joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x49
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x54
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x7e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x45
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x98
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x88
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x96
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x97
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3b
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xa1
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbd
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov esi, dword [eax]
or al, 0x53
out dx, al
xlatb
popfd
push eax
inc ebx
and edx, 4
cmp eax, dword [edi]
inc esi
inc ebp
or byte [ecx - 0x81607ab], cl
mov esp, dword [ecx + 0x20]
test eax, eax
je 0x404ccd
jmp 0x20a1d676
push 0xc
call eax
add esp, 0xfffffff3
xor edx, esi
pop edi
pop ebx
jae 0x404a7a
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
dec edx
mov esp, ebp
pop ebp
push ss
or byte [eax], al
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x404ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
std
in al, dx
or al, 0x53
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x60]
aaa
dec edi
jge 0x404cfc
in eax, dx
add byte [ebx - 0x24ccfbb9], cl
mov eax, dword [edi + 4]
xor ebx, ebx
xor edi, 4
rol ebx, 0x89
push ds
mov dword [edi + 0x3c], ebx
pop edi
or eax, 0xf4e850
add byte [eax], al
mov eax, dword [edi + 4]
cmp ebx, dword [eax]
jne 0x404cf5
add al, 0xc1
ret
pop ebp
adc edx, dword [eax]
nop
call 0x134056f0
mov eax, dword [edi + 5]
mov dword [esi + 0x49], edi
test byte [edi + 0x14], bl
call fcn.00405742
loop 0x404d73
and dword [ebx + 0x5f89344f], ecx
sbb al, 0x89
sub ah, byte [ecx + ecx*4]
inc edi
sahf
mov dword [eax + 0x10], ecx
mov ecx, dword [eax]
or ecx, 8
and ecx, eax
mov dword [ebp - 0xc], eax
sbb dword [ebp - 0x57], edi
add byte [ebx], cl
mov eax, dword [eax]
add al, 0x89
sbb ch, byte [ecx]
jg 0x404d6c
mov esi, dword [eax]
mov ebx, dword [ecx + 0xc]
test eax, eax
je 0x404d63
push eax
call fcn.00408528
mov eax, dword [edi]
mov ecx, dword [edi + 0x44]
mov edx, dword [edi + 8]
mov dword [ebp - 0x3a], eax
mov dword [ebp + 0x74], ecx
mov eax, dword [esi]
inc ebp
invalid
mov ecx, dword [ebp + 0x4d]
cmc
inc ebp
clc
mov esp, dword [edi + 8]
test ecx, ecx
cmp ecx, dword [edx + 0x22c7c23b]
mov dword [esi], ebx
mov ebx, esi
mov gs, word [edi]
cmp eax, 0x14
jae 0x404da7
mov ecx, dword [edi + eax*4 - 0x47]
test ecx, ecx
mov dword [esi], ecx
jne 0x404e18
cmp eax, dword [ebp + 8]
jbe 0x404da1
mov dword [0x87748108], ecx
adc al, 0xeb
or byte [ebx + 0xe89144f], cl
xor dword [edi + eax*4 + 0x14], 0x4f8b08eb
adc al, 0x89
push cs
mov ecx, dword [edi + 0x14]
mov dword [esi], ecx
invalid
add esp, 4
pop ebp
rol bh, 0xe4
add bl, bh
add al, dl
invalid
Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add dword [ebx], 0x10
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push 0
xor dl, byte [ebp - 8]
push 0x52
mov eax, dword [esi]
insb byte es:[edi], dx
mov edx, dword [ebp + 8]
mov dword [esi - 0x10], edi
lea eax, [eax]
cld
mov dword [ebp - 0xc], ecx
push eax
push esp
inc edx
add al, 0x8d
xor eax, esi
push 1
push ecx
push eax
mov dword [ebp - 4], 0x9e00
mov dword [ebp - 8], 0
add byte [esi + 0x45c70000], bl
clc
add byte [eax], al
add byte [eax], al
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x408bb3
push edi
xchg dword [0xa047dcd8], edi
call edi
sub al, al
jne 0x408b9e
mov ebx, edi
aad 0x5e
xchg ch, ah
pop ebp
ret 0xb30c
call edi
mov dword [esi], 0x8600
pop edi
add eax, 0x74f880
pop esi
mov esp, ebp
pop ebp
mov ch, 0xc
add byte [ebx + 0x5baefc45], cl
mov eax, dword [ebp - 4]
scasb al, byte es:[edi]
pop ebx
pop esi
neg eax
sbb eax, eax
and eax, 0xfffeee82
add eax, 0x1117e
mov esp, ebp
pop ebp
pushfd
or al, 0
inc ebx
nop
invalid
Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
lea ecx, [ebp + 0xc]
fist word [edx + 0x50]
push ebx
call int.0040b080
add esp, 0xffffffe3
pop ecx
jle 0x40b064
jecxz 0x40b055
mov dword [ebp + 8], eax
jne 0x40b061
mov dword [ebx + 0x28], 0xf10001
and dword [esi + 0x6075f0c], 0x5e08458b
pop edi
pop es
push es
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
xor eax, 0x9099000c
adc dl, byte [eax - 0x3c386f70]
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
or ecx, dword [ebx + 0x468b107d]
adc byte [ebx - 0x3ef42ab2], cl
xor byte [ebp + 0x20], al
adc eax, dword [eax]
add byte [eax], al
and dword [edx + ecx*4 + 0x46], esi
test al, al
je 0x40b10d
mov ebx, dword [esp + eax - 0x73]
dec ebp
or byte [edx], ch
push ecx
push 0
les eax, [eax]
push 0
push edx
and dl, byte [0x62c00c]
jae 0x40b041
jne 0x40b0f2
xor eax, sym.imp.KERNEL32.dll_GetLastError
call esi
xor eax, eax
jne 0x40b0d2
sal byte [ebp + 9], 0x8b
dec ebp
adc al, 0x5f
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov ecx, esi
pop ebp
ret
call esi
arpl word [eax + 0x3d000afc], ax
in eax, dx
invalid
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b107
cmpsb byte [esi], byte es:[edi]
push ebp
adc al, 0x5f
adc eax, 0xbb80289
jmp 0x40b104
add byte [ebp - 0x4e], bl
cmp edi, eax
jbe 0x40b10d
mov edi, eax
mov al, byte [0xc0850c46]
sub eax, 0x89f8a23
test cl, cl
jne 0x40b137
mov esi, dword [ecx]
push 0xffffffffffffff89
dec eax
mov ax, word [esi - 0x40]
mov edx, dword [esi + 0x1d]
mov ecx, 0x82000020
call 0x11cb810
jp 0x40b189
or al, 0x89
inc edx
rcl byte [esi], cl
push ss
inc esi
loope 0x40b0c6
push ebp
or al, 0x53
lea ecx, [ebp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
fcom dword [edx - 0x71]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b15a
xor eax, eax
jmp 0x40b285
mov ebp, dword [eax - 0x68]
rol byte [esi], 0xff
xlatb
test eax, eax
invalid
ljmp 0xc085:0x43a947c
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x40b29e
mov ecx, dword [ebp - 0x5e]
mov edx, dword [ebp + 0x10]
pop ebx
pop edi
mov eax, 0x1487e
mov dword [ebx - 0x7413a216], edi
push esi
add dword [ebp - 0x75e78b2e], 0x62
or byte [edx + edx*8 - 0x7a74ee8b], al
push eax
add edx, ecx
mov eax, dword [esp + 0x53]
mov edx, dword [esi - 0x7d]
test edx, edx
je 0x40b2bd
mov ah, byte [edx + 8]
test dl, dl
jne 0x40b2bd
mov eax, dword [ebp - 0x742efcb0]
inc esp
in al, 0x53
ror dword [esi - 0x76afa977], 1
dec esi
push esp
mov esi, ebp
adc al, 0x8b
push ebp
adc byte [0x5e11ce5f], bh
pop ebp
dec esp
nop
sbb edx, dword [eax + 0x55909090]
mov ebp, esp
push ecx
push esi
iretd
Function at 0x42d180
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x455c5c
mov ebx, ecx
push eax
call fcn.00447070
mov esi, dword [ebx + 0x1405]
mov ebp, eax
add esp, 8
lea eax, [esi - 0x400]
test eax, eax
jge 0x42d1ae
xor ecx, ecx
jmp 0x42d1bf
inc eax
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
mov ecx, eax
sub ecx, edx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
mov edi, eax
mov eax, ecx
sub edi, edx
cmp ecx, edi
je 0x42d203
lea esi, [eax + 1]
lea ecx, [ebx + esi*4]
mov edx, dword [esi + ecx]
push edx
push 0x4558c4
push ebp
call fcn.00447160
mov eax, esi
add esp, 0xc
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
sub eax, edx
cmp eax, edi
jne 0x42d1d7
push ebp
call fcn.00446f40
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4339e0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword [esp + 0xc]
cmp eax, 2
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], edx
mov dword [esi + 8], 0xffffffff
jne 0x433a0f
push edx
push ecx
push eax
call sub.WSOCK32.dll_socket
mov dword [esi + 8], eax
cmp dword [esi], 6
jne 0x433a42
cmp dword [esi + 4], 1
jne 0x433a2b
push 0x4e8
push 1
push 6
call sub.WSOCK32.dll_socket
mov dword [esi + 8], eax
cmp dword [esi + 4], 2
jne 0x433a42
push 0x3e8
push 2
push 6
call sub.WSOCK32.dll_socket
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x433a88
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_setsockopt
cmp dword [esi], 6
jne 0x433a88
cmp dword [esi + 4], 2
jne 0x433a88
mov eax, dword [esi + 8]
lea edx, [esp + 8]
push 4
push edx
push 0x20
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
mov eax, esi
pop esi
ret 8

Function at 0x433c20
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [ecx + 8]
push 0x10
push eax
push ecx
call sub.WSOCK32.dll_connect
ret 4

Function at 0x433c40
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esi + 8]
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x433c63
xor eax, eax
pop esi
ret 8
mov ecx, dword [esi + 0xc]
add ecx, eax
mov dword [esi + 0xc], ecx
pop esi
ret 8

Function at 0x433c70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esi + 8]
push ecx
push edx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x433c93
xor eax, eax
pop esi
ret 8
mov ecx, dword [esi + 0x10]
add ecx, eax
mov dword [esi + 0x10], ecx
pop esi
ret 8
Function at 0x433d10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
push esi
mov esi, ecx
mov cl, byte [0x70e818]
mov al, 1
test al, cl
jne 0x433d3f
mov dl, cl
push 0x433d00
or dl, al
mov byte [0x70e818], dl
mov eax, dword [esi]
mov word [0x70e7d0], ax
call fcn.00447620
add esp, 4
mov ecx, dword [esi + 8]
lea eax, [esp + 4]
push eax
push 0x70e7d0
push ecx
mov dword [esp + 0x10], 0x10
call sub.WSOCK32.dll_getsockname
mov eax, 0x70e7d0
pop esi
pop ecx
ret
Function at 0x4424a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
mov dword [esp + 8], esi
mov dword [esi + 0x140d], ebx
je 0x44255e
push edi
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x184
push ebx
call ebp
mov esi, dword [esi + 0x1405]
lea eax, [esi - 0x400]
test eax, eax
jge 0x4424e3
xor ecx, ecx
jmp 0x4424f4
inc eax
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
mov ecx, eax
sub ecx, edx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
mov edi, eax
mov eax, ecx
sub edi, edx
cmp ecx, edi
je 0x442538
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
lea ecx, [eax + esi*4]
mov edx, dword [esi + ecx]
push edx
push 0
push 0x180
push ebx
call ebp
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 0x3ff
xor eax, edx
sub eax, edx
cmp eax, edi
jne 0x44250c
push 0
push 0
push 0
push 0x18b
push ebx
call ebp
dec eax
push eax
push 0x197
push ebx
call ebp
push 0
push 0xffffffffffffffff
push 0x186
push ebx
call ebp
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x442e90
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x7563d8]
sub esp, 0x190
test eax, eax
jne 0x442ed3
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x442ed3
lea ecx, [esp + 4]
push ecx
push 0x455f88
push 0x754790
call fcn.0042d0e0
add esp, 0xc
mov dword [0x7563d8], 1
add esp, 0x190
ret

Function at 0x4472e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x447319
mov eax, dword [esp + 4]
cmp ah, 0x3a
jne 0x447319
and eax, 0xff
push eax
call fcn.004474a0
mov esi, eax
add esp, 4
sub esi, 0x40
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x448130
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454378
push 0x44d278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x77a0dc], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x77a0d8], ecx
shl ecx, 8
add ecx, edx
mov dword [0x77a0d4], ecx
shr eax, 0x10
mov dword [0x77a0d0], eax
call fcn.00449190
test eax, eax
jne 0x44819a
push 0x1c
call fcn.004482d0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0044c4f0
call fcn.0044d170
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x77b5c8], eax
call fcn.0044cd40
mov dword [0x77a090], eax
test eax, eax
je 0x4481cd
mov eax, dword [0x77b5c8]
test eax, eax
jne 0x4481d7
push 0xffffffffffffffff
call fcn.0044bc80
add esp, 4
call fcn.0044ca90
call fcn.0044c9a0
call fcn.0044bc50
mov esi, dword [0x77b5c8]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x4482b6
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x44821e
test al, al
je 0x44821e
and eax, 0xff
push eax
call fcn.0044c940
add esp, 4
test eax, eax
je 0x4481f8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4481f8
cmp byte [esi], 0x22
jne 0x448227
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x448237
cmp al, 0x20
ja 0x448237
inc esi
mov dword [ebp - 0x64], esi
jmp 0x448227
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x448258
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x44825d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0044bc80
jmp 0x44829b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x448227
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4482b6

Function at 0x44bcc0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x77a10c]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x44bcdf
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x77a108], 1
mov byte [0x77a104], bl
jne 0x44bd39
mov ecx, dword [0x77a5a8]
test ecx, ecx
je 0x44bd27
mov esi, dword [0x77a5a4]
sub esi, 4
cmp esi, ecx
jb 0x44bd27
mov eax, dword [esi]
test eax, eax
je 0x44bd20
call eax
mov ecx, dword [0x77a5a8]
sub esi, 4
cmp esi, ecx
jae 0x44bd12
push 0x455058
push 0x455050
call fcn.0044bd70
add esp, 8
push 0x455060
push 0x45505c
call fcn.0044bd70
add esp, 8
test ebx, ebx
jne 0x44bd60
push ebp
mov dword [0x77a10c], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x44be90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
test ebx, ebx
je 0x44bf01
push ebx
call fcn.0044bfc0
add esp, 4
test eax, eax
jne 0x44becf
mov dword [0x77a0c8], 0xf
mov dword [0x77a0c4], 0xd
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x14]
add bl, 0x40
push 0x104
push edx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x2e
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x44bf11
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x44bfa7
inc eax
cmp eax, 0x104
ja 0x44bfa7
mov edx, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
test edx, edx
jne 0x44bf60
cmp eax, ecx
jg 0x44bf3d
mov eax, ecx
push eax
call fcn.00447230
mov edx, eax
add esp, 4
test edx, edx
jne 0x44bf7a
mov dword [0x77a0c4], 0xc
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, ecx
jle 0x44bf7a
mov dword [0x77a0c4], 0x22
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret

Function at 0x44bfc0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x44bfce
mov eax, 1
ret
add al, 0x40
mov byte [esp + 5], 0x3a
mov byte [esp + 4], al
lea eax, [esp + 4]
push eax
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x44bffd
cmp eax, 1
je 0x44bffd
mov eax, 1
ret
xor eax, eax
ret
Function at 0x44cd40
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x77a240]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x44cd82
call edi
mov esi, eax
test esi, esi
je 0x44cd6c
mov eax, 1
jmp 0x44cd7d
call ebp
mov ebx, eax
test ebx, ebx
je 0x44ce8f
mov eax, 2
mov dword [0x77a240], eax
cmp eax, 1
jne 0x44ce22
test esi, esi
jne 0x44cd9b
call edi
mov esi, eax
test esi, esi
je 0x44ce8f
cmp word [esi], 0
mov eax, esi
je 0x44cdb5
add eax, 2
cmp word [eax], 0
jne 0x44cda3
add eax, 2
cmp word [eax], 0
jne 0x44cda3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x44ce14
push edi
call fcn.00447230
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44ce14
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x44ce06
push ebx
call fcn.00446d50
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x44ce8f
test ebx, ebx
jne 0x44ce33
call ebp
mov ebx, eax
test ebx, ebx
je 0x44ce8f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x44ce4b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44ce3b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44ce3b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00447230
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x44ce6d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x44d390
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x477708
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x44d3b4
add eax, 8
inc ebp
cmp eax, 0x477798
jb 0x44d3a5
cmp ecx, dword [ebp*8 + 0x477708]
jne 0x44d55b
mov eax, dword [0x77a098]
cmp eax, 1
je 0x44d51d
test eax, eax
jne 0x44d3e0
cmp dword [0x474e64], 1
je 0x44d51d
cmp ecx, 0xfc
je 0x44d55b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44d41b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x44d464
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x45477c
add ebx, ecx
push ebx
call fcn.00446be0
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x455994
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x47770c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0044fe50
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x77a4a0]
test eax, eax
je 0x44d52e
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x44d538
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x47770c]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret