joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ebb8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1019be84], 0x23d1
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x100ebc62
lea eax, [0x1016dbb7]
mov ecx, 0x20
lea edx, [ebp - 0x12c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.100ecc21
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x148]
mov dword [esp + 0xc], edx
call fcn.100ebe8e
mov eax, dword [ebp - 0x144]
add eax, 0x26c27
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 4], 0x135400
mov edx, dword [ebp - 0x144]
add edx, 0x1ea3c
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x1f50
mov dword [0x1019be88], 0xe43
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x17c
mov edi, edx
add edi, esi
add edi, 0x11c
mov esi, dword [edi]
imul edi, eax, 0x17c
add edx, edi
add edx, 0xec
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x1e4
mov ecx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x100ebc62
xor eax, eax
mov ecx, dword [0x1019be88]
mov edx, ecx
add edx, 0x411
mov dword [0x1019be88], edx
add ecx, 0x5d3
mov dword [0x1019be84], ecx
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov cl, byte [eax + 0x1016dbd8]
mov dl, byte [eax + 0x1016dba9]
sub dl, cl
mov byte [ebp + eax - 0x2c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x14c], eax
jne 0x100ebce3
lea eax, [ebp - 0x2c]
mov dword [0x1019be84], 0x1b8b
mov dword [ebp - 0x150], eax
call fcn.100ec8b2
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], eax
call fcn.100ec327
mov ecx, eax
mov dword [0x1019bea4], eax
mov eax, esp
mov edx, dword [ebp - 0x148]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x1019be84], 0x829
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
lea edx, section..data
imul esi, eax, 0x17c
mov edi, edx
add edi, esi
add edi, 0x11c
mov esi, dword [edi]
imul edi, eax, 0x17c
mov ebx, edx
add ebx, edi
add ebx, 0xd8
mov edi, dword [ebx]
imul ebx, eax, 0x17c
add edx, ebx
add edx, 0xec
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], edx
call fcn.100ebe2e
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x160]
add eax, ecx
mov edx, dword [ebp - 0x15c]
add edx, 1
cmp edx, 0x1e4
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], edx
je 0x100ebbbe
jmp 0x100ebd84
Function at 0x100ebe8e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1019be8c], 0
mov dword [0x1019be90], 0
mov dword [0x1019be9c], 0
mov dword [0x1019be84], 0x819
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jne 0x100ebf10
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1019be8c]
mov ecx, dword [0x1019be90]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1019be8c], edx
mov dword [0x1019be84], 0x110a
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1019be90], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1019be94], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1019be94]
mov edx, dword [0x1019be90]
mov byte [edi + edx], cl
mov edx, dword [0x1019be8c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1019be90]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x1019be84]
mov ecx, edx
add ecx, 0x154a
mov dword [0x1019be84], ecx
and ebx, 0xff
mov dword [0x1019be9c], ebx
mov ecx, dword [0x1019be88]
add ecx, 0x880
mov dword [0x1019be88], ecx
mov cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [ebx + esi]
mov byte [0x1019bea1], ch
mov byte [0x1019bea2], cl
xor ch, cl
mov byte [0x1019bea0], ch
add edx, 0xffffd056
mov dword [0x1019be84], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x2c], esi
je 0x100ebef1
jmp 0x100ebef9
Function at 0x100ec48b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1019be88], 0xfffffec1
mov dword [0x1019be84], 0x83
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x1016dbd8]
mov dl, byte [eax + 0x1016dba9]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x100ec4b6
lea eax, [ebp - 0x20]
mov dword [0x1019be88], 0xe43
mov dword [0x1019be84], 0x1b8b
mov dword [ebp - 0x30], eax
call fcn.100ec8b2
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.100ec327
cmp eax, 0
mov dword [ebp - 0x34], eax
je 0x100ec5bf
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.100ecaf3
mov eax, dword [ebp - 0x38]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xc0
mov dword [eax + 0xc0], 0x4550
add eax, 0xffc00000
mov dword [0x1019be88], 0xfc2
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 0x38], eax
mov dword [0x1019be84], 0x671
cmp eax, 0
sete dl
mov byte [ebp - 0x39], dl
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x101e
mov dl, byte [ebp - 0x39]
test dl, 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
jne 0x100ec5b7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x54
pop ebp
ret
xor eax, eax
add esp, 0x54
pop ebp
ret
Function at 0x100ec684
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x1019be84], 0x1f0
mov dword [ebp - 0x10], eax
call fcn.100ec08e
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100ec6ca
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x1019be88], 0x1eae
mov esi, dword [edx + eax + 0x24]
mov dword [0x1019be84], 0xb82
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x100ec753
jmp 0x100ec73b
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x1019be84], 0x2173
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
jmp 0x100ec7bb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x50], eax
xor eax, eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jmp 0x100ec712
mov eax, dword [ebp - 0x34]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x51]
test al, 1
jne 0x100ec7ea
jmp 0x100ec76b
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], eax
jb 0x100ec712
jmp 0x100ec753
mov eax, dword [ebp - 0x58]
add eax, 1
mov cl, byte [ebp - 0x59]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x51]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x100ec7bb
jmp 0x100ec75e
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x51], cl
je 0x100ec75e
jmp 0x100ec791
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x1019be84], 0x12d8
mov dword [ebp - 0x34], edi
jmp 0x100ec753
Function at 0x100ecc21
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1019be90], 0
mov byte [0x1019be94], 0
mov dword [0x1019be84], 0x719
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x1019be8c], 0
mov dword [ebp - 0x1c], eax
jmp 0x100ecc95
mov eax, dword [0x1019be84]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jmp 0x100eccd3
mov dword [0x1019be8c], 0
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x100eccd3
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1019be88]
add eax, 0xfffff13a
mov dword [0x1019be84], eax
mov esi, dword [0x1019be8c]
add esi, 1
mov dword [0x1019be8c], esi
cmp esi, 0x100
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], esi
jl 0x100ecc95
jmp 0x100ecc7e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, 0x100
mov dword [0x1019be98], 0
mov esi, dword [0x1019be90]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x34], eax
xor esi, esi
mov dword [ebp - 0x38], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x1019be98], ebx
mov dword [0x1019be88], 0xde7
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x38]
idiv ebx
mov dword [0x1019be90], edx
mov esi, dword [ebp - 0x34]
mov bl, byte [edi + esi]
mov byte [0x1019be94], bl
add ecx, 0x17b0
mov dword [0x1019be84], ecx
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov dword [0x1019be84], 0x20e9
mov bl, byte [0x1019be94]
mov ecx, dword [0x1019be90]
mov byte [edi + ecx], bl
mov ecx, dword [0x1019be8c]
add ecx, 1
mov dword [0x1019be8c], ecx
cmp ecx, 0x100
mov dword [ebp - 0x24], ecx
jl 0x100ecc68
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ece20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x1019be84], 0x1c02
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
add ecx, 0x3c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
jmp 0x100ece6b
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100ecf3a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x100ece98
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x100ece6b
mov eax, dword [ebp - 0x20]
mov dword [0x1019be84], 0x848
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
jne 0x100ece61
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x6f
jne 0x100ece61
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100ece61
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x100ece61
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov dx, word [eax + ecx*2 - 0x12]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x64
jne 0x100ece61
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100ece61
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
jne 0x100ece61
mov eax, dword [ebp - 0x18]
add esp, 0x2c
pop ebp
ret
Function at 0x100ecf42
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001064
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x100ecfd8
jmp 0x100ed0b4
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.100ebb8a
lea ecx, [0x100ec2bb]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x78], edx
mov dword [esp + 0x48], 0x135400
mov edx, dword [0x1019be70]
mov dword [esp + 0x3c], edx
mov edx, dword [0x1019be74]
mov dword [esp + 0x50], edx
mov edx, dword [0x1019be78]
mov dword [esp + 0x54], edx
mov edx, dword [0x1019be7c]
mov dword [esp + 0x44], edx
mov edx, dword [0x1019be80]
mov dword [esp + 0x40], edx
mov dword [0x1019be88], 0x5db
mov dword [0x1019be84], 0x183f
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x100ed00a
mov eax, dword [0x1019be88]
add eax, 0xffffe60f
mov dword [0x1019be84], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], eax
call fcn.100ece20
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
je 0x100ecf66
jmp 0x100ed0ac
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x100ed03c
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
sete dl
mov dword [esp + 0xc], ecx
mov byte [esp + 0xb], dl
mov al, byte [esp + 0xb]
test al, 1
jne 0x100ed050
jmp 0x100ed03c
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x100ed00a
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x58], ecx
mov dword [0x1019be88], 0xffffffce
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x38], esi
mov dword [0x1019be84], 0x108a
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.100ec48b
mov dword [0x1019be88], 0x159a
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x401410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], str.runas
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._ShellExecuteExA_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x401591
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4b3058
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4b3092
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x401602
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4b3058
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4b30a1
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x4016d7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4b3058
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0x4b30b6
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4b30bb
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4b30c5
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
nop
leave
ret
Function at 0x40cee0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4fc07c
call sym._EnterCriticalSection_4
mov ebx, dword [0x4fc074]
sub esp, 4
test ebx, ebx
je 0x40cf2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x40cf24
test esi, esi
je 0x40cf24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40cf00
mov dword [esp], 0x4fc07c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40d110
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40d160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40d234
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40d19e
cmp eax, 4
jne 0x40d1c0
test esi, esi
je 0x40d1b2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x40d1a4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40d1ff
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x40d1f1
cmp ecx, 0x40
je 0x40d1b2
cmp ecx, 4
je 0x40d1b2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040d110
lea esi, [esi]
Function at 0x416ac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._setlocale
test eax, eax
je 0x416b94
mov dword [esp], eax
mov esi, eax
mov ebx, esp
call sym._strlen
lea edx, [eax + 1]
add eax, 0x10
shr eax, 4
shl eax, 4
call fcn.00418a10
sub esp, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 4], 0x4b86a4
mov dword [esp], 2
mov esi, eax
call sym._setlocale
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._strcmp
test eax, eax
je 0x416ba0
mov dword [esp + 4], esi
mov dword [esp], 2
call sym._setlocale
mov eax, esi
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sym._strchr
test eax, eax
je 0x416b90
add eax, 1
mov dword [esp], eax
call sym._atoi
mov edi, eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._GetCPInfo_8
sub esp, 8
test eax, eax
je 0x416b90
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x416be0
xor edi, edi
mov esp, ebx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sym._getenv
test eax, eax
jne 0x416b52
mov dword [esp], str.LC_CTYPE
call sym._getenv
test eax, eax
jne 0x416b52
mov dword [esp], str.LANG
call sym._getenv
test eax, eax
jne 0x416b52
mov eax, esi
jmp 0x416b52
mov esp, ebx
jmp 0x416b94

Function at 0x418d90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x418dc0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x418de8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x41cfd0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x4fca84], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateSemaphoreW_16
sub esp, 0x10
mov dword [0x4fca88], eax
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x41d038
mov dword [esp + 4], dbg.emutls_destroy
mov dword [esp], eax
mov dword [0x4fca80], eax
call sym.___mingwthr_key_dtor
test eax, eax
jne sym._emutls_init.cold
add esp, 0x1c
ret
call sym._GetLastError_0
jmp 0x41d028