joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x4017b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x403186], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x4017f7
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x40180f
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402540
push 0x401dbc
push eax
mov eax, dword [0x403e84]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x403e80]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.00401db0
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x403e7c]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4020b8
push 0x4020b4
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4018aa
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4018a2
cmp al, 0x22
jne 0x401897
cmp byte [esi], 0x22
jne 0x4018b4
inc esi
jmp 0x4018b4
cmp al, 0x20
jbe 0x4018b4
inc esi
cmp byte [esi], 0x20
ja 0x4018ae
cmp byte [esi], 0
je 0x4018c4
cmp byte [esi], 0x20
ja 0x4018c4
inc esi
cmp byte [esi], 0
jne 0x4018b9
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4018e4
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x401920
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4012d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00401830
call fcn.004014d0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401308
jmp 0x4013a6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401307
cmp cl, 0x22
je 0x401360
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401380
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401380
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401340
jmp 0x401380
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401360
cmp cl, 0x22
je 0x4013e2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4013a0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x401390
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4013c4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00401290
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401380
Function at 0x402f70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402fac
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402fcc
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404be8
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403264
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404978
test esi, esi
jne 0x40329a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a68
jmp 0x4032b8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403108
mov edi, eax
test esi, esi
je 0x4032b8
cmp dword [ebx], 0
je 0x4032b8
dec esi
jmp 0x4032a1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x413020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403d08
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ce8
xor eax, eax
push ebp
push 0x403ce1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403d24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ce8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x413020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x413020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4047f8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x414044], 0
je 0x404859
cmp word [0x414218], 0xd7b2
jne 0x404821
cmp dword [0x414220], 0
jbe 0x404821
mov eax, 0x414214
call dword [0x414230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404880
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41302c], 0
jne 0x404875
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405ac4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cf4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b47
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405cf4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405b47
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405d10
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405bd0
xor eax, eax
push ebp
push 0x405bc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405900
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405bae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405d30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405bae
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bd0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405cea
cmp byte [ebp - 0xd], 0
jne 0x405c17
cmp byte [ebp - 0x12], 0
je 0x405cea
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405c30
dec ebx
cmp byte [ebx], 0x2e
je 0x405c3f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405c2f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405cea
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405c7c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cea
cmp byte [ebp - 0xd], 0
je 0x405cea
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405cea
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a49c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a4d5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a68
jmp 0x40a4de
mov eax, ebx
mov edx, esi
call fcn.004049cc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a4e8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a50a
movzx eax, byte [esp]
jmp 0x40a50c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40ab9c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40aa14
mov eax, dword [0x413bc0]
cmp byte [eax], 0
je 0x40ac18
mov eax, dword [0x413aec]
call fcn.004035fc
call fcn.00402efc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407dd8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ac60
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ac4e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x413acc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4167f0]
call fcn.004058a8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x410970
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x410af5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.0040366c
mov dword [ebp - 0x44], 0x44
cmp byte [ebp + 8], 0
je 0x4109ca
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], 0
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.0040366c
mov eax, dword [0x413c30]
cmp dword [eax], 2
jne 0x410a51
lea edx, [ebp - 0x48]
mov eax, ebx
call fcn.00406240
lea edx, [ebp - 0x4c]
mov eax, esi
call fcn.00406240
lea edx, [ebp - 0x50]
mov eax, edi
call fcn.00406240
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x50]
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea eax, [ebp - 0x48]
call fcn.00404fd0
lea eax, [ebp - 0x4c]
call fcn.00404fd0
lea eax, [ebp - 0x50]
call fcn.00404fd0
push esi
call sub.kernel32.dll_SetLastError
jmp 0x410abd
lea edx, [ebp - 0x54]
mov eax, ebx
call fcn.00406348
lea edx, [ebp - 0x58]
mov eax, esi
call fcn.00406348
lea edx, [ebp - 0x5c]
mov eax, edi
call fcn.00406348
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x44]
push eax

Function at 0x410b08
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x410b7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x413c30]
cmp dword [eax], 2
jne 0x410b44
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406240
mov eax, dword [ebp - 4]
call fcn.00405130
push eax
call sub.kernel32.dll_GetFileAttributesW
jmp 0x410b5c
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00406348
mov eax, dword [ebp - 8]
call fcn.00404d7c
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 0x10
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410b86
lea eax, [ebp - 8]
call fcn.00404978
lea eax, [ebp - 4]
call fcn.00404fd0
ret
Function at 0x410b90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x410c18
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x413c30]
cmp dword [eax], 2
jne 0x410be8
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x410bfa
mov edx, ebx
dec edx
lea eax, [ebp - 4]
call fcn.0040521c
mov eax, dword [ebp - 4]
call fcn.00405130
push eax
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00406184
jmp 0x410bfa
lea eax, [ebp - 8]
call fcn.00407dcc
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004062f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410c1f
lea eax, [ebp - 8]
call fcn.00404978
lea eax, [ebp - 4]
call fcn.00404fd0
ret

Function at 0x410ce8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x410d7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x413c30]
cmp dword [eax], 2
jne 0x410d38
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.00406240
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x410d5e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push 0
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406348
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410d83
lea eax, [ebp - 8]
call fcn.00404978
lea eax, [ebp - 4]
call fcn.00404fd0
ret
Function at 0x410fa8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov esi, eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x410fc5
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4110d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x413c30]
cmp dword [eax], 2
jne 0x411047
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00406240
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405130
mov edi, eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x411034
mov ebx, esi
dec ebx
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0040521c
push esi
mov eax, dword [ebp - 0x10]
call fcn.00405130
push eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
cmp ebx, eax
sete al
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00406184
jmp 0x4110ad
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xcb
je 0x4110ad
call fcn.0040c1c0
jmp 0x4110ad
lea edx, [ebp - 4]
mov eax, esi
call fcn.00406348
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d7c
mov edi, eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableA
mov esi, eax
test esi, esi
je 0x41109c
mov ebx, esi
dec ebx
mov edx, ebx
lea eax, [ebp - 8]
call fcn.00404f14
push esi
mov eax, dword [ebp - 8]
call fcn.00404d7c
push eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableA
cmp ebx, eax
sete al
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004062f8
jmp 0x4110ad
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xcb
je 0x4110ad
call fcn.0040c1c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4110dc
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404fe8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040499c
ret

Function at 0x4115d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x41164e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00410f0c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041112c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00406348
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x411664
call fcn.00404c6c
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404d7c
push eax
push 0x411690
push 0x411698
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411655
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040499c
ret
Function at 0x8fd1ff
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x89c2ca
mov esi, dword [ebp + 0xc]
cmc
test esi, esi
jmp 0x99c3c9
mov dword [ebp - 8], eax
jmp 0xcd7a0e
je 0x89c2ca
mov eax, dword [eax + ecx + 0x7c]
clc
push ebx
cmp bp, dx
push edi
mov dword [ebp - 0x10], eax
jmp 0x936487
jle 0xd39ec5
lea ebx, [esi + 1]
mov ecx, dword [ebp + 8]
cmp ebx, edi
jle 0x926aea
jmp 0xd39eec
je 0x9aa96d
sub eax, eax
pop esi
jmp 0xd4af9e
push edx
adc dl, ch
rcl edx, 0x5c
mov edx, dword [ebp + 0xc]
add eax, ecx
call fcn.00d00b8f
add esp, 4
test eax, eax
jmp 0x9d2a96
xor ebx, ebx
jmp 0x922134
push ebp
mov ebp, esp
add cx, di
mov ecx, dword [ebp + 8]
cmp di, 0x61f6
stc
sub esp, 0x114
cmp sp, sp
push esi
test edx, 0x26b81df9
jmp 0x905776
test ecx, ecx
jmp 0x85e8ae
dec edi
jmp 0xd239f7
mov eax, dword [ebp - 0xc]
adc dh, bl
sal esi, 0x66
mov edx, dword [ebp + 0x10]
btr esi, 0x3d
movsx esi, di
lea esi, [edi + ebx]
sar esi, 1
stc
clc
cmp bx, 0x4eb1
mov eax, dword [eax + esi*4]
jmp 0x8c0864
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0xce3bc8
jmp 0x86f69c
mov edi, dword [edx + ecx + 0x18]
cmc
test edi, edi
je 0xd39ef6
mov eax, dword [edx + ecx + 0x20]
cmp cx, dx
cmc
lea eax, [eax + ecx]
clc
jmp 0x8c2720
je 0x89c2ca
mov eax, 0x5a4d
cmp edx, 0x352c5d81
stc
cmp word [ecx], ax
jmp 0x89c2c4
ret
mov eax, dword [ecx + 0x3c]
stc
cmp bp, 0x6ab2
cmc
cmp dword [eax + ecx], 0x4550
jmp 0x9e95d7
jns 0x86f693
lea edi, [esi - 1]
jmp 0x93810b
jne 0x89c2ca
mov edx, dword [eax + ecx + 0x78]
cmp sp, 0x1249
clc
mov dword [ebp - 4], edx
test edi, 0x5f4a7f4d
test edx, edx
jmp 0x866179
ja 0x93f326
mov eax, esi
cmc
test bx, si
sub eax, dword [edx + ecx + 0x10]
jmp 0x863dd5
mov dword [ebp - 0xc], eax
js 0xd39ef6
jmp 0x926af2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
and edx, esp
mov edx, dword [ecx + eax + 0x24]
lea ecx, [edx + esi*2]
not edx
btc dx, 0xa9
movzx edx, word [ecx + eax]
add ecx, ebp
and ecx, 0x70cb6872
mov dword [ebp - 8], edx
mov ecx, eax
mov edx, dword [ebp - 4]
movzx ax, ah
sal al, 0x71
mov esp, ebp
pop ebp
jmp 0x9a9be7

Function at 0xfbcc31
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
jmp 0xfd9329
cmp edi, 0x6a4abc5b
movzx ebx, si
mov ebx, dword [edx + 0x10]
jmp 0xfb8313
jmp 0xf5065f
jl 0xfb2d57
sub al, 0x20
ror edi, 0xd
cmc
add edi, eax
jmp 0xf52d9a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0xf7cb5c
mov edx, dword [edx]
jne 0xfbcc61
mov eax, ebx
jmp 0xfb80c8
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cmovns cx, di
xchg cx, cx
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
shl si, 0x56
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
and si, 0x3ca9
mov si, bp
rol cx, cl
mov esi, dword [edx + 0x28]
sub ch, bh
movsx cx, cl
push 0x18
test esp, ebp
bts cx, bp
pop ecx
xor edi, edi
sub eax, eax
mov al, dl
lodsb al, byte [esi]
test dl, 0xf
clc
cmp al, 0x61
jmp 0xfb2d4f
loop 0xfd9330
jmp 0xf57d28
jmp 0xfbcc75