joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b4b8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b602
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044aaec
xor eax, eax
push ebp
push 0x44b5e5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x44b51d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44b51d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x44b5cf
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44b530
call fcn.0040363c
jmp 0x44b5ec
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44b5cf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44b5cf
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00403020
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44b5cf
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040ab7c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44b61c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x46d058]
mov dl, 1
mov eax, dword [0x449ef4]
call fcn.0040b4b4
call fcn.0040359c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b5ec
mov eax, dword [ebp - 4]
call fcn.0044aaf8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b609
lea eax, [ebp - 0x28]
call fcn.00403ae8
ret
Function at 0x44be8c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44bf64
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46ea04], 0
jne 0x44bf48
lea eax, [ebp - 4]
mov edx, 0x44bf7c
call fcn.00403b80
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403f2c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x44bf48
mov eax, ebx
call fcn.004026d8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44bf41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x44bf2b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x44bf8c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x44bf2b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x46ea04], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf48
mov eax, dword [ebp - 0xc]
call fcn.004026f0
ret
mov ebx, dword [0x46ea04]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf6b
lea eax, [ebp - 4]
call fcn.00403ae8
ret

Function at 0x44c404
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0044c140
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f2c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x44c462
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46cf64]
mov dl, 1
mov eax, dword [0x44c038]
call fcn.0040b4b4
call fcn.0040359c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44c46c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f2c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x44c4c4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46d144]
mov dl, 1
mov eax, dword [0x44c038]
call fcn.0040b4b4
call fcn.0040359c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044c170
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44d1a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [0x44d1ec]
mov byte [ebp - 1], al
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44d1c4
or byte [ebp - 1], 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44d1d4
or byte [ebp - 1], 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44d1e4
or byte [ebp - 1], 2
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x44ead0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [0x46cfe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44eafd
push 0
mov eax, dword [0x46cfe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret
Function at 0x44f640
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 8
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x44f68e
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 1
push 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x44f68e
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x44f6b8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 5], 0
je 0x44f6d6
mov dword [ebp - 0x10], 1
push 4
lea eax, [ebp - 0x10]
push eax
push 8
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_setsockopt
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x44f738
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
je 0x44f7b4
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 3
je 0x44f7ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
cmp byte [ebp - 5], 0
je 0x44f77b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
and dword [eax + 0xc], 0x7ffffffe
jmp 0x44f789
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
or dword [eax + 0xc], 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xc]
je 0x44f7ac
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x44f7bb
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x450474
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
je 0x45054f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 3
jne 0x4504e6
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x4504ab
call fcn.00402d7c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test eax, eax
jns 0x4504bf
call fcn.00402d7c
push eax
call sub.kernel32.dll_ReadFile_2
test eax, eax
jne 0x4504d5
mov dword [ebp - 0x10], 0xffffffff
jmp 0x450556
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x4504e1
call fcn.00402d7c
mov dword [ebp - 0x10], eax
jmp 0x450556
mov eax, dword [ebp - 4]
cmp byte [eax + 0xe4], 0
je 0x45050d
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv_1
mov dword [ebp - 0x10], eax
jmp 0x450556
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe0]
test edx, edx
jns 0x45051f
call fcn.00402d7c
mov eax, dword [ebp - 4]
call fcn.004503dc
test al, al
je 0x450546
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv_1
mov dword [ebp - 0x10], eax
jmp 0x450556
mov dword [ebp - 0x10], 0xffffffff
jmp 0x450556
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4505ac
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
je 0x450636
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 3
jne 0x450619
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x4505df
call fcn.00402d7c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test eax, eax
jns 0x4505f5
call fcn.00402d7c
push eax
call sub.kernel32.dll_WriteFile_2
test eax, eax
jne 0x450608
mov dword [ebp - 0x10], 0xffffffff
jmp 0x45063d
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x450614
call fcn.00402d7c
mov dword [ebp - 0x10], eax
jmp 0x45063d
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send_1
mov dword [ebp - 0x10], eax
jmp 0x45063d
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x45b4d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x25]
mov eax, dword [ebp - 8]
mov ecx, 8
call fcn.0040285c
mov byte [ebp - 0x1d], 0
cmp dword [ebp - 0xc], 0
je 0x45b5d5
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
je 0x45b5d5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0045b218
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x25]
call fcn.0045b218
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 0x18]
test ecx, ecx
jns 0x45b54a
call fcn.00402d7c
mov edx, dword [ebp - 0x14]
xor edx, dword [ebp - 0x1c]
test edx, edx
jns 0x45b559
call fcn.00402d7c
lea eax, [ebp - 0x50]
call fcn.0045b3bc
jmp 0x45b594
lea eax, [ebp - 0x50]
call fcn.0045b46c
fmul dword [0x45b5e0]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0045b41c
add eax, 0x40
jno 0x45b587
call fcn.00402d84
mov edx, dword [ebp - 0x34]
mov byte [edx], al
add dword [ebp - 0x34], 1
add dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
cmp byte [eax], 0
jne 0x45b563
lea eax, [ebp - 0x50]
call fcn.0045b46c
fmul dword [0x45b5e0]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0045b41c
mov byte [ebp - 0x35], al
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
je 0x45b5d5
mov al, byte [ebp - 0x35]
mov edx, dword [ebp - 0x30]
xor byte [edx], al
add dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jne 0x45b5c1
mov eax, dword [ebp - 0x34]
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x45f930
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f2c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jns 0x45f957
call fcn.00402d7c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x45f993
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040409c
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x45f977
call fcn.00402d7c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403f2c
push eax
mov eax, dword [ebp - 4]
call fcn.00403f2c
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
jmp 0x45f9a0
mov eax, dword [ebp - 8]
call fcn.00403ae8
call fcn.0040c59c
mov esp, ebp
pop ebp
ret
Function at 0x4628cc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4628d4
xor eax, eax
push ebp
push 0x462ab0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x46cf4c]
mov eax, dword [eax]
call fcn.0045edb0
test al, al
jne 0x462903
mov eax, 0x462ac4
call fcn.00462254
mov eax, 0x462ad4
call fcn.004616c0
mov dword [ebp - 4], 0x2328
mov eax, dword [ebp - 4]
add eax, 0xffffdcd8
cmp eax, 0x31
jbe 0x462926
call fcn.00402d7c
add eax, 0x2328
imul eax, eax, 0x28
jno 0x462935
call fcn.00402d84
mov edx, dword [0x46cd98]
mov byte [edx + eax*8 - 0x2bf200], 0
push 0x462afc
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040838c
push dword [ebp - 0x10]
push 0x462b38
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e28
mov al, byte [0x462b3c]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x462b48
mov edx, 0x462b54
mov eax, dword [ebp - 0xc]
call fcn.0040c468
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00403b80
mov eax, dword [ebp - 0xc]
call fcn.004625d0
test al, al
je 0x4629f3
mov eax, dword [0x46ce0c]
mov eax, dword [eax]
xor edx, edx
call fcn.0045f610
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00403ca0
mov eax, dword [ebp - 0x18]
call fcn.004083f0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 0xffffdcd8
cmp eax, 0x31
jbe 0x4629d0
call fcn.00402d7c
add eax, 0x2328
imul eax, eax, 0x28
jno 0x4629df
call fcn.00402d84
mov edx, dword [0x46cd98]
cmp dword [ebp - 8], 0
setg cl
mov byte [edx + eax*8 - 0x2bf200], cl
mov eax, dword [ebp - 4]
add eax, 0xffffdcd8
cmp eax, 0x31
jbe 0x462a05
call fcn.00402d7c
add eax, 0x2328
imul eax, eax, 0x28
jno 0x462a14
call fcn.00402d84
mov edx, dword [0x46cd98]
cmp byte [edx + eax*8 - 0x2bf200], 0
je 0x462a53
push 0x462b60
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040838c
push dword [ebp - 0x20]
push 0x462b70
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e28
mov eax, dword [ebp - 0x1c]
call fcn.004616c0
jmp 0x462a80
push 0x462b60
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0040838c
push dword [ebp - 0x28]
push 0x462b84
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403e28
mov eax, dword [ebp - 0x24]
call fcn.004616c0
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x235a
jne 0x462914
call fcn.00462510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462ab7
lea eax, [ebp - 0x28]
mov edx, 8
call fcn.00403b0c
ret
Function at 0x4698e8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
mov eax, dword [0x472c78]
call fcn.00403f2c
push eax
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46994b
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetCommandLineA_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00469778
imul eax, eax, 1
jae 0x46992b
call fcn.00402d84
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4a
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
cmp eax, 0xda860081
jne 0x46994b
call fcn.00403994
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403e59
pop dword [ebp - 0x24]
mov eax, 0x915098ec
sub eax, 0x91105a93
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x6ab26986
sub dword [ebp - 0x34], 0x1c60243b
mov dword [ebp - 0x30], 0x6aa159bb
add dword [ebp - 0x30], 0xc791f28a
mov dword [ebp - 0x2c], 0x50f6167d
sub dword [ebp - 0x2c], 0x4a9d24f
mov dword [ebp - 0x28], 0xb86c893
sub dword [ebp - 0x28], 0xb86c893
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xd604d458
add dword [ebp - 0x34], 0x9e6d94fe
mov dword [ebp - 0x30], 0x5f29b25d
add dword [ebp - 0x30], 0xe242af18
mov dword [ebp - 0x2c], 0x1d5d5353
add dword [ebp - 0x2c], 0x46121919
mov dword [ebp - 0x28], 0xbe572a91
add dword [ebp - 0x28], 0x41a8d56f
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x336a5
push 0
call eax
mov ecx, 0x6435a6c2
sub ecx, 0x64356c16
xor edx, edx
add edx, eax
mov ebx, 0x86a2594d
sub ebx, 0x8661494d
add ebx, dword [ebp - 0x24]
mov edi, 0xf0efb0a
add edi, 0x11ea786b
sub dword [ebp - 4], esi
mov esi, dword [ebx]
xor dword [ebp - 0x20], ebx
add esi, edi
xor dword [ebp - 0x14], esi
mov dword [edx], esi
add dword [ebp - 8], 0xe277701a
add edx, 0x968fe4e9
sub edx, 0x968fe4e5
add ebx, 0xf11b8acf
sub ebx, 0xf11b8acb
loop 0x403f73
add eax, 0x587282a5
sub eax, 0x5871a522
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x414eb162
add ecx, 0xbef14e9e
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x403543
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00402f22
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40359e
push dword [ebp - 0x14]
mov edx, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00403280
mov esi, eax
pop ecx
pop ecx
test esi, esi
jns 0x40359e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop esi
leave
ret

Function at 0x404ac2
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call fcn.0040490d
mov esi, eax
test esi, esi
je 0x404c3f
push 0x4011d4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4011e0
push esi
mov dword [0x40eb2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4011ec
push esi
mov dword [0x40eb30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4011f8
push esi
mov dword [0x40eb34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x40eb2c], 0
mov dword [0x40eb38], eax
je 0x404b38
cmp dword [0x40eb30], 0
je 0x404b38
cmp dword [0x40eb34], 0
je 0x404b38
test eax, eax
jne 0x404b60
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x40eb30], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x40eb34], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x40eb2c], 0x404680
mov dword [0x40eb38], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x40e01c], eax
cmp eax, 0xffffffff
je 0x404c44
push dword [0x40eb30]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x404c44
call fcn.00404e72
push dword [0x40eb2c]
call fcn.00404732
push dword [0x40eb30]
mov dword [0x40eb2c], eax
call fcn.00404732
push dword [0x40eb34]
mov dword [0x40eb30], eax
call fcn.00404732
push dword [0x40eb38]
mov dword [0x40eb34], eax
call fcn.00404732
add esp, 0x10
mov dword [0x40eb38], eax
call fcn.00408b65
test eax, eax
je 0x404c3f
push 0x4047b0
push dword [0x40eb2c]
call fcn.004046bd
pop ecx
mov esi, eax
mov ecx, eax
call dword [0x41112c]
call esi
mov dword [0x40e018], eax
cmp eax, 0xffffffff
je 0x404c3f
push 0x214
push 1
call fcn.00408bcc
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x404c3f
push edi
push dword [0x40e018]
push dword [0x40eb34]
call fcn.004046bd
pop ecx
mov esi, eax
mov ecx, eax
call dword [0x41112c]
call esi
test eax, eax
jne 0x404c49
push edi
call fcn.00405c00
pop ecx
call fcn.00404c5c
xor eax, eax
pop edi
pop esi
ret
push 0
push edi
call fcn.004049e9
pop ecx
pop ecx
or dword [edi + 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x404c46
Function at 0x4050c1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov esi, ebx
cmp edi, dword [esi*8 + 0x401278]
je 0x4050e0
inc esi
cmp esi, 0x17
jb 0x4050d1
cmp esi, 0x17
jae 0x405220
push 3
call fcn.004091ae
pop ecx
cmp eax, 1
je 0x4051ea
push 3
call fcn.004091ae
pop ecx
test eax, eax
jne 0x405113
cmp dword [section..data], 1
je 0x4051ea
cmp edi, 0xfc
je 0x405220
push 0x401888
push 0x314
mov edi, 0x40eb70
push edi
call fcn.004090bf
add esp, 0xc
test eax, eax
je 0x405148
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00406e88
add esp, 0x14
push 0x104
push 0x40eb89
push ebx
mov byte [0x40ec8d], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40518b
push 0x4018a4
push 0x2fb
push 0x40eb89
call fcn.004090bf
add esp, 0xc
test eax, eax
je 0x40518b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00406e88
add esp, 0x14
push 0x4018bc
push 0x314
push edi
call fcn.0040912f
add esp, 0xc
test eax, eax
je 0x4051af
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00406e88
add esp, 0x14
push dword [esi*8 + 0x40127c]
push 0x314
push edi
call fcn.0040912f
add esp, 0xc
test eax, eax
je 0x4051d5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00406e88
add esp, 0x14
push 0x12010
push 0x4018c0
push edi
call fcn.004091fa
add esp, 0xc
jmp 0x405220
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, eax
test edx, edx
je 0x405220
cmp edx, 0xffffffff
je 0x405220
mov esi, dword [esi*8 + 0x40127c]
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405209
push ebx
lea eax, [ebp - 4]
sub ecx, edi
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405975
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x405a07
xor edx, edx
push esi
mov esi, edi
cmp word [edi], dx
je 0x4059aa
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4059a5
add esi, 2
movzx ecx, word [esi]
test cx, cx
jne 0x405992
push ebx
push edx
push edx
push edx
sub esi, edi
push edx
sar esi, 1
inc esi
push esi
push edi
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x4059fc
push eax
call fcn.00407b93
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4059fc
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push ebx
push esi
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4059f1
push ebx
call fcn.00405c00
pop ecx
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x405a05
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret