joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xfd
mov dword [ebp - 8], 0
jmp 0x10028c82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x10028cc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x6be90bf8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028cbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028c79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa2
mov dword [ebp - 8], 0
jmp 0x10028d02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x10028d41
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4f349485]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028d3c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028cf9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9f
mov dword [ebp - 8], 0
jmp 0x10028d82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x10028dc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3c8a13b2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028dbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028d79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x27
mov dword [ebp - 8], 0
jmp 0x10028e02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10028e41
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4fd82c96]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028e3c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028df9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10028e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x39
mov dword [ebp - 8], 0
jmp 0x10028e82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10028ec1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7bb6f8e8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028ebc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028e79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6b
mov dword [ebp - 8], 0
jmp 0x10028f02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x10028f41
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x46cbf18e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028f3c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028ef9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd4
mov dword [ebp - 8], 0
jmp 0x10028f82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x10028fc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x162539dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10028fbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028f79
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10028fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa0
mov dword [ebp - 8], 0
jmp 0x10029002
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x10029041
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2efa48c0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1002903c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10028ff9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b2e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10060b3c]
jne 0x1002b2ea
repz ret
jmp fcn.1002b87c

Function at 0x1002ce80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002cf88
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002cf88
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1002cf88
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1002bbb0
add esp, 0x10
cmp eax, 2
je 0x1002cec9
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1002cebd
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1002bbb0
add esp, 0x10
cmp eax, 4
jne 0x1002cebd
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1002cef8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1002bbb0
add esp, 0x10
cmp eax, 2
jne 0x1002cebd
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1002cf53
cmp eax, 0x8664
jne 0x1002cebd
push 0x108
push ebx
push edi
push esi
call fcn.1002bbb0
add esp, 0x10
cmp eax, 0x108
jne 0x1002cebd
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1002bbb0
add esp, 0x10
cmp eax, 0xf8
jne 0x1002cebd
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1ada1d3b
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0xd110c54
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x404838
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x40e050]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x41c], 0
push ebx
push esi
push edi
push 0x44
lea eax, [ebp - 0x478]
push 0
push eax
mov dword [ebp - 0x430], edx
mov ebx, ecx
call fcn.00409ce0
xor eax, eax
lea edi, [ebp - 0x42c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, 0x208
push esi
xor edi, edi
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.00409ce0
push esi
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00409ce0
add esp, 0x24
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4048d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4048cc
movzx esi, si
or esi, 0x80070000
push 0x403518
jmp 0x404929
lea eax, [ebp - 0x210]
push eax
push 0x403550
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00403fd5
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x4048fc
push 0x402f08
jmp 0x404929
push edi
push ebx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x404933
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404924
movzx esi, si
or esi, 0x80070000
push 0x403568
push esi
call fcn.004055e9
pop ecx
pop ecx
jmp 0x4049b0
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x478]
push eax
push edi
push dword [ebp - 0x41c]
lea eax, [ebp - 0x418]
push 0x400
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x40499c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40497e
movzx esi, si
or esi, 0x80070000
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x4035d0
push esi
call fcn.004055e9
add esp, 0x10
jmp 0x4049b0
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x430]
mov dword [ebp - 0x42c], edi
mov dword [ecx], eax
cmp dword [ebp - 0x41c], edi
je 0x4049c4
push dword [ebp - 0x41c]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0x42c], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4049da
push dword [ebp - 0x42c]
call edi
cmp dword [ebp - 0x428], 0
je 0x4049eb
push dword [ebp - 0x428]
call edi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a7b
leave
ret
Function at 0x404a01
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x40e050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x404a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404a53
movzx esi, si
or esi, 0x80070000
push 0x40364c
jmp 0x404b05
lea eax, [ebp - 0x20]
push eax
push 0x403688
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x404a8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404a86
movzx esi, si
or esi, 0x80070000
push 0x4036b0
jmp 0x404b05
mov eax, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push esi
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
xor edi, edi
inc edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x404ad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404ad0
movzx esi, si
or esi, 0x80070000
push 0x403700
jmp 0x404b05
push 0x80000000
push edi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x404b0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404b00
movzx esi, si
or esi, 0x80070000
push 0x40374c
push esi
call fcn.004055e9
pop ecx
pop ecx
cmp dword [ebp - 0x18], 0
je 0x404b1c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405a7b
leave
ret
Function at 0x4053b2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x40e050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x403bb0
xor esi, esi
call fcn.004055c0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405402
push 0x403bf8
call fcn.004055c0
jmp 0x40545f
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00405b87
pop ecx
pop ecx
test eax, eax
je 0x405432
lea ecx, [ebp - 0x20c]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x405495
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x403c58
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00403fd5
add esp, 0x14
test eax, eax
jns 0x405462
push 0x403c88
push eax
call fcn.004055e9
pop ecx
pop ecx
jmp 0x405484
lea eax, [ebp - 0x414]
push eax
push 0x403cd4
call fcn.004055c0
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a7b
leave
ret
call fcn.00405d72
int3

Function at 0x4054de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x40e050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00409ce0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40555d
push 0x40299c
lea ecx, [ebp - 0x20c]
call fcn.00403f59
mov esi, eax
test esi, esi
js 0x40558a
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x40eda0], eax
cmp eax, 0xffffffff
jne 0x405574
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40558a
movzx esi, si
or esi, 0x80070000
jmp 0x40558a
push 2
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x403d00
call fcn.004055c0
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405a7b
leave
ret

Function at 0x40559f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [0x40eda0], 0xffffffff
je 0x4055b9
lea edx, [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.004056fc
pop ebp
ret
Function at 0x4056fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
push 0x400
push 8
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov ebx, 0x200
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x405740
mov esi, 0x8007000e
jmp 0x4058c4
mov eax, 0x3fe
mov dword [ebp - 4], eax
xor esi, esi
test ebx, ebx
je 0x405756
cmp ebx, 0x7fffffff
jbe 0x40575b
mov esi, 0x80070057
test esi, esi
js 0x40579c
push dword [ebp - 0x14]
lea eax, [ebx - 1]
push dword [ebp - 0x18]
xor esi, esi
push eax
push edi
call fcn.00405a8f
add esp, 0x10
test eax, eax
js 0x40578c
lea ecx, [ebx - 1]
cmp eax, ecx
ja 0x40578c
mov eax, dword [ebp - 4]
jne 0x4057a5
xor ecx, ecx
mov word [eax + edi], cx
jmp 0x4057a5
mov eax, dword [ebp - 4]
xor ecx, ecx
mov word [eax + edi], cx
mov esi, 0x8007007a
jmp 0x4057a5
test ebx, ebx
je 0x4057a5
xor ecx, ecx
mov word [edi], cx
cmp esi, 0x8007007a
jne 0x4057e7
add eax, 0x400
add ebx, 0x200
mov dword [ebp - 4], eax
lea eax, [ebx + ebx]
push eax
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x4057dd
mov edi, eax
mov eax, dword [ebp - 4]
jmp 0x405748
mov esi, 0x8007000e
jmp 0x405899
test esi, esi
js 0x405899
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + 1]
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x405884
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
test edi, edi
jne 0x405832
mov esi, 0x8007000e
jmp 0x4058b0
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0x18]
push eax
push ebx
push edi
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
je 0x405884
dec ebx
je 0x405899
mov ecx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
sub eax, ecx
push eax
mov eax, dword [ebp - 8]
add eax, ecx
push eax
push dword [0x40eda0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405884
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
jb 0x405854
jmp 0x405899
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x405899
movzx esi, si
or esi, 0x80070000
test edi, edi
je 0x4058ad
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4058c4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x406df7
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x40f95c]
push esi
push edi
xor edi, edi
test eax, eax
je 0x406e0b
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
mov eax, dword [0x40f0f4]
mov dword [0x40f95c], esi
test eax, eax
je 0x406e2f
push eax
call fcn.00408796
mov esi, dword [0x40f95c]
pop ecx
test esi, esi
jne 0x406e4b
or eax, 0xffffffff
jmp 0x406ea7
cmp ax, cx
je 0x406e3e
inc edi
push esi
call fcn.00409a12
lea esi, [esi + eax*2]
pop ecx
add esi, 2
movzx eax, word [esi]
push 0x3d
pop ecx
test ax, ax
jne 0x406e38
push ebx
lea eax, [edi + 1]
push 4
push eax
call fcn.004087d3
mov ebx, eax
pop ecx
pop ecx
mov dword [0x40f0f4], ebx
test ebx, ebx
jne 0x406e75
or eax, 0xffffffff
jmp 0x406ea6
mov esi, dword [0x40f95c]
xor edi, edi
jmp 0x406e98
push 0x3d
pop ecx
cmp ax, cx
je 0x406e8b
mov dword [ebx + edi*4], esi
inc edi
push esi
call fcn.00409a12
lea esi, [esi + eax*2]
pop ecx
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x406e7f
and dword [ebx + edi*4], 0
xor eax, eax
pop ebx
pop edi
pop esi
ret
Function at 0x409af3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x14], esi
call fcn.0040705b
mov dword [ebp - 0x18], eax
cmp dword [0x40fb14], edi
jne 0x409be4
push 0x800
push edi
push 0x401fb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x409b71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x409cbb
push 0x401fb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x409cbb
push 0x401fc8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x409cbb
push eax
call ebx
push 0x401fd4
push esi
mov dword [0x40fb14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x401fe4
push esi
mov dword [0x40fb18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x401ff8
push esi
mov dword [0x40fb1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x40fb24], eax
test eax, eax
je 0x409be1
push 0x402014
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x40fb20], eax
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x409bfc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409bfc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x18], edi
je 0x409c15
push dword [0x40fb14]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
pop eax
jmp 0x409cbd
mov eax, dword [0x40fb20]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x409c73
cmp dword [0x40fb24], esi
je 0x409c73
push eax
call ebx
push dword [0x40fb24]
mov dword [ebp - 0x18], eax
call ebx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x409c73
test eax, eax
je 0x409c73
call ecx
test eax, eax
je 0x409c68
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x14]
test eax, eax
je 0x409c68
test byte [ebp - 8], 1
jne 0x409c73
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x409ca3
mov eax, dword [0x40fb18]
cmp eax, esi
je 0x409ca0
push eax
call ebx
test eax, eax
je 0x409ca0
call eax
mov edi, eax
test edi, edi
je 0x409ca0
mov eax, dword [0x40fb1c]
cmp eax, esi
je 0x409ca0
push eax
call ebx
test eax, eax
je 0x409ca0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x40fb14]
call ebx
test eax, eax
je 0x409cbb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x409cbd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a7b
leave
ret