joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x10064000]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x59379e58
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0xae84720e
je 0x10001085
jmp 0x10001035
mov eax, dword [ebp - 0x14]
sub eax, 0x59379e58
je 0x1000104d
jmp 0x10001048
jmp 0x10001096
xor ecx, ecx
xor edi, edi
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
not byte [edi]
add byte [edi], 0x65
mov eax, 0
mov ebx, 0
add eax, ebx
xor eax, ebx
shl eax, 3
shr ebx, 2
nop
sub byte [edi], 0x88
imul byte [edi]
inc edi
loop 0x10001057
mov dword [ebp - 0x10], 0xae84720e
jmp 0x10001096
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10005220
add esp, 0xc
pop edi
pop ebx
pop ebp
ret
jmp 0x1000101f
Function at 0x100085f3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10008632
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008632
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008632
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10008632
cmp dword [ecx + 0x74], 0xe
jbe 0x10008632
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000b2af
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b34c
push ebx
push esi
call fcn.1000b278
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000b20c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b2f9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b34b
push edi
push eax
call fcn.1000c26a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b319
call fcn.10009d54
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b34a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000b20c
add esp, 0x20
test eax, eax
jne 0x1000b338
push edi
call fcn.10009d54
jmp 0x1000b340
push ebx
call fcn.10009d54
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000b5b9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012668
push 0x10012660
push str.FlsAlloc
push 0x1f
call fcn.1000b4d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b5ed
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011140]
call esi
jmp 0x1000b5f3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000b637
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012678
push 0x10012670
push str.FlsGetValue
push 0x21
call fcn.1000b4d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b66e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10011140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000b676
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012680
push 0x10012678
push str.FlsSetValue
push 0x22
call fcn.1000b4d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b6b0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10011140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10010d30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010d5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010d5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
pushfd
xor eax, eax
inc eax
popfd
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
test eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
push edi
pop ecx
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
test eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x817030]
jne 0x401073
repz ret
jmp fcn.00401e51

Function at 0x408b0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d5a
and dword [ebp - 4], 0
cmp dword [0x819b68], 0
mov ebx, eax
jne 0x408bbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c6d
push eax
call fcn.00404ce8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x819b68], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x819b6c], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x819b70], eax
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x819b78], eax
test eax, eax
je 0x408bbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x819b74], eax
mov eax, dword [0x819b74]
cmp eax, ebx
je 0x408c14
cmp dword [0x819b78], ebx
je 0x408c14
push eax
call fcn.00404d63
push dword [0x819b78]
mov esi, eax
call fcn.00404d63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408c14
test edi, edi
je 0x408c14
call esi
test eax, eax
je 0x408c0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408c0b
test byte [ebp - 0xc], 1
jne 0x408c14
or dword [ebp + 0x10], 0x200000
jmp 0x408c4d
mov eax, dword [0x819b6c]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c4d
mov eax, dword [0x819b70]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x819b68]
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af60
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x817030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x2ff755c]
push ebx
mov ebx, dword [0x2ff7280]
push esi
mov esi, dword [0x817f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40afa1
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ff755c]
mov dword [0x819d0c], esi
cmp eax, 0x114e
jne 0x40afcb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2ff755c]
cmp eax, 0x2f
jne 0x40afeb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae60
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5b3b79da
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x51b5430b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001a6e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001a6f3
pop dword [ebp - 0x38]
mov eax, 0x17be63b5
sub eax, 0x7bcbcc2
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3f7df
push 0
mov eax, 0x60c845eb
sub eax, 0x50c4e50f
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x365dc03
sub ecx, 0x36597d6
mov esi, eax
mov edx, 0x52581b78
sub edx, 0x42545d78
add edx, dword [ebp - 0x38]
mov ebx, 0xaa931b0b
sub ebx, 0x80fba9f0
sub dword [ebp - 0x14], 0x81b99ee1
mov edi, dword [edx]
xor edi, ebx
add dword [ebp - 0x30], 0xdb3ee474
mov dword [esi], edi
add dword [ebp - 0x2c], edi
add esi, 4
add edx, 0xad275dd8
sub edx, 0xad275dd4
loop 0x1001a752
add eax, 0x57eab71d
sub eax, 0x57e9b396
mov ebx, eax
add eax, 0xb7a57faf
add eax, 0x485a8056
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a6e4
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a6e4
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x401280
Capabilities:
Clear file content
Delete file
Write file on windows

Disassembly:
mov eax, 0x2510
call fcn.00407110
mov eax, 0x400
mov word [esp + 0x108], ax
mov eax, 0x100
push esi
push edi
mov edi, dword [esp + 0x2528]
mov word [esp + 0xc], ax
mov eax, 0x2000
push edi
mov word [esp + 0x518], ax
call sym.slink.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x2524]
call sym.slink.exe__string_pathname_split_12
lea eax, [esp + 0x110]
push eax
push eax
call sym.slink.exe__string_treename_8
lea eax, [esp + 0x514]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
call sym.slink.exe__string_pathname_join_12
test byte [esp + 0x2524], 1
mov esi, 1
je 0x401346
lea eax, [esp + 0x514]
mov esi, 2
push eax
call sym.slink.exe__string_terminate_null_4
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x401346
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [edi + 0xc], eax
call sym.slink.exe__file_not_found_4
test al, al
je 0x4013db
movzx eax, word [0x42ae04]
push eax
push 0x42ae00
lea eax, [esp + 0x51c]
push eax
call sym.slink.exe__string_appendn_12
lea eax, [esp + 0x514]
push eax
call sym.slink.exe__string_terminate_null_4
push dword [0x4307e4]
lea eax, [esp + 0x51c]
push 0x8000080
push esi
push dword [0x4307e0]
push 1
push 0x40000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4013d3
push dword [0x4307e8]
mov eax, dword [esp + 0x2524]
lea edx, [esp + 0xc]
push edx
movsx ecx, word [eax + 2]
add eax, 4
push ecx
push eax
push esi
call sub.KERNEL32.dll_WriteFile
test al, al
je 0x4013e6
push esi
call sub.KERNEL32.dll_SetEndOfFile
test al, al
je 0x4013e6
push esi
call fcn.00407a52
test al, al
jne 0x4013db
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x2510
ret 0x10
call sub.KERNEL32.dll_GetLastError
push esi
mov dword [edi + 0xc], eax
call fcn.00407a52
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop edi
pop esi
add esp, 0x2510
ret 0x10

Function at 0x401410
Capabilities:
Delete file

Disassembly:
mov eax, 0x250c
call fcn.00407110
mov eax, 0x400
mov word [esp + 0x104], ax
mov eax, 0x100
push esi
mov esi, dword [esp + 0x2518]
mov word [esp + 4], ax
mov eax, 0x2000
push esi
mov word [esp + 0x510], ax
call sym.slink.exe__sys_error_none_4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [esp + 0x251c]
call sym.slink.exe__string_pathname_split_12
lea eax, [esp + 0x108]
push eax
push eax
call sym.slink.exe__string_treename_8
lea eax, [esp + 0x50c]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x110]
push eax
call sym.slink.exe__string_pathname_join_12
movzx eax, word [0x42ae0c]
push eax
push 0x42ae08
lea eax, [esp + 0x514]
push eax
call sym.slink.exe__string_appendn_12
lea eax, [esp + 0x50c]
push eax
call sym.slink.exe__string_terminate_null_4
lea eax, [esp + 0x510]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x4014cd
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x250c
ret 8
Function at 0x4014e0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2008
call fcn.00407110
push esi
mov esi, dword [esp + 0x2018]
mov eax, 0x2000
push edi
push esi
mov word [esp + 0x10], ax
call sym.slink.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x2018]
call sym.slink.exe__string_copy_8
movzx eax, word [0x42ae14]
push eax
push 0x42ae10
lea eax, [esp + 0x14]
push eax
call sym.slink.exe__string_appendn_12
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_terminate_null_4
push dword [0x4307f0]
lea eax, [esp + 0x14]
push 0x8000080
push 3
push dword [0x4307ec]
push 1
push closesocket
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x401573
call sub.KERNEL32.dll_GetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x2008
ret 0xc
push dword [0x4307f4]
movsx eax, word [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x4015ac
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [esi + 0xc], eax
call fcn.00407a52
pop edi
pop esi
add esp, 0x2008
ret 0xc
movsx edx, word [esp + 0xc]
mov ecx, dword [esp + 8]
cmp edx, ecx
movzx eax, word [esp + 0xc]
movzx esi, cx
cmovb esi, eax
push edi
mov word [esp + 0x12], si
call fcn.00407a52
mov edx, dword [esp + 0x2018]
mov cx, word [esp + 0xe]
movzx eax, word [edx]
cmp ax, cx
cwde
jl 0x4015e5
movsx eax, cx
movzx eax, ax
mov ecx, 1
movsx esi, ax
mov word [edx + 2], ax
cmp esi, ecx
jl 0x40161f
mov al, byte [esp + ecx + 0xf]
cmp al, 0x1f
jbe 0x401618
cmp al, 0x7f
je 0x401618
mov byte [ecx + edx + 3], al
inc ecx
cmp ecx, esi
jle 0x4015f8
pop edi
pop esi
add esp, 0x2008
ret 0xc
lea eax, [ecx - 1]
mov word [edx + 2], ax
pop edi
pop esi
add esp, 0x2008
ret 0xc

Function at 0x401930
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1070
call fcn.00407110
call sym.slink.exe__sys_init_0
call sym.slink.exe__util_init_0
mov eax, 4
mov dword [0x4338c4], 0x400
mov word [esp], ax
movzx eax, word [0x42af60]
push eax
push dword [esp + 0x1080]
mov dword [0x433cc8], 0x100
push 0x433cc8
mov dword [0x433dcc], 0x20
mov dword [0x4318a0], 0x2000
call sym.slink.exe__string_vstring_12
mov byte [0x4307fc], 1
call sub.KERNEL32.dll_GetCommandLineA
test eax, eax
je 0x4019b1
movzx ecx, word [0x42af60]
push ecx
push eax
push 0x4318a0
call sym.slink.exe__string_vstring_12
mov eax, 1
mov word [0x4338a4], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x4338a4
push 0x4318a0
call sym.slink.exe__string_token_16
mov ax, word [0x4338a4]
mov word [0x4338a6], ax
mov dword [0x4338c0], 1
mov byte [0x433df0], 0
add esp, 0x1070
ret 0xc
Function at 0x4044f0
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0040a50c
push eax
push 0x21
push 1
push str._Program_aborted_on_error._
call fcn.0040a7a1
push 0x42cd44
call fcn.004044b0
add esp, 0x18
jmp sym.slink.exe__sys_exit_error_0

Function at 0x404580
Capabilities:
Get hostname

Disassembly:
mov eax, 0x146c
call fcn.00407110
lea eax, [esp]
mov dword [esp], 0x400
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test al, al
jne 0x4045da
lea eax, [esp + 0x404]
push eax
call sym.slink.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x430808
push str.node_name_get
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x410]
push 0x42cd48
push eax
call sym.slink.exe__sys_error_abort_20
push dword [esp]
lea eax, [esp + 8]
push eax
push dword [esp + 0x1478]
call sym.slink.exe__string_vstring_12
push dword [esp + 0x1470]
call sym.slink.exe__string_downcase_4
add esp, 0x146c
ret 4

Function at 0x404840
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x68]
mov eax, 0x50
push edi
mov word [esp + 0xc], ax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x68]
mov byte [esi], 0
call sym.slink.exe__string_copy_8
lea eax, [esp + 0xc]
push eax
call sym.slink.exe__string_terminate_null_4
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x64]
push edi
push eax
push 1
call fcn.00404750
push edi
call sym.slink.exe__sys_error_4
test al, al
jne 0x40491e
push ebx
mov ebx, dword [esp + 0x6c]
movsx eax, word [ebx]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
lea eax, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x7c]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x70]
mov dword [edi + 0xc], eax
mov word [ebx + 2], cx
cmp dword [edi + 0xc], 0xea
jne 0x4048d3
push edi
call sym.slink.exe__sys_error_none_4
jmp 0x4048ee
test cx, cx
jle 0x4048ee
movsx eax, cx
mov al, byte [eax + ebx + 3]
cmp al, byte [0x43080d]
jne 0x4048ee
lea eax, [ecx - 1]
mov word [ebx + 2], ax
push dword [esp + 0x68]
call sub.ADVAPI32.dll_RegCloseKey
push edi
call sym.slink.exe__sys_error_4
pop ebx
test al, al
jne 0x40491e
mov eax, dword [esp + 8]
sub eax, 1
je 0x40491b
sub eax, 1
jne 0x40491e
or byte [esi], 2
pop edi
pop esi
add esp, 0x58
ret 0x10
or byte [esi], 1
pop edi
pop esi
add esp, 0x58
ret 0x10

Function at 0x404930
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x884
lea eax, [esp]
push dword [0x42cdec]
push eax
push dword [esp + 0x890]
call sym.slink.exe__string_t_c_12
push dword [0x42cdf0]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x404994
push dword [esp + 0x890]
push 2
push 0xffffffffffffffff
call sym.slink.exe__sys_stat_set_12
push dword [esp + 0x890]
push dword [esp + 0x88c]
call sym.slink.exe__sys_stat_parm_vstr_8
add esp, 0x884
ret 0xc
movzx eax, word [0x42cdf4]
push eax
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x894]
call sym.slink.exe__string_vstring_12
push dword [esp + 0x890]
call sym.slink.exe__sys_error_none_4
add esp, 0x884
ret 0xc
Function at 0x4049d0
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x884
push esi
mov esi, dword [esp + 0x894]
push esi
call sym.slink.exe__sys_error_none_4
push 0x84
lea eax, [esp + 8]
push eax
push dword [esp + 0x894]
call sym.slink.exe__string_t_c_12
push 0x800
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x898]
call sym.slink.exe__string_t_c_12
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x404a31
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x884
ret 0xc

Function at 0x404a40
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x54
mov eax, 0x50
push esi
mov word [esp + 4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 0x60]
call sym.slink.exe__string_copy_8
lea eax, [esp + 4]
push eax
call sym.slink.exe__string_terminate_null_4
mov esi, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push esi
push eax
push 2
call fcn.00404750
push esi
call sym.slink.exe__sys_error_4
test al, al
jne 0x404a98
push esi
call sym.slink.exe__sys_error_none_4
lea eax, [esp + 8]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_RegDeleteValueA
mov dword [esi + 0xc], eax
pop esi
add esp, 0x54
ret 8

Function at 0x404aa0
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x88
push esi
push dword [0x42cde8]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x98]
call sym.slink.exe__string_t_c_12
mov al, byte [0x43080c]
mov esi, dword [esp + 0x94]
push esi
mov byte [esp + 0xb], al
call sym.slink.exe__sys_error_none_4
lea eax, [esp + 7]
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x404aef
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x88
ret 8