joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af4e1
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004ad413
add esp, 4
and eax, 0xff
test eax, eax
je 0x4af56a
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.004afff0
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4af568
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x4af568
jmp 0x4af56a
jmp 0x4af4ea
mov esp, ebp
pop ebp
ret

Function at 0x4b1ef2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4b7e38
cmp edx, dword [eax]
je 0x4b1f14
add eax, 8
inc ecx
cmp eax, 0x4b7ec8
jl 0x4b1f05
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4b7e38]
jne 0x4b2042
mov eax, dword [0x4baed0]
cmp eax, 1
je 0x4b201c
test eax, eax
jne 0x4b1f45
cmp dword [0x4b7b74], 1
je 0x4b201c
cmp edx, 0xfc
je 0x4b2042
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b1f7c
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b0330
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b00e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b1fbf
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b00e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ba8c4
push edi
call fcn.004b04e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b0330
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b0340
lea eax, [ebp - 0xa0]
push 0x4ba8a4
push eax
call fcn.004b0340
push dword [esi + 0x4b7e3c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b0340
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004b45a8
add esp, 0x2c
pop edi
jmp 0x4b2042
lea eax, [ebp + 8]
lea esi, [esi + 0x4b7e3c]
push 0
push eax
push dword [esi]
call fcn.004b00e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4681ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468063

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x403358
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x4033e8
mov eax, dword [ebp + 8]
push dword [eax + 8]
inc dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
call fcn.00404dd9
test eax, eax
pop ecx
pop ecx
je 0x4033ce
test ebx, ebx
je 0x4033bf
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.00404ca0
test eax, eax
pop ecx
pop ecx
jle 0x4033ce
push ebx
call fcn.00403fa4
pop ecx
lea eax, [ebp - 0x110]
push eax
call fcn.00403f83
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x403386
xor edi, edi
cmp ebx, edi
jne 0x4033ec
xor eax, eax
jmp 0x403460
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
push ebx
je 0x40340d
call fcn.00403fa4
pop ecx
jmp 0x403435
call fcn.00403fa4
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403445
cmp dword [ebp - 4], edi
je 0x4033e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4033e8
cmp dword [ebp - 4], edi
je 0x403453
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call fcn.00403f83
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403def
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push dword [ebp + 0x14]
mov esi, edi
call fcn.00403a37
test al, al
pop ecx
jne 0x403e1d
push 1
push str.Error:_could_not_find_Java_SE_Runtime_Environment.
call fcn.0040325c
pop ecx
pop ecx
push 2
jmp 0x403ead
push edi
call fcn.00403c1e
push 0
push str.i386
push edi
call fcn.004028ab
add esp, 0x10
cmp eax, 1
jge 0x403e4a
push 1
push str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call fcn.0040325c
pop ecx
pop ecx
push 1
jmp 0x403ead
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004021b8
mov ebx, dword [ebp + 0x18]
mov esi, eax
push ebx
push edi
mov dword [ebp - 4], esi
mov byte [ebx], 0
call fcn.00402f70
add esp, 0x14
test al, al
jne 0x403eb2
push esi
call fcn.00406cb0
push ebx
mov esi, eax
call fcn.00406cb0
mov edi, str.Error:_no___s_JVM_at___s.
push edi
add esi, eax
call fcn.00406cb0
add esi, eax
push esi
call fcn.00403f3c
push ebx
push dword [ebp - 4]
mov esi, eax
push edi
push esi
call fcn.0040712d
push 1
push esi
call fcn.0040325c
add esp, 0x28
push 4
call fcn.0040730c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404143
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
push 0x10
pop edi
call fcn.00403fa9
push 8
mov esi, eax
call fcn.00403f3c
mov ebx, eax
pop ecx
lea eax, [ebp - 0x14c]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404193
mov dword [ebx], eax
lea eax, [ebp - 0x120]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x40419a
and dword [ebx + 4], 0
jmp 0x4041b7
xor eax, eax
jmp 0x404286
lea eax, [ebp - 0x28c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
neg edi
sbb edi, edi
lea eax, [ebp - 0x260]
and edi, eax
test edi, edi
je 0x40426c
push edi
call fcn.00406cb0
cmp eax, 4
pop ecx
jl 0x404186
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404186
add eax, 0xfffffffd
push 0x414d4c
push eax
mov dword [ebp - 4], eax
call fcn.004074c0
test eax, eax
pop ecx
pop ecx
je 0x4041fd
push 0x414d48
push dword [ebp - 4]
call fcn.004074c0
test eax, eax
pop ecx
pop ecx
jne 0x404186
push 0x3b
push edi
call fcn.00407d30
test eax, eax
pop ecx
pop ecx
jne 0x404186
push dword [ebp + 8]
call fcn.00406cb0
push edi
mov ebx, eax
call fcn.00406cb0
mov dword [ebp - 4], eax
add eax, ebx
push eax
call fcn.00403f3c
lea ecx, [ebx - 1]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
call fcn.00406df0
mov eax, dword [ebp - 4]
inc eax
push eax
push edi
mov edi, dword [ebp - 0xc]
lea eax, [edi + ebx - 1]
push eax
call fcn.00406df0
mov edx, dword [esi + 4]
add esp, 0x24
inc edx
call fcn.00403fff
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 8]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404186
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.00403fa4
push ebx
call fcn.00403fa4
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407249
Capabilities:
Terminate process

Disassembly:
push 8
push 0x415310
call fcn.0040ab70
push 8
call fcn.0040a9c4
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x419eb0], esi
jne 0x40727d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x419eac], esi
mov al, byte [ebp + 0x10]
mov byte [0x419ea8], al
cmp dword [ebp + 0xc], edi
jne 0x4072c7
cmp dword [0x41b76c], edi
je 0x4072b7
mov eax, dword [0x41b768]
sub eax, 4
mov dword [0x41b768], eax
cmp eax, dword [0x41b76c]
jb 0x4072b7
mov eax, dword [eax]
cmp eax, edi
je 0x407298
call eax
jmp 0x407298
push 0x418028
mov eax, 0x418020
call fcn.004071c7
pop ecx
push 0x418030
mov eax, 0x41802c
call fcn.004071c7
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4072f8
cmp dword [ebp + 0x10], edi
jne 0x407306
mov dword [0x419eb0], esi
push dword [ebp + 8]
call fcn.00407185
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x407305
push 8
call fcn.0040a90f
pop ecx
ret
call fcn.0040abab
ret

Function at 0x4082f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x408311
call fcn.00407eea
mov dword [eax], 0x16
xor eax, eax
jmp 0x40837b
push esi
push 0x8c
push 1
call fcn.00409083
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x408366
push esi
call fcn.0040bac7
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x408344
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x40825f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40837a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00408b1f
test ebx, ebx
pop ecx
je 0x408378
push ebx
call fcn.00407efc
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40837f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40839f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407efc
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4083c2
test byte [esp + 8], 2
je 0x4083c2
call fcn.00407eea
mov dword [eax], 0xd
call fcn.00407ef3
mov dword [eax], 5
jmp 0x40839b
xor eax, eax
ret
Function at 0x40b237
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x419bb0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x40b268
xor eax, eax
jmp 0x40b3f1
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x41a640]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x40b2a4
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0040f04d
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40b37f
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x40b3bd
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x40b308
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40b2f9
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x40b2d9
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b348
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x40b351
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x40b2ca
jmp 0x40b353
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x40b3ec
cmp dword [ebp - 0x6c], edi
je 0x40b3bd
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x40b3b2
call fcn.00407eea
mov dword [eax], 9
call fcn.00407ef3
mov dword [eax], esi
jmp 0x40b3e7
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b3a7
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x40b353
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x40b353
push dword [ebp - 0x6c]
call fcn.00407efc
pop ecx
jmp 0x40b3e7
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40b3d5
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x40b3d5
xor eax, eax
jmp 0x40b3ef
call fcn.00407eea
mov dword [eax], 0x1c
call fcn.00407ef3
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x40b3ef
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040e5c3
add ebp, 0x3a0
leave
ret
Function at 0x40b591
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x40b765
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x41a640]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x40b765
test cl, 0x48
je 0x40b5fc
cmp byte [eax + 5], 0xa
je 0x40b5fc
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b64e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x40b636
call fcn.00407eea
mov dword [eax], 9
call fcn.00407ef3
mov dword [eax], esi
jmp 0x40b646
cmp eax, 0x6d
je 0x40b765
push eax
call fcn.00407efc
pop ecx
or eax, 0xffffffff
jmp 0x40b767
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x40b760
test eax, eax
je 0x40b675
cmp byte [ebx], 0xa
jne 0x40b675
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40b67e
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x40b75a
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x40b74a
cmp al, 0xd
je 0x40b6b0
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x40b73c
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x40b6ca
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x40b6c5
add dword [ebp + 0x10], 2
jmp 0x40b71e
mov dword [ebp + 0x10], eax
jmp 0x40b738
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b6f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40b738
cmp dword [ebp - 0xc], 0
je 0x40b738
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40b713
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40b71e
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40b73b
cmp ebx, dword [ebp + 0xc]
jne 0x40b723
cmp byte [ebp - 1], 0xa
jne 0x40b723
mov byte [ebx], 0xa
jmp 0x40b73b
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040e5d1
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40b73c
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x40b694
jmp 0x40b75a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40b75a
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x40b767
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c298
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x40c2b1
or eax, 0xffffffff
jmp 0x40c312
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x40c30e
push 0x3d
push esi
call fcn.0040f64d
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x40c30e
cmp esi, eax
je 0x40c30e
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x419e90]
sete cl
cmp eax, dword [0x419e94]
mov dword [ebp - 8], ecx
jne 0x40c2f4
mov edi, eax
call fcn.0040c237
mov dword [0x419e90], eax
cmp eax, ebx
jne 0x40c34d
cmp dword [ebp + 0xc], ebx
je 0x40c316
cmp dword [0x419e98], ebx
je 0x40c316
call fcn.0040adc5
test eax, eax
je 0x40c34d
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x40c31f
xor eax, eax
jmp 0x40c311
push 4
call fcn.00408960
cmp eax, ebx
pop ecx
mov dword [0x419e90], eax
je 0x40c30e
mov dword [eax], ebx
cmp dword [0x419e98], ebx
jne 0x40c34d
push 4
call fcn.00408960
cmp eax, ebx
pop ecx
mov dword [0x419e98], eax
je 0x40c30e
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x419e90]
call fcn.0040c1ea
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x40c3ae
cmp dword [esi], ebx
je 0x40c3ae
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00408b1f
cmp dword [ebp - 8], ebx
pop ecx
jne 0x40c391
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x40c3ef
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x40c388
mov eax, edi
shl eax, 2
push eax
push dword [0x419e90]
call fcn.00408972
cmp eax, ebx
pop ecx
pop ecx
je 0x40c3ef
jmp 0x40c3ea
cmp dword [ebp - 8], ebx
jne 0x40c45a
cmp edi, ebx
jge 0x40c3bd
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x419e90]
call fcn.00408972
cmp eax, ebx
pop ecx
pop ecx
je 0x40c30e
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x419e90], eax
cmp dword [ebp + 0xc], ebx
je 0x40c444
push dword [ebp - 4]
call fcn.00406cb0
inc eax
inc eax
push eax
call fcn.00408960
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40c444
push dword [ebp - 4]
push esi
call fcn.004073c0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x40c43d
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00408b1f
pop ecx
cmp dword [ebp - 8], ebx
je 0x40c452
push dword [ebp - 4]
call fcn.00408b1f
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x40c311
push dword [ebp - 4]
call fcn.00408b1f
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x40c31b
Function at 0x40cb5d
Capabilities:
Enumerate files on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x40cbbb
cmp dword [0x41a1c8], 0
jne 0x40cb81
push 0x244
call fcn.00408960
test eax, eax
pop ecx
mov dword [0x41a1c8], eax
je 0x40cbe4
mov eax, dword [0x41a1cc]
test eax, eax
je 0x40cb98
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x41a1cc], 0
push dword [0x41a1c8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x41a1cc], eax
je 0x40cbe4
mov eax, dword [0x41a1c8]
add eax, 0x2c
ret
push dword [0x41a1c8]
push dword [0x41a1cc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40cbb2
push dword [0x41a1cc]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x41a1cc], 0
xor eax, eax
ret

Function at 0x40ce11
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x419bb0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x419950]
je 0x40ce46
inc eax
cmp eax, 0x13
jb 0x40ce37
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x419950]
jne 0x40cf6c
mov eax, dword [0x41a050]
cmp eax, 1
je 0x40cf44
cmp eax, edx
jne 0x40ce76
cmp dword [0x4195bc], 1
je 0x40cf44
cmp ecx, 0xfc
je 0x40cf6c
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40ceac
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004073c0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00406cb0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40cee0
mov eax, edi
push eax
call fcn.00406cb0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x415d10
push edi
call fcn.004100a0
add esp, 0x10
push edi
call fcn.00406cb0
push dword [esi + 0x419954]
mov ebx, eax
call fcn.00406cb0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0040d220
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004073c0
push edi
push ebx
call fcn.004073d0
push 0x415cf0
push ebx
call fcn.004073d0
push dword [esi + 0x419954]
push ebx
call fcn.004073d0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040ffa2
add esp, 0x2c
jmp 0x40cf6c
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x419954]
push dword [esi]
call fcn.00406cb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040e5c3
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret