joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b18b0
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.004ae92b
push edx
pop ecx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x4b1938
push 2
push esi
push esi
push edi
call fcn.004ae92b
mov ecx, eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4b19cf
jg 0x4b1912
test esi, esi
je 0x4b19cf
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x4b1944
call fcn.004a93f4
mov dword [eax], 0xc
call fcn.004a93f4
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.004b1a8e
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jl 0x4b196c
jg 0x4b1965
cmp esi, 0x1000
jb 0x4b196c
mov eax, 0x1000
jmp 0x4b196e
mov eax, esi
push eax
push dword [ebp - 0xc]
push edi
call fcn.004add38
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b1995
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4b19b0
jg 0x4b1957
test esi, esi
je 0x4b19b0
jmp 0x4b1957
call fcn.004a93c0
cmp dword [eax], 5
jne 0x4b19aa
call fcn.004a93f4
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.004b1a8e
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4b1a35
or eax, eax
jg 0x4b1a41
jl 0x4b19d9
test esi, esi
jae 0x4b1a41
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004ae92b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
push edi
call fcn.004b14ba
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
push eax
pop ebx
mov eax, edx
push ebx
pop ecx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x4b1a41
call fcn.004a93f4
mov dword [eax], 0xd
call fcn.004a93c0
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x4b1938
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.004ae92b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b1938
xor eax, eax
jmp 0x4b193f

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40c27d
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x80
sub al, 0x3c
pushfd
invalid
or ch, byte [esi - 0x5a22d81b]
aam 0xb6
jge 0x40c2c3
movsb byte es:[edi], byte [esi]
cmc
pushfd
test eax, 0x959db8ce
rcr dword [edi + edi], 0x3e
xchg esp, eax
push ds
ret 0x7c98
jle 0x40c21a
sbb byte [ebx], 0x8d
xchg edx, eax
xchg ecx, eax
pop edi
lodsb al, byte ds:[esi]
lea edi, ss:[ebp + edx*2 - 0x166142b6]
push 0xfd5272a2
mov word [eax - 0x32], fs
push esi
scasb al, byte es:[edi]
jle 0x40c2e6
sub eax, 0x9e806523
jge 0x40c24c
out 0x9f, eax
std
lodsb al, byte [esi]
push eax
aas
and dword [eax], ecx
neg byte [edi]
stosd dword es:[edi], eax
fisubr word [edi + 0x5e]
outsd dx, dword [esi]
pop esi
in eax, 0x90
sbb ebx, esp
inc esp
cmp dword [eax + 0x5d], ecx
mov word [ebx], gs
invalid
retf
xor eax, 0x1ac09d9e
rcl byte [edx + ebp*2 + 0xd], cl
mov eax, ebx
pop ds
call 0x287f5c14
je 0x40c325
sbb eax, 0x74283e99
sub al, 0x73
mov ah, 0xa4
jae 0x40c2af
movsb byte es:[edi], byte [esi]
aam 0xe5
sub eax, 0xdc314ce0
sbb eax, esp
jge 0x40c2a6
invalid
adc al, 0x77
add byte [ebp - 0x32], ch
stc
mov ebx, 0x541b7ef5
jle 0x40c34a
push esp
pop ebp
add esp, dword [edx - 0x5353c830]
js 0x40c2f3
sahf
push cs
sbb ebx, dword [ebp + 0x365e6c34]
or al, byte [ebx]
pop esi
mov byte [0x3defb749], al
xor ebp, dword [0x314562de]
mov bh, 0xef
cmp eax, 0x62de2d33
inc ebp
xor dword [esi - 0x24], esi
sub eax, 0x314562de
jbe 0x40c32d
jl 0x40c346
sahf
jg 0x36fac0d0
scasd eax, dword es:[edi]
push bp
xchg edi, eax
aad 0xbf
iretd

Function at 0x48cd7c
Capabilities:
Encode data using xor

Disassembly:
fcom qword [ebx - 0x7eebfdfe]
nop
mov bl, 0x3d
imul ebx, dword [esi], 0x5113a13c
pushfd
mov bh, 0x42
push cs
mov ebx, 0x25723f46
and eax, 0x3a5ed20b
les edx, [0x8280fcd2]
xor byte [edi], bh
sub eax, 0x5f1cf44a
push 0x4c5e8dab
test eax, 0xa12fd6a4
dec edx
bound ebx, qword [0xf1888d9e]
or byte [eax], dh
pop ss
or ah, bl
mov eax, 0x62ecf621
mov bh, 0x3d
loopne 0x48cd95
daa
push edi
pop esi
dec ecx
invalid
Function at 0x4d10b7
Capabilities:
Encode data using xor

Disassembly:
fcmovnu st(0), st(0)
xchg ebx, eax
invalid
cmpsb byte [esi], byte es:[edi]
mov edi, 0x532c3c85
push ecx
jb 0x4d1038
insb byte es:[edi], dx
and byte [edi + 0x423fc9e6], cl
fdiv qword [ecx]
fbstp tbyte [eax]
pop eax
dec ebp
xor edi, ebx
xor byte [eax + 0x4d], bl
jbe 0x4d108b
je 0x4d10f9
fldln2
sahf
enter 0x2659, 0xffffffffffffffcb
pop esp
invalid
ja 0x4d107a
pop esi
mov dh, 0xcd
test al, 0xd
fisttp qword [edi + 0xf40ff6d]
mov ah, 0xdd
jbe 0x4d1117
pop ecx
dec esi
xor eax, 0x23550f4d
movsd dword es:[edi], dword [esi]
cmp dword [edx + 0x6dcfd54c], 0xffffff82
mov ebp, 0x2a04dda9
xor byte [edx - 0x37], ah
mov dword [edx - 0x37c3daf3], edx
dec esp
xchg esp, eax
lea edx, [edi]
fadd st(3), st(0)
mov cs, word [ecx - 0x73]
sub eax, 0x978d114c
in eax, dx
sbb al, 0x8d
sbb al, 0x75
sub eax, dword [ecx - 0x4b]
pushal
push ebp
and esp, dword [ebp - 0x2ab3457d]
iretd
inc ecx
mov ch, 0x60
or al, 6
xchg edi, eax
out dx, eax
jl 0x4d1141
repne cmpsb byte [esi], byte es:[edi]
cmp esp, dword [ecx + 0x7d6c355d]
popal
in al, dx
cwde
mov al, byte [0xba2fb512]
jl 0x4d10ba
xor eax, 0x2e201cd2
push cs
sbb al, 0x20
push cs
sbb ch, 0x5f
mov esp, 0xd43fd366
das
dec ebp
mov byte [ecx], 0xc7
jg 0x4d118b
stc
mov ebp, 0x8423e316
insb byte es:[edi], dx
or ah, bh
std
cmpsd dword [esi], dword es:[edi]
ljmp 0x505e
jle 0x4d1102
in eax, dx
add al, dh
jl 0x4d10cd
std
push ebp
inc ebp
jge 0x4d10ce
push eax
pop ds
pop ebp
pop eax
mov dl, 0x74
push esi
inc eax
invalid
add byte [ebx + 0x7f], dl
out dx, al
outsb dx, byte [esi]
dec edx
jb 0x4d1119
invalid
Function at 0x533734
Capabilities:
Encode data using xor

Disassembly:
cdq
sub esp, dword [ebx - 0x28226868]
mul byte [ecx]
mov bl, 0xe9
enter 0x2bb1, 0xfffffffffffffff3
adc byte [esi], dh
mov cl, 0x2b
adc byte [esi], dh
add byte [edi + 0x1a], al
push esp
mov bh, 0xa
cmp dl, byte [esi - 0x17a50a8a]
cmp dword [ebp - 0x58a74a1d], esi
not dword [eax]
mov edx, 0xbb853b21
xor byte [edx - 0x70], ah
dec ecx
test eax, 0x2f40209a
mov ah, 1
xor bl, dh
scasd eax, dword es:[edi]
add edi, dword [esi + 0x1efffd0e]
imul edi, dword [edx - 0x4f1d3a72], 0xdbd05082
adc byte [eax - 0x30], 0xdb
and edi, dword [ebp + 0x3b]
cmp dl, ch
jns fcn.00533734
dec ebx
jg 0x5336b4
cdq
aam 0x89
pop ebx
bound ecx, qword [0x9dd003d0]
pushal
push edi
jl 0x5336c0
stosd dword es:[edi], eax
sub esp, dword [edx]
sbb al, ch
nop
lds edi, [eax + eax*8 - 0x2148094d]
xchg byte [edx], dh
lcall 0xdb71, 0xf3dab4e
pushfd
div byte [edi - 0x65cd7922]
dec esi
stosd dword es:[edi], eax
cmp eax, 0x9cdb710f
in eax, dx
leave
mov byte [edx - 0x6b], ah
push ebp
popal
nop
mov ecx, 0xa42fff6f
mov ecx, 0xa42fff6f
mov ecx, 0xa42fff6f
jmp [edi]
xchg ebx, eax
fisub dword [eax]
test dword [edi - 0x7c9e04a0], edx
add esi, ebp
xor dword [eax + 0x31], 0x70
jo 0x533736
push eax
mov bl, 0x70
outsd dx, dword [esi]
jno 0x5336f8
push es
push cs
call 0xfa767bc3
jns 0x53374a
imul edx, esi, 0x7b6901c7
jnp 0x5337ba
pop ds
jbe 0x53371e
adc esp, edx
and esp, dword [edx - 0x2eb3cb73]
jno 0x53376b
sal dword [ecx - 3], 1
mov ds, word [eax - 0x42]
jmp 0x4231b309
mov al, byte [0xef93d333]
dec esp
stc
dec eax
or dh, byte [eax]
inc ebx
mov ah, 0xf1
scasd eax, dword es:[edi]
invalid
inc ebx
cwde
loope 0x533789
cmp dl, ch
cmp edi, dword [edi - 0x5c]
daa
ret 0x9b81

Function at 0x5d21a1
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
insb byte es:[edi], dx
leave
xor ebx, dword [ecx + edx*2]
pop eax
shr dword [eax], 1
sub dh, ah
cmp ah, byte [ecx + ebp*8]
push cs
imul edi, ebp, 0xffffffef
or eax, 0x5bc50c0b
retf 0xcbf5
xor esp, dword [ecx + 0x4bcad24c]
mov bl, 0xd0
mov dword [0xb3e59225], eax
push edx
add al, 0x4b
jge 0x5d215d
mov ebp, 0x8b0a727f
and eax, dword [ebx - 0x39e5f535]
js 0x5d2239
test eax, 0x23fe2691
invalid
lodsb al, byte [esi]
pop es
sub eax, 0x7eee1573
insd dword es:[edi], dx
shr byte [esi - 0x51], 1
cmovg eax, dword [ebx]
xor eax, 0xfe50ccda
loopne 0x5d223a
fsub st(3), st(0)
bound ecx, qword [edx]
sub eax, 0x160fd027
inc edi
sbb byte [esi + edx + 0x977bdb7], al
wait
sbb al, 0x4b
pushal
dec ebx

Function at 0x5d575a
Capabilities:
Encode data using xor

Disassembly:
std
cmc
ret
fst qword [ecx]
mov word [edi + 0x3431f249], gs
scasd eax, dword es:[edi]
dec ecx
xor dword [esi], esi
scasd eax, dword es:[edi]
dec ecx
xor dword [esi], esi
jo 0x5d5714
push es
dec eax
mov ebp, 0xdceb3b3d
cmp al, 0xb7
call 0xf54859b1
xor esp, ebx
insd dword es:[edi], dx
std
popal
push 0xc55b522c
cmp dl, dl
jge 0x5d5757
mov dh, 0x75
xchg ebp, eax
mov ch, 0x8a
stc
retf
Function at 0x401600
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x401652
call fcn.00401200
push eax
push str.Could_not_create_pipe:__s
call fcn.00402240
add esp, 8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4017e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.00405260
add esp, 0xc
mov dword [ebp - 0x60], 0x44
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x20], eax
cmp dword [ebp + 0x14], 0
je 0x401818
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
jmp 0x401823
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
je 0x401839
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x401844
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
or ecx, 0x100
mov dword [ebp - 0x34], ecx
push 0x10
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.00405260
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x42f280
call fcn.004014c0
add esp, 0xc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4018c5
call fcn.00401200
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004017c0
add esp, 8
push eax
push str.Could_not_create_child_process__s:__s_n
call fcn.00402240
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x401d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401d6a
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x401d6a
mov dword [ebp - 8], 1
jmp 0x401d71
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x401da2
mov dword [ebp - 4], 1
jmp 0x401da9
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401f30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401f62
call fcn.00401200
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.could_not_rename__s_to__s:__s
call fcn.00402240
add esp, 0x10
pop ebp
ret

Function at 0x4024f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40250b
xor al, al
jmp 0x402519
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x402517
xor al, al
jmp 0x402519
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x402d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x430040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004029f0
add esp, 4
mov byte [ebp - 0x15], al
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x402d6c
jmp 0x402f08
lea edx, [ebp - 0x24]
push edx
push 0x201
push 0
push str.SOFTWAREMicrosoftVisualStudioSxSVS7
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x402d95
jmp 0x402f08
mov dword [ebp - 0x14], str.14.0
mov dword [ebp - 0x10], str.12.0
mov dword [ebp - 0xc], str.11.0
mov dword [ebp - 8], str.10.0
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x20], 0
jmp 0x402dca
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x40]
jge 0x402efe
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + edx*4 - 0x14]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x30]
push ecx
push 0
lea edx, [ebp - 0x44]
push edx
push 0
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
je 0x402e09
cmp dword [ebp - 0x44], 1
je 0x402e0b
jmp 0x402dc1
mov edx, dword [ebp - 0x30]
push edx
call fcn.004078fa
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x402e25
jmp 0x402f08
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x402e4d
jmp 0x402dc1
push 0
push 0
push 0
push str.VCLib_amd64
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00402520
add esp, 0x14
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push str._vcruntime.lib
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00402520
add esp, 0x14
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004024f0
add esp, 4
mov byte [ebp - 0x16], al
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004078df
add esp, 4
movzx edx, byte [ebp - 0x16]
test edx, edx
je 0x402ee1
push 0
push 0
push 0
push str.VC_bin_amd64
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00402520
add esp, 0x14
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004078df
add esp, 4
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402f08
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004078df
add esp, 4
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004078df
add esp, 4
jmp 0x402dc1
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040416e
mov esp, ebp
pop ebp
ret
Function at 0x403ed0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004024a0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0x430000
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x430004
mov eax, dword [ebp - 0xc]
push eax
push str.cmd__k___
call fcn.00402520
add esp, 0x14
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0x43002c
call fcn.00404040
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.00407a20
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.004078df
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
call fcn.004024c0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x40499f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4049de
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4049de
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4049de
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4049de
cmp dword [ecx + 0x74], 0xe
jbe 0x4049de
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4172e7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417269

Function at 0x417e84
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428e58
push 0x428e50
push str.FlsAlloc
push 0x1f
call fcn.00417cc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417eb8
push dword [ebp + 8]
mov ecx, esi
call dword [0x426190]
call esi
jmp 0x417ebe
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x417f02
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428e68
push 0x428e60
push str.FlsGetValue
push 0x21
call fcn.00417cc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417f39
push dword [ebp + 8]
mov ecx, esi
call dword [0x426190]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417f41
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428e70
push 0x428e68
push str.FlsSetValue
push 0x22
call fcn.00417cc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417f7b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x426190]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41b321
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41b3be
push ebx
push esi
call fcn.0041b2ea
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041b27e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41b36b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b3bd
push edi
push eax
call fcn.00415fbd
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41b38b
call fcn.00415eb5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b3bc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041b27e
add esp, 0x20
test eax, eax
jne 0x41b3aa
push edi
call fcn.00415eb5
jmp 0x41b3b2
push ebx
call fcn.00415eb5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41b3c1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41b3d2
pop esi
ret
push ebx
push edi
push esi
call fcn.0041b2ea
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00415fbd
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41b3fa
push ebx
push esi
push edi
call fcn.00404ce0
add esp, 0xc
push 0
call fcn.00415eb5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x41bb54
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b66f
Function at 0x422375
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x431188]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4223b5
cmp byte [ebx], 0xa
jne 0x4223b5
or byte [edi + eax + 0x28], 4
jmp 0x4223ba
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4224b9
mov dl, byte [eax]
cmp dl, 0x1a
je 0x42249c
inc eax
cmp dl, 0xd
je 0x4223e6
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x42240c
cmp eax, ecx
jae 0x42241a
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4223ce
jmp 0x4224b9
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422497
cmp dword [ebp - 0x10], 0
je 0x422497
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x431188]
test byte [eax + edi + 0x28], 0x48
je 0x422471
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x42245c
mov byte [esi], dl
jmp 0x42246d
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x431188]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4224b9
cmp byte [ebp - 1], 0xa
jne 0x422480
cmp esi, ebx
jne 0x422480
mov byte [esi], 0xa
jmp 0x4224b8
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004222e5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4224b9
mov byte [esi], 0xd
jmp 0x4224b8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x431188]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4224b6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4224b9
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret