joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10002ebf
pop dword [ebp - 0x10]
mov eax, 0xfdb2e4db
add eax, 0x124d49e4
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x9e851729
sub dword [ebp - 0x20], 0x5032d1de
mov dword [ebp - 0x1c], 0xc14bc6a7
add dword [ebp - 0x1c], 0x70e7859e
mov dword [ebp - 0x18], 0x2988ec7d
add dword [ebp - 0x18], 0x22c357b1
mov dword [ebp - 0x14], 0xbfeee01b
sub dword [ebp - 0x14], 0xbfeee01b
lea eax, [ebp - 0x20]
push eax
mov eax, 0xaedffb3e
add eax, 0x612194fe
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xba3cc05c
add dword [ebp - 0x20], 0xba35a8fa
mov dword [ebp - 0x1c], 0x6dc373e
add dword [ebp - 0x1c], 0x3a902a37
mov dword [ebp - 0x18], 0x3c8c8d8b
add dword [ebp - 0x18], 0x26e2dee1
mov dword [ebp - 0x14], 0x2e1f2167
add dword [ebp - 0x14], 0xd1e0de99
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xc1017dc2
sub eax, 0xb0ffed8a
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38f3a
push 0
call eax
mov ecx, 0xfd1a06fe
sub ecx, 0xfd19b8b4
mov edi, eax
mov ebx, 0x754565bf
add ebx, 0x9abcc241
add ebx, dword [ebp - 0x10]
mov edx, 0xace15c00
sub dword [ebp - 4], esi
mov esi, dword [ebx]
xor dword [ebp - 0xc], edx
sub esi, edx
sub dword [ebp - 0xc], 0xa61a8b0b
mov dword [edi], esi
add dword [ebp - 4], 0x81b8ff0c
add edi, 0x7341e794
sub edi, 0x7341e790
add ebx, 0xa83cf8bd
add ebx, 0x57c30747
loop 0x10002fdb
add eax, 0x12bfb
xor ebx, ebx
add ebx, eax
add eax, 0xbefa71ff
sub eax, 0xbefa71fa
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401100
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437004]
jne 0x40110a
repz ret
jmp fcn.004014dc

Function at 0x408cfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404a5e
and dword [ebp - 0x14], 0
cmp dword [0x439c74], 0
mov dword [ebp - 0x18], eax
jne 0x408daf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x439c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x439c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x439c7c], eax
call edi
push eax
call esi
mov dword [0x439c84], eax
test eax, eax
je 0x408daf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x439c80], eax
mov eax, dword [0x439c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408e08
cmp dword [0x439c84], ecx
je 0x408e08
push eax
call esi
push dword [0x439c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408e08
test ebx, ebx
je 0x408e08
call edi
test eax, eax
je 0x408dff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408dff
test byte [ebp - 8], 1
jne 0x408e08
or dword [ebp + 0x10], 0x200000
jmp 0x408e3b
mov eax, dword [0x439c78]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e3b
mov eax, dword [0x439c7c]
cmp eax, dword [ebp - 0x18]
je 0x408e3b
push eax
call esi
test eax, eax
je 0x408e3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439c74]
call esi
test eax, eax
je 0x408e57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401100
leave
ret
Function at 0x42b910
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x437db0]
push ebx
mov ebx, dword [0x2bdd234]
push edi
mov edi, dword [0x2bdf6b4]
call fcn.0042b880
cmp dword [0x2bdf6b4], 0x2f
jne 0x42b97d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0042b8b0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401100
add esp, 0x24
ret
Function at 0x42bc70
Capabilities:
Get disk information
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x437004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x42bc95
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x42bcde
mov dword [0x2bdf31c], 0x8e46a6f0
cmp dword [0x2bdf6b4], 0x3dc
jne 0x42bcdc
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x42bc8c
mov dword [ebp - 0x10], 0
jmp 0x42bcf0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x42bd8b
cmp dword [0x2bdf6b4], 0xa5f
jne 0x42bd42
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x42bd66
mov edx, dword [0x438bd0]
mov dword [0x2bdf6b4], edx
mov eax, dword [0x2bdf6b4]
add eax, 0xa231
mov dword [0x2bdf6b4], eax
cmp dword [0x2bdf6b4], 0x141
jne 0x42bd86
mov dword [0x43a1a0], 0xec58acac
mov dword [0x43a1a4], 0xffffffff
jmp 0x42bce7
call fcn.0042b9a0
jmp dword [0x2bdd234]
Function at 0x10014f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10014f9f
pop dword [ebp - 8]
mov eax, 0x10014f9f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x57e4ff65
sub dword [ebp - 0x18], 0x992ba1a
mov dword [ebp - 0x14], 0x1ca3d5de
add dword [ebp - 0x14], 0x158f7667
mov dword [ebp - 0x10], 0x5d952b7
add dword [ebp - 0x10], 0x4672f177
mov dword [ebp - 0xc], 0x1932622e
sub dword [ebp - 0xc], 0x1932622e
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe870055e
sub eax, 0xd86e750e
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x38338cda
sub dword [ebp - 0x18], 0xc3c12384
mov dword [ebp - 0x14], 0x67621e8a
add dword [ebp - 0x14], 0xda0a42eb
mov dword [ebp - 0x10], 0xecc99997
sub dword [ebp - 0x10], 0x895a2d2b
mov dword [ebp - 0xc], 0xba18e575
sub dword [ebp - 0xc], 0xba18e575
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x5cfcb335
sub eax, 0x4cfb22e1
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35e1c
push 0
call eax
mov ecx, 0x3883440
add ecx, 0xfc781135
xor edi, edi
add edi, eax
mov ebx, 0x537d8c1a
add ebx, 0xbc848de6
add ebx, dword [ebp - 8]
mov edx, 0x7e08b625
add edx, 0xe89fc7a7
xor dword [ebp - 4], 0x77189bbc
mov esi, dword [ebx]
add dword [ebp - 4], edi
add esi, edx
add dword [ebp - 4], 0xb4b900ee
mov dword [edi], esi
add dword [ebp - 4], 0x2e53c3cc
add edi, 0x3a857acd
add edi, 0xc57a8537
add ebx, 0x2199bc0b
add ebx, 0xde6643f9
loop 0x100150be
add eax, 0xc504700e
sub eax, 0xc5036767
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x40274c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403f70
test esi, esi
jne 0x402782
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404060
jmp 0x4027a0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402660
mov edi, eax
test esi, esi
je 0x4027a0
cmp dword [ebx], 0
je 0x4027a0
dec esi
jmp 0x402789
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40800c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4034b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403498
xor eax, eax
push ebp
push 0x403491
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403498
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40800c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40800c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403df4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x409034], 0
je 0x403e55
cmp word [0x409208], 0xd7b2
jne 0x403e1d
cmp dword [0x409210], 0
jbe 0x403e1d
mov eax, 0x409204
call dword [0x409220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40809c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e7c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x408018], 0
jne 0x403e71
push 0
push 0x4080bc
push 0x40809c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4054d8
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40569c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042cc
xor eax, eax
push ebp
push 0x405725
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x20e]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004042dc
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jne 0x4056fd
mov eax, ebx
call fcn.00403f70
jmp 0x40570f
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004040cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40572c
lea eax, [ebp - 4]
call fcn.00403f70
ret
Function at 0x405860
Capabilities:
Create thread

Disassembly:
push ebx
push edx
push 0
push eax
push 0x405840
push 0
push 0
call sub.kernel32.dll_CreateThread
mov ebx, eax
test ebx, ebx
jne 0x405883
mov eax, 0x405890
call fcn.00404de8
mov eax, ebx
pop ebx
ret

Function at 0x405ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042cc
mov eax, dword [ebp - 8]
call fcn.004042cc
xor eax, eax
push ebp
push 0x405c4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
mov edx, 0x44
call fcn.00404bf8
lea eax, [ebp - 0x64]
mov edx, 0x10
call fcn.00404bf8
mov dword [ebp - 0x54], 0x44
cmp dword [ebp - 8], 0
jne 0x405b34
xor ebx, ebx
jmp 0x405b5b
push 0x405c68
push dword [ebp - 4]
push 0x405c74
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004041a4
mov eax, dword [ebp - 0x10]
call fcn.004042dc
mov ebx, eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.004042dc
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x405b9a
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 4]
mov edx, 0x405c80
call fcn.00404130
mov eax, dword [ebp - 0x68]
call fcn.00404de8
xor eax, eax
push ebp
push 0x405c18
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x405bcf
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 4]
mov edx, 0x405ca4
call fcn.00404130
mov eax, dword [ebp - 0x6c]
call fcn.00404de8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x405bf8
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 4]
mov edx, 0x405cc8
call fcn.00404130
mov eax, dword [ebp - 0x70]
call fcn.00404de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c1f
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x405e30
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x14]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x405e55
mov eax, 0x405ec8
call fcn.00404de8
lea eax, [ebp - 0xc]
push eax
push 0x405ee4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x405ea2
mov eax, 0x405f00
call fcn.00404de8
push 2
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x405eb9
mov eax, 0x405f2c
call fcn.00404de8
mov esp, ebp
pop ebp
ret
Function at 0x405f3c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004042cc
mov eax, dword [ebp - 8]
call fcn.004042cc
mov eax, dword [ebp + 8]
call fcn.004042cc
xor eax, eax
push ebp
push 0x406016
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004042dc
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x405fef
xor eax, eax
push ebp
push 0x405fe8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004040e4
inc eax
push eax
mov eax, dword [ebp + 8]
call fcn.004042dc
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004042dc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ff3
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40601d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f94
lea eax, [ebp + 8]
call fcn.00403f70
ret

Function at 0x406028
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor edx, edx
push ebp
push 0x4060a8
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x406059
push 0
mov ecx, 0x4060bc
mov edx, 0x4060cc
mov eax, 0x80000001
call fcn.00405f3c
jmp 0x40608d
lea edx, [ebp - 8]
xor eax, eax
call fcn.0040274c
mov eax, dword [ebp - 8]
call fcn.004042dc
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404090
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4060bc
mov edx, 0x4060cc
mov eax, 0x80000001
call fcn.00405f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060af
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f94
ret

Function at 0x406100
Capabilities:
Shutdown system

Disassembly:
cmp eax, 0xbc2
jne 0x40614b
xor eax, eax
call fcn.00406028
push 0x2004
push 0x40615c
push 0x40616c
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 7
jne 0x40612e
call fcn.00403e80
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x406141
call fcn.00405e30
jmp 0x406159
push 2
push 2
call sub.user32.dll_ExitWindowsEx
ret
test eax, eax
je 0x406159
mov eax, 0x4061e4
call fcn.00404de8
ret
Function at 0x406308
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042cc
xor eax, eax
push ebp
push 0x406381
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004042dc
push eax
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x406363
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x40635b
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x40635f
xor ebx, ebx
jmp 0x40636b
mov bl, 1
jmp 0x40636b
xor ebx, ebx
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406388
lea eax, [ebp - 4]
call fcn.00403f70
ret

Function at 0x406390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042cc
mov eax, dword [ebp - 8]
call fcn.004042cc
xor eax, eax
push ebp
push 0x406494
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403f70
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004042dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406479
xor eax, eax
push ebp
push 0x406472
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004042dc
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40645b
cmp dword [ebp - 0x10], 1
jne 0x40645b
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.0040440c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.004042dc
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x14]
dec edx
mov eax, ebx
call fcn.0040440c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406479
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40649b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f94
ret
Function at 0x10005a08
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010488
push 0x10010480
push str.FlsAlloc
push 0x1e
call fcn.10005926
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10005a3c
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f124]
call esi
jmp 0x10005a42
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10005a86
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010498
push 0x10010490
push str.FlsGetValue
push 0x20
call fcn.10005926
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10005abd
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f124]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10008458
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100084f5
push ebx
push esi
call fcn.10008421
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000836a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100084a2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100084f4
push edi
push eax
call fcn.10008a10
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100084c2
call fcn.100057d3
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100084f3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000836a
add esp, 0x20
test eax, eax
jne 0x100084e1
push edi
call fcn.100057d3
jmp 0x100084e9
push ebx
call fcn.100057d3
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000bbb3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10015f10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1000bbf3
cmp byte [ebx], 0xa
jne 0x1000bbf3
or byte [eax + edi + 0x28], 4
jmp 0x1000bbf8
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1000bcf6
mov al, byte [edx]
cmp al, 0x1a
je 0x1000bcd8
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1000bc27
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1000bc4c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1000bc56
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1000bc09
jmp 0x1000bcf6
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000bcd3
cmp dword [ebp - 0xc], 0
je 0x1000bcd3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10015f10]
test byte [eax + edi + 0x28], 0x48
je 0x1000bcad
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1000bc98
mov byte [esi], dl
jmp 0x1000bca9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10015f10]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1000bcf6
cmp byte [ebp - 1], 0xa
jne 0x1000bcbc
cmp esi, ebx
jne 0x1000bcbc
mov byte [esi], 0xa
jmp 0x1000bcf5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1000bb23
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1000bcf6
mov byte [esi], 0xd
jmp 0x1000bcf5
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10015f10]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1000bcf2
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1000bcf6
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret