joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6100a687
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
or byte [eax], bl

Function at 0x61010290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
jmp 0x610102cd
lea edi, [ecx + 0x38]
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x610102ba
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x610102c5
test al, al
jne 0x610102ab
mov eax, 1
jmp 0x610102c7
xor eax, eax
test eax, eax
jne 0x610102d6
mov ecx, dword [ecx]
test ecx, ecx
jne 0x610102a0
pop esi
xor eax, eax
pop edi
ret
pop esi
mov eax, ecx
pop edi
ret
Function at 0x61011b40
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x9c
mov dword [esp + 0x98], ebp
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], edi
call fcn.61101110
test eax, eax
jne 0x61011b95
mov ebx, dword [esp + 0x8c]
mov esi, dword [esp + 0x90]
mov edi, dword [esp + 0x94]
mov ebp, dword [esp + 0x98]
add esp, 0x9c
ret
mov byte [esp + 0x6a], 0
lea eax, [esp + 0x50]
mov ecx, 3
mov dword [esp + 8], eax
mov edx, 0xd
lea ebx, [esp + 0x20]
mov dword [esp + 0x10], ecx
mov eax, str.cYgstd__x__x__x
xor esi, esi
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov byte [esp + 0x5d], 0
mov byte [esp + 0x50], 0
mov dword [esp + 4], eax
call sym._sprintf_1
mov dword [esp], ebx
xor ebx, ebx
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
cmp byte [esp + esi + 0x50], 0
jne 0x61011c04
lea esi, [esi]
inc ebx
add esi, 0xd
cmp ebx, 2
jg 0x61011b72
cmp byte [esp + esi + 0x50], 0
je 0x61011bf0
mov eax, dword [ebx*4 + 0x611076ec]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
add eax, esi
mov dword [esp], eax
call sym.build_fh_name_char_const__void__unsigned_int__suffix_info_
test eax, eax
mov edx, eax
je 0x61011bf0
mov eax, dword [ebp]
test ebx, ebx
mov ecx, dword [edx]
mov dword [eax + ebx*4], edx
mov eax, 0x1ff
mov dword [esp + 8], eax
mov eax, 0x10000
jne 0x61011c77
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [ecx + 0x34]
test eax, eax
jne 0x61011c92
mov dword [esp + 4], ebx
mov dword [esp], ebp
call method.dtable.release_int_
jmp 0x61011bf0
mov dword [esp], edx
xor eax, eax
cmp ebx, 2
sete al
add eax, 0x10001
mov dword [esp + 4], eax
call dword [ecx + 0x34]
test eax, eax
je 0x61011c66
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x61011bf0
Function at 0x61013690
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x1c
mov ebx, ecx
mov dword [esp], edx
call sym.cygwin1.dll__strlen
inc eax
mov dword [esp + 4], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._realloc_1
mov dword [edi + 8], eax
mov dword [esp + 4], esi
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
test ebx, ebx
je 0x61013816
mov dword [esp], ebx
call sym.cygwin1.dll__strlen
mov edx, dword [edi + 4]
add eax, edx
inc eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym._realloc_1
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [esp + 4], ebx
mov eax, dword [edi + 4]
mov esi, dword [edi + 0xc]
add eax, esi
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
cmp byte [edi + 0x20], 0
jne 0x61013738
movzx edx, byte [0x6110c854]
and edx, 1
test dl, dl
jne 0x610137a0
jne 0x610137e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [0x61107534], 0
je 0x6101371c
mov dword [ebp - 0x10], esp
mov ebx, dword [edi + 4]
lea eax, [ebx + 0x1e]
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov eax, dword [edi]
lea esi, [esp + 0x23]
dec ebx
mov dword [esp + 8], ebx
and esi, 0xfffffff0
mov dword [esp], esi
mov dword [esp + 4], eax
call sym.cygwin1.dll__memcpy
mov byte [esi + ebx], 0
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 4]
mov dword [esp], esi
add eax, edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
movzx edx, byte [0x6110c854]
mov esp, dword [ebp - 0x10]
and edx, 1
test dl, dl
je 0x6101372a
nop
lea esi, [esi]
mov eax, dword [edi + 8]
mov dword [esp], 0x6110c854
mov dword [esp + 0x10], eax
mov eax, 0x6111a582
mov dword [esp + 0xc], eax
mov eax, str.void_win_env::add_cache_const_char__const_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
test byte [0x6110c854], 1
je 0x61013730
nop
lea esi, [esi]
mov eax, dword [edi + 0xc]
mov esi, 0x40
mov edi, str.void_win_env::add_cache_const_char__const_char_
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
mov eax, str.native__s
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call dword [edi + 0x1c]
mov ebx, dword [edi + 4]
add eax, ebx
inc eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym._realloc_1
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0xc]
mov dword [esp], esi
add eax, ecx
mov dword [esp + 4], eax
call dword [edi + 0x14]
jmp 0x61013716
Function at 0x61013880
Capabilities:
Encrypt data using rc4 prga
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x61107524]
test eax, eax
je 0x61013911
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0x10]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x61013911
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.cygwin1.dll__strlen
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
test edx, edx
je 0x61013903
lea esi, [esi]
lea edi, [edi]
mov esi, dword [ebp + 8]
mov edi, edx
mov ecx, ebx
cld
and eax, 0xff
dec ecx
js 0x610138e3
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x610138df
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x610138ea
test al, al
jne 0x610138cd
mov eax, 1
jmp 0x610138ec
xor eax, eax
test eax, eax
je 0x610138f6
cmp byte [edx + ebx], 0x3d
je 0x61013961
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
test edx, edx
jne 0x610138c0
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x61013903
mov edx, eax
mov eax, 0x65
call sym._cmalloc_8
test eax, eax
mov esi, eax
je 0x61013903
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
mov edx, esi
jne 0x61013905
jmp 0x61013903
lea edx, [edx + ebx + 1]
jmp 0x61013905
Function at 0x610155c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x2c
mov dword [ebp - 0x18], ecx
lea ecx, [edx - 1]
lea edx, [edx + 0x1d]
mov dword [ebp - 0x14], eax
and edx, 0xfffffff0
mov eax, edx
mov dword [ebp - 0x1c], esp
call sym.cygwin1.dll__alloca
mov dword [esp + 8], ecx
lea esi, [esp + 0x23]
xor ebx, ebx
mov eax, dword [ebp - 0x14]
and esi, 0xfffffff0
mov dword [esp], esi
mov dword [esp + 4], eax
call sym.cygwin1.dll__memcpy
mov byte [edi + esi - 1], 0
lea eax, [ebp - 0xd]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
mov ebx, eax
jle 0x6101569c
inc ebx
cmp dword [ebp - 0x18], 0xb
je 0x610156b2
mov eax, dword [ebp - 0x18]
mov edx, ebx
call sym._cmalloc_8
mov dword [ebp - 0x20], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
je 0x61015694
test byte [0x6110c854], 1
jne 0x61015667
mov eax, dword [ebp - 0x20]
mov esp, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], esi
mov ecx, str.using_value_from_GetEnvironmentVariable_for__s
mov edx, str.char_getwinenveq_const_char__size_t__int_
mov dword [esp + 0xc], ecx
mov eax, 0x40
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x61015659
mov eax, dword [ebp - 0x20]
call sym._cfree_4
test byte [0x6110c854], 1
jne 0x610156d5
mov esp, dword [ebp - 0x1c]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, edi
mov eax, 0xb
mov edx, ebx
call sym._cmalloc_8
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x6101570a
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x20]
add eax, edi
jmp 0x6101563d
mov eax, dword [ebp - 0x14]
mov dword [esp], 0x6110c854
mov dword [esp + 0x10], eax
mov eax, str.warning:__s_not_present_in_environment
mov dword [esp + 0xc], eax
mov eax, str.char_getwinenveq_const_char__size_t__int_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov esp, dword [ebp - 0x1c]
xor eax, eax
jmp 0x610156aa
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x20]
add eax, edi
jmp 0x6101563d
Function at 0x61016700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0xc], ebx
mov ebx, eax
lea eax, [ebp - 0x39]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edx, dword fs:[4]
sub edx, 0x319c
cmp eax, edx
jae 0x61016737
cmp dword [edx + 0x1070], 0xc763173f
je 0x61016870
test cl, cl
mov edx, 1
jne 0x61016750
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
xor eax, eax
lea edi, [ebp - 0x38]
mov ecx, 7
rep stosd dword es:[edi], eax
mov eax, 0x1c
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xb8]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x61016827
mov eax, dword [0x61141bb0]
add eax, 0x22
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
lea edi, [esp + 0x2b]
and edi, 0xfffffff0
mov dword [edi], 0
mov edx, dword [ebp - 0x34]
test edx, edx
je 0x610167b7
cmp dword [ebp - 0x28], 0x1000
je 0x6101687a
mov dword [ebp - 0x40], 1
mov edx, 1
test byte [0x6110c854], 1
je 0x61016740
mov eax, dword [ebp - 0x40]
mov edx, str.pc__p__h__p__inside_kernel__d
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0xb8]
mov dword [esp + 0xc], edx
mov dword [esp], 0x6110c854
mov dword [esp + 0x10], eax
mov eax, str.bool_inside_kernel_CONTEXT_
mov dword [esp + 8], eax
mov eax, 0x800
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor edx, edx
cmp dword [ebp - 0x40], 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
setne dl
mov esp, ebp
pop ebp
mov eax, edx
ret
test byte [0x6110c854], 1
je 0x61016786
mov eax, dword [ebx + 0xb8]
mov edi, str.couldnt_get_memory_info__pc__p___E
mov esi, str.bool_inside_kernel_CONTEXT_
mov dword [esp + 0xc], edi
mov ecx, 0x800
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov dword [esp + 4], ecx
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x61016786
mov ecx, 1
jmp 0x61016737
cmp edx, dword [0x6110221c]
mov dword [ebp - 0x40], 0
je 0x610168af
mov eax, dword [0x61141bb0]
mov dword [esp + 4], edi
mov dword [esp], edx
add eax, 2
mov dword [esp + 8], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
test eax, eax
jne 0x610168c1
mov dword [ebp - 0x40], 0
test byte [0x6110c854], 1
je 0x6101680f
jmp 0x610167d0
mov esi, 0x61141590
mov ecx, dword [0x61141bb0]
cld
and eax, 0xff
dec ecx
js 0x610168e8
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x610168e4
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x610168ef
test al, al
jne 0x610168d2
mov eax, 1
jmp 0x610168f1
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x610168af
Function at 0x61016eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
cmp byte [0x61107534], 0
jne 0x61016ef1
mov eax, dword [0x61109170]
mov edx, 1
mov eax, dword [eax + 0xc]
test eax, eax
je 0x6101708c
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
mov esi, 0xffffffff
mov dword [esp + 4], esi
mov eax, dword fs:[4]
sub eax, 0x319c
mov dword [esp], eax
call main
xor edx, edx
cmp ebx, 6
je 0x61016ee0
mov eax, dword [0x61109170]
cmp dword [eax + 0x12c], 0xffffffff
je 0x61016f40
cmp ebx, 2
je 0x61017072
cmp byte [0x61141bd0], 0
jne 0x61016f40
cmp ebx, 5
je 0x61017047
lea esi, [esi]
mov eax, dword [0x61148180]
test eax, eax
je 0x61016f63
or byte [eax + 0x2c], 4
mov edx, 1
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
call sub.KERNEL32.dll_GetCurrentProcessId
mov edx, eax
mov eax, dword [0x611650ec]
lea edi, [ebp - 0x38]
test byte [eax + 0x13], 4
jne 0x61017040
mov dword [edi + 0xc], 0
xor ecx, ecx
mov eax, edi
mov dword [edi + 0x10], 0
mov dword [esp], 0
call method.pinfo.init_int__unsigned_long__void_
cmp byte [ebp - 0x30], 0
mov esi, dword [ebp - 0x34]
je 0x61016faf
test esi, esi
je 0x61016f4d
mov dword [esp], edi
call method.pinfo.release__
test esi, esi
je 0x61016f4d
mov eax, dword [0x61109170]
mov eax, dword [eax + 0x12c]
mov dword [esp + 4], eax
mov eax, dword [0x61109538]
add eax, 0x18
mov dword [esp], eax
call method.tty_list.get_tty_int_
mov esi, eax
mov eax, dword [0x61109170]
cmp dword [eax + 0x12c], 0xffffffff
je 0x61016f4d
mov eax, dword [eax]
cmp dword [esi + 8], eax
jne 0x61016f4d
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esi + 0x14]
sub eax, edx
cmp eax, 0x31
jbe 0x61016f4d
dec ebx
mov edi, 2
je 0x610170d3
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x14], eax
mov eax, dword [0x61109170]
mov eax, dword [eax]
mov dword [esp + 4], edi
neg eax
mov dword [esp], eax
call sym.killsys_int__int_
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x14], eax
mov edx, 1
jmp 0x61016f52
neg edx
jmp 0x61016f7c
mov eax, dword [0x61148178]
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x61016ee0
mov edx, 1
mov eax, 0x61109564
call sym.__Z8sig_sendP6_pinfoi_8
mov edx, 1
jmp 0x61016f52
mov edx, 1
xor eax, eax
call sym.__Z8sig_sendP6_pinfoi_8
mov byte [0x61141bd0], 1
xor edx, edx
jmp 0x61016ee0
test byte [0x6110c854], 1
jne 0x610170a1
mov dword [esp], 0xc000013a
call sub.KERNEL32.dll_ExitProcess
mov dword [esp], 0x6110c854
mov eax, 0xc000013a
mov edi, 0x40
mov dword [esp + 0x10], eax
mov eax, str.exiting_with_status__p
mov dword [esp + 0xc], eax
mov eax, str.BOOL_ctrl_c_handler_DWORD_
mov dword [esp + 8], eax
mov dword [esp + 4], edi
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x61017095
cmp byte [esi + 0x33], 3
jne 0x61017010
cmp byte [esi + 0x37], 3
jne 0x61017010
mov edi, 3
jmp 0x61017010
Function at 0x61017930
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, str.mask_sync
mov ebp, esp
push ebx
mov eax, 0x61108130
sub esp, 0x24
call method.muto.init_char_const_
mov byte [0x61141590], 0
mov ebx, 0x61141590
mov eax, 0x3fe
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetSystemDirectoryA
xor edx, edx
sub esp, 8
mov eax, edx
mov ah, al
mov al, byte [ebx]
cmp al, ah
je 0x61017979
inc ebx
test al, al
jne 0x6101796c
xor ebx, ebx
mov eax, ebx
cmp eax, 0x61141590
mov edx, eax
je 0x610179f9
cmp byte [eax - 1], 0x5c
je 0x610179f0
mov byte [eax], 0x5c
sub eax, 0x6114158f
mov byte [edx + 1], 0
test byte [0x6110c854], 1
mov dword [0x61141bb0], eax
jne 0x610179b0
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 0x14], eax
mov ebx, 0x61141590
mov ecx, str.windows_system_directory__s__windows_system_directory_length__d
mov dword [esp + 0x10], ebx
mov edx, str.void_events_init__
mov eax, 0x40
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov ebx, dword [ebp - 4]
leave
ret
mov eax, edx
sub eax, 0x61141590
jmp 0x61017996
mov dword [esp], str.cant_find_windows_system_directory
call sym.___api_fatal
nop
lea esi, [esi]
lea edi, [edi]

Function at 0x61017d80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 8], ebx
mov ebx, eax
lea eax, [ebp - 9]
mov dword [ebp - 4], esi
mov esi, edx
xor edx, edx
cmp eax, ebx
jae 0x61017da5
cmp dword [ebx + 0x1070], 0xc763173f
je 0x61017df2
test dl, dl
jne 0x61017db3
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.61101110
test eax, eax
je 0x61017da9
lea eax, [ebx + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x104]
mov ebx, str.cYgSiGw00f__d__p__p
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], ebx
call sym.___small_sprintf
mov dword [esp], ebx
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
jmp 0x61017da9
mov edx, 1
jmp 0x61017da5
Function at 0x61017e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x30
mov ebx, edx
mov eax, dword [0x61148184]
test eax, eax
je 0x61017ed0
test byte [0x6110c854], 1
jne 0x61017e80
mov dword [0x61108128], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
mov edx, ebx
sub esp, 8
and edx, 0x7f
mov eax, esi
call method._cygtls.signal_debugger_int_
test bl, 0x80
jne 0x61017f20
mov edx, 0xffffffff
mov eax, 0x61107544
call method.muto.acquire_unsigned_long_
mov byte [ebp - 0x18], 1
mov eax, dword [0x61107520]
test eax, eax
jle 0x61017f47
mov edx, dword [0x61148184]
test edx, edx
jne 0x61017f10
dec eax
jmp 0x61017f0e
mov dword [esp], 0x6110c854
mov eax, str.terminating_captive_process
mov dword [esp + 0xc], eax
mov eax, str.void__cygtls::signal_exit_int_
mov dword [esp + 8], eax
mov eax, 0x800
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov dword [0x61108128], ebx
mov eax, dword [0x61148184]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
jmp 0x61017ed0
mov edx, ebx
mov eax, esi
and edx, 0x7f
call method._cygtls.signal_debugger_int_
test bl, 0x80
jne 0x61017f20
mov edx, 0xffffffff
mov eax, 0x61107544
call method.muto.acquire_unsigned_long_
mov byte [ebp - 0x18], 1
mov eax, dword [0x61107520]
test eax, eax
jle 0x61017f47
mov esi, dword [0x61148184]
test esi, esi
jne 0x61017f10
cmp dword [0x61107520], 1
jle 0x61017f5e
mov edx, ebx
mov eax, 0x6110916c
call method.pinfo.exit_unsigned_long_
lea esi, [esi]
mov dword [esp], 1
call sym._try_to_debug
test eax, eax
jne 0x61017ee1
mov eax, dword [esi + 0xe4]
mov ecx, 1
mov edx, 1
call sym.stackdump_unsigned_long__int__bool_
jmp 0x61017ee1
mov ecx, 1
mov dword [0x61107520], ecx
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [0x6110cd34], eax
jmp 0x61017efd
call sub.KERNEL32.dll_GetCurrentThread
mov dword [esp], eax
mov edx, 0xf
mov dword [esp + 4], edx
call sub.KERNEL32.dll_SetThreadPriority
sub esp, 8
test byte [0x6110c854], 1
jne 0x61017f97
mov eax, dword [0x61109560]
mov dword [esp], eax
call sub.KERNEL32.dll_SetEvent
sub esp, 4
mov eax, ebx
call sym.__Z7do_exiti_4
mov dword [esp + 0x10], ebx
mov eax, str.about_to_call_do_exit___x_
mov esi, 0x800
mov dword [esp + 0xc], eax
mov eax, str.void__cygtls::signal_exit_int_
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x61017f80
Function at 0x6101a770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x611021c4]
mov ebx, dword [0x61141e04]
mov eax, dword [eax]
test ebx, ebx
mov dword [esp + 0x18], eax
je 0x6101a7f2
mov eax, dword [esp + 0x30]
mov ebp, dword [eax + 0x84]
mov dword [esp], ebp
call sym.cygwin1.dll__strlen
mov dword [esp + 0x14], eax
mov edi, dword [ebx]
mov eax, dword [esp + 0x34]
and eax, 3
test edi, edi
mov dword [esp + 0x10], eax
je 0x6101a7f2
lea esi, [esi]
lea edi, [edi]
cmp byte [edi], 0
jne 0x6101a7d3
mov edx, dword [ebx + 4]
mov eax, edx
and eax, 3
cmp eax, dword [esp + 0x10]
je 0x6101a84a
mov dword [esp], edi
call sym.cygwin1.dll__strlen
mov edx, dword [esp + 0x14]
lea esi, [ebp + edx]
sub esi, eax
cmp eax, edx
jbe 0x6101a800
add ebx, 8
mov edi, dword [ebx]
test edi, edi
jne 0x6101a7c0
mov eax, dword [esp + 0x18]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebp, esi
je 0x6101a816
movzx eax, byte [esi - 1]
cmp al, 0x2f
sete dl
cmp al, 0x5c
sete al
or dl, al
je 0x6101a7e9
mov edx, dword [ebx + 4]
mov eax, edx
and eax, 3
cmp eax, dword [esp + 0x10]
jne 0x6101a7e9
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6101a839
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6101a844
test al, al
jne 0x6101a82a
mov eax, 1
jmp 0x6101a846
xor eax, eax
test eax, eax
je 0x6101a7e9
and edx, 0xfffffffc
mov dword [esp + 0x18], edx
jmp 0x6101a7f2
Function at 0x6101d420
Capabilities:
Get file size

Disassembly:
push esi
mov esi, eax
push ebx
sub esp, 0x14
mov ebx, edx
test byte [0x6110c854], 1
jne 0x6101d4e0
lea eax, [esi + 0x6c]
xor edx, edx
cmp byte [eax + 0x10], 0
jne 0x6101d4c0
test dl, dl
jne 0x6101d4cd
mov eax, dword [esi + 0x70]
cmp eax, 0xfe
je 0x6101d527
jbe 0x6101d510
cmp eax, 0xff
je 0x6101d533
cmp eax, 0x10007
je 0x6101d53f
mov dword [ebx + 0x10], 0x21b6
call sym.cygwin1.dll__geteuid32
mov dword [ebx + 0x18], eax
call sym.cygwin1.dll__getegid32
mov dword [ebx + 0x40], 0x456f7080
mov dword [ebx + 0x44], 0
mov edx, dword [ebx + 0x44]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x40]
mov word [ebx + 0x14], 1
mov dword [ebx + 0x48], 0x10000
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x34], edx
add esp, 0x14
pop ebx
pop esi
ret
cmp dword [eax + 4], 0xf7
je 0x6101d441
add esp, 0x14
mov edx, ebx
mov eax, esi
pop ebx
pop esi
jmp sym.__ZN13fhandler_base8fstat_fsEP8__stat64_8
mov dword [esp], 0x6110c854
mov eax, 0x6111d61c
mov ecx, str.virtual_int_fhandler_base::fstat___stat64_
mov dword [esp + 0xc], eax
mov edx, 0x40
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6101d436
cmp eax, 0xfd
jne 0x6101d473
mov dword [ebx + 0x10], 0x1080
jmp 0x6101d47a
mov dword [ebx + 0x10], 0x1100
jmp 0x6101d47a
mov dword [ebx + 0x10], 0x1180
jmp 0x6101d47a
mov dword [ebx + 0x10], 0x2192
jmp 0x6101d47a

Function at 0x6101fb20
Capabilities:
Manipulate console buffer

Disassembly:
push ebx
sub esp, 0x38
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0xec]
lea edx, [esp + 0x10]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
sub esp, 8
test eax, eax
je 0x6101fb8f
mov edx, dword [0x611082d0]
mov eax, dword [esp + 0x14]
cmp word [edx + 0x47a], ax
je 0x6101fb94
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0xec]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esp, 8
mov edx, dword [0x611082d0]
mov eax, dword [esp + 0x14]
mov dword [edx + 0x47a], eax
add esp, 0x38
pop ebx
ret
movzx eax, word [esp + 0x16]
cmp word [edx + 0x47c], ax
jne 0x6101fb5f
jmp 0x6101fb8f