joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc43250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc57808
push 0xc47288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xc43329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xc43329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00c461d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xc43329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xc43329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xc4332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00c43351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc43d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xc43d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xc43d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xc43d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xc43d94
push eax
push esi
call fcn.00c4620b
add esp, 8
pop esi
ret 0x10

Function at 0xc43da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xc43e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xc43e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xc5c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00c45dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xc43dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xc43e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xc43ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xc43eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xc5c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00c45dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xc43eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xc43e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xc44000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xc44131
push esi
call fcn.00c47145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00c36080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xc44131
push 0
push ebp
call fcn.00c363a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00c36260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xc4408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00c362f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xc44121
push 0xc5c918
push edi
call fcn.00c453f0
push eax
push ebx
push esi
call fcn.00c43f60
push 0xc5c8f8
push edi
call fcn.00c453f0
push eax
push ebx
push esi
call fcn.00c43f60
push 0xc5c8d8
push edi
call fcn.00c453f0
push eax
push ebx
push esi
call fcn.00c43f60
push 0xc5c8c0
push edi
call fcn.00c453f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00c43f60
push 0xc5c8a0
push edi
call fcn.00c453f0
push eax
push ebx
push esi
call fcn.00c43f60
push 0xc5c888
push edi
call fcn.00c453f0
push eax
push ebx
push esi
call fcn.00c43f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xc451b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00c45140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00c45140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00c45140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00c45140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xc45bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xc45c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xc5787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xc45c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xc45c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401300
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x43800c]
mov dword [eax], 0
jmp fcn.00401120

Function at 0x4015b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x24]
xor esi, esi
test edx, edx
je 0x401730
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x401730
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
and eax, ecx
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x401602
movq xmm0, qword [edx + 8]
movd dword [esp + 8], xmm0
pshufd xmm0, xmm0, 0x55
movd dword [esp + 4], xmm0
xor esi, esi
lea eax, [edx + 0x1c]
mov dword [esp], eax
jmp 0x401622
add esi, eax
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x2c]
cmp esi, ebp
jae 0x40170a
sub ebp, esi
cmp ebp, 0x10000000
mov eax, 0x10000000
cmovae ebp, eax
mov edi, dword [esp + 8]
add edi, esi
mov ebx, dword [esp + 4]
adc ebx, 0
xor eax, eax
mov ecx, 1
lock cmpxchg dword [edx + 0x1c], ecx
jne 0x4016e1
mov dword [edx + 0x20], str.blk_io.c_291
mov eax, dword [edx + 0x10]
xor eax, edi
mov ecx, dword [edx + 0x14]
xor ecx, ebx
or ecx, eax
jne 0x40166c
cmp byte [edx + 0x24], 1
je 0x40167e
push 0
push edi
push dword [edx + 0x18]
call sub.MSVCR70.dll_fseek
mov edx, dword [esp + 0x30]
add esp, 0xc
mov eax, dword [esp + 0x28]
add eax, esi
push dword [edx + 0x18]
push ebp
push 1
push eax
mov ebp, edx
call sub.MSVCR70.dll_fread
add esp, 0x10
mov ecx, edi
add ecx, eax
mov edx, ebx
adc edx, 0
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0x14], edx
mov byte [ebp + 0x24], 1
xor edx, edx
xchg dword [ebp + 0x1c], edx
cmp edx, 1
jne 0x4016f4
test eax, eax
jg 0x401610
mov edx, dword [esp + 0x24]
je 0x40170a
movq xmm0, qword [edx]
pshufd xmm1, xmm0, 0x55
movd eax, xmm1
movd ecx, xmm0
cmp edi, ecx
sbb ebx, eax
mov ebp, dword [esp + 0x2c]
jb 0x40161a
jmp 0x40170a
mov ecx, dword [esp]
xor edx, edx
call fcn.0040f5ee
mov edx, dword [esp + 0x24]
jmp 0x401658
mov ecx, dword [esp]
mov ebp, eax
call fcn.0040f821
mov eax, ebp
test eax, eax
jg 0x401610
jmp 0x4016ba
cmp dword [esp + 0xc], 0xffffffff
jne 0x401730
mov eax, dword [edx + 8]
mov edi, edx
mov edx, dword [edx + 0xc]
nop dword [eax]
mov ebx, eax
add ebx, esi
mov ecx, edx
adc ecx, 0
lock cmpxchg8b qword [edi + 8]
jne 0x401720
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401740
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, dword [esp + 0x28]
xor esi, esi
test edx, edx
je 0x4018d0
cmp dword [esp + 0x30], 0
je 0x4018d0
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, ebx
and eax, ecx
mov dword [esp + 4], eax
cmp eax, 0xffffffff
jne 0x401787
movq xmm0, qword [edx + 8]
movd ebx, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
xor esi, esi
lea eax, [edx + 0x1c]
mov dword [esp], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
nop word [eax + eax]
mov ebp, dword [esp + 0x30]
sub ebp, esi
jbe 0x401879
cmp ebp, 0x10000000
mov eax, 0x10000000
cmovae ebp, eax
add ebx, esi
mov edi, ecx
adc edi, 0
xor eax, eax
mov ecx, 1
lock cmpxchg dword [edx + 0x1c], ecx
jne 0x40185c
mov dword [edx + 0x20], str.blk_io.c_336
mov eax, dword [edx + 0x10]
xor eax, ebx
mov ecx, dword [edx + 0x14]
xor ecx, edi
or ecx, eax
jne 0x4017ee
cmp byte [edx + 0x24], 2
je 0x401800
push 0
push ebx
push dword [edx + 0x18]
call sub.MSVCR70.dll_fseek
mov edx, dword [esp + 0x34]
add esp, 0xc
mov eax, dword [esp + 0x2c]
add eax, esi
push dword [edx + 0x18]
push ebp
push 1
push eax
mov dword [esp + 0x20], esi
mov esi, edx
call sub.MSVCR70.dll_fwrite
add esp, 0x10
mov ebp, eax
add ebx, eax
adc edi, 0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov byte [esi + 0x24], 2
xor edx, edx
xchg dword [esi + 0x1c], edx
cmp edx, 1
jne 0x40186f
test ebp, ebp
mov eax, 0
cmovg eax, ebp
mov esi, dword [esp + 0x10]
add esi, eax
test ebp, ebp
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jne 0x4017a0
jmp 0x401879
mov ecx, dword [esp]
xor edx, edx
call fcn.0040f5ee
mov edx, dword [esp + 0x28]
jmp 0x4017da
mov ecx, dword [esp]
call fcn.0040f821
jmp 0x401836
add ebx, esi
adc ecx, 0
mov eax, dword [esp + 0x28]
movq xmm0, qword [eax]
pshufd xmm1, xmm0, 0x55
movd edx, xmm1
movd eax, xmm0
cmp eax, ebx
mov edi, edx
sbb edi, ecx
jae 0x4018a7
mov ebp, ecx
mov edi, dword [esp + 0x28]
lock cmpxchg8b qword [edi]
jne 0x40187e
cmp dword [esp + 4], 0xffffffff
jne 0x4018d0
mov edi, dword [esp + 0x28]
mov eax, dword [edi + 8]
mov edx, dword [edi + 0xc]
nop dword [eax + eax]
mov ebx, eax
add ebx, esi
mov ecx, edx
adc ecx, 0
lock cmpxchg8b qword [edi + 8]
jne 0x4018c0
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40fc20
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov edi, edx
mov ebx, ecx
push 4
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x40fc8c
mov esi, eax
push 8
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x40fc8c
mov dword [eax], ebx
mov dword [eax + 4], edi
push 0
push 0x10000
push eax
push 0x40fca0
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x40fc86
push str.Failed_to_spawn_thread_
call fcn.00410c10
add esp, 4
push esi
call sub.MSVCR70.dll_free
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
ret
push str.Out_of_memory_
call fcn.00410c90
int3
Function at 0x410120
Capabilities:
Create thread

Disassembly:
push esi
mov dword [0x440218], 0
mov dword [0x440214], 1
xor eax, eax
mov ecx, 0x44022c
nop dword [eax]
mov dword [ecx], eax
lea edx, [eax + 1]
mov dword [ecx + 0x2c], edx
lea edx, [eax + 2]
mov dword [ecx + 0x58], edx
lea edx, [eax + 3]
mov dword [ecx + 0x84], edx
add ecx, 0xb0
add eax, 4
cmp eax, 0x800
jne 0x410140
call fcn.0040fcc0
mov dword [0x440210], eax
push 4
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov esi, eax
push 8
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov dword [eax], 0x410370
mov dword [eax + 4], 0
push 0
push 0x10000
push eax
push 0x40fca0
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x4101e0
push str.Failed_to_spawn_thread_
call fcn.00410c10
add esp, 4
push esi
call sub.MSVCR70.dll_free
add esp, 4
xor esi, esi
mov dword [0x44021c], esi
push 4
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov esi, eax
push 8
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov dword [eax], 0x410370
mov dword [eax + 4], 0
push 0
push 0x10000
push eax
push 0x40fca0
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x410255
push str.Failed_to_spawn_thread_
call fcn.00410c10
add esp, 4
push esi
call sub.MSVCR70.dll_free
add esp, 4
xor esi, esi
mov dword [0x440220], esi
push 4
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov esi, eax
push 8
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov dword [eax], 0x410370
mov dword [eax + 4], 0
push 0
push 0x10000
push eax
push 0x40fca0
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x4102ca
push str.Failed_to_spawn_thread_
call fcn.00410c10
add esp, 4
push esi
call sub.MSVCR70.dll_free
add esp, 4
xor esi, esi
mov dword [0x440224], esi
push 4
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov esi, eax
push 8
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x410359
mov dword [eax], 0x410370
mov dword [eax + 4], 0
push 0
push 0x10000
push eax
push 0x40fca0
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x410330
mov dword [0x440228], esi
mov ecx, 0x4106e0
pop esi
jmp fcn.00410e60
push str.Failed_to_spawn_thread_
call fcn.00410c10
add esp, 4
push esi
call sub.MSVCR70.dll_free
add esp, 4
xor esi, esi
mov dword [0x440228], esi
mov ecx, 0x4106e0
pop esi
jmp fcn.00410e60
push str.Out_of_memory_
call fcn.00410c90
int3

Function at 0x410a40
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x4401ec], 1
jne 0x410a80
push esi
push eax
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], eax
push str.TERM
call sub.MSVCR70.dll_getenv
add esp, 4
test eax, eax
mov eax, str.INFO:
mov ecx, str.e_33_1mINFOe_37_1m:
cmove ecx, eax
mov edx, esi
push dword [esp]
call fcn.00410a90
add esp, 8
pop esi
ret
Function at 0x410a90
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x100
mov eax, dword [esp + 0x114]
xorps xmm0, xmm0
movups xmmword [esp + 0xf0], xmm0
movups xmmword [esp + 0xe0], xmm0
movups xmmword [esp + 0xd0], xmm0
movups xmmword [esp + 0xc0], xmm0
movups xmmword [esp + 0xb0], xmm0
movups xmmword [esp + 0xa0], xmm0
movups xmmword [esp + 0x90], xmm0
movups xmmword [esp + 0x80], xmm0
movups xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov esi, 2
movzx ebx, byte [ecx + esi - 2]
test bl, bl
je 0x410b47
mov byte [esp + esi - 2], bl
movzx ebx, byte [ecx + esi - 1]
test bl, bl
je 0x410b4c
mov byte [esp + esi - 1], bl
movzx ebx, byte [ecx + esi]
test bl, bl
je 0x410b4d
mov byte [esp + esi], bl
add esi, 3
cmp esi, 0x101
jne 0x410b10
mov esi, 0xff
jmp 0x410b4d
add esi, 0xfffffffe
jmp 0x410b4d
dec esi
mov byte [esp + esi], 0
lea ecx, [esi + 6]
xor ebp, ebp
mov edi, 0x100
mov ebx, 0x100
sub ebx, ecx
cmovb ebx, ebp
cmp ebx, 2
jb 0x410b8b
lea ecx, [esp + esi]
push eax
push 0
push edx
push ebx
push ecx
push 0
push 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
add esp, 0x1c
test eax, eax
jle 0x410b8b
dec ebx
cmp ebx, eax
cmovae ebx, eax
add esi, ebx
lea ebp, [esp + esi]
push str.TERM
call sub.MSVCR70.dll_getenv
add esp, 4
test eax, eax
mov ecx, 0x43a2fe
mov eax, str.e_0m_n
cmove eax, ecx
sub edi, esi
cmp edi, 2
jb 0x410bd3
mov edx, 0xff
sub edx, esi
xor ecx, ecx
nop word [eax + eax]
movzx ebx, byte [eax + ecx]
test bl, bl
je 0x410bdd
mov byte [ebp + ecx], bl
inc ecx
cmp edx, ecx
jne 0x410bc0
jmp 0x410bdd
xor ecx, ecx
cmp esi, 0x100
je 0x410be2
mov byte [ebp + ecx], 0
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ecx, esp
push eax
push ecx
call sub.MSVCR70.dll_fputs
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x410c10
Capabilities:
Query environment variable

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], eax
push str.TERM
call sub.MSVCR70.dll_getenv
add esp, 4
test eax, eax
mov eax, str.WARN:
mov ecx, str.e_31_1mWARNe_37_1m:
cmove ecx, eax
mov edx, esi
push dword [esp]
call fcn.00410a90
add esp, 8
pop esi
ret

Function at 0x410c50
Capabilities:
Query environment variable

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], eax
push str.TERM
call sub.MSVCR70.dll_getenv
add esp, 4
test eax, eax
mov eax, str.ERROR:
mov ecx, str.e_31_1mERRORe_37_1m:
cmove ecx, eax
mov edx, esi
push dword [esp]
call fcn.00410a90
add esp, 8
pop esi
ret

Function at 0x410cd0
Capabilities:
Query environment variable

Disassembly:
push str.TERM
call sub.MSVCR70.dll_getenv
add esp, 4
test eax, eax
setne al
ret
Function at 0x410f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp], edx
mov ebp, ecx
movzx ecx, byte [esp + 0x20]
xor ebx, ebx
test cl, cl
jne case.0x410fad.67
mov cl, 0xa
cmp byte [ebp], 0x30
jne case.0x410fad.67
movzx eax, byte [ebp + 1]
mov cl, 8
add eax, 0xffffffbe
cmp eax, 0x36
ja case.0x410fad.67
jmp dword [eax*4 + 0x43c074]
mov cl, 2
jmp case.0x410fad.79
mov cl, 0x10
mov ebx, 2
cmp dword [esp], 0
je 0x410fce
mov eax, dword [esp]
mov dword [eax], 0
mov dh, cl
add dh, 0xfe
xor eax, eax
cmp dh, 0x22
mov edx, 0
ja 0x411085
movzx eax, cl
mov dword [esp + 4], eax
inc ebx
xor eax, eax
xor edx, edx
jmp 0x411001
inc ebx
mov dword [esp + 8], ebx
movsx ecx, byte [ebp + ebx - 1]
mov ebx, ecx
add bl, 0xd0
cmp bl, 0xa
jae 0x411030
add ecx, 0xffffffd0
mov esi, dword [esp + 4]
cmp ecx, esi
jb 0x411065
jmp 0x411085
mov ebx, ecx
add bl, 0xbf
cmp bl, 0x19
ja 0x411050
add ecx, 0xffffffc9
mov esi, dword [esp + 4]
cmp ecx, esi
jb 0x411065
jmp 0x411085
mov ebx, ecx
add bl, 0x9f
cmp bl, 0x19
ja 0x411085
add ecx, 0xffffffa9
mov esi, dword [esp + 4]
cmp ecx, esi
jae 0x411085
mov edi, edx
mul esi
imul edi, esi
add eax, ecx
adc edx, edi
mov ecx, dword [esp]
test ecx, ecx
mov ebx, dword [esp + 8]
je 0x411000
mov ecx, dword [esp]
mov dword [ecx], ebx
jmp 0x411000
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411650
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 4], ecx
mov eax, dword [0x440164]
mov dword [esp + 8], eax
test eax, eax
jle 0x41176e
mov eax, dword [0x440168]
mov dword [esp], eax
xor edi, edi
jmp 0x411690
cmp bl, 0x3d
je 0x411703
inc edi
cmp edi, dword [esp + 8]
je 0x41176e
mov eax, dword [esp]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x41176e
cmp byte [eax], 0x2d
jne 0x411685
xor ecx, ecx
cmp byte [eax + 1], 0x2d
sete cl
lea esi, [eax + ecx + 1]
mov edx, dword [esp + 4]
movzx edx, byte [edx]
xor ebp, ebp
test dl, dl
je 0x4116df
nop dword [eax]
movzx ebx, byte [esi + ebp]
test ebx, ebx
je 0x411680
cmp ebx, 0x3d
je 0x411680
cmp bl, dl
jne 0x411685
mov edx, dword [esp + 4]
movzx edx, byte [edx + ebp + 1]
inc ebp
test dl, dl
jne 0x4116c0
inc ecx
add eax, ebp
movzx ebx, byte [ecx + eax]
cmp ebx, 0x3d
je 0x4116ef
test ebx, ebx
jne 0x411685
mov eax, dword [esp]
mov eax, dword [eax + edi*4 + 4]
test eax, eax
je 0x411680
cmp byte [eax], 0x2d
je 0x411680
xor ebx, ebx
jmp 0x411710
add esi, ebp
mov eax, esi
inc eax
je 0x41176e
cmp byte [eax], 0x2d
sete bl
movzx ecx, bl
add ecx, eax
xor edx, edx
push 0
mov edi, eax
call fcn.00410f80
add esp, 4
mov esi, eax
mov eax, edi
mov ecx, edx
mov edx, 0xffffffff
nop
cmp byte [eax + edx + 1], 0
lea edx, [edx + 1]
jne 0x411730
xor edi, edi
mov ebp, eax
mov eax, esi
neg eax
sbb edi, ecx
test bl, bl
cmove eax, esi
cmove edi, ecx
mov esi, edi
movzx edx, byte [ebp + edx - 1]
add edx, 0xffffffb9
cmp edx, 0x26
ja case.0x411760.72
mov ecx, 0xa
jmp dword [edx*4 + 0x43c150]
mov ecx, 0x1e
jmp case.0x411760.75
xor eax, eax
xor edx, edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x14
jmp case.0x411760.75
xor ecx, ecx
mov edx, esi
shld edx, eax, cl
shl eax, cl
jmp 0x411772

Function at 0x4118f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xorps xmm0, xmm0
movups xmmword [esp], xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov dword [esp + 4], 0x1000
mov dword [esp + 0x1c], 0x10000
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov dword [0x4401d4], eax
mov dword [0x4401d0], ecx
add esp, 0x24
ret