joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1aa4207
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, ecx
mov dword [ebp - 4], edx
push ebx
push esi
push edi
movzx edi, word [edx]
lea esi, [eax + 0x154]
mov ebx, dword [esi]
mov dword [ebp - 8], eax
cmp ebx, esi
je 0x1aa4251
lea eax, [edi + 2]
cmp dword [ebx + 0x14], eax
jne 0x1aa424b
push edi
push dword [edx + 4]
lea eax, [ebx + 0x18]
push eax
call fcn.01a36560
cmp eax, edi
je 0x1aa4313
mov edx, dword [ebp - 4]
lea eax, [edi + 2]
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x1aa422b
lea eax, [edi + 0x1a]
push eax
mov eax, dword fs:[0x30]
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov ebx, eax
test ebx, ebx
je 0x1aa434d
lea eax, [edi + 2]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 4]
push edi
push dword [eax + 4]
lea eax, [ebx + 0x18]
push eax
call fcn.01a287e0
xor eax, eax
add esp, 0xc
mov word [ebx + edi + 0x18], ax
lea eax, [ebx + 0xc]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword fs:[0x30]
and dword [ebx + 8], 0
push 0x18
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov ecx, eax
test ecx, ecx
je 0x1aa434d
mov esi, dword [ebp + 8]
lea edi, [ecx + 8]
lea eax, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [eax]
cmp dword [edx + 4], eax
jne 0x1aa4366
mov dword [ecx + 4], eax
mov dword [ecx], edx
mov dword [edx + 4], ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov dword [ebx + 8], 1
or dword [ecx + 0xdc], 0x10
lea eax, [ecx + 0x154]
mov edx, dword [eax]
cmp dword [edx + 4], eax
jne 0x1aa4366
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov dword [edx + 4], ebx
mov dword [eax], ebx
or dword [ecx + 0xdc], 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ebx + 0xc]
mov edi, dword [esi]
jmp 0x1aa4331
push 0x10
lea eax, [edi + 8]
push eax
push dword [ebp + 8]
call fcn.01a28780
add esp, 0xc
test eax, eax
je 0x1aa4308
mov edi, dword [edi]
cmp edi, esi
jne 0x1aa431a
mov eax, dword fs:[0x30]
push 0x18
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov ecx, eax
test ecx, ecx
jne 0x1aa4352
push 0xe
pop eax
jmp 0x1aa430a
mov esi, dword [ebp + 8]
lea edi, [ecx + 8]
lea eax, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [eax]
cmp dword [edx + 4], eax
je 0x1aa436b
push 3
pop ecx
int 0x29
mov dword [ecx + 4], eax
mov dword [ecx], edx
mov dword [edx + 4], ecx
mov dword [eax], ecx
mov eax, dword [ebp - 8]
inc dword [ebx + 8]
or dword [eax + 0xdc], 0x10
jmp 0x1aa4308
Function at 0x1aa4da4
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push esi
mov esi, ecx
test esi, esi
je 0x1aa4dd6
lea ecx, [esi + 0x30]
call fcn.019fd879
test eax, eax
je 0x1aa4dd6
cmp dword [esi + 0x34], 0x19b18c0
jne 0x1aa4dd6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1aa4dd6
xor eax, eax
inc eax
pop esi
ret
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x28], 0
jne 0x1aa4dea
call fcn.01aa5c15
xor eax, eax
pop esi
ret

Function at 0x1aa5421
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [0x7ffe03c0]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
lea eax, [edi + 0x2c]
push eax
call fcn.019f6460
mov eax, dword [edi + 0x100]
cmp ebx, eax
je 0x1aa54dd
mov dword [edi + 0x100], ebx
sub ebx, eax
mov dword [esp + 0x10], ebx
je 0x1aa54dd
lea eax, [edi + 8]
mov edi, ebx
mov ecx, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov edx, eax
mov esi, ecx
lea eax, [ecx + edi]
mov dword [esp + 0x1c], edx
xor eax, ecx
movzx ebx, ax
mov eax, esi
xor ebx, ecx
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x18]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x10]
mov ecx, eax
mov eax, edx
mov dword [esp + 0xc], eax
cmp ecx, esi
jne 0x1aa5476
cmp eax, dword [esp + 0x1c]
jne 0x1aa5476
mov eax, dword [esp + 0x20]
push 4
pop ecx
cmp eax, ecx
jb 0x1aa54be
inc eax
mov dword [esp + 0x14], eax
jmp 0x1aa54c2
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x14]
push ecx
push eax
push 8
push dword [edi + 0x24]
call fcn.01a24280
mov ecx, edi
call fcn.019e1ba5
lea eax, [edi + 0x2c]
push eax
call fcn.019f8f20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1aa69c8
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
push esi
push edi
mov esi, dword [eax + 0x3c]
xor ebx, ebx
add esi, eax
mov dword [ebp - 4], eax
movzx eax, word [esi + 0x14]
lea edi, [esi + 0x18]
movzx esi, word [esi + 6]
add edi, eax
test esi, esi
je 0x1aa6a0f
push 8
push edi
push 0x19cf74c
call fcn.01a27440
add esp, 0xc
test eax, eax
je 0x1aa6a18
inc ebx
add edi, 0x28
cmp ebx, esi
jb 0x1aa69f3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [edi + 0x10]
cmp dword [edi + 8], ecx
ja 0x1aa6a29
mov ecx, dword [edi + 8]
lea ebx, [eax + ecx]
mov dword [ebp - 0xc], ebx
jmp 0x1aa6a91
cmp dword [eax], 0x45734c6b
jne 0x1aa6a8e
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1aa6a8e
mov esi, dword [ecx]
xor edx, edx
mov dword [ebp - 4], esi
test esi, esi
je 0x1aa6a8e
lea edi, [ecx + 4]
mov esi, dword [edi]
mov ecx, dword [ebp - 8]
mov bx, word [ecx]
cmp bx, word [esi]
jne 0x1aa6a79
test bx, bx
je 0x1aa6a75
mov bx, word [ecx + 2]
cmp bx, word [esi + 2]
jne 0x1aa6a79
add ecx, 4
add esi, 4
test bx, bx
jne 0x1aa6a53
xor ecx, ecx
jmp 0x1aa6a7e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1aa6a9a
inc edx
add edi, 8
cmp edx, dword [ebp - 4]
jb 0x1aa6a4e
mov ebx, dword [ebp - 0xc]
add eax, 0x18
cmp eax, ebx
jb 0x1aa6a31
jmp 0x1aa6a0f
mov eax, dword [eax + 0xc]
mov eax, dword [eax + edx*8 + 8]
jmp 0x1aa6a11

Function at 0x1aa7ea5
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov edi, esi
push 0
push 0x40
mov ebx, edx
mov dword [ebp - 0x148], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
push eax
push ecx
push ebx
call fcn.01a22d50
test eax, eax
js 0x1aa7f72
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
je 0x1aa7efb
mov eax, 0xc000012f
jmp 0x1aa7f72
push 0
push 0xf8
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x148]
push eax
push ebx
call fcn.01a22d50
test eax, eax
js 0x1aa7f72
cmp dword [ebp - 0x144], 0x4550
je 0x1aa7f30
mov eax, 0xc000007b
jmp 0x1aa7f72
movzx eax, word [ebp - 0x12c]
cmp eax, 0x10b
je 0x1aa7f4d
cmp eax, 0x20b
jne 0x1aa7f29
mov eax, dword [ebp - 0x114]
jmp 0x1aa7f53
mov eax, dword [ebp - 0x110]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x13c]
mov dword [esi], eax
mov eax, dword [ebp - 0xf4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xec]
mov dword [esi + 0xc], eax
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
Function at 0x1aa9ef6
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x214]
push ebx
push esi
push edi
push 0x208
push 0
push eax
mov ebx, edx
call fcn.01a28e60
add esp, 0xc
lea ecx, [ebp - 0x214]
xor edi, edi
call fcn.01a07392
dec eax
cmp eax, 0x102
ja 0x1aa9f48
lea edi, [ebp - 0x214]
mov eax, dword fs:[0x30]
push 0x1c
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
jne 0x1aa9f7b
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], esi
jne 0x1aaa017
push 0xe
call fcn.01a06240
jmp 0x1aaa017
and dword [esi + 8], 0
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x21c]
call fcn.01aaa058
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
push 1
push dword [ebp + 8]
push ebx
call fcn.01a07255
mov dword [esi + 0xc], eax
test eax, eax
je 0x1aa9ffa
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x44], 1
jb 0x1aa9ffa
call fcn.01aaac50
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x34]
shl eax, 2
push eax
mov eax, dword fs:[0x30]
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov dword [esi + 0x10], eax
test eax, eax
jne 0x1aaa02c
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0
jne 0x1aa9ffa
push 0xe
call fcn.01a06240
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1aaa006
call fcn.01aaa998
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call fcn.019f1440
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x1aaa039
mov ecx, edi
call fcn.01a07f81
jmp 0x1aaa03b
xor eax, eax
and dword [esi + 0x18], 0
or dword [esi], 0x80
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x218]
and eax, 7
or dword [esi + 4], eax
mov eax, esi
jmp 0x1aaa019
Function at 0x1aad98f
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x1c]
push esi
push eax
mov edi, edx
call fcn.01a02c30
test eax, eax
jns 0x1aad9ca
push eax
call fcn.01a062b0
push eax
call fcn.01a06240
or eax, 0xffffffff
jmp 0x1aadb21
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
inc ecx
cmp ax, cx
jbe 0x1aad9e6
movzx eax, ax
shr eax, 1
cmp word [esi + eax*2 - 2], 0x5c
jne 0x1aad9e6
mov ebx, ecx
jmp 0x1aad9e8
xor ebx, ebx
mov edx, edi
lea ecx, [ebp - 0x1c]
call fcn.01aad231
test eax, eax
je 0x1aad9fd
push 0xc0000022
jmp 0x1aad9b7
lea eax, [ebp - 0x34]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.01a02af0
test al, al
jne 0x1aada15
push 3
jmp 0x1aad9bd
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
test ax, ax
je 0x1aada33
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
jmp 0x1aada35
mov eax, ecx
push ecx
push ecx
push 0x60
push 1
push dword [ebp + 8]
mov dword [ebp - 0x48], eax
or edi, 0x100080
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
push ecx
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], 0x40
push eax
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
push eax
mov word [ebp - 0xc], 0x101
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], 0xc
call fcn.01a22eb0
mov ecx, dword fs:[0x30]
mov esi, eax
push 0
push 0
push dword [ecx + 0x18]
call fcn.019f1440
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x1aadaca
or eax, 0xffffffff
lock xadd dword [edi], eax
jne 0x1aadaca
push dword [edi + 4]
call fcn.01a22a30
mov eax, dword fs:[0x30]
push edi
push 0
push dword [eax + 0x18]
call fcn.019f1440
push dword [ebp - 0x20]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call fcn.019f1440
test esi, esi
jns 0x1aadb17
push esi
call fcn.01a062b0
push eax
call fcn.01a06240
cmp esi, 0xc0000035
jne 0x1aadafc
push 0x50
jmp 0x1aad9bd
cmp esi, 0xc00000ba
jne 0x1aad9c2
test ebx, ebx
jne 0x1aada11
push 5
jmp 0x1aad9bd
push 0
call fcn.01a06240
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1aae697
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x38]
push ebx
push ebx
push eax
push ecx
call fcn.01a05b70
test al, al
jne 0x1aae6d9
push 3
call fcn.01a06240
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x18
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call fcn.01a22d30
mov ecx, dword fs:[0x30]
mov esi, eax
push edi
push ebx
push dword [ecx + 0x18]
call fcn.019f1440
test esi, esi
js 0x1aae6c5
mov eax, dword [ebp - 0x10]
jmp 0x1aae6c8

Function at 0x1aaf386
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1acd344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, ebx
test edi, edi
je 0x1aaf489
mov eax, dword fs:[0x30]
push 0x28
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov esi, eax
test esi, esi
je 0x1aaf49b
mov ecx, dword fs:[0x30]
push 0x20
push 8
push dword [ecx + 0x18]
call fcn.019f3940
mov dword [esi + 4], eax
test eax, eax
je 0x1aaf490
mov eax, dword fs:[0x30]
push 0x50
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov dword [esi + 8], eax
test eax, eax
je 0x1aaf490
mov eax, dword fs:[0x30]
push 0x400
push 8
push dword [eax + 0x18]
call fcn.019f3940
mov dword [esi + 0xc], eax
test eax, eax
je 0x1aaf490
mov eax, dword [esi + 4]
mov ecx, edi
mov dword [esi], 6
mov dword [eax], 0x43534552
mov dword [eax + 4], 0x4c5543
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0xa
mov dword [eax + 0x10], 0x200
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
lea eax, [ebp - 0x28]
push eax
call fcn.01aae57e
test eax, eax
jne 0x1aaf468
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 2
jne 0x1aaf468
mov eax, ebx
jmp 0x1aaf46b
xor eax, eax
inc eax
mov ecx, edi
mov dword [esi + 0x10], eax
call fcn.01a07f81
mov dword [esi + 0x14], eax
test eax, eax
je 0x1aaf490
mov dword [esi + 0x20], ebx
mov eax, esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], ebx
jmp 0x1aaf49d
push 0x57
call fcn.01a06240
test esi, esi
je 0x1aaf49b
mov ecx, esi
call fcn.01aaf59c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01a24a40
mov esp, ebp
pop ebp
ret 4
Function at 0x1aaf59c
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ecx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1aaf63b
xor edi, edi
cmp dword [esi + 4], edi
je 0x1aaf5c7
push dword [esi + 4]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call fcn.019f1440
mov dword [esi + 4], edi
cmp dword [esi + 0x14], edi
je 0x1aaf5e1
push dword [esi + 0x14]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call fcn.019f1440
mov dword [esi + 0x14], edi
test byte [esi], 4
je 0x1aaf61a
cmp dword [esi + 8], edi
je 0x1aaf600
push dword [esi + 8]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call fcn.019f1440
mov dword [esi + 8], edi
cmp dword [esi + 0xc], edi
je 0x1aaf61a
push dword [esi + 0xc]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call fcn.019f1440
mov dword [esi + 0xc], edi
test byte [esi], 1
je 0x1aaf62b
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1aaf62b
call fcn.01aae94c
mov eax, dword fs:[0x30]
push esi
push edi
push dword [eax + 0x18]
call fcn.019f1440
xor eax, eax
pop edi
inc eax
pop esi
pop ecx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x44e063]
shl eax, 2
mov dword [0x44e067], eax
push edi
push ecx
xor eax, eax
mov edi, 0x456060
mov ecx, 0x4595c0
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00401ca7
pop ecx
push 0x44e02c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x44e06b], eax
push 0
jmp fcn.0040c988
Function at 0x4075b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00406f3c
test byte [ebp + 0xd], 0xc0
jne 0x4075d4
mov eax, dword [0x4546fc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4075e1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40760e
je 0x407620
sub ecx, 0x100
je 0x40762e
sub ecx, 0x100
je 0x407635
sub ecx, 0x100
je 0x407627
jmp 0x40763c
sub ecx, 0x600
je 0x407635
sub ecx, 0x100
je 0x407620
jmp 0x40763c
mov edi, 1
jmp 0x407641
mov edi, 2
jmp 0x407641
mov edi, 4
jmp 0x407641
mov edi, 5
jmp 0x407641
mov edi, 3
test byte [ebp + 0xd], 1
je 0x407668
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x454ce0]
test al, 0x80
je 0x407661
mov ebx, 0x80
jmp 0x40767a
mov ebx, 1
jmp 0x40767a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40767a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40768c
je 0x407695
dec eax
je 0x40769e
jmp 0x4076a7
mov dword [ebp - 4], 0x80000000
jmp 0x4076b6
mov dword [ebp - 4], 0x40000000
jmp 0x4076b6
mov dword [ebp - 4], 0xc0000000
jmp 0x4076b6
push 1
call fcn.004072fc
pop ecx
mov ebx, eax
jmp 0x4077a2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4076d2
sub eax, 0x10
je 0x4076d9
sub eax, 0x10
je 0x4076e2
sub eax, 0x10
je 0x4076eb
jmp 0x4076eb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4076f2
mov dword [ebp - 8], 1
jmp 0x4076f2
mov dword [ebp - 8], 2
jmp 0x4076f2
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40775b
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x407750
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x407750
add ebx, 0xffffffb2
push ebx
call fcn.004072fc
pop ecx
mov ebx, eax
jmp 0x4077a2
mov edi, esi
push edi
call fcn.00407514
pop ecx
test eax, eax
je 0x40776f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40777b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040703c
add esp, 8
mov ebx, eax
inc eax
jne 0x4077a2
push 4
call fcn.004072fc
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.00406f70
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b6fc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40bb9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x4557b4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40bc54
cmp byte [0x44e062], 0
je 0x40bc0e
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0040a904
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40bbf7
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0040a904
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40bbf7
lea ebx, [ebp - 0x54]
jmp 0x40bbf8
inc ebx
call fcn.0040bb54
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x40bc75
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4557b8
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00401348
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4557bb
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x40bc75
cmp dword [0x4557b4], 0xffffffff
je 0x40bc75
mov eax, dword [0x4557b4]
test eax, eax
je 0x40bc75
cmp byte [eax], 0
je 0x40bc75
push esi
push eax
call fcn.0040bd04
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c37c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x45654c], 0
jne 0x40c3fd
cmp dword [0x456568], 0
jne 0x40c3ac
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x456568], eax
test eax, eax
jne 0x40c3ac
push 0x4558dc
call fcn.0040bc8c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x456568]
jmp 0x40c3c0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00401348
pop ecx
mov edi, eax
test eax, eax
jne 0x40c3b8
lea edi, [ebp + 1]
push edi
call fcn.0040b3fc
pop ecx
mov ebx, eax
mov dword [0x456550], ebx
test ebx, ebx
jne 0x40c3ea
xor eax, eax
jmp 0x40c4c0
push edi
mov edx, dword [0x456568]
push edx
push ebx
call fcn.00401128
add esp, 0xc
jmp 0x40c41d
xor esi, esi
mov ebx, dword [0x45654c]
jmp 0x40c417
push eax
call fcn.00401348
pop ecx
test eax, eax
jne 0x40c413
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c407
lea ebx, [esi + 4]
push 4
mov dword [0x456554], ebx
inc ebx
push ebx
call fcn.0040a95c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40c440
xor eax, eax
jmp 0x40c4c0
cmp dword [0x45654c], 0
jne 0x40c471
xor esi, esi
mov ebx, dword [0x456550]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40c462
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00401348
pop ecx
mov edi, eax
test eax, eax
jne 0x40c458
jmp 0x40c4a2
xor esi, esi
mov ebx, dword [0x45654c]
mov eax, dword [esp]
mov edi, eax
jmp 0x40c49c
push eax
call fcn.00401348
pop ecx
test eax, eax
je 0x40c491
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c495
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c480
mov eax, dword [0x45654c]
test eax, eax
je 0x40c4b2
push eax
call fcn.0040b2e8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x45654c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d8b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x40d8de
test esi, esi
je 0x40d8de
call fcn.0040bb28
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x40d94a
call fcn.0040d694
mov ebx, eax
test eax, eax
jne 0x40d8f9
call fcn.0040bb28
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x40d94a
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x40d828
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.dll_CreateThread
test eax, eax
jne 0x40d93e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x718
jne 0x40d937
push 0x59
call fcn.004072fc
pop ecx
jmp 0x40d94a
call fcn.00407368
jmp 0x40d94a
mov dword [ebx + 8], eax
test edi, edi
je 0x40d94a
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40ec7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x44e27e
push 0
call sub.SHELL32.dll_ShellExecuteA
xor eax, eax
pop ebp
ret