joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f53
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
cmp word [edi], ax
mov esi, edi
je 0x401f6c
inc esi
inc esi
cmp word [esi], ax
jne 0x401f65
sub esi, 4
mov dword [ebp + 8], eax
push ebx
lea eax, [ebp - 4]
push eax
push 4
push dword [0x419e68]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x402051
lea ecx, [esi - 2]
xor edx, edx
movzx eax, byte [ebp + edx - 4]
mov ebx, eax
and ebx, 0xf
mov bx, word [ebx*2 + str.0123456789abcdefab]
mov word [ecx], bx
dec ecx
shr eax, 4
mov ax, word [eax*2 + str.0123456789abcdefab]
dec ecx
mov word [ecx], ax
dec ecx
dec ecx
inc edx
cmp edx, 4
jl 0x401f92
push 0x411ee8
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
jne 0x402044
push 0x411ef0
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
jne 0x402044
push 0x411ef8
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
jne 0x402044
push 0x411ee0
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
jne 0x402044
push 0x411ed8
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
jne 0x402044
push 0x411ed0
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
jne 0x402044
push 0x411ec8
push esi
push edi
call fcn.00401ed1
add esp, 0xc
test eax, eax
je 0x40205b
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x64
jl 0x401f73
push 0x1f65
call fcn.00408a41
and word [esi], 0
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x402112
Capabilities:
Resolve path using msvcrt

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call sub.MSVCR80.dll__get_wpgmptr
mov eax, dword [ebp - 4]
pop ecx
leave
ret

Function at 0x4029fd
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp + 0x790], eax
mov eax, dword [ebp + 0x79c]
and word [esi], 0
push edi
push 0x400
lea ecx, [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x402abb
push edi
call fcn.00408299
test eax, eax
pop ecx
mov dword [ebp - 0x74], eax
je 0x402abb
push eax
push edi
push 0
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x402ab2
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x415a2c
push dword [ebp - 0x74]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x402ab2
cmp dword [ebp - 0x7c], 0
je 0x402ab2
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._02d._04d._d
push 0xffffffffffffffff
push dword [ebp + 0x7a0]
push esi
call dword [sym.imp.MSVCR80.dll__snwprintf_s]
add esp, 0x20
push dword [ebp - 0x74]
call fcn.004082af
pop ecx
mov ecx, dword [ebp + 0x790]
xor ecx, ebp
pop edi
call fcn.0040bb82
add ebp, 0x794
leave
ret
Function at 0x402ad1
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov edi, dword [esp + 0xc]
push 0
push edi
call ebx
test eax, eax
je 0x402aeb
xor eax, eax
inc eax
jmp 0x402b26
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x402ae6
push esi
push 0x5c
push edi
call dword [sym.imp.MSVCR80.dll_wcsrchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x402b1c
and word [esi], 0
push edi
call fcn.00402ad1
test eax, eax
pop ecx
mov word [esi], 0x5c
jne 0x402b20
xor eax, eax
jmp 0x402b25
push 0
push edi
call ebx
pop esi
pop edi
pop ebx
ret

Function at 0x402b29
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov ax, word [ebp + 0xc]
push dword [ebp + 8]
mov word [ebp - 0x28], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
push 1
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push 0xc
push eax
mov byte [ebp - 0x26], 8
mov byte [ebp - 0x25], 2
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
dec eax
neg eax
sbb eax, eax
inc eax
leave
ret

Function at 0x403d6d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp - 4], eax
and word [0x419f70], 0
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x58]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x403da4
mov eax, 0x419f70
jmp 0x403eac
push edi
call fcn.00408299
pop ecx
push eax
push edi
push 0
push esi
mov dword [ebp - 0x48], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
mov esi, 0x419f70
je 0x403ea1
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x415a2c
push dword [ebp - 0x48]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403ea1
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push ebx
mov ebx, ecx
movzx ecx, cx
mov eax, edx
mov dword [ebp - 0x4c], ecx
push 0xa
lea ecx, [ebp - 0x42]
movzx edx, dx
shr eax, 0x10
push ecx
push eax
mov dword [ebp - 0x50], edx
shr ebx, 0x10
mov word [ebp - 0x44], 0x20
call fcn.004081d3
lea eax, [ebp + eax*2 - 0x46]
push eax
push esi
call fcn.00402bca
mov edi, 0x414b1c
push edi
push esi
call fcn.00402be8
push 0xa
lea eax, [ebp - 0x42]
push eax
push dword [ebp - 0x50]
mov word [ebp - 0x44], 0x30
call fcn.004081d3
lea eax, [ebp + eax*2 - 0x46]
push eax
push esi
call fcn.00402be8
push edi
push esi
call fcn.00402be8
lea eax, [ebp - 0x44]
push str.0000
push eax
call fcn.00402bca
add esp, 0x40
push 0xa
lea eax, [ebp - 0x3c]
push eax
push ebx
call fcn.004081d3
lea eax, [ebp + eax*2 - 0x46]
push eax
push esi
call fcn.00402be8
push edi
push esi
call fcn.00402be8
add esp, 0x1c
push 0xa
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea eax, [eax*2 + 0x419f70]
push eax
push dword [ebp - 0x4c]
call fcn.004081d3
add esp, 0xc
pop ebx
push dword [ebp - 0x48]
call fcn.004082af
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040bb82
leave
ret
Function at 0x406055
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x417838]
push esi
mov ecx, 0xc7
xor esi, esi
cmp eax, ecx
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ecx
jg 0x406076
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
movzx edx, word [eax + 2]
cmp dx, 0x3a
jne 0x406093
lea ecx, [eax + 4]
cmp word [ecx], 0x5c
jne 0x406093
mov esi, ecx
jmp 0x4060c1
cmp word [eax], 0x5c
jne 0x4060d9
cmp dx, 0x5c
jne 0x4060d9
mov edi, dword [sym.imp.MSVCR80.dll_wcschr]
add eax, 4
push 0x5c
push eax
call edi
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4060d9
add esi, 2
push 0x5c
push esi
call edi
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x4060d9
mov eax, dword [ebp + 8]
inc esi
inc esi
movzx edi, word [esi]
and word [esi], 0
mov eax, dword [eax + 0x20]
mov dword [ebp - 8], eax
jmp 0x4060dc
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40611f
mov eax, dword [ebp - 4]
xor ecx, ecx
imul eax, eax, 0x2dc6c0
cmp dword [ebp - 0xc], ecx
ja 0x40611f
jb 0x40610a
cmp dword [ebp - 0x10], eax
jae 0x40611f
push 0
push 0x2dc6c0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0040bd50
mov dword [ebp - 4], eax
test esi, esi
mov eax, dword [ebp - 4]
mov dword [0x417838], eax
je 0x40612e
mov word [esi], di
pop edi
pop esi
leave
ret

Function at 0x4085a3
Capabilities:
Terminate process

Disassembly:
push esi
push 0
call fcn.0040856c
pop ecx
mov esi, 0x417960
mov eax, dword [esi]
test eax, eax
je 0x4085be
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x24
cmp esi, 0x417ac8
jl 0x4085b1
mov eax, dword [0x419e68]
test eax, eax
pop esi
je 0x4085dc
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push dword [esp + 4]
call dword [sym.imp.MSVCR80.dll_exit]
int3
Function at 0x40884c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 1
je 0x408864
cmp dword [ebp + 8], 2
je 0x408864
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x4088ba
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__get_osfhandle]
push eax
call fcn.00407f3c
test eax, eax
pop ecx
pop ecx
je 0x408885
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR80.dll__cputws]
pop ecx
leave
ret
lea eax, [ebp - 4]
push eax
call fcn.00407edb
test eax, eax
pop ecx
je 0x4088b4
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea esi, [esi + esi + 2]
push esi
mov dword [ebp - 4], eax
call fcn.00408299
pop ecx
push 0
push 0
push esi
mov ebx, eax
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jge 0x4088f1
push 0
call fcn.00408a41
dec eax
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__write]
push ebx
call fcn.004082af
add esp, 0x10
pop esi
pop ebx
leave
ret

Function at 0x4089b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x419fe0]
test eax, eax
jne 0x4089f3
and word [0x419638], ax
push 0x400
push 0x419638
call fcn.00409816
test eax, eax
pop ecx
pop ecx
mov dword [0x419fe0], eax
jne 0x4089f3
push str.fatal_error_C1510:_Cannot_load_language_resource_clui.dll._n
push 1
call fcn.0040890a
pop ecx
pop ecx
push 4
call fcn.004085a3
push esi
mov esi, dword [esp + 8]
mov ecx, esi
shr ecx, 4
inc ecx
movzx ecx, cx
push 6
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x408a35
push eax
push dword [0x419fe0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408a35
and esi, 0xf
je 0x408a2f
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x408a25
cmp word [eax], 0
jne 0x408a3c
mov eax, 0x415a28
pop esi
ret
add eax, 2
pop esi
ret
Function at 0x408cec
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call fcn.00401df4
xor edi, edi
inc edi
test eax, eax
je 0x408d0b
mov dword [esp + 0x1c], ebp
jmp 0x408d30
push edi
call dword [sym.imp.MSVCR80.dll__get_osfhandle]
push eax
call fcn.00407f3c
test eax, eax
pop ecx
pop ecx
je 0x408d26
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
jmp 0x408d2c
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], edi
mov ebx, 0x41498c
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x20]
add eax, 0xa
imul eax, eax, 0x14
add eax, dword [esp + 0x18]
imul eax, eax, 0x32
add eax, dword [esp + 0x14]
push eax
call fcn.004089b4
mov esi, eax
cmp word [esi], bp
pop ecx
je 0x408e42
mov edi, dword [sym.imp.MSVCR80.dll_wcslen]
push esi
call edi
pop ecx
xor ecx, ecx
cmp word [esi + eax*2 - 2], 0xa
sete cl
xor eax, eax
cmp dword [esp + 0x1c], eax
mov ebp, ecx
jne 0x408d8f
push esi
call edi
pop ecx
mov edi, eax
jmp 0x408da4
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
dec edi
cmp edi, 0x28
jg 0x408df7
test ebp, ebp
jne 0x408df7
push esi
push 1
call fcn.0040890a
cmp dword [esp + 0x18], ebp
pop ecx
pop ecx
jne 0x408dd9
push 0x28
pop esi
cmp edi, esi
jge 0x408de8
sub esi, edi
push 0x414c90
push 1
call fcn.0040890a
dec esi
pop ecx
pop ecx
jne 0x408dc6
jmp 0x408de8
push ebx
push 1
call fcn.0040890a
pop ecx
pop ecx
call fcn.00408c5b
xor eax, eax
cmp dword [esp + 0x10], eax
sete al
mov dword [esp + 0x10], eax
jmp 0x408e2a
cmp dword [esp + 0x10], 0
je 0x408e12
and dword [esp + 0x10], 0
push ebx
push 1
call fcn.0040890a
pop ecx
pop ecx
call fcn.00408c5b
push esi
push 1
call fcn.0040890a
push ebx
push 1
call fcn.0040890a
add esp, 0x10
call fcn.00408c5b
cmp dword [esp + 0x14], 1
jne 0x408e3d
cmp dword [esp + 0x20], 1
jne 0x408e3d
call fcn.00408c5b
xor edi, edi
inc edi
xor ebp, ebp
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x32
jne 0x408d41
push dword [esp + 0x20]
call fcn.00408249
add esp, 4
cmp eax, edi
mov dword [esp + 0x20], eax
jne 0x408d3d
push ebx
push edi
call fcn.0040890a
pop ecx
pop ecx
call fcn.00408c5b
cmp dword [esp + 0x10], ebp
je 0x408e8f
push ebx
push edi
mov dword [esp + 0x18], ebp
call fcn.0040890a
pop ecx
pop ecx
call fcn.00408c5b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 8
jl 0x408d3d
jne 0x408ead
call fcn.0040423d
test al, al
jne 0x408d3d
push ebp
call dword [sym.imp.MSVCR80.dll_exit]
pop edi
pop esi
pop ebp
pop ebx
Function at 0x40993b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftVisualStudio8.0General
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4099a5
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.UserCanAutoSendErrorReport
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x4099a5
cmp dword [ebp - 0xc], 4
jne 0x4099a5
xor eax, eax
cmp dword [ebp - 0x10], 1
sete al
leave
ret
xor al, al
leave
ret

Function at 0x4099a9
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test ebx, ebx
push edi
je 0x409a26
mov edi, 0x104
cmp esi, edi
jb 0x409a26
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a26
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push str.DW0200
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
mov byte [ebx + esi - 1], 0
jne 0x409a26
cmp dword [ebp - 8], 2
jne 0x409a2b
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, edi
ja 0x409a26
test eax, eax
jne 0x409a31
xor al, al
pop edi
leave
ret
cmp dword [ebp - 8], 1
jne 0x409a26
mov al, 1
jmp 0x409a28

Function at 0x409a35
Capabilities:
Read file via mapping

Disassembly:
push esi
xor esi, esi
push esi
push 0x9c9c
push esi
push 4
push 0x419ffc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [0x41a014], eax
jne 0x409a5b
xor al, al
pop esi
ret
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [0x41a010], eax
jne 0x409a84
push dword [0x41a014]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41a014], esi
jmp 0x409a57
mov al, 1
pop esi
ret

Function at 0x409a88
Capabilities:
Read file via mapping

Disassembly:
and dword [0x41a000], 0
mov dword [0x419ffc], 0xc
mov dword [0x41a004], 1
jmp fcn.00409a35
Function at 0x409ef3
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.MPCL_MUTEX__d
lea eax, [ebp - 0x22c]
push 0x100
push eax
call fcn.004014b8
and dword [ebp - 0x234], 0
add esp, 0x10
lea eax, [ebp - 0x22c]
push eax
push 0
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x238], 0xc
mov dword [ebp - 0x230], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
push str._.16X
mov dword [0x41aad8], eax
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.004014b8
add esp, 0x10
lea eax, [ebp - 0x2c]
push eax
push 0x415700
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bb82
leave
ret

Function at 0x40a473
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41aad8], 0
jne 0x40a4ce
push 0x14
lea eax, [ebp - 0x2c]
push eax
push 0x415700
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.0040a2a1
mov dword [esp], 0x41aad8
lea eax, [ebp - 0x2c]
push 0x415788
push eax
call dword [sym.imp.MSVCR80.dll_swscanf_s]
add esp, 0xc
cmp eax, 1
je 0x40a4ce
and dword [0x41aad8], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bb82
leave
ret

Function at 0x40a4da
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41aad8], 0
je 0x40a53e
push 0x14
lea eax, [ebp - 0x2c]
push eax
push 0x415700
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.0040a2a1
cmp dword [0x417be0], 0
pop ecx
je 0x40a53e
push 0
push str.1PAT2
lea eax, [ebp - 0x2c]
push eax
push str.MPdiagMutex
call fcn.0040182a
push eax
push dword [0x417030]
call fcn.00401886
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bb82
leave
ret

Function at 0x40a661
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
push esi
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push dword [esp + 0x18]
xor ebp, ebp
push dword [esp + 0x18]
inc ebp
push dword [esp + 0x18]
call esi
test eax, eax
jne 0x40a6d4
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RaiseException]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x40a6a2
push ebx
push ebx
push ebx
push 1
call edi
jmp 0x40a6b3
inc ebp
cmp ebp, 5
jg 0x40a6cb
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call esi
test eax, eax
je 0x40a68c
jmp 0x40a6d2
push ebx
push ebx
push ebx
push 1
call edi
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x40a7b0
Capabilities:
Create thread

Disassembly:
push 0x20
push 0x415cd8
call fcn.0040bdc0
mov edi, ecx
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x1c], 0xffffffff
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], esi
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push 0x40a029
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp eax, esi
setne cl
push ecx
call fcn.0040a2a1
pop ecx
mov eax, dword [edi + 4]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x20]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, esi
je 0x40a820
dec eax
jmp 0x40a825
cmp dword [ebp - 0x24], esi
jne 0x40a830
push esi
push esi
push esi
push 1
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 4], 0xfffffffe
call fcn.0040a844
call fcn.0040be05
ret 8

Function at 0x40a8e3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
jmp 0x40a911
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
call fcn.0040a2a1
mov eax, dword [ebp + 0xc]
sub esi, eax
add dword [ebp + 8], eax
pop ecx
test esi, esi
ja 0x40a8ef
pop edi
pop esi
pop ebp
ret 8

Function at 0x40a91b
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
push ebx
call fcn.0040a2b9
push dword [esp + 0x14]
mov esi, eax
call fcn.0040a2b9
add esi, eax
lea eax, [esi + esi + 2]
push eax
call fcn.00408299
push dword [esp + 0x1c]
mov edi, eax
lea eax, [esi - 1]
push eax
push edi
call fcn.0040a2e6
mov ecx, eax
sub ecx, edi
sar ecx, 1
sub esi, ecx
push ebx
dec esi
push esi
push eax
call fcn.0040a2e6
and word [eax], 0
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x40bb82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417c2c]
jne 0x40bb8c
repz ret
jmp fcn.0040c180
Function at 0x10001d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x1001c954], 0x1234
mov dword [0x1001c958], 0x118d
mov dword [ebp - 0x10], eax
call fcn.1000207b
xor ecx, ecx
mov edx, eax
mov esi, dword [0x1001c958]
mov edi, dword [eax + 0x3c]
mov ebx, edx
add ebx, edi
mov edi, dword [eax + edi]
cmp edi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
je 0x10001d99
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x20]
add ecx, 0x21fc
mov dword [0x1001c958], ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x1001c954], 0x62
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
je 0x10001ed9
jmp 0x10001e20
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x34]
cmp edx, esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], eax
jb 0x10001e30
jmp 0x10001ed9
mov al, byte [ebp - 0x49]
test al, 1
jne 0x10001eaa
jmp 0x10001dea
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
add ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [esi + ecx*4]
mov dword [0x1001c954], 0x1234
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x49], cl
je 0x10001e13
mov eax, dword [ebp - 0x58]
add eax, 1
mov cl, byte [ebp - 0x59]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x49]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x54], eax
jne 0x10001e54
jmp 0x10001e13
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov dword [0x1001c958], 0x185c
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x1001c954], 0x6ff
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret