joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dde14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00484424
xor edx, edx
push ebp
push 0x4dde86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dde90
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4014a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ebx
push ebx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push esi
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 8]
lea eax, [ebx - 3]
pop ebx
pop esi
pop ebp
ret

Function at 0x401692
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
jmp loc.00463000
Function at 0x406c10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xb001f
push 0x9001f
call fcn.004d396f
add esp, 8
cmp dword [0x51fc68], 0
je 0x406cc4
push str.SW_sigpipe
mov dword [0x51fc68], 0
call fcn.004d4ed6
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x406cc4
push 0xa
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004d4a45
add esp, 0xc
mov dword [0x533b68], eax
test eax, eax
je 0x406cc4
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2c
jne 0x406cc4
push 0xa
lea ecx, [ebp - 4]
inc eax
push ecx
push eax
call fcn.004d4a45
add esp, 0xc
mov dword [0x533b6c], eax
test eax, eax
je 0x406cc4
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2c
jne 0x406ca7
push 0xa
lea ecx, [ebp - 4]
inc eax
push ecx
push eax
call fcn.004d4a45
add esp, 0xc
mov dword [0x546304], eax
push 0x533b68
push 0
push 0x406cd0
call fcn.004d503f
add esp, 0xc
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret

Function at 0x406f10
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x74]
push eax
push esi
call fcn.004d644b
add esp, 8
test eax, eax
jne 0x407033
mov eax, dword [ebp - 0x6e]
test eax, 0x4000
je 0x406f5a
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
test eax, 0x8000
je 0x40701f
push 0x4fc778
push esi
call fcn.004d5440
mov esi, eax
add esp, 8
test esi, esi
je 0x40701f
push edi
push esi
mov edi, 1
lea eax, [ebp - 0x44]
push edi
push 0x40
push eax
call fcn.004d563d
add esp, 0x10
cmp eax, edi
jne 0x406fff
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
jne 0x406fff
push 0
push dword [ebp - 8]
push esi
call fcn.004d5a53
add esp, 0xc
test eax, eax
jne 0x406fff
push esi
push edi
lea eax, [ebp - 0x16c]
push 4
push eax
call fcn.004d563d
add esp, 0x10
cmp eax, edi
jne 0x406fff
cmp dword [ebp - 0x16c], 0x4550
jne 0x406fff
push esi
push edi
lea eax, [ebp - 0x168]
push 0xf4
push eax
call fcn.004d563d
add esp, 0x10
cmp eax, edi
jne 0x406fff
mov eax, 0x10b
cmp word [ebp - 0x154], ax
je 0x407004
mov edi, 3
push esi
call fcn.004d5359
add esp, 4
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
Function at 0x410940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push dword [esi + 0x1c]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d563d
add esp, 0x10
cmp eax, 1
jne 0x410964
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x10], eax
mov eax, dword [esi + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410970
push ebx
push edi
mov edi, dword [ebp + 0x14]
sub eax, edx
mov edx, edi
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x410983
sub edx, ebx
mov ebx, dword [ebp + 0x10]
add edx, 0x20
add eax, edx
push eax
mov eax, dword [esi + 8]
push dword [ebx + 0x20]
mov eax, dword [eax + 0x34]
call eax
mov dword [ebx + 0x18], eax
push dword [esi + 0x10]
push edi
push str.could_not_read__s_from_file__s.
push eax
call fcn.004086e0
push dword [esi + 0x1c]
call fcn.004d5359
add esp, 0x1c
mov eax, 2
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x44cc80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x533f1c], 0
push esi
mov esi, dword [ebp + 8]
je 0x44cce5
mov eax, dword [0x540c48]
test eax, eax
je 0x44ccac
push eax
call fcn.004d5359
add esp, 4
mov dword [0x540c48], 0
push 0x4fcf10
call fcn.00411360
push esi
push 0x501540
call fcn.004084d0
add esp, 0xc
cmp dword [0x533f1c], 4
jge 0x44cce5
push esi
push 0x501540
call fcn.004084d0
push 0x4fc5ab
call fcn.00411360
add esp, 0xc
call fcn.0044cc50
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4a6210
Capabilities:
Read file on windows
Read pipe
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0
push eax
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [esi + 4]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x4a6328
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0
je 0x4a6328
push 0x7d0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4a6333
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0xf
push eax
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
push dword [esi + 4]
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x4a6328
push eax
lea eax, [ebp - 0x14]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 0
je 0x4a6328
push 0x7d0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4a6333
push 0x3f
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
Function at 0x4a68a0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push 0x1000
push eax
mov dword [ebp - 0xc], 0xc
lea eax, [ecx + 4]
mov dword [ebp - 8], 0
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4a68dc
xor eax, eax
mov esp, ebp
pop ebp
ret
push str.CreatePipe_failed__n
push 1
call fcn.004d27a8
add esp, 4
push eax
call fcn.00408350
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4a7860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [ebp + 8]
addsd xmm0, qword [0x507ca0]
mulsd xmm0, qword [0x4fca90]
call fcn.004cec00
push eax
push 0
push 0x4a61d0
call fcn.004d503f
add esp, 0xc
pop ebp
ret

Function at 0x4aff10
Capabilities:
Connect socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x544a5c], 0
push esi
push edi
je 0x4b0004
cmp dword [0x544a60], 0
jle 0x4affe4
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
nop dword [eax]
push dword [0x531a80]
push 1
push dword [0x544a64]
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x4affe3
push dword [0x544a84]
push 0x544a68
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4affe3
mov eax, dword [0x544a60]
dec eax
mov dword [0x544a60], eax
push dword [eax*4 + 0x544a58]
lea eax, [ebp - 0x44]
push dword [0x544a5c]
push str.En__lx__lx
push 0x40
push eax
call fcn.004085b0
add esp, 0x14
cmp eax, 0x40
jae 0x4affce
push 0
push eax
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
push 0
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push 2
push esi
call edi
push esi
call ebx
cmp dword [0x544a60], 0
jg 0x4aff50
pop ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
mov dword [0x544a5c], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
mov eax, dword [0x544a60]
test eax, eax
jle 0x4b006a
nop dword [eax]
dec eax
mov dword [0x544a60], eax
lea esi, [eax + eax*2]
mov edi, dword [esi*8 + 0x544a98]
mov dword [esi*8 + 0x544a9c], 1
test edi, edi
je 0x4b0066
push edi
mov dword [esi*8 + 0x544a98], 0
call fcn.004e3287
push edi
call fcn.004d2dae
push dword [esi*8 + 0x544a90]
call fcn.004e9ecf
push dword [esi*8 + 0x544a90]
call fcn.004d2dae
mov eax, dword [0x544a60]
add esp, 0x10
test eax, eax
jg 0x4b0010
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
Function at 0x4b0840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.004b3390
mov esi, dword [0x544a14]
xor eax, eax
mov edx, dword [0x544a10]
mov byte [esi], 0
cmp edx, esi
jae 0x4b0877
movzx ecx, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x531b10]
cmp edx, esi
jb 0x4b0860
push eax
push dword [0x544a38]
push dword [0x544a28]
push dword [0x544a24]
push str._d__d__d__lx
push dword [ebp + 8]
call fcn.004086e0
mov esi, dword [0x544a34]
add esp, 0x18
mov edx, dword [0x544a18]
mov ebx, eax
mov ecx, dword [0x544a14]
mov dword [edx + esi*4], ecx
mov ecx, 1
cmp esi, ecx
jl 0x4b08cc
nop word [eax + eax]
mov eax, dword [edx + ecx*4]
inc ecx
mov byte [eax - 1], 0
cmp ecx, esi
jle 0x4b08c0
mov ecx, dword [ebp + 0xc]
mov esi, dword [0x544a28]
mov edi, dword [0x544a24]
mov eax, dword [0x544a38]
mov dword [ecx], edi
mov dword [ecx + 4], esi
mov dword [ecx + 8], eax
cmp esi, 1
jle 0x4b0901
push 0x4b0080
push 4
lea eax, [edx + edi*4]
push esi
push eax
call fcn.004e4b90
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4b0b60
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x544a44], 0
jne 0x4b0c69
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x14c], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4b0c5f
lea eax, [ebp - 0x84]
mov dword [ebp - 0x148], eax
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 0x14c]
add eax, ecx
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x154]
push edi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x144]
push 0xc0
push eax
call fcn.004b0480
mov ecx, dword [ebp - 0x150]
add esp, 0x14
mov edi, dword [ebp - 0x154]
mov eax, ecx
sub eax, dword [ebp - 0x148]
mov dword [0x544a48], eax
test edi, edi
je 0x4b0c25
mov dword [0x544a44], edi
mov byte [ecx], 0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
inc eax
push esi
push eax
call fcn.004538c0
mov esi, dword [0x544a48]
mov edi, eax
push esi
push dword [ebp - 0x148]
push edi
call fcn.004cfba0
add esp, 0x10
mov byte [edi + esi], 0
mov dword [0x544a44], edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
mov dword [0x544a44], 0x4fc5ab
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
Function at 0x4b3090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xff38
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], 0xff38
call fcn.004538c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0
push 0x508c00
push reloc.WS2_32.dll_connect
call ebx
mov esi, eax
cmp esi, 0xea
jne 0x4b311b
nop dword [eax + eax]
push edi
call fcn.004d2dae
mov eax, dword [ebp - 4]
add eax, 0x8000
push eax
mov dword [ebp - 4], eax
call fcn.004538c0
add esp, 8
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0
push 0x508c00
push reloc.WS2_32.dll_connect
call ebx
mov esi, eax
cmp esi, 0xea
je 0x4b30e0
push reloc.WS2_32.dll_connect
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4b314e
push esi
push dword [ebp + 0xc]
push str._s:_Return__ld_from_RegQueryValueEx_n
call fcn.004084d0
add esp, 0xc
push edi
call fcn.004d2dae
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov edx, dword [edi + 0x1c]
add eax, edi
test edx, edx
jle 0x4b3170
nop dword [eax]
cmp dword [eax + 0xc], 0xe6
je 0x4b3193
add eax, dword [eax]
inc ecx
cmp ecx, edx
jl 0x4b3160
push dword [ebp + 0xc]
push str._s:_could_not_find_Process__object_230__n
call fcn.004084d0
add esp, 8
push edi
call fcn.004d2dae
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 8]
xor esi, esi
or ebx, 0xffffffff
mov dword [ebp - 8], 0xffffffff
add ecx, eax
cmp dword [eax + 0x20], esi
jle 0x4b31de
nop dword [eax]
mov edx, dword [ecx + 4]
cmp edx, 0x310
je 0x4b31cd
cmp edx, 0x582
jne 0x4b31d6
mov edx, dword [ecx + 0x24]
test ebx, ebx
mov dword [ebp - 8], edx
jmp 0x4b31d4
mov ebx, dword [ecx + 0x24]
cmp dword [ebp - 8], 0
jg 0x4b31fe
add ecx, dword [ecx]
inc esi
cmp esi, dword [eax + 0x20]
jl 0x4b31b0
push str.pid_in_use:_could_not_find_offsets_n
call fcn.004af980
add esp, 4
push edi
call fcn.004d2dae
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x28]
test esi, esi
jg 0x4b3215
push esi
push str.pid_in_use:_Got_PO__NumInstances___ld__expected_a_positive_value._n
call fcn.004af980
jmp 0x4b317d
mov ecx, dword [eax + 4]
add ecx, eax
xor edx, edx
nop dword [eax]
mov eax, dword [ecx]
add eax, ecx
mov ecx, dword [ebp + 8]
cmp dword [eax + ebx], ecx
je 0x4b3180
mov ecx, dword [eax]
inc edx
add ecx, eax
cmp edx, esi
jl 0x4b3220
push edi
mov dword [ebp - 0xc], 0
call fcn.004d2dae
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b40f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
add esi, edx
cmp edx, esi
jae 0x4b411a
movzx ecx, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x531b10]
cmp edx, esi
jb 0x4b4103
pop esi
pop ebp
ret

Function at 0x4b4570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x544ad8], 0
push esi
mov esi, dword [ebp + 8]
jne 0x4b45a1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
push ebx
push edi
push dword [0x5320b4]
call fcn.004d4ed6
mov edi, eax
add esp, 4
test edi, edi
je 0x4b46ad
push 0
call fcn.004d7382
add esp, 4
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x848], eax
push esi
push eax
push ebx
push dword [0x544d90]
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str._d__d:_lld:_s
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.004b6830
add esp, 0x20
test eax, eax
js 0x4b46ad
mov eax, dword [ebp - 0x848]
lea ecx, [ebp - 0x404]
inc dword [0x544d90]
lea edx, [ecx + 1]
mov dword [0x544d88], ebx
mov dword [0x544d8c], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b4620
sub ecx, edx
xor eax, eax
lea edx, [ebp - 0x404]
mov esi, edx
add esi, ecx
mov ecx, edx
cmp ecx, esi
jae 0x4b465c
nop dword [eax + eax]
movzx ecx, byte [edx]
inc edx
xor ecx, eax
sar eax, 8
movzx ecx, cl
and eax, 0xffffff
xor eax, dword [ecx*4 + 0x532228]
cmp edx, esi
jb 0x4b4640
lea ecx, [ebp - 0x404]
push ecx
push eax
push str._lx:_s
lea eax, [ebp - 0x844]
push 0x440
push eax
call fcn.004b6830
add esp, 0x14
test eax, eax
js 0x4b46ad
lea eax, [ebp - 0x844]
push eax
push dword [0x5320b8]
call fcn.004b5900
push edi
call fcn.004b50a0
add esp, 0xc
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
Function at 0x4b4ec0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x4fcad0
push esi
call fcn.004d5440
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4b506e
push edi
mov edi, dword [str.AMPL_ENVFILE]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [0x544ad0], 0
push esi
push edi
jne 0x4b4f11
call fcn.00467bb0
xor edi, edi
add esp, 8
mov dword [ebp - 0xc], edi
xor esi, esi
jmp 0x4b4f30
call fcn.004e5a56
xor edi, edi
add esp, 8
mov dword [ebp - 0xc], edi
xor esi, esi
jmp 0x4b4f30
add esp, 8
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
nop dword [eax + eax]
push ebx
call fcn.004db7ab
add esp, 4
test eax, eax
jne 0x4b5051
mov dword [ebp - 8], esi
cmp dword [ebp - 0xc], eax
jne 0x4b4f64
mov esi, 0x400
push esi
mov dword [ebp - 8], esi
call fcn.004d2dc9
mov edi, eax
add esp, 4
test edi, edi
je 0x4b5076
xor esi, esi
push ebx
call fcn.004d743c
push dword [ebp - 4]
mov bl, al
call fcn.004db7ab
add esp, 8
test eax, eax
jne 0x4b4fac
mov eax, dword [ebp - 8]
lea ecx, [eax - 1]
cmp esi, ecx
jne 0x4b4fa0
add eax, eax
push eax
push edi
mov dword [ebp - 8], eax
call fcn.004d73ea
mov edi, eax
add esp, 8
test edi, edi
je 0x4b504e
mov byte [esi + edi], bl
inc esi
cmp bl, 0xa
mov ebx, dword [ebp - 4]
jne 0x4b4f66
mov byte [esi + edi], 0
mov dword [ebp - 0xc], edi
cmp esi, 0xffffffff
je 0x4b504e
push 0xa
push edi
call fcn.004d0a10
add esp, 8
test eax, eax
je 0x4b4fce
mov byte [eax], 0
push 0xd
push edi
call fcn.004d0a10
add esp, 8
test eax, eax
je 0x4b4fe0
mov byte [eax], 0
mov esi, edi
mov al, byte [esi]
cmp al, 0x20
je 0x4b4fec
cmp al, 9
jne 0x4b4fef
inc esi
jmp 0x4b4fe2
mov ebx, dword [ebp - 4]
cmp al, 0x23
je 0x4b4f25
push 0x3d
push edi
call fcn.004d0a10
mov edi, eax
add esp, 8
test edi, edi
je 0x4b4f25
lea ecx, [edi - 1]
cmp ecx, esi
jb 0x4b5023
cmp byte [ecx], 0x20
jne 0x4b5023
mov byte [ecx], 0
dec ecx
cmp ecx, esi
jae 0x4b5016
mov byte [edi], 0
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [0x544ad0], 0
push edi
push esi
jne 0x4b5044
call fcn.00467bb0
jmp 0x4b4f22
call fcn.004e5a56
jmp 0x4b4f22
mov ebx, dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.004d2dae
push ebx
call fcn.004d5359
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x400
push str.malloc__lu__failed__n
push 2
call fcn.004d27a8
add esp, 4
push eax
call fcn.0040cba0
add esp, 0xc
push 1
call fcn.004d31f3
int3
Function at 0x4b50a0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53273c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push dword [0x5320a0]
mov dword [ebp - 0x210], eax
call fcn.004d4ed6
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4b51c7
lea edx, [ebp - 0x108]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4b50e4
mov esi, dword [str.ampl.env]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b5100
sub ecx, edx
lea edx, [ebp - 0x108]
push edi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4b5113
sub edx, edi
cmp ecx, edx
ja 0x4b5194
mov edi, esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4b5125
sub edi, ecx
mov eax, edx
sub eax, edi
mov ecx, esi
lea eax, [ebp + eax - 0x108]
nop dword [eax + eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x4b5160
test bl, bl
je 0x4b515c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x4b5160
add eax, 2
add ecx, 2
test bl, bl
jne 0x4b5140
xor eax, eax
jmp 0x4b5165
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b518e
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4b5170
sub esi, ecx
sub edx, esi
cmp edx, 0x104
jae 0x4b521d
mov byte [ebp + edx - 0x108], al
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004e6298
add esp, 8
pop edi
test eax, eax
je 0x4b51c7
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x108]
push eax
call fcn.004e661c
add esp, 4
jmp 0x4b51ce
mov byte [ebp - 0x20c], 0
push dword [0x5320ac]
call fcn.004d4ed6
push eax
push dword [ebp - 0x210]
call fcn.004b5230
add esp, 0xc
mov esi, eax
cmp byte [ebp - 0x20c], 0
je 0x4b520b
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.004e661c
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ceaf9
mov esp, ebp
pop ebp
ret
call fcn.004cee9d
int3
Function at 0x4b5900
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [0x544ad0], 0
push esi
push edi
jne 0x4b592c
call fcn.00467bb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
ret
call fcn.004e5a56
add esp, 8
pop edi
pop esi
pop ebp
ret