joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010c870
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.10061200
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x1010c9dd
cmp dword [ebp + 0xc], 0
je 0x1010c9dd
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push 0x10175774
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1010cdf0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1010c9c0
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.10129ae0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1010c9b5
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.10129ae0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.1010d3f0
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.1010cd80
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1010c9ca
inc esi
cmp esi, 0x10
jl 0x1010c8b0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
Function at 0x1010c9f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x1010cad8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10129ae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x1010cad8
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1010ca47
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x1010cad8
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1010ca70
mov eax, dword [0x10175764]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1010ca85
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1010caa0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10061045
mov esp, ebp
pop ebp
ret
Function at 0x1010caf0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.10129ae0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.1010bfb0
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1010cb5a
mov al, byte [edi + ecx]
test al, al
je 0x1010cb5a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1010cb41
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x1010cb7b
inc eax
sub ecx, 1
jne 0x1010cb70
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x1010cbd0
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x1010cbc5
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x1010cbc4
mov bl, byte [edi + ecx]
test bl, bl
je 0x1010cbc4
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x1010cbb0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.10129ae0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x1017586c
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x1010cc8a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1010cc54
test cl, cl
je 0x1010cc50
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1010cc54
add eax, 2
add esi, 2
test cl, cl
jne 0x1010cc34
xor eax, eax
jmp 0x1010cc59
sbb eax, eax
or eax, 1
test eax, eax
je 0x1010cc8a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1010cc66
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1010cc93
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x1017586c
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10061045
mov esp, ebp
pop ebp
ret
Function at 0x1010dfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x1010e0a7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x1010dff5
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x1010f900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159943
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x101991d8]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010f7f0
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x1010fae1
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.10129ae0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x10176d04
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010fae1
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x1010f9d5
cmp eax, 2
jne 0x1010fae1
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x1010f9f6
test cl, 1
jne 0x1010fae1
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x1010f9fc
jmp 0x1010fae1
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x1010fae1
call fcn.1000b6b0
mov ecx, eax
test ecx, ecx
je 0x1010fb0c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.1010da50
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x10176d0c
push eax
call fcn.10013e70
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.1010dfe0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x1010fac5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1010fa66
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.1010fb20
push dword [0x101991e0]
lea eax, [ebp - 0x74]
push dword [0x101991dc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1010faa2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1010fabe
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x1010fae3
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1010fae1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x1010faee
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000b280
int3
Function at 0x1010fc00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159978
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101933a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x101991d8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010f7f0
test eax, eax
je 0x1010fd28
mov esi, dword [ebp - 0x18]
mov edi, dword [0x101991d8]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x1010fcd3
cmp dword [esi], 0
je 0x1010fcc6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1010fc93
mov eax, 1
jmp 0x1010fcf4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1010fccc
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x1010fcf4
cmp dword [esi + 4], 0
jne 0x1010fcd3
mov eax, 1
jmp 0x1010fcf4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010fd1e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1010fd06
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x1010fd2b
xor ebx, ebx
jmp 0x1010fdcf
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x1010fdcf
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x1010fd88
mov ecx, dword [ebx]
test ecx, ecx
je 0x1010fdee
push ecx
push eax
call fcn.1013026a
add esp, 8
test eax, eax
je 0x1010fd88
mov edx, dword [edi]
test edx, edx
je 0x1010fd88
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1010fd60
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x1010fd93
lea eax, [edx + 0xd]
jmp 0x1010fdc8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1010fda0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x10176d04
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x1010fdda
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000b280
int3
Function at 0x101114e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10111551
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1011151f
cmp eax, 2
jne 0x1011153b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1011154b
test ecx, ecx
je 0x10111546
test cl, 1
jne 0x1011153b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1011154b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x101131b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10146c84
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10146b03

Function at 0x1014c7aa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014c46a
Function at 0x401be4
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2130
call fcn.0042335c
push edi
push esi
push ebx
add esp, 0xfffffffc
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push 0x401bcc
call fcn.0041ac58
mov esi, eax
add esp, 0x20
cmp esi, 0xffffffff
jne 0x401c40
add esp, 0xfffffffc
push 0x2000
push 0xff
lea ebx, [esp + 0x13c]
push ebx
call sub.msvcrt40.dll_memset
add esp, 0x10
jmp 0x401c66
add esp, 0xfffffff4
push 0
lea eax, [esp + 0x2c]
push eax
push 0x2000
lea ebx, [esp + 0x148]
push ebx
push esi
call sub.KERNEL32.dll_ReadFile
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov edi, ebx
add esp, 0xfffffff8
push 0x105
lea ebx, [esp + 0x2c]
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x401bd7
push ebx
call sub.KERNEL32.dll_lstrcatA
push 0x401bd9
push ebx
call sub.KERNEL32.dll_lstrcatA
add esp, 0xfffffff4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call fcn.0041ac58
mov esi, eax
add esp, 0x30
cmp esi, 0xffffffff
je 0x401cd4
add esp, 0xfffffff4
push 0
lea eax, [esp + 0x28]
push eax
push 0x2000
push edi
push esi
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
pop ebx
pop esi
pop edi
add esp, 0x2130
ret
Function at 0x404330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push edi
push esi
push ebx
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
add esp, 0xfffffff4
mov eax, dword [esi]
push eax
call sub.msvcrt40.dll_malloc
mov ecx, eax
mov dword [ebx], ecx
add esp, 0x10
test ecx, ecx
jne 0x404360
mov eax, 0xffffffff
jmp 0x404430
mov dword [0x44e920], 0
mov dword [0x44e930], 0
mov dword [0x44e940], 0
mov ebx, esi
xor edx, edx
lea edi, [esp + 0x1c]
mov eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x1c], eax
mov esi, dword [ebx]
add ebx, 4
cmp edx, esi
jge 0x4043bc
mov al, byte [0x44e920]
xor byte [edx + ebx], al
mov eax, dword [0x44e920]
imul eax, dword [0x44e930]
inc edx
add eax, dword [0x44e940]
mov dword [0x44e920], eax
cmp edx, esi
jl 0x404398
push esi
push ebx
push edi
push ecx
call fcn.0041fbf0
add esp, 0x10
test eax, eax
je 0x4043d6
mov dword [esp + 0x1c], 0
xor esi, esi
mov dword [0x44e920], 0
mov dword [0x44e930], 0
mov dword [0x44e940], 0
xor edx, edx
lea ecx, [esi + 8]
cmp edx, esi
jge 0x404424
lea esi, [esi]
mov al, byte [0x44e920]
xor byte [edx + ebx], al
mov eax, dword [0x44e920]
imul eax, dword [0x44e930]
inc edx
add eax, dword [0x44e940]
mov dword [0x44e920], eax
cmp edx, esi
jl 0x404400
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov dword [eax], edx
mov eax, ecx
pop ebx
pop esi
pop edi
add esp, 0x20
ret

Function at 0x407b6c
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x120
mov dword [0x536f20], 0
push edi
push esi
push ebx
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetCommandLineA
push eax
lea ebx, [esp + 0x1c]
push ebx
call sub.KERNEL32.dll_lstrcpyA
xor edx, edx
add esp, 8
mov esi, ebx
mov al, byte [esp + 0x10]
jmp 0x407ba4
inc edx
mov al, byte [edx + esi]
test al, al
je 0x407bb0
cmp al, 0x20
je 0x407ba0
cmp al, 9
je 0x407ba0
mov al, byte [edx + esi]
cmp al, 0x22
jne 0x407be0
lea edi, [edx + 1]
mov edx, edi
mov al, byte [edi + esi]
test al, al
je 0x407c00
cmp al, 0x22
je 0x407c00
mov ecx, esi
lea esi, [esi]
inc edx
mov al, byte [edx + ecx]
test al, al
je 0x407c00
cmp al, 0x22
jne 0x407bd0
jmp 0x407c00
mov edi, edx
test al, al
je 0x407c00
cmp al, 0x20
je 0x407c00
cmp al, 9
je 0x407c00
mov ecx, esi
inc edx
mov al, byte [edx + ecx]
test al, al
je 0x407c00
cmp al, 0x20
je 0x407c00
cmp al, 9
jne 0x407bf0
mov byte [edx + esi], 0
dec edx
je 0x407c2a
mov al, byte [edx + esi]
cmp al, 0x22
je 0x407c2a
cmp al, 0x5c
je 0x407c2a
cmp al, 0x3a
je 0x407c2a
mov ecx, esi
dec edx
je 0x407c2a
mov al, byte [edx + ecx]
cmp al, 0x22
je 0x407c2a
cmp al, 0x5c
je 0x407c2a
cmp al, 0x3a
jne 0x407c18
add esp, 0xfffffff8
push 0x407b5a
lea ebx, [esi + edx + 1]
push ebx
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
jne 0x407c70
mov byte [ebx], 0
add esp, 0xfffffff8
lea eax, [edi + esi]
push eax
push 0x44b010
call sub.KERNEL32.dll_lstrcpyA
push 0x407b65
push section..bss
call sub.KERNEL32.dll_lstrcpyA
mov eax, 1
add esp, 8
jmp 0x407c82
mov eax, dword [0x6df150]
mov eax, dword [eax + 0x308]
mov dword [0x44e950], eax
xor eax, eax
pop ebx
pop esi
pop edi
add esp, 0x120
ret
Function at 0x407cc8
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x118
mov ecx, 1
push ebx
cmp dword [0x4356bc], 0
je 0x407ceb
lea esi, [esi]
inc ecx
cmp dword [ecx*4 + 0x4356b8], 0
jne 0x407ce0
mov edx, 1
cmp dword [0x435a6c], 0
je 0x407d0b
lea esi, [esi]
inc edx
cmp dword [edx*4 + 0x435a68], 0
jne 0x407d00
mov eax, 1
cmp dword [0x435e1c], 0
je 0x407d2b
lea esi, [esi]
inc eax
cmp dword [eax*4 + 0x435e18], 0
jne 0x407d20
xor ebx, ebx
cmp ecx, edx
jne 0x407d38
cmp edx, eax
sete al
mov bl, al
test ebx, ebx
jne 0x407d60
mov eax, dword [0x6df150]
add esp, 0xfffffff4
mov eax, dword [eax + 0x314]
push eax
call fcn.0041aa68
add esp, 0x10
test ebx, ebx
jne 0x407d60
xor eax, eax
jmp 0x407da5
mov byte [esp + 0x10], 0
add esp, 0xfffffff8
lea ebx, [esp + 0x18]
push ebx
push 0x41bd08
call sub.USER32.dll_EnumWindows
add esp, 8
cmp byte [esp + 0x10], 0
je 0x407da0
mov eax, dword [0x6df150]
add esp, 0xfffffffc
mov eax, dword [eax + 0x74]
push eax
push ebx
push 0x407cc0
call fcn.00407070
xor eax, eax
add esp, 0x10
jmp 0x407da5
mov eax, 1
pop ebx
add esp, 0x118
ret

Function at 0x408a70
Capabilities:
Get hostname

Disassembly:
sub esp, 0x34
push edi
push ebx
call fcn.00408844
test eax, eax
je 0x408a90
call fcn.0040df98
test eax, eax
je 0x408a90
call fcn.00407b6c
test eax, eax
jne 0x408a97
xor eax, eax
jmp 0x408b8f
mov dword [0x44b250], 0
mov dword [0x44b600], 0xffffffff
mov byte [0x44b2d0], 0xff
mov byte [0x44b2e0], 0xff
mov dword [0x44b3a0], 0x12c
mov dword [0x44b160], 0
mov dword [0x44b260], 0
mov dword [0x44b280], 0
mov dword [0x44b220], 0
mov dword [0x44b170], 0
mov dword [0x44b180], 0
mov dword [0x44b1b0], 0
mov edi, 0x44b1c0
xor eax, eax
cld
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x44b2b0
cld
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [0x44b590], 0
mov dword [esp + 0x1c], 0x10
add esp, 0xfffffff8
lea eax, [esp + 0x24]
push eax
lea ebx, [esp + 0x2c]
push ebx
call sub.KERNEL32.dll_GetComputerNameA
add esp, 0xfffffff4
push 0x14
push ebx
push 0x44b1e0
call sub.KERNEL32.dll_lstrcpynA
mov dword [0x44b5c0], 1
mov dword [0x44b5d0], 0
mov dword [0x44b5e0], 0
mov dword [0x44b5f0], 0
mov dword [0x44b240], 0
add esp, 0x14
mov eax, 1
pop ebx
pop edi
add esp, 0x34
ret
Function at 0x40e240
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x934
push esi
push ebx
lea esi, [esp + 0x130]
add esp, 0xfffffff8
lea ebx, [esp + 0x28]
push ebx
push 0x401bcc
call fcn.004077cc
add esp, 0xfffffffc
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
jne 0x40e2a7
mov eax, dword [0x6df150]
add esp, 0xfffffffc
push 0x401bcc
mov eax, dword [eax + 0x32c]
push eax
push 0x4078c0
call fcn.00407070
add esp, 0x10
cmp ebx, 0xffffffff
je 0x40e2fa
add esp, 0xfffffff4
push 0
lea eax, [esp + 0x2c]
push eax
push 0x800
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
cmp dword [esp + 0x1c], 0
jne 0x40e313
mov eax, dword [0x6df150]
add esp, 0xfffffffc
push 0x401bcc
mov eax, dword [eax + 0x330]
push eax
push 0x408dc6
call fcn.00407070
add esp, 0x10
cmp dword [esp + 0x1c], 0
jne 0x40e313
add esp, 0xfffffffc
push 0x800
xor eax, eax
mov al, byte [0x44606f]
push eax
push esi
call sub.msvcrt40.dll_memset
add esp, 0x10
xor edx, edx
mov ebx, esi
mov esi, 0x445e70
mov ecx, 0x6e71c0
xor eax, eax
mov al, byte [edx + ebx]
mov al, byte [eax + esi]
mov byte [ecx], al
inc ecx
inc edx
cmp edx, 0x7ff
jle 0x40e321
mov dword [0x536f20], 1
pop ebx
pop esi
add esp, 0x934
ret

Function at 0x40e348
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x92c
xor edx, edx
mov ecx, 0x6e71c0
push ebp
push edi
push esi
push ebx
lea ebp, [esp + 0x130]
lea edi, [esp + 0x20]
mov esi, ebp
mov ebx, 0x445f70
nop
lea esi, [esi]
xor eax, eax
mov al, byte [ecx]
mov al, byte [eax + ebx]
mov byte [edx + esi], al
inc ecx
inc edx
cmp edx, 0x7ff
jle 0x40e370
add esp, 0xfffffff8
push edi
push 0x401bcc
call fcn.004077cc
add esp, 0xfffffffc
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
jne 0x40e3dd
mov eax, dword [0x6df150]
add esp, 0xfffffffc
push 0x401bcc
mov eax, dword [eax + 0x32c]
push eax
push 0x4078c0
call fcn.00407070
add esp, 0x10
cmp ebx, 0xffffffff
je 0x40e424
add esp, 0xfffffff4
push 0
lea eax, [esp + 0x2c]
push eax
push 0x800
push ebp
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
cmp dword [esp + 0x1c], 0
jne 0x40e424
mov eax, dword [0x6df150]
add esp, 0xfffffffc
push 0x401bcc
mov eax, dword [eax + 0x334]
push eax
push 0x408dc6
call fcn.00407070
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x92c
ret