joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45de40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x535ba0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45dfa0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.00408d60
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45df89
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.004303e0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.00430ac0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.00430ac0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x45df10
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.00450940
mov eax, dword [0x535c80]
test eax, eax
jne 0x45def7
mov eax, dword [esp + 0x20]
jmp 0x45df05
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.00460e50
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45df47
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.00450940
mov eax, dword [0x535c80]
test eax, eax
jne 0x45df32
mov eax, dword [esp + 0x20]
jmp 0x45df40
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.00460e50
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408f60
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45df6d
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004308a0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45df85
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004308a0
add esp, 0x1c
ret
lea eax, [0x497e89]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e90
nop
call fcn.0045fa60
jmp fcn.0045de40
Function at 0x460d10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x535d60]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45f49b
je 0x45f4ee
cmp ebx, 0x20
jbe 0x45f4f4
cmp ebx, 0x40
jbe 0x45f53a
jmp 0x45f5db
test ebx, ebx
je 0x45f4e4
add eax, 0x10
test ax, 0xff0
je 0x45f4d0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4aee40]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4aef40]
jmp 0x45f4b8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45f4b8
pxor xmm1, xmmword [0x535d70]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x535d70]
pxor xmm2, xmmword [0x535d80]
pxor xmm3, xmmword [0x535d90]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x535d70]
pxor xmm2, xmmword [0x535d80]
pxor xmm3, xmmword [0x535d90]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45f63a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x535a85], 0
je 0x460d2a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45f460
jmp fcn.00407910
Function at 0x460d30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x535ba0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4029bc
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407910
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045fa60
jmp 0x402980
cmp byte [0x535a85], 0
je 0x460d4b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45f460
jmp 0x402980

Function at 0x461b90
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x461baa
mov ecx, 0x14
jmp 0x461bb3
shl ecx, 2
add ecx, 0xe10
mov dword [0x535ba0], ecx
ret
Function at 0x4726b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x535ba0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4727a1
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4726ec
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x472725
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00465290
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4726e1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x47272f
inc eax
cmp eax, 4
jge 0x472744
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x47279a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.004652c0
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x47276b
jmp 0x47272e
call fcn.0045fa60
jmp fcn.004726b0
Function at 0x401390
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 8
cmp byte [esp + 0x14], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebp
push esi
push edi
je 0x401448
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x24], 3
mov esi, eax
jl 0x401428
mov ecx, dword [esi + 4]
push ecx
push str._stdio
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x401428
mov edx, dword [esi + 8]
push ebp
push ebp
push 4
push ebp
push ebp
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401400
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push esi
push 0xfffffffffffffff6
call edi
test eax, eax
jne 0x401417
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0xfffffffffffffff5
call edi
test eax, eax
jne 0x40144a
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.AttachConsole
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x40144a
push 0xffffffffffffffff
call eax
add esp, 4
jmp 0x40144a
xor ebp, ebp
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
call fcn.004010a0
mov esi, eax
add esp, 0x10
cmp esi, ebp
mov dword [esp + 0x14], esi
je 0x4014fe
mov edi, dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
mov ebx, dword [section..data]
lea ecx, [esp + 0x24]
push ecx
push ebp
push ebp
push str..air
push 2
push ebp
mov dword [esp + 0x3c], ebp
call edi
cmp eax, 1
jne 0x4014eb
mov edx, dword [esp + 0x24]
lea eax, [edx + edx]
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x24]
push ecx
mov esi, eax
push esi
push 0
push str..air
push 2
push 0
call edi
test eax, eax
jne 0x4014d9
mov ebx, dword [str.This_application_requires_a_version_of_nAdobe_AIR_which_is_no_longer_supported._nPlease_contact_the_application_nauthor_for_an_updated_version.]
push esi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x14]
xor ebp, ebp
push 0x30
push str.Adobe_AIR
push ebx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, esi
jmp 0x40150b
mov edx, dword [esp + 0x24]
push edx
push ebp
call ebx
push eax
call dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x411019
Capabilities:
Terminate process

Disassembly:
jmp 0x411790
jmp fcn.00411f00
cmp ecx, dword [section..data]
jne 0x41179a
repz ret
jmp 0x41108c
Function at 0x100ff93
Capabilities:
Print debug messages

Disassembly:
push 0x834
push 0x1003d08
call fcn.01009278
mov eax, dword [0x101203c]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x824], eax
lea esi, [ebp - 0x81c]
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x820], eax
mov ecx, esi
mov dword [ebp - 0x828], ecx
mov ebx, 0x800
mov dword [ebp - 0x838], ebx
mov ecx, dword [ebp + 8]
mov edi, ecx
and edi, 0x7f
mov dword [ebp - 0x840], edi
mov dword [ebp - 0x834], eax
mov eax, dword [0x10125b0]
cmp eax, 0xc0ffee
jne 0x1010004
call fcn.0100f2ee
mov dword [0x10125b0], eax
mov ecx, dword [ebp + 8]
shr ecx, 7
and ecx, 1
mov dword [ebp - 0x830], ecx
jne 0x101001a
cmp edi, eax
jg 0x1010193
and dword [ebp - 4], 0
lea eax, [ebp - 0x820]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1010030
sub eax, edx
add eax, 4
and eax, 0xfffffffc
call fcn.01007f20
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x820], eax
or dword [ebp - 4], 0xffffffff
jmp 0x1010089
cmp dword [ebp - 0x820], 0
jne 0x10100a4
call fcn.0100f0d2
cmp dword [ebp - 0x820], 0
je 0x1010193
push dword [ebp + 0x10]
push dword [ebp - 0x820]
call fcn.0100ee55
cmp dword [ebp - 0x820], 0
je 0x1010193
lea eax, [ebp + 0x14]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x830], 0
je 0x1010112
lea eax, [ebp + 0x18]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x834], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1003cf4
lea eax, [ebp - 0x81c]
push eax
call sub.ntdll.dll_sprintf
add esp, 0xc
lea esi, [ebp + eax - 0x81c]
mov dword [ebp - 0x828], esi
mov ebx, 0x800
sub ebx, eax
xor eax, eax
cmp dword [eax*8 + 0x10125b8], edi
je 0x1010125
inc eax
cmp eax, 4
jl 0x1010114
jmp 0x1010132
mov eax, dword [eax*8 + 0x10125b4]
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0
jne 0x1010146
mov eax, dword [0x10125d4]
mov dword [ebp - 0x824], eax
push dword [ebp - 0x824]
push 0x1003cec
push esi
call sub.ntdll.dll_sprintf
add esp, 0xc
add esi, eax
sub ebx, eax
cmp dword [ebp + 0xc], 0
je 0x1010179
push dword [ebp + 0xc]
push 0x1003ce0
push esi
call sub.ntdll.dll_sprintf
add esp, 0xc
add esi, eax
sub ebx, eax
push dword [ebp - 0x82c]
push dword [ebp - 0x820]
push ebx
push esi
call fcn.01007f62
add esp, 0x10
test eax, eax
jge 0x1010197
xor eax, eax
jmp 0x10101c4
cmp dword [ebp - 0x830], 0
je 0x10101b2
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x834]
call fcn.0100f4f9
push dword [ebp - 0x828]
push 0x1003cdc
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
lea esp, [ebp - 0x850]
mov ecx, dword [ebp - 0x1c]
call fcn.01007b7f
call fcn.010092b3
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010c8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010da
mov eax, dword [0x40d08b]
shl eax, 2
mov dword [0x40d08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00404150
pop edx
call fcn.004034ec
call fcn.00404154
push 0
call fcn.00405ab4
pop ecx
push 0x40d034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40d093], eax
push 0
jmp fcn.0040a98c

Function at 0x4012bc
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x42f9cd
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
push 0xa
push 0x40d0a4
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x10], eax
push 0xfc00
push dword [ebp - 0x10]
push 0x41fdcd
call fcn.00404a34
add esp, 0xc
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x276e
call fcn.0040811c
pop ecx
xor eax, eax
mov dword [ebp - 0x14], eax
call fcn.00408144
mov edx, dword [ebp - 0x14]
xor byte [edx + 0x41fdcd], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfc00
jl 0x401327
xor ecx, ecx
mov cl, byte [0x4227c6]
xor eax, eax
mov al, byte [0x4227c7]
shl eax, 8
add cx, ax
mov word [0x4101ca], cx
xor edx, edx
mov dl, byte [0x42ddcd]
xor ecx, ecx
mov cl, byte [0x42ddce]
shl ecx, 8
add dx, cx
mov word [0x4101c8], dx
mov esp, ebp
pop ebp
ret

Function at 0x401574
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
cmp word [0x4101c4], 0x100
jae 0x40159e
push 0x40d0a8
lea eax, [ebp - 0x114]
push eax
call fcn.00404bd0
add esp, 8
jmp 0x4015b2
push 0x40d0ac
lea edx, [ebp - 0x114]
push edx
call fcn.00404bd0
add esp, 8
push 0x42f9cd
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
push 0xa
lea ecx, [ebp - 0x114]
push ecx
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x10], eax
push 0xfc00
push dword [ebp - 0x10]
push 0x4101cd
call fcn.00404a34
add esp, 0xc
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x276e
call fcn.0040811c
pop ecx
xor eax, eax
mov dword [ebp - 0x14], eax
call fcn.00408144
mov edx, dword [ebp - 0x14]
xor byte [edx + 0x4101cd], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfc00
jl 0x401619
push 0x1a00
push 0x42ddcd
push 0x4111cd
call fcn.00404a34
add esp, 0xc
mov cl, byte [0x41fdce]
mov byte [0x4110cd], cl
mov al, byte [0x41fdcf]
mov byte [0x4110ce], al
mov dl, byte [0x41fe11]
mov byte [0x4110cf], dl
mov cl, byte [0x41fe12]
mov byte [0x4110d0], cl
mov esp, ebp
pop ebp
ret

Function at 0x403e44
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x409a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x409a72
call fcn.004099c0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00404c00
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00404c00
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x409ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40f740], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x409baa
cmp dword [0x40f73c], 0
jne 0x409baa
cmp dword [0x40f930], 0
je 0x409b64
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004098c0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409b4a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004098c0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x409b4a
lea ebx, [ebp - 0x84]
jmp 0x409b4b
inc ebx
call fcn.00409a8c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x409be5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40f744
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00404c00
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40f747
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x409be5
cmp dword [0x40f73c], 0
je 0x409bc4
cmp dword [0x40f73c], 0xffffffff
je 0x409be5
push esi
call dword [0x40f73c]
pop ecx
mov eax, dword [0x40f740]
test eax, eax
je 0x409be5
cmp dword [0x40f740], 0xffffffff
je 0x409be5
cmp byte [eax], 0
je 0x409be5
push esi
push eax
call fcn.00409a10
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a3d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x430328], 0
jne 0x40a451
cmp dword [0x430348], 0
jne 0x40a400
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x430348], eax
test eax, eax
jne 0x40a400
push str.GetEnvironmentStrings_failed
call fcn.00409bfc
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x430348]
jmp 0x40a414
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00404c00
pop ecx
mov edi, eax
test eax, eax
jne 0x40a40c
lea edi, [ebp + 1]
push edi
call fcn.004033fc
pop ecx
mov ebx, eax
mov dword [0x43032c], ebx
test ebx, ebx
jne 0x40a43e
xor eax, eax
jmp 0x40a514
push edi
mov edx, dword [0x430348]
push edx
push ebx
call fcn.00404a34
add esp, 0xc
jmp 0x40a471
xor esi, esi
mov ebx, dword [0x430328]
jmp 0x40a46b
push eax
call fcn.00404c00
pop ecx
test eax, eax
jne 0x40a467
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a45b
lea ebx, [esi + 4]
push 4
mov dword [0x430330], ebx
inc ebx
push ebx
call fcn.00402eb8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40a494
xor eax, eax
jmp 0x40a514
cmp dword [0x430328], 0
jne 0x40a4c5
xor esi, esi
mov ebx, dword [0x43032c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40a4b6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00404c00
pop ecx
mov edi, eax
test eax, eax
jne 0x40a4ac
jmp 0x40a4f6
xor esi, esi
mov ebx, dword [0x430328]
mov eax, dword [esp]
mov edi, eax
jmp 0x40a4f0
push eax
call fcn.00404c00
pop ecx
test eax, eax
je 0x40a4e5
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40a4e9
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40a4d4
mov eax, dword [0x430328]
test eax, eax
je 0x40a506
push eax
call fcn.0040340c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x430328], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10013430
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013593
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10013470
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xf
jle 0x10013591
mov dword [ebp - 0x4c], 0x1ece
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x2c], 0x393e75cb
mov dword [ebp - 0x44], 0xeec299e
mov dword [ebp - 0xc], 0xfff8
mov dword [ebp - 0x28], 0xfafe44fa
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
je 0x100134be
mov dword [ebp - 0x10], 1
jmp 0x100134c2
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x243e
jl 0x100134d4
mov dword [ebp - 8], 1
jmp 0x100134d8
and dword [ebp - 8], 0
push 2
mov ecx, dword [ebp - 0x38]
call fcn.10014e7f
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jne 0x100134f8
mov dword [ebp - 0x18], 1
jmp 0x100134fc
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x40]
jne 0x10013520
mov dword [ebp - 0x1c], 1
jmp 0x10013524
and dword [ebp - 0x1c], 0
imul eax, dword [ebp - 0x1c], 0
test eax, eax
jne 0x10013535
mov dword [ebp - 0x20], 1
jmp 0x10013539
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0x9a57
jl 0x1001354b
mov dword [ebp - 0x24], 1
jmp 0x1001354f
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x10013565
mov dword [ebp - 0x48], 1
jmp 0x10013569
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x28], eax
jge 0x10013582
mov dword [ebp - 0x50], 1
jmp 0x10013586
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x10013465
jmp 0x100135a8
push 0
push 0x1e0b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esp, ebp
pop ebp
ret