joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d1b0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.004457c0
test al, al
je 0x40d3ae
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043d630
test al, al
je 0x40d3a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x7e054845
mov dword [esp + 8], 0xaaa01ea2
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d236
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d3c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40d210
mov dword [esp + 4], 0xe61f4585
mov dword [esp + 8], 0xe81fba83
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d286
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d430
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d260
test esi, esi
je 0x40d336
mov dword [esp + 4], 0x23222101
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x40d2e6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d4c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x40d2c0
mov dword [esp + 4], 0xbf11ef41
mov dword [esp + 8], 0xe9f4e09a
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40d336
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d540
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40d310
mov dword [esp + 4], 0xf6f7f8f9
mov dword [esp + 8], 0xf2f3f4f5
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d396
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d5c0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d370
call fcn.0040ec30
test al, al
je 0x40d3a9
call fcn.00412720
call fcn.00410550
call fcn.004465c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov edi, dword [esp + 0x68]
add edi, dword [ecx + 0x60]
mov word [esp + 4], 0x9795
mov byte [esp + 6], 0x9e
mov dword [esp + 7], 0
mov byte [esp + 0xb], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 7
ja 0x40d8ab
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x18]
push eax
call fcn.0040e5d0
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x40d880
mov dword [esp + 0xc], 0x6080472
mov word [esp + 0x10], 0x6d76
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 0xa
ja 0x40d90b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x18]
movzx eax, byte [esp + eax + 0xc]
push dword [esp + 0x18]
push eax
call fcn.0040e540
add esp, 8
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 0xb
jb 0x40d8e0
mov dword [esp + 0x18], 0x46407c7d
mov dword [esp + 0x1c], 0x4242706c
mov dword [esp + 0x20], 0x3fcac00d
mov dword [esp + 0x24], 0x3ac73ec3
mov dword [esp + 0x28], 0x237c3c2
mov dword [esp + 0x2c], 0xc8156f69
mov dword [esp + 0x30], 0xd52fddd6
mov dword [esp + 0x34], 0xd60a10d8
mov dword [esp + 0x38], 0xd0ddd1d3
mov dword [esp + 0x3c], 0xd8dfd1dd
mov dword [esp + 0x40], 0x1d5a33e6
mov dword [esp + 0x44], 0x22e3efe3
mov dword [esp + 0x48], 0x12e61014
mov dword [esp + 0x4c], 0x16e8553f
mov dword [esp + 0x50], 0x49270cf5
mov byte [esp + 0x54], 0x6c
mov word [esp + 0x55], 0
mov byte [esp + 0x57], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x40d9d6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.0040e4a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x40d9b0
mov ecx, dword [esp + 0x6c]
movzx edx, byte [esp + 0x18]
mov eax, edi
test dl, dl
je 0x40d9fb
lea ebx, [esp + 0x19]
mov eax, edi
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d9f0
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40da1b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40da10
mov ecx, dword [esp + 0x70]
mov byte [eax], 0
movzx edx, byte [esp + 0xc]
test dl, dl
je 0x40da3b
lea ebx, [esp + 0xd]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40da30
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40da5b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40da50
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40da7b
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40da70
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x58
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x428ff0
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x455f6c]
mov dword [esp + 0x14], 0x71420f6b
mov dword [esp + 0x18], 0x75d773e1
mov dword [esp + 0x1c], 0x79da77d7
mov dword [esp + 0x20], 0x7dea7b3b
mov dword [esp + 0x24], 0x613a7fec
mov dword [esp + 0x28], 0x65f663c3
mov dword [esp + 0x2c], 0x690167c7
mov dword [esp + 0x30], 0x6b68
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x42907b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042c450
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x429050
lea edi, [esp + 0x64]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x42909e
mov eax, 0xffffffff
jmp 0x4290a1
lea eax, [ebx + ebx]
push eax
call fcn.0040cb00
add esp, 4
mov esi, eax
mov ebp, dword [0x455f6c]
mov dword [esp + 0x14], 0x71a27f9b
mov dword [esp + 0x18], 0x75d773c1
mov dword [esp + 0x1c], 0x49ca77d7
mov dword [esp + 0x20], 0x4dfa4b8b
mov dword [esp + 0x24], 0x418a4ffc
mov dword [esp + 0x28], 0x45f643e3
mov dword [esp + 0x2c], 0x59a147e7
mov word [esp + 0x30], 0x5b58
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x42913b
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042c4c0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x429110
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x42915b
mov eax, 0xffffffff
jmp 0x429162
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040cb00
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0xc1b6c7a0
mov dword [esp + 0x18], 0xcdafc3a3
mov dword [esp + 0x1c], 0xc9adcf59
mov dword [esp + 0x20], 0xf5a5cba1
mov dword [esp + 0x24], 0xf1f6f769
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x17
ja 0x4291db
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042c530
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x18
jb 0x4291b0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x429201
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4291f0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x429231
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x429220
mov ebx, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.0044a380
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x451c20]
Function at 0x42cec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x848
mov dword [esp + 4], 0
xor edi, edi
mov ebx, 0x20219
mov eax, 1
xor ebp, ebp
jmp dword [eax*4 + 0x452384]

Function at 0x42db00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042db20
add esp, 4
test al, al
je 0x42e200
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa8
xor edi, edi
mov esi, 0x20219
mov eax, 1
lea ebx, [esp + 0x66]
jmp dword [eax*4 + 0x4524e4]
Function at 0x439d70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0041dba0
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
jmp 0x439d88
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
jmp 0x439da2
jmp 0x439da4
xor ebx, ebx
test al, 1
jne 0x439daf
jmp 0x439edf
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x1c], edi
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
jmp 0x439de0
cmp edi, 0
setne al
jmp 0x439de8
xor ebx, ebx
test al, 1
jne 0x439df3
jmp 0x439ed9
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.0040cc30
add esp, 4
mov edx, eax
jmp 0x439e14
xor ebx, ebx
cmp edx, 0
je 0x439ecd
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [esi], 0x8f
mov byte [esi + 1], 0xd5
mov byte [esi + 2], 0xd7
mov byte [esi + 3], 0xdf
mov byte [esi + 4], 0xaa
mov byte [esi + 5], 0xde
mov byte [esi + 6], 0xa3
mov byte [esi + 7], 0xd5
mov byte [esi + 8], 0xa4
mov byte [esi + 9], 0x93
mov byte [esi + 0xa], 0xd2
mov byte [esi + 0xb], 0xcf
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 0x45
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x439e63
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x13
jae 0x439ead
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov ebx, edx
call fcn.0043d560
mov edx, ebx
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x439e76
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d7c0
mov bl, al
and bl, 1
jmp 0x439ecd
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ebx], 0
lea ebx, [ebx + 2]
jne 0x43f980
mov dword [esp + 8], 0x8e8e881f
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43f9d6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
push dword [esp]
push eax
call fcn.00443940
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43f9b0
cmp ebx, 2
je 0x43f9fc
lea eax, [ebx - 2]
mov edx, eax
sar edx, 1
mov edi, dword [esp + 8]
mov ecx, edi
not ecx
test al, 2
mov dword [esp + 0x10], ecx
jne 0x43fa03
cmp ebx, 4
jne 0x43fa37
jmp 0x43fa90
mov eax, ebp
jmp 0x43fa90
dec edx
movzx eax, word [esi]
xor eax, ebp
mov ebp, eax
or ebp, edi
mov dword [esp + 4], ebp
mov ebp, eax
and ebp, edi
imul ebp, dword [esp + 4]
mov dword [esp + 4], ebp
mov ebp, eax
not ebp
and ebp, edi
and eax, ecx
imul eax, ebp
add eax, dword [esp + 4]
add esi, 2
mov ebp, eax
cmp ebx, 4
je 0x43fa90
xor ebx, ebx
mov eax, ebp
mov dword [esp + 4], edx
nop
movzx ebp, word [esi + ebx*2]
xor ebp, eax
mov eax, ebp
or eax, edi
mov ecx, ebp
and ecx, edi
imul ecx, eax
mov eax, ebp
not eax
and eax, edi
mov edx, esi
mov esi, dword [esp + 0x10]
and ebp, esi
imul ebp, eax
add ebp, ecx
movzx eax, word [edx + ebx*2 + 2]
xor eax, ebp
mov ecx, eax
or ecx, edi
mov ebp, eax
and ebp, edi
imul ebp, ecx
mov ecx, eax
not ecx
and ecx, edi
and eax, esi
mov esi, edx
imul eax, ecx
mov edx, dword [esp + 4]
add eax, ebp
add ebx, 2
cmp edx, ebx
jne 0x43fa40
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4407e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, 0xffffffff
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
jne 0x4407f0
mov eax, esi
and eax, 3
mov edx, esi
or edx, 3
imul edx, eax
xor eax, 3
mov dword [esp], esi
mov ecx, dword [esp]
and ecx, 0xfffffffc
imul ecx, eax
add edx, ecx
mov ecx, dword [esp]
shr edx, 2
movzx eax, byte [edi + ecx - 1]
cmp eax, 0x3d
je 0x44082d
cmp eax, 0x2e
jne 0x44082e
dec edx
movzx eax, byte [edi + ecx - 2]
cmp eax, 0x3d
je 0x44083d
cmp eax, 0x2e
jne 0x44083e
dec edx
mov dword [esp + 8], edx
mov edx, 0
test ecx, ecx
je 0x44094b
xor esi, esi
mov ebp, 2
jmp 0x440872
mov edx, dword [esp + 4]
nop
nop
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov esi, edx
cmp ebp, ecx
mov ebp, eax
jae 0x44094b
mov edi, dword [esp + 0x40]
movzx eax, byte [edi + ebp - 2]
push eax
call fcn.00422950
add esp, 4
mov bh, al
movzx eax, byte [edi + ebp - 1]
push eax
call fcn.00422950
add esp, 4
mov bl, al
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, bh
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi], al
mov ecx, dword [esp]
lea edx, [esi + 1]
cmp ebp, ecx
jae 0x440860
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 8], edx
call fcn.00422950
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
add esp, 4
cmp al, 0x40
je 0x440860
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea edx, [esi + 2]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x44]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp]
mov ecx, dword [esp]
jae 0x440858
mov ebx, eax
mov eax, dword [esp + 0x40]
movzx eax, byte [eax + ebp + 1]
push eax
call fcn.00422950
add esp, 4
cmp al, 0x40
jne 0x440927
mov edx, dword [esp + 4]
jmp 0x440943
shl bl, 6
add al, bl
mov ecx, esi
and ecx, 1
mov edx, dword [esp + 4]
xor edx, 1
lea edx, [edx + ecx*2]
mov ecx, dword [esp + 0x44]
mov byte [ecx + esi + 2], al
mov ecx, dword [esp]
jmp 0x440860
mov ebx, dword [esp + 8]
cmp edx, ebx
mov eax, 0
jne 0x4409e5
mov esi, dword [esp + 0x44]
lea edx, [esi + 0x20]
lea edi, [esp + 0xc]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x2c]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x4409e1
cmp ebx, 0x21
je 0x4409cb
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0xc]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x4409a0
test bl, 1
je 0x4409e1
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0xc]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00406810
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406c32
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x43712c]
call dword [ebp - 8]
jmp 0x406c3c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x40b280
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x40b29e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp + 8]
push edx
call fcn.0040b380
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x420710
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0040a3c0
lea ecx, [ebp - 4]
call fcn.004206e0
movzx eax, al
test eax, eax
jne 0x42074d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.00420620
mov eax, dword [ebp - 0x18]
jmp 0x420875
lea ecx, [ebp - 4]
call fcn.0040a4d0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004206a0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0040a4d0
push eax
push 0
push 0
call fcn.00420560
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4207b3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.00420620
mov eax, dword [ebp - 0x20]
jmp 0x420875
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040df10
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00405d60
lea ecx, [ebp - 8]
call fcn.00405da0
movzx edx, al
test edx, edx
jne 0x4207fc
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00405d80
lea ecx, [ebp - 4]
call fcn.00420620
mov eax, dword [ebp - 0x24]
jmp 0x420875
lea ecx, [ebp - 8]
call fcn.00405de0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.0040a4d0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.00420560
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x420857
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00405d80
lea ecx, [ebp - 4]
call fcn.00420620
mov eax, dword [ebp - 0x34]
jmp 0x420875
lea ecx, [ebp - 8]
call fcn.0040a470
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00405d80
lea ecx, [ebp - 4]
call fcn.00420620
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x42fe10
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00435cd0
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4477c8]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x42ffe8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x42ff37
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x42ff37
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x42ff15
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x42fe99
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42ffa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x430008
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x42ffe3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x430008
jmp 0x42fe72
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405850
mov esp, ebp
pop ebp
ret