dword [edi], esi
sub dword [ebp - 4], eax
add edi, 0x1b074f40
sub edi, 0x1b074f3c
add ebx, 0xea24afc2
sub ebx, 0xea24afbe
loop 0x508061
add eax, 0xf827
mov ebx, eax
add eax, 0x1927f936
add eax, 0xe6d806cf
mov ecx, 0x13aa40a0
add ecx, 0xec95bf60
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4028c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
push 0x18
mov dword [ebp - 4], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0xc8
call fcn.00408f50
mov esi, eax
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 8], esi
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 4], 0xc8
mov byte [esi + 8], 0
mov dword [esi], vtable.HidCH9326.0
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0x1f001f
mov dword [esi + 4], 0xc8
call dword [sym.imp.CH9326DLL.DLL_CH9326DllInt]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x14], eax
push 0x38
mov dword [ebx + 8], esi
call fcn.00408f50
push 0x38
mov ebx, eax
push 0
push ebx
mov dword [ebp - 8], ebx
call fcn.0040b580
add esp, 0x10
mov dword [ebx + 4], 0xc8
mov byte [ebx + 8], 0
mov dword [ebx], vtable.HidClass.0
mov dword [ebx + 0xc], 0
push 0x466658
mov dword [ebx + 4], 0xc8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.SetFeature
push edi
call esi
push str.GetFeature
push edi
mov dword [ebx + 0x10], eax
call esi
push str.OpenFirstHIDDevice
push edi
mov dword [ebx + 0x14], eax
call esi
push str.OpenNextHIDDevice
push edi
mov dword [ebx + 0x18], eax
call esi
push str.CloseHIDDevice
push edi
mov dword [ebx + 0x1c], eax
call esi
mov dword [ebx + 0x20], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 4]
movups xmmword [ebx + 0x24], xmm0
pop edi
mov dword [ebx + 0x34], 0
pop esi
mov dword [eax + 0xc], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c800
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor al, al
mov dword [ebp - 4], 0
mov byte [ebp - 0x221], al
xor edi, edi
cmp edi, 2
jge 0x402b2f
mov ecx, dword [ebx + edi*4 + 8]
mov dword [ebx], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x402b1b
push 0x205
lea eax, [ebp - 0x219]
push 0
push eax
call fcn.0040b580
xor eax, eax
mov word [ebp - 0x220], 0x15aa
add esp, 0xc
mov dword [ebp - 0x21d], eax
mov byte [ebp - 0x21e], 0xea
lea eax, [ebp - 0x220]
xor dl, dl
mov esi, 7
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
xor cl, dl
movzx ecx, cl
mov dl, byte [ecx + 0x466528]
sub esi, 1
jne 0x402ae0
push esi
push esi
push esi
lea eax, [ebp - 0x220]
mov byte [ebp - 0x219], dl
push eax
mov ecx, ebx
mov dword [ebp - 0x18], 8
call fcn.00402d40
test al, al
je 0x402b1b
mov al, 1
jmp 0x402b2f
mov al, byte [ebp - 0x221]
inc edi
jmp 0x402a84
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret
Function at 0x402b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x205
lea eax, [ebp - 0x655]
mov edi, ecx
push 0
push eax
call fcn.0040b580
xor eax, eax
mov word [ebp - 0x65c], 0x14aa
add esp, 0xc
mov dword [ebp - 0x659], eax
mov byte [ebp - 0x65a], 0xeb
lea edx, [ebp - 0x65c]
xor al, al
mov esi, 7
movzx ecx, byte [edx]
lea edx, [edx + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x466528]
sub esi, 1
jne 0x402ba2
mov byte [ebp - 0x655], al
mov ecx, edi
push 0xa
lea eax, [ebp - 0x660]
mov dword [ebp - 0x454], 8
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.00402d40
pop edi
pop esi
test al, al
jne 0x402bfa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x450]
push eax
push str._s_r_n
call fcn.004015e0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
call fcn.00408f20
mov esp, ebp
pop ebp
ret

Function at 0x402c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str._SetTIME_:_2019_01_01_00:00:00_]
mov ax, word [0x4662c4]
push ebx
movups xmmword [ebp - 0x684], xmm0
mov word [ebp - 0x664], ax
lea eax, [ebp - 0x684]
movups xmm0, xmmword [0x4662b4]
push esi
push edi
mov ebx, ecx
lea edx, [eax + 1]
movups xmmword [ebp - 0x674], xmm0
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c70
sub eax, edx
push 0x205
push 0
lea edi, [eax + 1]
lea eax, [ebp - 0x655]
push eax
call fcn.0040b580
xor eax, eax
mov word [ebp - 0x65c], 0x16aa
mov word [ebp - 0x659], ax
lea eax, [ebp - 0x684]
push edi
push eax
lea eax, [ebp - 0x655]
mov byte [ebp - 0x65a], 0xe9
push eax
mov word [ebp - 0x657], di
call fcn.0040b000
movzx esi, word [ebp - 0x657]
lea edx, [ebp - 0x65c]
add esp, 0x18
xor al, al
add esi, 7
je 0x402cf7
nop word [eax + eax]
movzx ecx, al
lea edx, [edx + 1]
movzx eax, byte [edx - 1]
xor ecx, eax
mov al, byte [ecx + 0x466528]
sub esi, 1
jne 0x402ce0
mov byte [ebp + edi - 0x655], al
mov ecx, ebx
lea eax, [edi + 8]
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x660]
push 0xa
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.00402d40
mov ecx, dword [ebp - 4]
test al, al
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00408f20
mov esp, ebp
pop ebp
ret
Function at 0x402d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 9], 0
mov ecx, dword [eax]
push dword [edx + 0x208]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x402df7
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
push 0x46c330
mov ecx, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x402df7
mov esi, dword [ebp - 8]
cmp esi, 4
jl 0x402df7
cmp byte [0x46c330], 0x55
jne 0x402df7
movzx edi, word [0x46c335]
lea eax, [esi - 8]
cmp edi, eax
jl 0x402df7
xor al, al
mov edx, 0x46c330
add esi, 0xffffffff
je 0x402de6
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
movzx eax, al
xor ecx, eax
mov al, byte [ecx + 0x466528]
sub esi, 1
jne 0x402dd0
cmp al, byte [edi + 0x46c337]
jne 0x402df7
cmp byte [0x46c331], 0
je 0x402e17
mov eax, dword [ebp - 0x10]
inc ebx
mov eax, dword [eax + 4]
add eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, dword [ebp + 0x14]
jge 0x402e49
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x402d70
mov eax, dword [ebp - 0x18]
mov bl, 1
test eax, eax
je 0x402e34
mov ecx, dword [ebp - 0x1c]
push edi
push 0x46c337
push eax
mov dword [ecx], edi
call fcn.0040b000
add esp, 0xc
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00408f20
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4043c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
cmp dword [eax + 0xc], 0
jne 0x4043f3
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [ebp + 0xc]
mov al, 1
push edi
xor edi, edi
mov byte [ebp - 0x1d], al
test esi, esi
jle 0x4044b4
push ebx
mov edx, 0x1d
mov dword [ebp - 0xc], 0
cmp esi, edx
mov dword [ebp - 8], 0
mov ebx, esi
mov byte [0x46c7a0], 0
cmova ebx, edx
lea eax, [ecx + edi]
xorps xmm0, xmm0
push ebx
push eax
movups xmmword [0x46c780], xmm0
push 0x46c782
movups xmmword [ebp - 0x1c], xmm0
mov byte [0x46c781], bl
movups xmmword [0x46c790], xmm0
call fcn.0040b000
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x24]
push 0x21
push 0x46c780
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x24]
push 0xffffffffffffffff
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40449b
sub esi, ebx
add edi, ebx
test esi, esi
jle 0x4044b0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x28]
jmp 0x404408
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret 8
mov al, byte [ebp - 0x1d]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00408f20
mov esp, ebp
pop ebp
ret 8

Function at 0x4044d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
cmp dword [edi + 0xc], 0
jne 0x404507
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret 8
push ebx
xor bl, bl
mov dword [esi], 0
lea eax, [edi + 0x24]
push eax
lea eax, [ebp - 8]
push eax
push 0x21
push 0x46c7a4
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [edi + 4]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x404543
cmp eax, 0x102
jne 0x404567
mov bl, 1
jmp 0x404567
movsx eax, byte [0x46c7a5]
push eax
mov eax, dword [esi]
add eax, dword [ebp - 0xc]
push 0x46c7a6
push eax
call fcn.0040b000
movsx eax, byte [0x46c7a5]
add esp, 0xc
add dword [esi], eax
cmp dword [esi], 0x44c
jg 0x404576
lea eax, [edi + 0x24]
test bl, bl
je 0x404513
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00408f20
mov esp, ebp
pop ebp
ret 8
Function at 0x40e700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0040e320
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e732
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44e174]
call dword [ebp - 8]
jmp 0x40e73c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x42ef20
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e730
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ef54
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44e174]
call dword [ebp - 8]
jmp 0x42ef5a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x42efb0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e770
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42efe4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44e174]
call dword [ebp - 8]
jmp 0x42efee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x42f000
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e790
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f038
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x44e174]
call dword [ebp - 8]
jmp 0x42f046
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x42f050
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0042e810
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f090
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44e174]
call dword [ebp - 8]
jmp 0x42f0ae
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042f2a0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x434a40
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0044be30
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x46c000]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x434c18
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x434b67
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x434b67
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x434b45
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x434ac9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434bd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x434c38
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x434c13
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x434c38
jmp 0x434aa2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret
Function at 0x434c50
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0044be30
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x46c000]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x434e3b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x434d86
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x434d86
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x434d62
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x434cd9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434df4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x434e5b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x434e36
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x434e5b
jmp 0x434cb2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f20
mov esp, ebp
pop ebp
ret
Function at 0x43e360
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0040fdf0
lea ecx, [ebp - 4]
call fcn.0043e330
movzx eax, al
test eax, eax
jne 0x43e39d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0043e270
mov eax, dword [ebp - 0x18]
jmp 0x43e4c5
lea ecx, [ebp - 4]
call fcn.0040f9f0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043e2f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0040f9f0
push eax
push 0
push 0
call fcn.0043b3b0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43e403
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.0043e270
mov eax, dword [ebp - 0x20]
jmp 0x43e4c5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00412a40
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.004089f0
lea ecx, [ebp - 8]
call fcn.00408ed0
movzx edx, al
test edx, edx
jne 0x43e44c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00408eb0
lea ecx, [ebp - 4]
call fcn.0043e270
mov eax, dword [ebp - 0x24]
jmp 0x43e4c5
lea ecx, [ebp - 8]
call fcn.00408a60
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.0040f9f0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.0043b3b0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43e4a7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00408eb0
lea ecx, [ebp - 4]
call fcn.0043e270
mov eax, dword [ebp - 0x34]
jmp 0x43e4c5
lea ecx, [ebp - 8]
call fcn.0040fe30
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00408eb0
lea ecx, [ebp - 4]
call fcn.0043e270
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x44a4b0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.00425580
lea ecx, [ebp - 0x34]
call fcn.00425580
call fcn.0042d030
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004254d0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44a503
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.00425620
lea ecx, [ebp - 0x4c]
call fcn.00425620
mov eax, dword [ebp - 8]
jmp 0x44a578
call fcn.0042d030
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004254d0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44a53e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.00425620
lea ecx, [ebp - 0x4c]
call fcn.00425620
mov eax, dword [ebp - 0x10]
jmp 0x44a578
lea ecx, [ebp - 0x34]
call fcn.004258d0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.004258d0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.00425620
lea ecx, [ebp - 0x4c]
call fcn.00425620
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret