joyce8/EMBER2024-capa huggingface dataset:
Function at 0x630a6250
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x630cc1c8
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.630a62b0

Function at 0x630a62b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x631e3ed8]
test esi, esi
jle 0x630a639d
mov edi, dword [0x631e3edc]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x630a62e4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x630a6396
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x630a62d0
mov dword [esp], eax
mov ebx, eax
call fcn.630a6a40
test eax, eax
mov edi, eax
je 0x630a63da
lea ebx, [esi + esi*2]
mov esi, dword [0x631e3edc]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.630a6b40
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x631e3edc]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x630a63ba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x630a638f
sub eax, 0x40
and eax, 0xffffffbf
je 0x630a638f
mov eax, dword [esp + 0x20]
add ebx, dword [0x631e3edc]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x630a63a4
add dword [0x631e3ed8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x630a62ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.630a6250
mov eax, dword [0x631e3edc]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.630a6250
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.630a6250
lea esi, [esi]
Function at 0x630a66b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x631e3ee8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x631e3ee0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x630a6705
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x630a66fe
test esi, esi
je 0x630a66fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x630a66e0
mov dword [esp], 0x631e3ee8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x630a6960
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x630a6998
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x630a698e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x630a699a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x630a6980
xor eax, eax
pop ebx
pop esi
ret
Function at 0x630aa8e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x140]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x630aaa9e
cmp byte [ebx], 0
je 0x630aaa60
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x630aaa80
test al, 0x10
je 0x630aaa60
lea ebp, [esp + 0x1c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov edi, ebp
call sub.msvcrt.dll__fullpath
mov edx, dword [edi]
add edi, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x630aa944
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [edi + 2]
cmove edi, edx
add al, al
sbb edi, 3
sub edi, ebp
lea eax, [edi + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x630aaa8f
lea ebx, [eax + 0x22c]
lea eax, [edi + 1]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
cmp byte [esi + 0x22c], 0
je 0x630aa9d0
movzx eax, byte [esi + edi + 0x22b]
cmp al, 0x2f
je 0x630aa9d0
cmp al, 0x5c
je 0x630aa9d0
mov ebp, 0x5c
mov word [ebx + edi], bp
mov esi, esi
lea edi, [edi]
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x630aa9d2
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ecx + 2]
cmove ecx, eax
add dl, dl
mov eax, 0x2a
sbb ecx, 3
xor edx, edx
mov word [ecx], ax
mov word [esi + 0x11c], dx
lea edx, [esi + 0x120]
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x224], 0xffffffff
mov word [esi + 0x11e], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
rep stosd dword es:[edi], eax
mov eax, esi
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
add esp, 0x12c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x630aaa4d
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x630aaa4d
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x630aaa4d

Function at 0x630ab9c0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x630c343c], eax
je 0x630ab9d7
add esp, 0xc
ret
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x630abde0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x630abe05
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.630b5f50
cmp eax, 1
je 0x630abe07
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov cl, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x630abe55
jmp 0x630abe63
cmp eax, 0x6a
je 0x630abe6d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x630abe50
cmp eax, 0x6a
je 0x630abe6d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x630abf10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x631e3f7c], 1
je 0x630abf25
call fcn.630abe80
mov eax, dword [0x630c343c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x630abf42
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.630abd30
test eax, eax
mov ebx, eax
je 0x630ac049
mov eax, dword [entry3]
test eax, eax
je 0x630ac049
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x38]
sub esp, 0x10
mov dword [ebx + 0x1c], 0xffffffff
call fcn.630abde0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x630ac050
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x630c343c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x630ac050
mov eax, ebx
jmp 0x630abf3a
xor eax, eax
jmp 0x630abf3a
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
push esi
push ebx
mov eax, 0x80070057
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
test edx, edx
jg 0x630ac082
pop ebx
pop esi
ret 0xc
mov esi, ebx
movzx eax, byte [ecx]
test al, al
je 0x630ac0a4
lea ebx, [esi + 1]
add ecx, 1
sub edx, 1
mov byte [ebx - 1], al
jne 0x630ac080
mov eax, 0x8007007a
mov byte [esi], 0
pop ebx
pop esi
ret 0xc
xor eax, eax
jmp 0x630ac09c
Function at 0x630b4080
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.630abf10
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x630b4102
test byte [ebx + 0x20], 0x30
jne 0x630b40b6
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x630c343c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x630b40f9
cmp dword [eax + 0x14], 0
je 0x630b4109
mov esi, dword [eax + 4]
mov dword [eax + 0x68], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x630b40ec
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x630b414d
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.630b3440
jmp 0x630b409d
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x630b4120
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x630b4170
mov eax, dword [0x630c343c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x630b40f9
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
jne 0x630b4133
mov eax, ebx
call fcn.630aba60
jmp 0x630b4133
Function at 0x6e29bfc4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6e29c09e
jmp 0x6e29c167
jmp 0x6e29c230
jmp 0x6e29c2f9
jmp 0x6e29c3c2
jmp 0x6e29c48b
jmp 0x6e29c554
jmp 0x6e29c61d
jmp 0x6e29c6e6
jmp 0x6e29c7af
jmp 0x6e29c878
jmp 0x6e29c941
jmp 0x6e29ca0a
jmp 0x6e29cad3
jmp 0x6e29cb9c
jmp 0x6e29cc65
jmp 0x6e29cd2e
jmp 0x6e29cdf7
jmp 0x6e29cec0
jmp 0x6e29cf89
jmp 0x6e29d052
jmp 0x6e29d11b
jmp 0x6e29d1e4
jmp 0x6e29d2ad
jmp 0x6e29d376
jmp 0x6e29d43f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6e29d50e
jmp 0x6e29d5d7
jmp 0x6e29d6a0
jmp 0x6e29d769
jmp 0x6e29d832
jmp 0x6e29d8fb
jmp 0x6e29d9c4
jmp 0x6e29da8d
jmp 0x6e29db56
jmp 0x6e29dc1f
jmp 0x6e29dce8
jmp 0x6e29ddb1
jmp 0x6e29de7a
jmp 0x6e29df43
jmp 0x6e29e00c
jmp 0x6e29e0d5
jmp 0x6e29e19e
jmp 0x6e29e267
jmp 0x6e29e330
jmp 0x6e29e3f9
jmp 0x6e29e4c2
jmp 0x6e29e58b
jmp 0x6e29e654
jmp 0x6e29e71d
jmp 0x6e29e7e6
jmp 0x6e29e8af
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6e29e992
jmp 0x6e29ea5b
jmp 0x6e29eb24
jmp 0x6e29ebed
jmp 0x6e29ecb6
jmp 0x6e29ed7f
jmp 0x6e29ee48
jmp 0x6e29ef11
jmp 0x6e29efda
jmp 0x6e29f0a3
jmp 0x6e29f16c
jmp 0x6e29f235
jmp 0x6e29f2fe
jmp 0x6e29f3c7
jmp 0x6e29f490
jmp 0x6e29f559
jmp 0x6e29f622
jmp 0x6e29f6eb
jmp 0x6e29f7b4
jmp 0x6e29f87d
jmp 0x6e29f946
jmp 0x6e29fa0f
jmp 0x6e29fad8
jmp 0x6e29fba1
jmp 0x6e29fc6a
jmp 0x6e29fd33
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6e29fe05
jmp 0x6e29fece
jmp 0x6e29ff97
jmp 0x6e2a0060
jmp 0x6e2a0129
jmp 0x6e2a01f2
jmp 0x6e2a02bb
jmp 0x6e2a0384
jmp 0x6e2a044d
jmp 0x6e2a0516
jmp 0x6e2a05df
jmp 0x6e2a06a8
jmp 0x6e2a0771
jmp 0x6e2a083a
jmp 0x6e2a0903
jmp 0x6e2a09cc
jmp 0x6e2a0a95
jmp 0x6e2a0b5e
jmp 0x6e2a0c27
jmp 0x6e2a0cf0
jmp 0x6e2a0db9
jmp 0x6e2a0e82
jmp 0x6e2a0f4b
jmp 0x6e2a1014
jmp 0x6e2a10dd
jmp 0x6e2a11a6
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6e2a1288
jmp 0x6e2a1351
jmp 0x6e2a141a
jmp 0x6e2a14e3
jmp 0x6e2a15ac
jmp 0x6e2a1675
jmp 0x6e2a173e
jmp 0x6e2a1807
jmp 0x6e2a18d0
jmp 0x6e2a1999
jmp 0x6e2a1a62
jmp 0x6e2a1b2b
jmp 0x6e2a1bf4
jmp 0x6e2a1cbd
jmp 0x6e2a1d86
jmp 0x6e2a1e4f
jmp 0x6e2a1f18
jmp 0x6e2a1fe1
jmp 0x6e2a20aa
jmp 0x6e2a2173
jmp 0x6e2a223c
jmp 0x6e2a2305
jmp 0x6e2a23ce
jmp 0x6e2a2497
jmp 0x6e2a2560
Function at 0x6e2d7003
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6ef15018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6ef15018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6e2d70ec
jmp 0x6e2d71b5
jmp 0x6e2d727e
jmp 0x6e2d7347
jmp 0x6e2d7410
jmp 0x6e2d74d9
jmp 0x6e2d75a2
jmp 0x6e2d766b
jmp 0x6e2d7734
jmp 0x6e2d77fd
jmp 0x6e2d78c6
jmp 0x6e2d798f
jmp 0x6e2d7a58
jmp 0x6e2d7b21
jmp 0x6e2d7bea
jmp 0x6e2d7cb3
jmp 0x6e2d7d7c
jmp 0x6e2d7e45
jmp 0x6e2d7f0e
jmp 0x6e2d7fd7
jmp 0x6e2d80a0
jmp 0x6e2d8169
jmp 0x6e2d8232
jmp 0x6e2d82fb
jmp 0x6e2d83c4
jmp 0x6e2d848d
mov dword [ebp - 0x14], 0
jmp 0x6e2d855d
jmp 0x6e2d8626
jmp 0x6e2d86ef
jmp 0x6e2d87b8
jmp 0x6e2d8881
jmp 0x6e2d894a
jmp 0x6e2d8a13
jmp 0x6e2d8adc
jmp 0x6e2d8ba5
jmp 0x6e2d8c6e
jmp 0x6e2d8d37
jmp 0x6e2d8e00
jmp 0x6e2d8ec9
jmp 0x6e2d8f92
jmp 0x6e2d905b
jmp 0x6e2d9124
jmp 0x6e2d91ed
jmp 0x6e2d92b6
jmp 0x6e2d937f
jmp 0x6e2d9448
jmp 0x6e2d9511
jmp 0x6e2d95da
jmp 0x6e2d96a3
jmp 0x6e2d976c
jmp 0x6e2d9835
jmp 0x6e2d98fe
mov dword [ebp - 0x18], 0
Function at 0x10022ada
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10022b19
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022b19
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022b19
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10022b19
cmp dword [ecx + 0x74], 0xe
jbe 0x10022b19
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100254a4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10025541
push ebx
push esi
call fcn.1002546d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10025401
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100254ee
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10025540
push edi
push eax
call fcn.10023da2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002550e
call fcn.10023df0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002553f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10025401
add esp, 0x20
test eax, eax
jne 0x1002552d
push edi
call fcn.10023df0
jmp 0x10025535
push ebx
call fcn.10023df0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100257ae
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002e250
push 0x1002e248
push str.FlsAlloc
push 0x1f
call fcn.100256ca
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100257e2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002c150]
call esi
jmp 0x100257e8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002582c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002e260
push 0x1002e258
push str.FlsGetValue
push 0x21
call fcn.100256ca
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10025863
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002c150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002586b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002e268
push 0x1002e260
push str.FlsSetValue
push 0x22
call fcn.100256ca
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100258a5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002c150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1002adb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002addd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002addd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402cc0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402cfd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402d1d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405168
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402efc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402f55
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d98
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d98
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402f3f
inc ebx
jmp 0x402f28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f5c
lea eax, [ebp - 8]
call fcn.00404ef8
ret

Function at 0x402f64
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404ef8
test esi, esi
jne 0x402f9b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404fe8
jmp 0x402fbc
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d98
mov dword [esp], eax
test esi, esi
je 0x402fbc
cmp dword [ebx], 0
je 0x402fbc
dec esi
jmp 0x402fa3
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403f4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x518020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403fe4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403fc4
xor eax, eax
push ebp
push 0x403fbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404000
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403fc4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x518020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x518020], ax
mov esp, ebp
pop ebp
ret
Function at 0x404cf0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52204c], 0
je 0x404d51
cmp word [0x522220], 0xd7b2
jne 0x404d19
cmp dword [0x522228], 0
jbe 0x404d19
mov eax, 0x52221c
call dword [0x522238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x518090
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404d78
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x518030], 0
jne 0x404d6d
push 0
push 0x518088
push 0x518090
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404eac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402ab4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x52204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404e74
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc