joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61011b80
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x9c
mov dword [esp + 0x98], ebp
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], edi
call fcn.610ff110
test eax, eax
jne 0x61011bd5
mov ebx, dword [esp + 0x8c]
mov esi, dword [esp + 0x90]
mov edi, dword [esp + 0x94]
mov ebp, dword [esp + 0x98]
add esp, 0x9c
ret
mov byte [esp + 0x6a], 0
lea eax, [esp + 0x50]
mov ecx, 3
mov dword [esp + 8], eax
mov edx, 0xd
lea ebx, [esp + 0x20]
mov dword [esp + 0x10], ecx
mov eax, str.cYgstd__x__x__x
xor esi, esi
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov byte [esp + 0x5d], 0
mov byte [esp + 0x50], 0
mov dword [esp + 4], eax
call sym._sprintf_1
mov dword [esp], ebx
xor ebx, ebx
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
cmp byte [esp + esi + 0x50], 0
jne 0x61011c44
lea esi, [esi]
inc ebx
add esi, 0xd
cmp ebx, 2
jg 0x61011bb2
cmp byte [esp + esi + 0x50], 0
je 0x61011c30
mov eax, dword [ebx*4 + 0x61105708]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
add eax, esi
mov dword [esp], eax
call sym.build_fh_name_char_const__void__unsigned_int__suffix_info_
test eax, eax
mov edx, eax
je 0x61011c30
mov eax, dword [ebp]
test ebx, ebx
mov ecx, dword [edx]
mov dword [eax + ebx*4], edx
mov eax, 0x1ff
mov dword [esp + 8], eax
mov eax, 0x10000
jne 0x61011cb7
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x34]
test eax, eax
jne 0x61011cd2
mov dword [esp + 4], ebx
mov dword [esp], ebp
call method.dtable.release_int_
jmp 0x61011c30
mov dword [esp], edx
xor eax, eax
cmp ebx, 2
sete al
add eax, 0x10001
mov dword [esp + 4], eax
call dword [ecx + 0x34]
test eax, eax
je 0x61011ca6
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x61011c30
Function at 0x610136d0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov ebx, ecx
mov dword [esp], edx
call sym.cygwin1.dll__strlen
inc eax
mov dword [esp + 4], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._realloc_1
mov dword [edi + 8], eax
mov dword [esp + 4], esi
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
test ebx, ebx
je 0x61013856
mov dword [esp], ebx
call sym.cygwin1.dll__strlen
mov edx, dword [edi + 4]
add eax, edx
inc eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym._realloc_1
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [esp + 4], ebx
mov eax, dword [edi + 4]
mov esi, dword [edi + 0xc]
add eax, esi
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
cmp byte [edi + 0x20], 0
jne 0x61013778
movzx edx, byte [0x6110a820]
and edx, 1
test dl, dl
jne 0x610137e0
jne 0x61013820
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [0x61105550], 0
je 0x6101375c
mov dword [ebp - 0x10], esp
mov ebx, dword [edi + 4]
lea eax, [ebx + 0x1e]
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov eax, dword [edi]
lea esi, [esp + 0x23]
dec ebx
mov dword [esp + 8], ebx
and esi, 0xfffffff0
mov dword [esp], esi
mov dword [esp + 4], eax
call sym.cygwin1.dll__memcpy
mov byte [esi + ebx], 0
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 4]
mov dword [esp], esi
add eax, edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
movzx edx, byte [0x6110a820]
mov esp, dword [ebp - 0x10]
and edx, 1
test dl, dl
je 0x6101376a
nop
lea esi, [esi]
mov eax, dword [edi + 8]
mov dword [esp], 0x6110a820
mov dword [esp + 0x10], eax
mov eax, 0x61118582
mov dword [esp + 0xc], eax
mov eax, str.void_win_env::add_cache_const_char__const_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
test byte [0x6110a820], 1
je 0x61013770
nop
lea esi, [esi]
mov eax, dword [edi + 0xc]
mov esi, 0x40
mov edi, str.void_win_env::add_cache_const_char__const_char_
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
mov eax, str.native__s
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call dword [edi + 0x1c]
mov ebx, dword [edi + 4]
add eax, ebx
inc eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym._realloc_1
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0xc]
mov dword [esp], esi
add eax, ecx
mov dword [esp + 4], eax
call dword [edi + 0x14]
jmp 0x61013756
Function at 0x610138c0
Capabilities:
Encrypt data using rc4 prga
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x61105524]
test eax, eax
je 0x61013951
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0x10]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x61013951
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.cygwin1.dll__strlen
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
test edx, edx
je 0x61013943
lea esi, [esi]
lea edi, [edi]
mov esi, dword [ebp + 8]
mov edi, edx
mov ecx, ebx
cld
and eax, 0xff
dec ecx
js 0x61013923
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6101391f
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6101392a
test al, al
jne 0x6101390d
mov eax, 1
jmp 0x6101392c
xor eax, eax
test eax, eax
je 0x61013936
cmp byte [edx + ebx], 0x3d
je 0x610139a1
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
test edx, edx
jne 0x61013900
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x61013943
mov edx, eax
mov eax, 0x65
call sym._cmalloc_8
test eax, eax
mov esi, eax
je 0x61013943
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
mov edx, esi
jne 0x61013945
jmp 0x61013943
lea edx, [edx + ebx + 1]
jmp 0x61013945
Function at 0x61015600
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x2c
mov dword [ebp - 0x18], ecx
lea ecx, [edx - 1]
lea edx, [edx + 0x1d]
mov dword [ebp - 0x14], eax
and edx, 0xfffffff0
mov eax, edx
mov dword [ebp - 0x1c], esp
call sym.cygwin1.dll__alloca
mov dword [esp + 8], ecx
lea esi, [esp + 0x23]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
and esi, 0xfffffff0
mov dword [esp], esi
mov dword [esp + 4], eax
call sym.cygwin1.dll__memcpy
mov byte [edi + esi - 1], 0
lea eax, [ebp - 0xd]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
mov ebx, eax
jle 0x610156dc
inc ebx
cmp dword [ebp - 0x18], 0xb
je 0x610156f2
mov eax, dword [ebp - 0x18]
mov edx, ebx
call sym._cmalloc_8
mov dword [ebp - 0x20], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
je 0x610156d4
test byte [0x6110a820], 1
jne 0x610156a7
mov eax, dword [ebp - 0x20]
mov esp, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], esi
mov ecx, str.using_value_from_GetEnvironmentVariable_for__s
mov edx, str.char_getwinenveq_const_char__size_t__int_
mov dword [esp + 0xc], ecx
mov eax, 0x40
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x61015699
mov eax, dword [ebp - 0x20]
call sym._cfree_4
test byte [0x6110a820], 1
jne 0x61015715
mov esp, dword [ebp - 0x1c]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, edi
mov eax, 0xb
mov edx, ebx
call sym._cmalloc_8
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x6101574a
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x20]
add eax, edi
jmp 0x6101567d
mov eax, dword [ebp - 0x14]
mov dword [esp], 0x6110a820
mov dword [esp + 0x10], eax
mov eax, str.warning:__s_not_present_in_environment
mov dword [esp + 0xc], eax
mov eax, str.char_getwinenveq_const_char__size_t__int_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov esp, dword [ebp - 0x1c]
xor eax, eax
jmp 0x610156ea
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x20]
add eax, edi
jmp 0x6101567d
Function at 0x61016740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov eax, 1
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
cmp byte [0x611402c0], 0
je 0x61016770
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
xor eax, eax
lea edi, [ebp - 0x38]
mov ecx, 7
rep stosd dword es:[edi], eax
mov eax, 0x1c
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xb8]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x61016845
mov eax, dword [0x6113fbb0]
add eax, 0x22
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
lea edi, [esp + 0x2b]
and edi, 0xfffffff0
mov dword [edi], 0
mov edx, dword [ebp - 0x34]
test edx, edx
je 0x610167d7
cmp dword [ebp - 0x28], 0x1000
je 0x61016888
mov dword [ebp - 0x3c], 1
mov eax, 1
test byte [0x6110a820], 1
je 0x6101675f
mov eax, dword [ebp - 0x3c]
mov edx, str.pc__p__h__p__inside_kernel__d
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0xb8]
mov dword [esp + 0xc], edx
mov dword [esp], 0x6110a820
mov dword [esp + 0x10], eax
mov eax, str.bool_inside_kernel_CONTEXT_
mov dword [esp + 8], eax
mov eax, 0x800
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor eax, eax
cmp dword [ebp - 0x3c], 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
setne al
mov esp, ebp
pop ebp
ret
test byte [0x6110a820], 1
je 0x610167a6
mov eax, dword [ebx + 0xb8]
mov edi, str.couldnt_get_memory_info__pc__p___E
mov esi, str.bool_inside_kernel_CONTEXT_
mov dword [esp + 0xc], edi
mov ecx, 0x800
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x610167a6
cmp edx, dword [0x6110021c]
mov dword [ebp - 0x3c], 0
je 0x610168bd
mov eax, dword [0x6113fbb0]
mov dword [esp + 4], edi
mov dword [esp], edx
add eax, 2
mov dword [esp + 8], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
test eax, eax
jne 0x610168cf
mov dword [ebp - 0x3c], 0
test byte [0x6110a820], 1
je 0x6101682f
jmp 0x610167f0
mov esi, 0x6113f590
mov ecx, dword [0x6113fbb0]
cld
and eax, 0xff
dec ecx
js 0x610168f6
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x610168f2
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x610168fd
test al, al
jne 0x610168e0
mov eax, 1
jmp 0x610168ff
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x610168bd
Function at 0x61016ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
cmp byte [0x61105550], 0
jne 0x61016f01
mov eax, dword [0x61107154]
mov edx, 1
mov eax, dword [eax + 0xc]
test eax, eax
je 0x6101709c
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
mov esi, 0xffffffff
mov dword [esp + 4], esi
mov eax, dword fs:[4]
sub eax, 0x319c
mov dword [esp], eax
call method._cygtls.remove_unsigned_long_
xor edx, edx
cmp ebx, 6
je 0x61016ef0
mov eax, dword [0x61107154]
cmp dword [eax + 0x12c], 0xffffffff
je 0x61016f50
cmp ebx, 2
je 0x61017082
cmp byte [0x6113fbd0], 0
jne 0x61016f50
cmp ebx, 5
je 0x61017057
lea esi, [esi]
mov eax, dword [0x61146330]
test eax, eax
je 0x61016f73
or byte [eax + 0x2c], 4
mov edx, 1
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
call sub.KERNEL32.dll_GetCurrentProcessId
mov edx, eax
mov eax, dword [0x611630ec]
lea edi, [ebp - 0x38]
test byte [eax + 0x13], 4
jne 0x61017050
mov dword [edi + 0xc], 0
xor ecx, ecx
mov eax, edi
mov dword [edi + 0x10], 0
mov dword [esp], 0
call method.pinfo.init_int__unsigned_long__void_
cmp byte [ebp - 0x30], 0
mov esi, dword [ebp - 0x34]
je 0x61016fbf
test esi, esi
je 0x61016f5d
mov dword [esp], edi
call method.pinfo.release__
test esi, esi
je 0x61016f5d
mov eax, dword [0x61107154]
mov eax, dword [eax + 0x12c]
mov dword [esp + 4], eax
mov eax, dword [0x6110751c]
add eax, 0x14
mov dword [esp], eax
call method.tty_list.get_tty_int_
mov esi, eax
mov eax, dword [0x61107154]
cmp dword [eax + 0x12c], 0xffffffff
je 0x61016f5d
mov eax, dword [eax]
cmp dword [esi + 8], eax
jne 0x61016f5d
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esi + 0x14]
sub eax, edx
cmp eax, 0x31
jbe 0x61016f5d
dec ebx
mov edi, 2
je 0x610170e3
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x14], eax
mov eax, dword [0x61107154]
mov eax, dword [eax]
mov dword [esp + 4], edi
neg eax
mov dword [esp], eax
call sym.killsys_int__int_
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x14], eax
mov edx, 1
jmp 0x61016f62
neg edx
jmp 0x61016f8c
mov eax, dword [0x61146328]
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x61016ef0
mov edx, 1
mov eax, 0x61107530
call sym.__Z8sig_sendP6_pinfoi_8
mov edx, 1
jmp 0x61016f62
mov edx, 1
xor eax, eax
call sym.__Z8sig_sendP6_pinfoi_8
mov byte [0x6113fbd0], 1
xor edx, edx
jmp 0x61016ef0
test byte [0x6110a820], 1
jne 0x610170b1
mov dword [esp], 0xc000013a
call sub.KERNEL32.dll_ExitProcess
mov dword [esp], 0x6110a820
mov eax, 0xc000013a
mov edi, 0x40
mov dword [esp + 0x10], eax
mov eax, str.exiting_with_status__p
mov dword [esp + 0xc], eax
mov eax, str.BOOL_ctrl_c_handler_DWORD_
mov dword [esp + 8], eax
mov dword [esp + 4], edi
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x610170a5
cmp byte [esi + 0x33], 3
jne 0x61017020
cmp byte [esi + 0x37], 3
jne 0x61017020
mov edi, 3
jmp 0x61017020
Function at 0x61017940
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, str.mask_sync
mov ebp, esp
push ebx
mov eax, 0x6110614c
sub esp, 0x24
call method.muto.init_char_const_
mov byte [0x6113f590], 0
mov ebx, 0x6113f590
mov eax, 0x3fe
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetSystemDirectoryA
xor edx, edx
sub esp, 8
mov eax, edx
mov ah, al
mov al, byte [ebx]
cmp al, ah
je 0x61017989
inc ebx
test al, al
jne 0x6101797c
xor ebx, ebx
mov eax, ebx
cmp eax, 0x6113f590
mov edx, eax
je 0x61017a09
cmp byte [eax - 1], 0x5c
je 0x61017a00
mov byte [eax], 0x5c
sub eax, 0x6113f58f
mov byte [edx + 1], 0
test byte [0x6110a820], 1
mov dword [0x6113fbb0], eax
jne 0x610179c0
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x14], eax
mov ebx, 0x6113f590
mov ecx, str.windows_system_directory__s__windows_system_directory_length__d
mov dword [esp + 0x10], ebx
mov edx, str.void_events_init__
mov eax, 0x40
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov ebx, dword [ebp - 4]
leave
ret
mov eax, edx
sub eax, 0x6113f590
jmp 0x610179a6
mov dword [esp], str.cant_find_windows_system_directory
call sym.___api_fatal
nop
lea esi, [esi]
lea edi, [edi]

Function at 0x61017d90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 8], ebx
mov ebx, eax
lea eax, [ebp - 9]
mov dword [ebp - 4], esi
mov esi, edx
xor edx, edx
cmp eax, ebx
jae 0x61017db5
cmp dword [ebx + 0x1070], 0xc763173f
je 0x61017e02
test dl, dl
jne 0x61017dc3
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.610ff110
test eax, eax
je 0x61017db9
lea eax, [ebx + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x104]
mov ebx, str.cYgSiGw00f__d__p__p
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], ebx
call sym.___small_sprintf
mov dword [esp], ebx
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
jmp 0x61017db9
mov edx, 1
jmp 0x61017db5
Function at 0x61017e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x30
mov ebx, edx
mov eax, dword [0x61146334]
test eax, eax
je 0x61017ee0
test byte [0x6110a820], 1
jne 0x61017e97
mov dword [0x61106144], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
mov edx, ebx
sub esp, 8
and edx, 0x7f
mov eax, esi
call method._cygtls.signal_debugger_int_
test bl, 0x80
jne 0x61017f30
mov edx, 0xffffffff
mov eax, 0x61105560
call method.muto.acquire_unsigned_long_
mov byte [ebp - 0x18], 1
mov eax, dword [0x61105520]
test eax, eax
jg 0x61017f24
lea esi, [esi]
mov ecx, 1
mov dword [0x61105520], ecx
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [0x6110ad00], eax
jmp 0x61017f11
mov dword [esp], 0x6110a820
mov eax, str.terminating_captive_process
mov dword [esp + 0xc], eax
mov eax, str.void__cygtls::signal_exit_int_
mov dword [esp + 8], eax
mov eax, 0x800
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov dword [0x61106144], ebx
mov eax, dword [0x61146334]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
nop
lea esi, [esi]
mov edx, ebx
mov eax, esi
and edx, 0x7f
call method._cygtls.signal_debugger_int_
test bl, 0x80
jne 0x61017f30
mov edx, 0xffffffff
mov eax, 0x61105560
call method.muto.acquire_unsigned_long_
mov byte [ebp - 0x18], 1
mov eax, dword [0x61105520]
test eax, eax
jle 0x61017e80
mov eax, dword [0x61146334]
test eax, eax
jne 0x61017f24
mov esi, dword [0x61105520]
test esi, esi
je 0x61017f57
mov edx, ebx
mov eax, 0x61107150
call method.pinfo.exit_unsigned_long_
mov dword [esp], 1
call sym._try_to_debug
test eax, eax
jne 0x61017ef1
mov eax, dword [esi + 0xe4]
mov ecx, 1
mov edx, 1
call sym.stackdump_unsigned_long__int__bool_
jmp 0x61017ef1
call sub.KERNEL32.dll_GetCurrentThread
mov dword [esp], eax
mov edx, 0xf
mov dword [esp + 4], edx
call sub.KERNEL32.dll_SetThreadPriority
mov eax, dword [0x6110023c]
sub esp, 8
mov dword [esp], eax
call method.ResourceLocks.Delete__
mov eax, dword [0x6110023c]
mov dword [esp], eax
call method.ResourceLocks.Init__
test byte [0x6110a820], 1
jne 0x61017faa
mov eax, dword [0x6110752c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetEvent
sub esp, 4
mov eax, ebx
call sym.__Z7do_exiti_4
mov dword [esp + 0x10], ebx
mov eax, str.about_to_call_do_exit___x_
mov esi, 0x800
mov dword [esp + 0xc], eax
mov eax, str.void__cygtls::signal_exit_int_
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x61017f93
Function at 0x6101a780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x611001c4]
mov ebx, dword [0x6113fe04]
mov eax, dword [eax]
test ebx, ebx
mov dword [esp + 0x18], eax
je 0x6101a802
mov eax, dword [esp + 0x30]
mov ebp, dword [eax + 0x84]
mov dword [esp], ebp
call sym.cygwin1.dll__strlen
mov dword [esp + 0x14], eax
mov edi, dword [ebx]
mov eax, dword [esp + 0x34]
and eax, 3
test edi, edi
mov dword [esp + 0x10], eax
je 0x6101a802
lea esi, [esi]
lea edi, [edi]
cmp byte [edi], 0
jne 0x6101a7e3
mov edx, dword [ebx + 4]
mov eax, edx
and eax, 3
cmp eax, dword [esp + 0x10]
je 0x6101a85a
mov dword [esp], edi
call sym.cygwin1.dll__strlen
mov edx, dword [esp + 0x14]
lea esi, [ebp + edx]
sub esi, eax
cmp eax, edx
jbe 0x6101a810
add ebx, 8
mov edi, dword [ebx]
test edi, edi
jne 0x6101a7d0
mov eax, dword [esp + 0x18]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebp, esi
je 0x6101a826
movzx eax, byte [esi - 1]
cmp al, 0x2f
sete dl
cmp al, 0x5c
sete al
or dl, al
je 0x6101a7f9
mov edx, dword [ebx + 4]
mov eax, edx
and eax, 3
cmp eax, dword [esp + 0x10]
jne 0x6101a7f9
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6101a849
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6101a854
test al, al
jne 0x6101a83a
mov eax, 1
jmp 0x6101a856
xor eax, eax
test eax, eax
je 0x6101a7f9
and edx, 0xfffffffc
mov dword [esp + 0x18], edx
jmp 0x6101a802
Function at 0x6101f9f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
sub esp, 0x38
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0xec]
lea edx, [esp + 0x10]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
sub esp, 8
test eax, eax
je 0x6101fa5f
mov edx, dword [0x611062ec]
mov eax, dword [esp + 0x14]
cmp word [edx + 0x47a], ax
je 0x6101fa64
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0xec]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esp, 8
mov edx, dword [0x611062ec]
mov eax, dword [esp + 0x14]
mov dword [edx + 0x47a], eax
add esp, 0x38
pop ebx
ret
movzx eax, word [esp + 0x16]
cmp word [edx + 0x47c], ax
jne 0x6101fa2f
jmp 0x6101fa5f

Function at 0x61022f30
Capabilities:
Set console window title

Disassembly:
push ebx
mov eax, 0x100
sub esp, 0x148
mov dword [esp + 8], eax
mov eax, dword [esp + 0x150]
lea ebx, [esp + 0x30]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.cygwin1.dll__strncpy
xor eax, eax
mov byte [esp + 0x130], al
mov eax, 0x3a98
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
call sym.lock_ttys::lock_ttys_unsigned_long_
mov dword [esp], ebx
call sub.KERNEL32.dll_SetConsoleTitleA
sub esp, 4
test byte [0x6110a820], 1
jne 0x61022fa0
cmp byte [esp + 0x20], 0
jne 0x61022fe0
add esp, 0x148
pop ebx
ret 4
mov dword [esp + 0x10], ebx
mov eax, str.title__s
mov ebx, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x6111cba0
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
cmp byte [esp + 0x20], 0
je 0x61022f90
lea esi, [esi]
lea edi, [edi]
call method.lock_ttys.release__
add esp, 0x148
pop ebx
ret 4