joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Get hostname
Get session user name
Query environment variable
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xac], pe_nt_image_headers32
mov dword [ebp - 0x14c], pe_nt_image_headers32
sub esp, 4
push 0x81
push 0
lea eax, [ebp - 0xa8]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
push eax
call sub.ADVAPI32.DLL_GetUserNameA
add esp, 8
cmp dword [0x45f100], 0
je 0x407091
sub esp, 8
push 0x446902
sub esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.004417d8
add esp, 0x10
cmp dword [0x45f104], 0
je 0x4070cf
sub esp, 0xc
push str.CLIENTNAME
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4070cf
sub esp, 4
push pe_nt_image_headers32
push dword [ebp - 0xc]
lea eax, [ebp - 0x148]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0x10
jmp 0x40711a
sub esp, 8
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.dll_GetComputerNameA
add esp, 8
cmp dword [0x45f100], 0
je 0x40711a
sub esp, 8
push 0x440540
sub esp, 0xc
lea eax, [ebp - 0x148]
push eax
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x40718c
push 0
lea eax, [ebp - 0xa8]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
push 0
push 2
push 0x446902
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
push 0
lea eax, [ebp - 0x148]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
push 0
push 1
push 0x446910
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
jmp 0x407206
sub esp, 4
lea eax, [ebp - 0xa8]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
sub esp, 4
push 2
push 0x446902
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
sub esp, 4
lea eax, [ebp - 0x148]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
sub esp, 4
push 1
push 0x446910
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
leave
ret
Function at 0x407d38
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [0x45f1ac], 0
je 0x407e1e
mov dword [ebp - 0x90], 8
sub esp, 0xc
lea eax, [ebp - 0x90]
push eax
mov eax, dword [0x45f1ac]
call eax
add esp, 0xc
test eax, eax
je 0x407dee
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x8c]
push eax
push str._ld_n
push pe_nt_image_headers32
lea eax, [ebp - 0x88]
push eax
call fcn.00417200
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x407dc4
push 0
lea eax, [ebp - 0x88]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
jmp 0x407e4c
sub esp, 4
lea eax, [ebp - 0x88]
sub esp, 8
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
jmp 0x407e4c
cmp dword [ebp + 0xc], 0
je 0x407e07
push 0
push 3
push 0x4469d8
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
jmp 0x407e4c
sub esp, 4
push 3
push 0x4469d8
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
jmp 0x407e4c
cmp dword [ebp + 0xc], 0
je 0x407e37
push 0
push 3
push 0x4469dc
push dword [ebp + 8]
call sub.WSOCK32.DLL_send
jmp 0x407e4c
sub esp, 4
push 3
push 0x4469dc
push dword [ebp + 8]
call sub.msvcrt.dll__write
add esp, 0x10
leave
ret
Function at 0x407e4e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [0x45f100], 0
je 0x407e84
sub esp, 8
push 0x440540
sub esp, 0xc
push str.inside_do_connect
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
mov eax, dword [0x45f1bc]
mov ax, word [eax + 8]
mov word [ebp - 0x38], ax
sub esp, 4
mov eax, dword [0x45f1bc]
movsx eax, word [eax + 0xa]
push eax
mov eax, dword [0x45f1bc]
mov eax, dword [eax + 0xc]
push dword [eax]
lea eax, [ebp - 0x38]
add eax, 4
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x10
sub esp, 0xc
mov ax, word [0x445010]
and eax, 0xffff
push eax
call sub.WSOCK32.DLL_htons
add esp, 0xc
mov word [ebp - 0x36], ax
cmp dword [0x445014], 0
je 0x407ef1
sub esp, 4
push 0
push 2
push 2
call sub.WSOCK32.DLL_socket
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x407f05
sub esp, 4
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x407f47
cmp dword [0x45f100], 0
je 0x407f3b
sub esp, 8
push 0x440540
sub esp, 0xc
push str.cannot_open_socket
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
mov dword [ebp - 0x3c], 0
jmp 0x408038
mov word [ebp - 0x28], 2
sub esp, 0xc
push 0
call sub.WSOCK32.DLL_htonl
add esp, 0xc
mov dword [ebp - 0x24], eax
sub esp, 0xc
push 0
call sub.WSOCK32.DLL_htons
add esp, 0xc
mov word [ebp - 0x26], ax
sub esp, 4
push 0x10
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc]
call sub.WSOCK32.DLL_bind
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x407fdc
cmp dword [0x45f100], 0
je 0x407fd3
sub esp, 8
push 0x440540
sub esp, 0xc
mov ax, word [0x445010]
and eax, 0xffff
push eax
sub esp, 0xc
push str.cannot_bind_port_TCP
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00431fa0
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
mov dword [ebp - 0x3c], 0
jmp 0x408038
sub esp, 4
push 0x10
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0xc]
call sub.WSOCK32.DLL_connect
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jns 0x408032
cmp dword [0x45f100], 0
je 0x408029
sub esp, 8
push 0x440540
sub esp, 0xc
push str.cannot_connect_to_server
push dword [0x45f10c]
call fcn.004417d8
add esp, 0x14
push eax
call fcn.00430ae0
add esp, 0x10
mov dword [ebp - 0x3c], 0
jmp 0x408038
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
leave
ret
Function at 0x412f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push esi
push edi
push eax
call fcn.00412ea0
mov dword [esp], eax
call sub.msvcrt.dll__read
add esp, 0x10
mov ebx, eax
cmp eax, 0xffffffff
jne 0x412f8d
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x412f65
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x416140
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov ebx, dword [0x469e40]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x416180
mov dword [ebx + 0x30], eax
push edx
push edx
push 0
mov eax, dword [ebx + 0x30]
push eax
call fcn.00417930
add esp, 0x10
test eax, eax
sete al
and eax, 0xff
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
leave
ret
call fcn.004176c0
test eax, eax
sete al
and eax, 0xff
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x416490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x469e40]
mov edi, dword [ebp + 8]
test eax, eax
je 0x416552
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x416567
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x41652d
mov eax, dword [eax + 0x28]
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x4164d8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, 5
test eax, eax
je 0x4164e8
mov ecx, dword [eax + 0x18]
xor dl, dl
cmp edx, 5
je 0x416520
test edx, edx
jne 0x416513
test ecx, ecx
je 0x4164d0
push eax
push eax
push ebx
push edi
mov eax, dword [edi + 4]
push eax
mov esi, dword [edi]
push esi
push 1
push 1
call ecx
add esp, 0x20
cmp eax, 6
je 0x416576
cmp eax, 8
je 0x4164d0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call fcn.004176c0
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x4164be
call fcn.00415ec0
mov eax, dword [0x469e40]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x4164b4
call fcn.004161a0
mov eax, dword [0x469e40]
jmp 0x4164b4
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, ebx
mov eax, edi
call fcn.00416410
cmp eax, 7
jne 0x416518
mov eax, dword [0x469e40]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4165c5
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x4165ea
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x4165d1
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00415ec0
mov eax, dword [0x469e40]
jmp 0x4165a3
push esi
push esi
push ebx
mov ebx, dword [eax + 0x30]
push ebx
call sub.KERNEL32.dll_TlsSetValue
pop edx
test eax, eax
pop ecx
jne 0x4165b4
call fcn.004176c0
jmp 0x4165b4
call fcn.004161a0
mov eax, dword [0x469e40]
jmp 0x4165aa
Function at 0x4167f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x469e40]
mov edi, dword [ebp + 8]
test eax, eax
je 0x416880
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x416895
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x4168b0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x416874
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00416410
cmp eax, 7
jne 0x41691f
mov eax, dword [0x469e40]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4168f5
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x416910
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x4168d5
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00416600
jmp 0x416835
call fcn.00415ec0
mov eax, dword [0x469e40]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x416810
call fcn.004161a0
mov eax, dword [0x469e40]
mov edx, dword [eax + 0x2c]
test edx, edx
je 0x41681b
lea esi, [esi]
mov ebx, dword [eax + 0x30]
call fcn.004176c0
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x41681e
push edx
push edx
push ebx
mov edi, dword [eax + 0x30]
push edi
call sub.KERNEL32.dll_TlsSetValue
pop ebx
test eax, eax
pop esi
jne 0x416863
call fcn.004176c0
jmp 0x416863
call fcn.00415ec0
mov eax, dword [0x469e40]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x416859
lea esi, [esi]
call fcn.004161a0
mov eax, dword [0x469e40]
jmp 0x416859
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x416930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x4169c0
mov eax, dword [0x469e40]
test eax, eax
je 0x4169b0
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x416a1f
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x4169d1
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00416600
cmp eax, 7
jne 0x416a3d
mov eax, dword [0x469e40]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x416a10
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x416a2e
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x4169f6
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00415ec0
mov eax, dword [0x469e40]
jmp 0x41694c
sub esp, 0xc
push edi
call fcn.00416490
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call fcn.004176c0
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x416961
push edx
push edx
push ebx
mov edi, dword [eax + 0x30]
push edi
call sub.KERNEL32.dll_TlsSetValue
pop ebx
test eax, eax
pop esi
jne 0x41699f
call fcn.004176c0
jmp 0x41699f
call fcn.00415ec0
mov eax, dword [0x469e40]
jmp 0x41698a
call fcn.004161a0
mov eax, dword [0x469e40]
jmp 0x416957
call fcn.004161a0
mov eax, dword [0x469e40]
jmp 0x416995
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x416c00
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push eax
push eax
call sub.KERNEL32.dll_TlsAlloc
mov edx, eax
cmp eax, 0xffffffff
je 0x416c27
mov eax, dword [ebp + 8]
mov dword [eax], edx
push eax
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push edx
call fcn.00417930
add esp, 0x10
leave
ret
call fcn.004176c0
leave
ret
Function at 0x417ad0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x445190]
test eax, eax
je 0x417bcb
mov al, byte [0x4451a8]
test al, al
jne 0x417bbc
mov eax, dword [0x445198]
mov esi, dword [0x445194]
cmp esi, eax
jbe 0x417b19
mov ecx, dword [0x4451ac]
add eax, eax
lea edx, [ecx + 1]
mov ecx, edx
cmp esi, eax
ja 0x417b08
mov dword [0x4451ac], edx
sub esp, 0xc
lea eax, [esi + esi + 2]
xor edi, edi
push eax
call fcn.0040bf00
mov bx, word [0x445198]
mov dword [0x4451d0], eax
mov edx, eax
xor ecx, ecx
add esp, 0x10
mov esi, dword [0x445194]
cmp bx, cx
jae 0x417b49
add ebx, ebx
inc edi
inc ecx
mov word [edx], di
mov eax, ecx
add edx, 2
and eax, 0xffff
cmp eax, esi
jbe 0x417b41
sub esp, 0xc
mov eax, dword [0x4451ac]
shl eax, 4
push eax
call fcn.0040bf00
mov dword [0x4451c0], eax
mov eax, dword [0x469dd0]
add esp, 0x10
test eax, eax
jne 0x417c26
xor esi, esi
cmp esi, dword [0x4451ac]
jae 0x417bbc
nop
lea esi, [esi]
sub esp, 0xc
mov ebx, esi
shl ebx, 4
mov eax, dword [0x4451c0]
add ebx, eax
push 4
call fcn.0040bf00
inc esi
add esp, 0x10
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x4451ac]
jb 0x417b90
mov byte [0x4451c4], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [0x445190], 8
mov dword [0x445194], 0x80
mov dword [0x445198], 8
push str.GLIBCXX_FORCE_NEW
mov dword [0x44519c], 0xff0
mov dword [0x4451a0], 0x1000
mov dword [0x4451a4], 0xa
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
setne al
mov byte [0x4451a8], al
jmp 0x417aeb
sub esp, 0xc
mov eax, dword [0x4451a0]
shl eax, 3
mov ebx, 1
push eax
call fcn.0040bf00
add esp, 0x10
mov dword [0x4451b4], eax
cmp dword [0x4451a0], 1
jmp 0x417c75
lea eax, [ebx*8]
mov edx, dword [0x4451b4]
mov ecx, dword [0x4451b4]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x4451a0], ebx
mov dword [edx - 8], eax
ja 0x417c50
mov eax, dword [0x4451b4]
sub esp, 0xc
mov dword [eax + ebx*8 - 8], 0
mov eax, dword [0x4451b4]
mov dword [eax + ebx*8 - 4], ebx
push 0x4451b8
call fcn.00416cc0
pop esi
pop edi
push 0x417ea0
push 0x4451b0
call fcn.00416c00
mov esi, dword [0x4451a0]
xor eax, eax
add esp, 0x10
inc esi
mov dword [ebp - 0x10], 0
cmp eax, dword [0x4451ac]
jae 0x417bbc
lea edi, [esi*4]
mov edx, dword [ebp - 0x10]
sub esp, 0xc
shl edx, 4
mov eax, dword [0x4451c0]
push edi
lea ebx, [edx + eax]
call fcn.0040bf00
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0040bf00
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0040bf00
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0040bf00
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.00416cc0
add esp, 0x10
xor edx, edx
jmp 0x417d3e
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x417d20
mov ebx, dword [ebp - 0x10]
inc ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x4451ac]
jb 0x417cd1
jmp 0x417bbc
Function at 0x418460
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [0x4451d4]
test edi, edi
je 0x41856b
mov al, byte [0x4451ec]
test al, al
jne 0x41855c
mov eax, dword [0x4451dc]
mov esi, dword [0x4451d8]
cmp esi, eax
jbe 0x4184b1
mov ecx, dword [0x4451f0]
lea esi, [esi]
add eax, eax
lea edx, [ecx + 1]
mov ecx, edx
cmp esi, eax
ja 0x4184a0
mov dword [0x4451f0], edx
sub esp, 0xc
lea eax, [esi + esi + 2]
xor edi, edi
push eax
call fcn.0040bf00
mov bx, word [0x4451dc]
mov dword [0x445214], eax
mov edx, eax
xor ecx, ecx
add esp, 0x10
mov esi, dword [0x4451d8]
lea esi, [esi]
cmp bx, cx
jae 0x4184e8
add ebx, ebx
inc edi
inc ecx
mov word [edx], di
mov eax, ecx
add edx, 2
and eax, 0xffff
cmp eax, esi
jbe 0x4184e0
sub esp, 0xc
mov eax, dword [0x4451f0]
shl eax, 4
push eax
call fcn.0040bf00
mov esi, dword [0x469dd0]
add esp, 0x10
mov dword [0x445204], eax
test esi, esi
jne 0x4185c6
xor esi, esi
cmp esi, dword [0x4451f0]
jae 0x41855c
nop
lea esi, [esi]
sub esp, 0xc
mov ebx, esi
shl ebx, 4
mov eax, dword [0x445204]
add ebx, eax
push 4
call fcn.0040bf00
inc esi
add esp, 0x10
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x4451f0]
jb 0x418530
mov byte [0x445208], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [0x4451d4], 8
mov dword [0x4451d8], 0x80
mov dword [0x4451dc], 8
push str.GLIBCXX_FORCE_NEW
mov dword [0x4451e0], 0xff0
mov dword [0x4451e4], 0x1000
mov dword [0x4451e8], 0xa
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
setne al
mov byte [0x4451ec], al
jmp 0x41847c
sub esp, 0xc
mov eax, dword [0x4451e4]
shl eax, 3
mov ebx, 1
push eax
call fcn.0040bf00
add esp, 0x10
mov dword [0x4451f8], eax
cmp dword [0x4451e4], 1
jmp 0x418615
lea eax, [ebx*8]
mov edx, dword [0x4451f8]
mov ecx, dword [0x4451f8]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x4451e4], ebx
mov dword [edx - 8], eax
ja 0x4185f0
mov eax, dword [0x4451f8]
sub esp, 0xc
mov dword [eax + ebx*8 - 8], 0
mov eax, dword [0x4451f8]
mov dword [eax + ebx*8 - 4], ebx
push 0x4451fc
call fcn.00416cc0
pop ecx
pop ebx
push 0x418840
push 0x4451f4
call fcn.00416c00
mov esi, dword [0x4451e4]
xor eax, eax
add esp, 0x10
inc esi
mov dword [ebp - 0x10], 0
cmp eax, dword [0x4451f0]
jae 0x41855c
lea edi, [esi*4]
mov edx, dword [ebp - 0x10]
sub esp, 0xc
shl edx, 4
mov eax, dword [0x445204]
push edi
lea ebx, [edx + eax]
call fcn.0040bf00
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0040bf00
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0040bf00
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0040bf00
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.00416cc0
add esp, 0x10
xor edx, edx
jmp 0x4186de
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x4186c0
mov edx, dword [ebp - 0x10]
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x4451f0]
jb 0x418671
jmp 0x41855c
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a96f8]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4a96fc]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x4a9700]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x4a9704]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x4b8954], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x4b8954]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x4b8950], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x4b88a4], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x4b894c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408d28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a8f30]
jne 0x408d32
repz ret
jmp fcn.0040cca4

Function at 0x409fa3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402aae
and dword [ebp - 4], 0
cmp dword [0x4ad940], 0
mov ebx, eax
jne 0x40a054
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a105
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a105
push eax
call fcn.00402a3c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ad940], eax
call esi
push eax
call fcn.00402a3c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ad944], eax
call esi
push eax
call fcn.00402a3c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ad948], eax
call esi
push eax
call fcn.00402a3c
pop ecx
mov dword [0x4ad950], eax
test eax, eax
je 0x40a054
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402a3c
pop ecx
mov dword [0x4ad94c], eax
mov eax, dword [0x4ad94c]
cmp eax, ebx
je 0x40a0ac
cmp dword [0x4ad950], ebx
je 0x40a0ac
push eax
call fcn.00402ab7
push dword [0x4ad950]
mov esi, eax
call fcn.00402ab7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a0ac
test edi, edi
je 0x40a0ac
call esi
test eax, eax
je 0x40a0a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a0a3
test byte [ebp - 0xc], 1
jne 0x40a0ac
or dword [ebp + 0x10], 0x200000
jmp 0x40a0e5
mov eax, dword [0x4ad944]
cmp eax, ebx
je 0x40a0e5
push eax
call fcn.00402ab7
pop ecx
test eax, eax
je 0x40a0e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a0e5
mov eax, dword [0x4ad948]
cmp eax, ebx
je 0x40a0e5
push eax
call fcn.00402ab7
pop ecx
test eax, eax
je 0x40a0e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ad940]
call fcn.00402ab7
pop ecx
test eax, eax
je 0x40a105
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a107
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret