joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524206
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x524327
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x52430b
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x52425d
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x52423b
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x524d6f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x524dc6
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x524dc6
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x524dc6
xor eax, eax
inc eax
jmp 0x524dc8
xor eax, eax
leave
ret 0x10
Function at 0x524df1
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x524e5f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x697304
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x524e56
cmp dword [ebp - 0xc], 4
jne 0x524e56
cmp dword [ebp - 0x10], edi
je 0x524e56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x6d13a8], edi
xor eax, eax
jmp 0x524e9e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x6d13a8], edi
jge 0x524e99
lea eax, [ebp - 0x34]
push eax
mov dword [0x6d13a8], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x524e99
cmp word [ebp - 0x14], 5
jb 0x524e99
call fcn.00524dcc
test eax, eax
je 0x524e99
emms
mov dword [0x6d13a8], 1
mov eax, dword [0x6d13a8]
pop edi
leave
ret

Function at 0x5395df
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x539617
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0053758f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00537567
jmp 0x539623
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x53adda
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x53ae1c
call fcn.00541779
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x53ae1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x53ae13
xor eax, eax
jmp 0x53ae24
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0053ae2a
pop edi
pop esi
pop ebx
ret 4

Function at 0x541ca9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x541cd7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x541cf5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00541c0f
jmp 0x541cf5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x541cf5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00541c0f
test edi, edi
mov eax, edi
jne 0x541cdf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x48b2e2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48b321
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48b321
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48b321
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48b321
cmp dword [ecx + 0x74], 0xe
jbe 0x48b321
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x490d43
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x490de0
push ebx
push esi
call fcn.00490d0c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00490ca0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x490d8d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x490ddf
push edi
push eax
call fcn.00491960
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x490dad
call fcn.0048f801
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x490dde
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00490ca0
add esp, 0x20
test eax, eax
jne 0x490dcc
push edi
call fcn.0048f801
jmp 0x490dd4
push ebx
call fcn.0048f801
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4920dd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e3cb0
push 0x4e3ca8
push str.FlsAlloc
push 0x1f
call fcn.00491f9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x492111
push dword [ebp + 8]
mov ecx, esi
call dword [0x498130]
call esi
jmp 0x492117
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x49215b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e3cc0
push 0x4e3cb8
push str.FlsGetValue
push 0x21
call fcn.00491f9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x492192
push dword [ebp + 8]
mov ecx, esi
call dword [0x498130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x49219a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e3cc8
push 0x4e3cc0
push str.FlsSetValue
push 0x22
call fcn.00491f9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4921d4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x498130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x497630
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49765d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49765d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4236b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
jmp 0x4236ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4236d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4236c0
mov eax, 1
add ebx, ebx
jne 0x4236e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4236d8
jne 0x4236f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4236d8
xor ecx, ecx
sub eax, 3
jb 0x423708
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42377a
mov ebp, eax
add ebx, ebx
jne 0x423713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423720
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423744
inc ecx
add ebx, ebx
jne 0x423730
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423725
jne 0x423741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423725
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423764
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423755
jmp 0x4236c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423764
add edi, ecx
jmp 0x4236c6
pop esi
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x4237c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423781
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23030]
or eax, eax
je 0x4237bd
mov dword [ebx], eax
add ebx, 4
jmp 0x42379e
call dword [esi + 0x2302c]
mov ebp, dword [esi + 0x23034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4237f7
sub esp, 0xffffff80
jmp 0x4038fc
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push str.hf32
push dword [esp + 0xc]
push dword [esp + 0xc]
call sym.hf32.exe__string_cmline_set_12
call sym.hf32.exe__string_cmline_init_0
push 0x433790
push section..data
call sym.hf32.exe__string_cmline_token_8
push 0x433790
call sym.hf32.exe__string_cmline_req_check_4
call sym.hf32.exe__string_cmline_end_abort_0
push 0x433790
push 0x433784
push section..data
call sym.hf32.exe__string_t_int32h_12
push 0
push 0x434848
push 0x4347f8
push 0x4347f8
push 0x433790
call sym.hf32.exe__sys_error_abort_20
movzx eax, word [0x433784]
mov word [0x433780], ax
movzx eax, word [0x433786]
mov word [0x433782], ax
push dword [0x433780]
call sym.hf32.exe__pic_fp32f_t_real_4
push 6
sub esp, 8
fstp qword [0x433788]
movsd xmm0, qword [0x433788]
movsd qword [esp], xmm0
push section..data
call sym.hf32.exe__string_f_fp_free_16
mov ax, word [0x42f002]
cmp ax, 0x20
jle 0x4010d4
cwde
push 0x43484c
sub eax, 0x20
push eax
push 0x42f02c
call fcn.00401130
mov ax, word [0x42f002]
add esp, 0xc
push esi
test ax, ax
jle 0x4010ec
cmp ax, 0x20
jge 0x4010e5
movsx esi, ax
jmp 0x4010ee
mov esi, 0x20
jmp 0x4010ee
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
push 1
push 0x42f004
call fcn.0040a941
push 0x42f030
call fcn.00401130
add esp, 0x18
xor eax, eax
pop esi
ret

Function at 0x402280
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1070
call fcn.00407310
call sym.hf32.exe__sys_init_0
call sym.hf32.exe__util_init_0
mov eax, 4
mov dword [0x437924], 0x400
mov word [esp], ax
movzx eax, word [0x42f218]
push eax
push dword [esp + 0x1080]
mov dword [0x437d28], 0x100
push 0x437d28
mov dword [0x437e2c], 0x20
mov dword [0x435900], 0x2000
call sym.hf32.exe__string_vstring_12
mov byte [0x434964], 1
call sub.KERNEL32.dll_GetCommandLineA
test eax, eax
je 0x402301
movzx ecx, word [0x42f218]
push ecx
push eax
push 0x435900
call sym.hf32.exe__string_vstring_12
mov eax, 1
mov word [0x437904], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x437904
push 0x435900
call sym.hf32.exe__string_token_16
mov ax, word [0x437904]
mov word [0x437906], ax
mov dword [0x437920], 1
mov byte [0x437e50], 0
add esp, 0x1070
ret 0xc

Function at 0x4030d0
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0040a6ac
push eax
push 0x21
push 1
push str._Program_aborted_on_error._
call fcn.0040a941
push 0x42f388
call fcn.00401130
add esp, 0x18
jmp sym.hf32.exe__sys_exit_error_0
Function at 0x403e80
Capabilities:
Write file on windows

Disassembly:
push 0x430c50
call sym.hf32.exe__string_upcase_4
push 0x431058
call sym.hf32.exe__string_upcase_4
push 1
call fcn.0040a6ac
push eax
push 8
push 1
push str.Status__
call fcn.0040a941
mov ax, word [0x43105a]
add esp, 0x14
cmp ax, 0x50
jle 0x403ed6
cwde
push 0x43496d
sub eax, 0x50
push eax
push 0x431288
call fcn.00401130
mov ax, word [0x43105a]
add esp, 0xc
push esi
test ax, ax
jle 0x403eee
cmp ax, 0x50
jge 0x403ee7
movsx esi, ax
jmp 0x403ef0
mov esi, 0x50
jmp 0x403ef0
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
push 1
push 0x43105c
call fcn.0040a941
push 1
call fcn.0040a6ac
push eax
push 0x10
push 1
push str.__in_subsystem__
call fcn.0040a941
mov ax, word [0x430c52]
mov esi, 0x400
add esp, 0x28
cmp ax, si
jle 0x403f4a
cwde
push 0x43496e
sub eax, esi
push eax
push 0x4312a0
call fcn.00401130
mov ax, word [0x430c52]
add esp, 0xc
test ax, ax
jle 0x403f59
cmp ax, si
jge 0x403f5b
movsx esi, ax
jmp 0x403f5b
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
push 1
push 0x430c54
call fcn.0040a941
push 1
call fcn.0040a6ac
push eax
push 2
push 1
push 0x4312a4
call fcn.0040a941
push 0x4312a8
call fcn.00401130
add esp, 0x2c
mov byte [0x430c48], 1
pop esi
ret

Function at 0x404190
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov esi, dword [esp + 0x114]
mov word [esi + 2], ax
test ebx, ebx
jne 0x4041bd
pop esi
xor al, al
pop ebx
add esp, 0x104
ret 8
push ebp
push edi
cmp word [esi], ax
jle 0x4042c3
push 0
push dword [0x434970]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [0x431300]
push ebx
push 0
push 0x11ff
call sub.KERNEL32.dll_FormatMessageA
test eax, eax
je 0x404209
push eax
push dword [esp + 0x14]
push esi
call sym.hf32.exe__string_vstring_12
push dword [esp + 0x10]
call sub.KERNEL32.dll_LocalFree
jmp 0x4042bd
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404217
push eax
call sub.KERNEL32.dll_LocalFree
push str.RASAPI32.DLL
mov ebp, 1
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
test edi, edi
jne 0x40425c
push ebp
call fcn.0040a6ac
push eax
push 0x1c
push ebp
push str.Could_not_load_RASAIP32.DLL.
call fcn.0040a941
push 0x43133c
call fcn.00401130
add esp, 0x18
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x104
ret 8
push str.RasGetErrorStringA
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
jne 0x404290
push 1
call fcn.0040a6ac
push eax
push 0x2e
push 1
push str.Could_not_find_RasGetErrorStringA_entry_point.
call fcn.0040a941
push 0x431370
call fcn.00401130
add esp, 0x18
jmp 0x4042a0
push dword [0x431314]
lea ecx, [esp + 0x18]
push ecx
push ebx
call eax
mov ebp, eax
push edi
call sub.KERNEL32.dll_FreeLibrary
test ebp, ebp
jne 0x4042c3
movzx eax, word [0x431318]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call sym.hf32.exe__string_vstring_12
push esi
call sym.hf32.exe__string_unpad_4
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x4047e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a6ac
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.0040a941
push 0x4317a0
call fcn.00401130
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x4316d0
push eax
call sym.hf32.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.hf32.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.hf32.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.hf32.exe__string_append_8
push 0x431720
lea eax, [esp + 0x24]
push eax
call sym.hf32.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x40489c
cwde
push 0x4349fa
sub eax, ebx
push eax
push 0x4317a4
call fcn.00401130
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x4048af
cmp ax, bx
jge 0x4048ab
movsx esi, ax
jmp 0x4048b1
mov esi, ebx
jmp 0x4048b1
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a941
push 0x4317a8
call fcn.00401130
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x404903
movsx eax, cx
push 0x4349fb
sub eax, 0x400
push eax
push 0x4317ac
call fcn.00401130
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x404916
cmp ax, bx
jge 0x404912
movsx esi, ax
jmp 0x404918
mov esi, ebx
jmp 0x404918
xor esi, esi
push 1
call fcn.0040a6ac
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a941
push 0x4317b0
call fcn.00401130
add esp, 0x18
call sym.hf32.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x405300
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push esi
call sym.hf32.exe__sys_error_none_4
cmp byte [0x43497d], 0
jne 0x405325
push 0x437e70
call sub.KERNEL32.dll_InitializeCriticalSection
mov byte [0x43497d], 1
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [0x434a00]
push dword [0x4349fc]
call sub.KERNEL32.dll_CreateThread
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x405357
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x10

Function at 0x405570
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x88
push esi
push dword [0x4317bc]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x98]
call sym.hf32.exe__string_t_c_12
mov al, byte [0x434a0c]
mov esi, dword [esp + 0x94]
push esi
mov byte [esp + 0xb], al
call sym.hf32.exe__sys_error_none_4
lea eax, [esp + 7]
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x4055bf
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x88
ret 8

Function at 0x4055d0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x54
mov eax, 0x50
push esi
mov word [esp + 4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 0x60]
call sym.hf32.exe__string_copy_8
lea eax, [esp + 4]
push eax
call sym.hf32.exe__string_terminate_null_4
mov esi, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push esi
push eax
push 2
call fcn.00405630
push esi
call sym.hf32.exe__sys_error_4
test al, al
jne 0x405628
push esi
call sym.hf32.exe__sys_error_none_4
lea eax, [esp + 8]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_RegDeleteValueA
mov dword [esi + 0xc], eax
pop esi
add esp, 0x54
ret 8
Function at 0x405720
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x68]
mov eax, 0x50
push edi
mov word [esp + 0xc], ax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x68]
mov byte [esi], 0
call sym.hf32.exe__string_copy_8
lea eax, [esp + 0xc]
push eax
call sym.hf32.exe__string_terminate_null_4
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x64]
push edi
push eax
push 1
call fcn.00405630
push edi
call sym.hf32.exe__sys_error_4
test al, al
jne 0x4057fe
push ebx
mov ebx, dword [esp + 0x6c]
movsx eax, word [ebx]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
lea eax, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x7c]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x70]
mov dword [edi + 0xc], eax
mov word [ebx + 2], cx
cmp dword [edi + 0xc], 0xea
jne 0x4057b3
push edi
call sym.hf32.exe__sys_error_none_4
jmp 0x4057ce
test cx, cx
jle 0x4057ce
movsx eax, cx
mov al, byte [eax + ebx + 3]
cmp al, byte [0x434a0d]
jne 0x4057ce
lea eax, [ecx - 1]
mov word [ebx + 2], ax
push dword [esp + 0x68]
call sub.ADVAPI32.dll_RegCloseKey
push edi
call sym.hf32.exe__sys_error_4
pop ebx
test al, al
jne 0x4057fe
mov eax, dword [esp + 8]
sub eax, 1
je 0x4057fb
sub eax, 1
jne 0x4057fe
or byte [esi], 2
pop edi
pop esi
add esp, 0x58
ret 0x10
or byte [esi], 1
pop edi
pop esi
add esp, 0x58
ret 0x10

Function at 0x405810
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x884
lea eax, [esp]
push dword [0x4317c0]
push eax
push dword [esp + 0x890]
call sym.hf32.exe__string_t_c_12
push dword [0x4317c4]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x405874
push dword [esp + 0x890]
push 2
push 0xffffffffffffffff
call sym.hf32.exe__sys_stat_set_12
push dword [esp + 0x890]
push dword [esp + 0x88c]
call sym.hf32.exe__sys_stat_parm_vstr_8
add esp, 0x884
ret 0xc
movzx eax, word [0x4317c8]
push eax
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x894]
call sym.hf32.exe__string_vstring_12
push dword [esp + 0x890]
call sym.hf32.exe__sys_error_none_4
add esp, 0x884
ret 0xc