joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412f76
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x412fc6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x5acd
push 0x5f04
push 0x428b
push 1
push dword [ebp - 0x10]
push 0x28f1
call fcn.00413079
add esp, 0x20
jmp 0x413075
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x413008
push 0x5a50
push 1
push 0x6d84
push 0x7b93
push 0x240f
call fcn.0040d848
add esp, 0x14
jmp 0x413075
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41306d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x17
jmp 0x413052
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x10
jle 0x41306b
mov dword [ebp - 0x3c], 0xf14c90d2
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
jmp 0x413047
jmp 0x413075
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x413ccc
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x413d36
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x4681
push dword [ebp - 0xc]
push 0
push 0x410
push 0xc8d
push dword [ebp - 0x10]
push 0x4a0c
push 0x31b7
push 0x5a5a
push 0x7f8e
push 0x6e92
push 0x44ae
push 0x68bc
call fcn.00428a92
add esp, 0x38
jmp 0x413dd5
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x413db1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x413d87
mov byte [ebp - 1], 0
push 0x4eb7
lea eax, [ebp - 1]
push eax
push 0xcb2
push 1
push 1
push 0x1b95
push 1
push 1
push 1
call fcn.0040dd2c
add esp, 0x24
jmp 0x413daf
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x413daf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x413dd5
push 0x2788
push 1
push 0x7564
push 0x45f7
push 1
push 1
push 0
push 0x945
call fcn.004422f3
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x4145e8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41460d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
call fcn.0044a9b2
pop ecx
pop ecx
jmp 0x4146b1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x414690
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x414667
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x414665
push 1
push 0
push 0
call fcn.00449f35
add esp, 0xc
jmp 0x41468e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41468e
push 0
push 0x454
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x4146b1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x533d
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.0041b1d2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x414728
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc421
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4148ec
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4147f6
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4147ab
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0
jmp 0x4147f1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x4147cd
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jg 0x4147f1
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4147ef
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x4147c2
jmp 0x4148ea
mov dword [ebp - 0x2c], 0x5d98
mov dword [ebp - 0x58], str.dfllrm_liaxjvgix_gwmimm_mrzk_evonqruoj_ldlehdygi_rjmo_xouoqug_kypfitx_iywcuggl
cmp dword [ebp - 0x2c], 0x6101
jle 0x414896
and dword [ebp - 0x1c], 0
jmp 0x41481e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7663
jge 0x414896
and dword [ebp - 0x20], 0
jmp 0x414834
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6beb
jge 0x414894
and dword [ebp - 0x24], 0
jmp 0x41484a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3f7
jge 0x414892
and dword [ebp - 0x28], 0
jmp 0x414860
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3d58
jge 0x414890
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sar eax, cl
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0xace058
call fcn.004063d1
jmp 0x414859
jmp 0x414843
jmp 0x41482d
jmp 0x414817
push 0x3076
push 0
push 0x108b
call fcn.00415c80
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x5aa6
jge 0x4148c4
mov edx, dword [ebp - 0x58]
mov ecx, 0xace058
call fcn.00409042
jmp 0x4148e0
or dword [ebp - 4], 0xffffffff
jmp 0x4148ea
jmp 0x414909
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
push 1
push 0x4b4e
push dword [ebp - 0x5c]
push 0x29d3
call fcn.0040f52a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a95a
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc4d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41aaf5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41aadf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41a9e1
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x41a9dc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x41aadd
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], 0x39fb
mov dword [ebp - 0x48], str.qdri_kxkbx_eclfyao_worsxkok_pnvbrw_qfy_telpz
cmp dword [ebp - 0x24], 0x3ced
jle 0x41aa5e
push 0
push 0x5da
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
and dword [ebp - 0x1c], 0
jmp 0x41aa1e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7237
jge 0x41aa5e
and dword [ebp - 0x20], 0
jmp 0x41aa34
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc0
jge 0x41aa5c
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0xace058
call fcn.004063d1
jmp 0x41aa2d
jmp 0x41aa17
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3791
jge 0x41aa7e
mov edx, dword [ebp - 0x48]
mov ecx, 0xace058
call fcn.00409042
jmp 0x41aa9a
or dword [ebp - 4], 0xffffffff
jmp 0x41aaa4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x41aac0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x41aadd
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.00406814
mov dword [eax], 0x9b3198a8
jmp 0x41aab5
jmp 0x41aaf3
push 0
push 0x1794
push 0x3179
call fcn.00435893
add esp, 0xc
jmp 0x41aafd
push 0
call fcn.004138e8
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ff78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41ffbe
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push 0x2136
push dword [ebp - 0x14]
push 0x193e
push 1
call fcn.00420066
add esp, 0x18
jmp 0x420062
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41fff0
push 0x3eda
push 1
call fcn.00413858
pop ecx
pop ecx
jmp 0x420062
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x42001f
push 0xd4f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x420062
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42004d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x420062
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x420042
mov esp, ebp
pop ebp
ret
Function at 0x423105
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x4231ac
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x423189
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x423161
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x423187
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x423187
push 0x6f0
push 0x1eef
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x4231aa
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0
push 0x79e2
call fcn.004261b4
add esp, 0x10
jmp 0x4231d6
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
push 1
push dword [ebp - 0x30]
push 0xe55
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00412078
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x426c5c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x426c98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x10]
call fcn.00426d1c
add esp, 0x10
jmp 0x426d18
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x426cf5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x426cdd
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
call fcn.0040fc23
pop ecx
pop ecx
jmp 0x426cf3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x426d18
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x28]
push 0x742
push dword [ebp - 0x2c]
push 1
call fcn.0040c9a0
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x426d37
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x426de9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x426ddf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x426d95
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x426ddd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x426dc3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x426ddd
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.00406814
or dword [eax], 0xffffffff
jmp 0x426db8
jmp 0x426de7
push 0
call fcn.00455693
pop ecx
jmp 0x426df1
push 1
call fcn.004138e8
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4280af
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc629
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x31a3
mov dword [ebp - 0x24], str.sqq_ruboszs_opvopr_qjzegt_ganookrve_zibyqa_fkfmmrfqd_nypjv
cmp dword [ebp - 0x20], 0x3511
jle 0x428162
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
and dword [ebp - 0x14], 0
jmp 0x4280fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x36d9
jge 0x42815a
and dword [ebp - 0x18], 0
jmp 0x428111
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5fed
jge 0x428158
and dword [ebp - 0x1c], 0
jmp 0x428127
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4bea
jge 0x428156
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
imul edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0xace058
call fcn.004063d1
jmp 0x428120
jmp 0x42810a
jmp 0x4280f4
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x4cd9
push 1
push 0x79a
push 1
call fcn.004281cf
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2f51
jge 0x428198
mov edx, dword [ebp - 0x24]
mov ecx, 0xace058
call fcn.00409042
jmp 0x4281b4
or dword [ebp - 4], 0xffffffff
jmp 0x4281be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4419ce
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x441ab2
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x441a7f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x441a77
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x441a58
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x441a75
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.00406814
mov dword [eax], 3
jmp 0x441a4d
jmp 0x441a7d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x441ab0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push 0
push 1
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x4e27
push 0x2d3
push 0x77be
push 1
call fcn.0042bb01
add esp, 0x24
jmp 0x441aed
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
push eax
push 1
call fcn.0042df95
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4434d8
Capabilities:
Get disk information
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x443570
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x443526
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
push 0x4987
call fcn.004435a6
add esp, 0xc
jmp 0x44356e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x443552
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x443550
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x44356e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44356e
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x4435a2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x38]
call fcn.0040d589
add esp, 0x14
mov esp, ebp
pop ebp
ret