joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d78
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x402f1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4051f0
push ecx
push 8
push 1
push 5
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x401e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x402f4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4051fc
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4132b0]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor eax, eax
mov dword [0x414ce0], eax
mov dword [0x414ce4], eax
mov dword [0x414ce8], eax
mov dword [0x414cec], eax
mov dword [0x414cf0], eax
mov dword [0x414cf4], eax
mov dword [0x414cf8], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401060
push 0x1c2
push str.sfxhead.c
call fcn.0040242b
pop ecx
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jne 0x401080
cmp dword [ebp - 0x18], 0xa
jb 0x4010bd
cmp dword [ebp - 0x18], 0x5a
mov dword [0x414ce0], eax
jb 0x4010bd
mov dword [0x414ce4], eax
jmp 0x4010bd
cmp dword [ebp - 0x10], 2
jne 0x4010bd
cmp dword [ebp - 0x1c], 5
mov dword [0x414ce8], eax
jb 0x4010bd
mov dword [0x414cec], eax
jne 0x4010ad
cmp dword [ebp - 0x18], 2
jne 0x4010a3
mov dword [0x414cf0], eax
cmp dword [ebp - 0x18], eax
jb 0x4010bd
mov dword [0x414cf4], eax
cmp dword [ebp - 0x1c], 6
jb 0x4010bd
mov dword [0x414cf4], eax
mov dword [0x414cf8], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00407386
add ebp, 0x78
leave
ret

Function at 0x40134a
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00401196
pop ecx
push dword [esp + 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
dec esi
neg esi
sbb esi, esi
neg esi
test edi, edi
je 0x40137e
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004011f2
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x401b4d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, str.sfxhead.c
jne 0x401b6b
push 0xd63
push esi
call fcn.0040242b
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
jg 0x401b7e
push 0xd64
push esi
call fcn.0040242b
pop ecx
pop ecx
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004012be
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [0x414d38]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
pop esi
jge 0x401baa
xor al, al
leave
ret
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401a6a
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x401bde
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
leave
ret
Function at 0x40242b
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x220]
sub esp, 0x2a0
mov eax, dword [0x4132b0]
xor eax, ebp
mov dword [ebp + 0x21c], eax
mov ecx, dword [0x414d4c]
inc dword [0x414d4c]
test ecx, ecx
mov eax, dword [ebp + 0x228]
push ebx
push esi
push edi
je 0x402467
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x22c]
mov ecx, 0x7d4
push eax
call fcn.004025d3
push eax
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.004071ab
add esp, 0x14
test eax, eax
jge 0x40249d
push 0xd8d
push str.sfxhead.c
call fcn.0040242b
push 0x30
mov ecx, 0x7d0
call fcn.004025d3
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x414d38]
call ebx
push 0
mov esi, 0x104
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.00401b4d
lea eax, [ebp + 0x118]
push eax
call fcn.00407880
add esp, 0x10
test eax, eax
je 0x4024f8
push 0x410318
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.00407970
add esp, 0xc
mov edi, str.WZSFX32.RPT
push edi
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.00407970
add esp, 0xc
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40245f
push 0x410378
push 0x191
lea eax, [ebp - 0x7c]
push eax
call fcn.00407207
test eax, eax
jge 0x40255b
push 0xdaa
push str.sfxhead.c
call fcn.0040242b
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00407880
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00401be2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x7d1
call fcn.004025d3
push eax
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.004071ab
add esp, 0x10
test eax, eax
jge 0x4025b5
push 0xdb3
push str.sfxhead.c
call fcn.0040242b
push 0x30
mov ecx, 0x7d0
call fcn.004025d3
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x414d38]
call ebx
jmp 0x40245f
Function at 0x406ee2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x417700]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x414418]
mov ecx, dword [0x417708]
mov dword [0x417700], eax
movzx eax, al
add eax, dword [0x417704]
imul eax, eax, 0x8088405
inc eax
mov dword [0x417704], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x414418]
mov eax, dword [esp + 4]
mov dword [0x417708], ecx
ret

Function at 0x406f72
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4132b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x414cd4]
mov esi, ecx
call fcn.00406f3a
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040126e
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.00406ec8
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.00406ee2
inc esi
cmp esi, 0xc
pop ecx
jl 0x406fa1
cmp dword [0x414cd0], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x406fe0
movzx cx, byte [0x414403]
cmp ax, cx
je 0x406fea
or eax, 0xffffffff
jmp 0x406fec
movzx cx, byte [0x414409]
jmp 0x406fd6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407386
leave
ret

Function at 0x407386
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4132b0]
jne 0x407390
repz ret
jmp fcn.00407f8e
Function at 0x4099a8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x413a78]
je 0x4099c3
inc edi
cmp edi, 0x17
jb 0x4099b4
cmp edi, 0x17
jae 0x409b43
push ebp
push 3
call fcn.0040c8e1
cmp eax, 1
pop ecx
je 0x409b0f
push 3
call fcn.0040c8e1
test eax, eax
pop ecx
jne 0x4099f7
cmp dword [0x4132c0], 1
je 0x409b0f
cmp ebx, 0xfc
je 0x409b42
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x417ae0
push ebp
call fcn.0040790b
add esp, 0xc
test eax, eax
je 0x409a2d
push esi
push esi
push esi
push esi
push esi
call fcn.0040931e
add esp, 0x14
push 0x104
mov esi, 0x417af9
push esi
push 0
mov byte [0x417bfd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409a71
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040790b
add esp, 0xc
test eax, eax
je 0x409a71
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040931e
add esp, 0x14
push esi
call fcn.00407880
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x409ab6
push esi
call fcn.00407880
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x417df4
push 0x410b1c
sub ecx, eax
push ecx
push eax
call fcn.0040bea6
add esp, 0x14
test eax, eax
je 0x409ab6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040931e
add esp, 0x14
jmp 0x409ab8
xor esi, esi
push 0x410b18
push ebx
push ebp
call fcn.00407970
add esp, 0xc
test eax, eax
je 0x409ad8
push esi
push esi
push esi
push esi
push esi
call fcn.0040931e
add esp, 0x14
push dword [edi*8 + 0x413a7c]
push ebx
push ebp
call fcn.00407970
add esp, 0xc
test eax, eax
je 0x409afa
push esi
push esi
push esi
push esi
push esi
call fcn.0040931e
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040c724
add esp, 0xc
jmp 0x409b42
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x409b42
cmp ebp, 0xffffffff
je 0x409b42
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x413a7c]
push dword [esi]
call fcn.00407880
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40c724
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00408b2f
xor ebx, ebx
cmp dword [0x418098], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40c7fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40c8da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x411594
push edi
call esi
cmp eax, ebx
je 0x40c8da
push eax
call fcn.00408ac1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418098], eax
call esi
push eax
call fcn.00408ac1
mov dword [esp], 0x411570
push edi
mov dword [0x41809c], eax
call esi
push eax
call fcn.00408ac1
mov dword [0x4180a0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00409735
test eax, eax
pop ecx
pop ecx
je 0x40c7c8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040931e
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40c7fa
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00408ac1
cmp eax, ebx
pop ecx
mov dword [0x4180a8], eax
je 0x40c7fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00408ac1
pop ecx
mov dword [0x4180a4], eax
mov eax, dword [0x4180a4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40c87f
cmp dword [0x4180a8], ecx
je 0x40c87f
push eax
call fcn.00408b38
push dword [0x4180a8]
mov esi, eax
call fcn.00408b38
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40c87f
cmp edi, ebx
je 0x40c87f
call esi
cmp eax, ebx
je 0x40c84c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c84c
test byte [ebp - 0x18], 1
jne 0x40c87f
lea eax, [ebp - 0x10]
push eax
call fcn.0040976c
test eax, eax
pop ecx
je 0x40c867
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040931e
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40c876
or dword [ebp + 0x10], 0x200000
jmp 0x40c8ba
or dword [ebp + 0x10], 0x40000
jmp 0x40c8ba
mov eax, dword [0x41809c]
cmp eax, dword [ebp - 8]
je 0x40c8ba
push eax
call fcn.00408b38
cmp eax, ebx
pop ecx
je 0x40c8ba
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40c8ba
mov eax, dword [0x4180a0]
cmp eax, dword [ebp - 8]
je 0x40c8ba
push eax
call fcn.00408b38
cmp eax, ebx
pop ecx
je 0x40c8ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418098]
call fcn.00408b38
cmp eax, ebx
pop ecx
je 0x40c8da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c8dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc47137
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00c471ba
jae 0xc47145
xor ecx, ecx
call fcn.00c471ba
jae 0xc47174
xor eax, eax
call fcn.00c471ba
jae 0xc47184
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00c471ba
adc al, al
jae 0xc47166
jne 0xc471b0
stosb byte es:[edi], al
jmp 0xc47148
call fcn.00c471c6
sub ecx, ebx
jne 0xc4718d
call fcn.00c471c4
jmp 0xc471ac
lodsb al, byte [esi]
shr eax, 1
je 0xc471d6
adc ecx, ecx
jmp 0xc471a9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00c471c4
cmp eax, 0x7d00
jae 0xc471a9
cmp ah, 5
jae 0xc471aa
cmp eax, 0x7f
ja 0xc471ab
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc47148
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x1011040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10b17b9
call fcn.0101dff9
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x1011099
call fcn.0100ce00
mov esi, eax
jmp 0x10111a2
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10110b2
call fcn.0100ce00
jmp 0x1011194
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x10110a8
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x1011118
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10110fe
lea ecx, [ebp - 0x418]
call fcn.0100d8f8
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.0100d83b
mov eax, esi
call fcn.0101e064
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0100f56f
mov dword [ebp - 4], 1
jmp 0x1011146
cmp dword [ebp - 0x418], esi
jne 0x1011155
mov esi, 0x8007000e
jmp 0x1011196
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10110a8
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.01010be0
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1011103
lea ecx, [ebp - 0x418]
call fcn.0100d8f8
jmp 0x1011103
Function at 0x101d423
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x10bbf70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0101d364
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x101d496
cmp dword [ebp - 0x94], 5
jb 0x101d4b7
jmp 0x101d4b3
cmp dword [ebp - 0x88], 1
jne 0x101d4b7
cmp dword [ebp - 0x94], 4
ja 0x101d4b3
jne 0x101d4b7
cmp dword [ebp - 0x90], 0
jbe 0x101d4b7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10037c0
call fcn.0100cc99
test eax, eax
jge 0x101d4d8
mov byte [0x10c5570], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0101def4
leave
ret

Function at 0x101d9f8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10c5778], 0
push esi
jne 0x101d966
call fcn.0101d85d
test eax, eax
je 0x101d9a9
mov eax, dword [0x10c5778]
cmp eax, 1
jne 0x101d987
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x101d9a9
pop esi
ret
push eax
call dword [0x10c5780]
test eax, eax
jne 0x101d9f1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x101d9ad
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x10c5778]
call dword [0x10c5780]
mov edi, eax
test edi, edi
je 0x101d9d2
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x101d9ee
mov edi, esi
add esi, 0xff0
push edi
push dword [0x10c5778]
call dword [0x10c577c]
add edi, 0x10
cmp edi, esi
jb 0x101d9da
mov eax, edi
pop edi
pop esi
ret
jmp 0x101d953
Function at 0x10b0e90
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ecx
mov eax, dword [ecx]
test eax, eax
jne 0x10b0ea2
mov eax, 1
pop ecx
ret 8
movzx cx, byte [eax]
mov edx, 0x100
imul cx, dx
movzx dx, byte [eax + 1]
add cx, dx
movzx ecx, cx
sub ecx, 1
push esi
push edi
je 0x10b0f5d
sub ecx, 1
jne 0x10b0f9c
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], esi
test ecx, ecx
je 0x10b0ee9
add eax, 2
cmp eax, ecx
jbe 0x10b0ee9
xor esi, esi
mov dword [esp + 8], esi
mov edi, dword [esp + 0x14]
movzx eax, word [edi]
push ecx
push eax
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.010afa20
mov ecx, eax
call fcn.010af3a0
movzx eax, ax
test ax, ax
jl 0x10b0f9c
movzx dx, byte [esi + 4]
mov ecx, 0x100
imul dx, cx
movzx cx, byte [esi + 5]
add dx, cx
movzx edx, dx
movsx ecx, ax
cmp ecx, edx
jg 0x10b0f9c
movzx edx, ax
movzx cx, byte [esi + edx*2 + 6]
lea eax, [esi + edx*2 + 6]
movzx ax, byte [eax + 1]
mov edx, 0x100
imul cx, dx
add cx, ax
mov word [edi], cx
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], esi
test ecx, ecx
je 0x10b0f78
add eax, 2
cmp eax, ecx
jbe 0x10b0f78
xor esi, esi
mov dword [esp + 8], esi
mov edi, dword [esp + 0x14]
movzx edx, word [edi]
push ecx
push edx
push ecx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.010afa20
mov ecx, eax
call fcn.010af3a0
test ax, ax
jge 0x10b0fa7
pop edi
mov eax, 1
pop esi
pop ecx
ret 8
movzx cx, byte [esi + 4]
movzx ax, byte [esi + 5]
mov edx, 0x100
imul cx, dx
add cx, ax
add word [edi], cx
pop edi
xor eax, eax
pop esi
pop ecx
ret 8

Function at 0x112dd44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not ch
add eax, 0xbfb4a312
lea edx, [edx + ebx]
mov esi, dword [edx + 0x20]
adc edi, edx
nop
not edi
or ecx, 0xffffffff
add esi, ebx
jmp 0x112de31
mov eax, dword [ebx + 0x3c]
lea esi, [edx]
mov edx, dword [eax + ebx + 0x78]
jmp 0x112dc9a
nop
nop
add esi, ebx
lea edx, [ebp + 0x64]
adc edx, 0x3c
or eax, 0x69
nop
ret 4
nop
xchg ch, ch
xchg ch, ch
pop eax
jne 0x112de0f
nop
xor eax, 0xabe7083f
not edi
not edi
cmp eax, dword [esp + 4]
jmp 0x112de85
and dl, 0xff
xor eax, eax
push eax
clc
shl eax, 4
not eax
not eax
nop
inc dl
dec dl
xor dl, 0
nop
cld
cmc
xchg dword [esp], eax
mov esi, esi
sahf
sub dword [esp], eax
jmp 0x1131d4e
xchg edi, edi
adc edi, edx
mov dh, dh
cmp bh, ah
mov ch, ch
mov edi, 0xcf74f7bb
mov dh, dh
inc ecx
lodsd eax, dword [esi]
cld
xchg ch, dl
xchg ch, dl
xchg dh, cl
xchg dh, cl
cmp ecx, dword [edx + 0x18]
cld
lea edi, [eax + ebx]
je 0x112dd43
jmp 0x112de0a
wait
mov cl, cl
jne 0x112de42
inc eax
clc
xor ah, 0x39
mov eax, 0x63a6f7c
dec eax
not eax
sbb eax, ebp
dec eax
stc
mov esi, dword [edx + 0x24]
test al, bh
dec eax
cwde
xor al, dh
cmp ah, 0x88
xor eax, edx
mov edi, dword [edx + 0x1c]
jmp 0x112deb5
add esi, ebx
lea edx, [edx]
sub edx, ebp
mov dl, 0xe3
not edx
mov eax, dword [esi + ecx*2]
add edi, ebx
xchg edx, edx
mov edx, 0xab6a18b5
xor dh, 0x26
wait
and eax, 0xffff
xchg edx, edx
mov esi, dword [edi + eax*4]
jmp 0x112dd52
movzx eax, byte [edi]
lea ebx, [ebx]
sub dword [esp], eax
lea eax, [eax]
inc edi
cmp byte [edi], 0
jmp 0x112ddce
Function at 0x4019fa
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR100.dll__mbslen]
push esi
push 0x40c534
call ebp
lea esi, [eax + 0x105]
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x401a6b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push ebx
push dword [esp + 0x1c]
call edi
mov esi, eax
test esi, esi
jne 0x401a6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x401a5f
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401a44
mov esi, str.JavaLow
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push dword [esp + 0x18]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call dword [sym.imp.MSVCR100.dll_free]
xor eax, eax
inc eax
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
cmp esi, 0x104
jbe 0x401a41
push 0x40c540
call ebp
lea eax, [eax + esi + 1]
push eax
push ebx
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 0xc
xor ebx, ebx
push esi
push ebx
push dword [esp + 0x1c]
call edi
test eax, eax
jne 0x401a41
push ebx
call dword [sym.imp.MSVCR100.dll_free]
xor eax, eax
jmp 0x401a69
Function at 0x401e73
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x411100]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
mov ebx, dword [ebp + 0x19c]
push esi
push 0x103
lea eax, [ebp + 0x8d]
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x80], ebx
mov byte [ebp + 0x8c], 0
call sub.MSVCR100.dll_memset
push 0
lea edx, [ebp + 0x8c]
mov ecx, esi
call fcn.004016b2
add esp, 0x10
test eax, eax
je 0x401f87
mov esi, dword [sym.imp.MSVCR100.dll__snprintf]
push edi
lea eax, [ebp + 0x8c]
push eax
push eax
push eax
push str._Xbootclasspath_a:__slibdeploy.jar____slibjavaws.jar____slibplugin.jar_
push 0x410
mov edi, 0x4118e8
push edi
call esi
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
mov dword [ebp - 0x7c], edi
call fcn.00402a78
lea eax, [ebp + 0x8c]
push eax
push str._Djava.class.path__sclasses_
mov ebx, 0x208
push ebx
mov edi, 0x4116e0
push edi
call esi
mov ecx, dword [ebp - 0x80]
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], edi
call fcn.00402a78
mov edi, 0x104
push edi
lea eax, [ebp - 0x78]
push eax
push 0x40c4a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401f74
cmp eax, edi
jae 0x401f74
lea eax, [ebp - 0x78]
push eax
push 0x40c4b8
push 0x40c4d0
push ebx
mov edi, 0x4114d8
push edi
call esi
mov ecx, dword [ebp - 0x80]
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], edi
call fcn.00402a78
push dword [ebp - 0x80]
lea ecx, [ebp + 0x8c]
call fcn.00401c10
pop ecx
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0x190]
pop esi
xor ecx, ebp
pop ebx
call fcn.00409df2
add ebp, 0x194
leave
ret
Function at 0x405284
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x411100]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x411d05], 0
je 0x4052a7
mov al, byte [0x411d04]
jmp 0x4052f8
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x4052ea
cmp dword [ebp - 0x94], 6
jb 0x4052ea
mov al, 1
jmp 0x4052ec
xor al, al
mov byte [0x411d04], al
mov byte [0x411d05], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409df2
leave
ret