joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470124
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x484704
lea eax, [ebp - 0x10c]
call fcn.0046ff40
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x14]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x484604]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x484604]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x484804]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x470161
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x484704
lea eax, [ebp - 0x10c]
call fcn.0046ff40
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x17]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x13]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x484704]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x484604]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x484c04]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x400], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x4701d6
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x484604
lea eax, [ebp - 0x10c]
call fcn.0046ff40
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x16]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x12]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x484604]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x484704]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x485004]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x800], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x47024f
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x484604
lea eax, [ebp - 0x10c]
call fcn.0046ff40
pop ecx
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x15]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 0x11]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x10c]
movzx eax, byte [eax + 0x484704]
xor eax, dword [ebp - 8]
movzx eax, byte [eax + 0x484704]
xor eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x485404]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0xc00], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x4702c8
mov esp, ebp
pop ebp
ret
Function at 0x470be4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov byte [eax - 0x100], 1
mov word [ebp - 2], 1
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax - 0x101]
add eax, eax
mov word [ebp - 4], ax
test byte [ebp - 3], 1
je 0x470c19
xor word [ebp - 4], 0x1f5
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 4]
mov byte [edx + eax - 0x100], cl
inc word [ebp - 2]
cmp word [ebp - 2], 0x100
jne 0x470bf8
mov word [ebp - 2], 1
movzx eax, word [ebp - 2]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax - 0x100]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 2]
mov byte [edx + eax - 0x200], cl
inc word [ebp - 2]
cmp word [ebp - 2], 0xff
jne 0x470c3c
pop ecx
pop ebp
ret

Function at 0x470cb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.00402c98
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call fcn.00402c98
mov ebx, dword [0x490250]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 0
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
xor eax, eax
mov al, byte [ebp - 0xd]
movzx eax, byte [eax*8 + 0x485a04]
call fcn.00470c68
pop ecx
xor edx, edx
mov dl, byte [ebp - 0xd]
mov byte [ebp + edx - 0x1e], al
mov byte [ebp - 0xe], 1
push ebp
xor eax, eax
mov al, byte [ebp - 0xe]
xor edx, edx
mov dl, byte [ebp - 0xd]
lea edx, [edx*8 + 0x485a04]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xe]
movzx edx, byte [ebp + edx - 0x16]
call fcn.00470c68
pop ecx
xor edx, edx
mov dl, byte [ebp - 0xd]
xor byte [ebp + edx - 0x1e], al
inc byte [ebp - 0xe]
cmp byte [ebp - 0xe], 8
jne 0x470d2a
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 8
jne 0x470d04
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
shl eax, 8
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0xd]
movzx edx, byte [ebp + edx - 0x1e]
xor eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
inc byte [ebp - 0xd]
cmp byte [ebp - 0xd], 8
jne 0x470d81
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471d0c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
jmp 0x471d27
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x471d23
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x471d84
xor eax, eax
push ebp
push 0x471d7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471d84
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret
Function at 0x47479c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x474972
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x474959
mov eax, dword [edi + 0x30]
call fcn.00404d18
test eax, eax
jne 0x4747f2
mov eax, dword [edi + 0x34]
call fcn.00404d18
test eax, eax
jne 0x4747f2
mov eax, edi
call fcn.00474a10
jmp 0x474959
cmp dword [edi + 0xa0], 0
jne 0x474829
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.004094c4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x491c30]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x474860
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.004094c4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x491c30]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00474a50
mov ebx, eax
test bl, bl
jne 0x47490e
mov eax, dword [edi + 0x30]
call fcn.00404d18
test eax, eax
jne 0x474898
mov eax, dword [edi + 0xc0]
call fcn.00404d18
test eax, eax
je 0x47490e
mov eax, dword [edi + 0xc0]
call fcn.00404d18
test eax, eax
je 0x4748ba
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.004094c4
jmp 0x4748e6
push dword [edi + 0x30]
push 0x47498c
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404dd8
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004094c4
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x47490e
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00474a50
mov ebx, eax
test bl, bl
jne 0x47491b
mov eax, edi
call fcn.00474a10
jmp 0x474959
mov eax, dword [edi + 0x58]
test eax, eax
je 0x47492a
mov dword [edi + 0xa8], eax
jmp 0x474934
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00474ac8
test al, al
je 0x474959
mov eax, edi
mov si, 0xffee
call fcn.00403e50
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00474b74
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474979
lea eax, [ebp - 0x108]
call fcn.00404a58
ret
Function at 0x4766a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4766a8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x476768
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x476743
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x476780
call fcn.00404af0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x476790
call fcn.00409b38
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404f18
push eax
mov eax, dword [ebp - 8]
call fcn.00404f18
push eax
push 0x47679c
push 0
call sub.shell32.dll_ShellExecuteA
mov ecx, 0x4767ac
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00477d9c
push 0x7d0
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47674d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47676f
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00404a7c
ret

Function at 0x4767c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4767cc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x476899
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47686c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x4768b0
call fcn.00404af0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x4768c0
call fcn.00409b38
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404f18
push eax
mov eax, dword [ebp - 8]
call fcn.00404f18
push eax
push 0x4768cc
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4768dc
call fcn.00404d64
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00477d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x476876
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4768a0
lea eax, [ebp - 0x34]
call fcn.00404a58
lea eax, [ebp - 0x28]
mov edx, 9
call fcn.00404a7c
ret
Function at 0x401000
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2224
call fcn.00402150
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x2220]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x40106b
push 0x4013d0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Failed_to_enumerate_processes.
call fcn.004011b0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014ba
mov esp, ebp
pop ebp
ret
xor ebx, ebx
test dword [ebp - 0x2220], 0xfffffffc
jbe 0x401058
nop dword [eax]
push dword [ebp + ebx*4 - 0x1218]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x401129
lea eax, [ebp - 0x221c]
push eax
push 0x1000
lea eax, [ebp - 0x2218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x401122
xor esi, esi
test dword [ebp - 0x221c], 0xfffffffc
jbe 0x401122
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp + esi*4 - 0x2218]
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x401114
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x218]
push str.DBGHELP.DLL
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x40114e
mov eax, dword [ebp - 0x221c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4010d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2220]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x401080
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014ba
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004014ba
mov esp, ebp
pop ebp
ret

Function at 0x401cbf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401cfe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401cfe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401cfe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401cfe
cmp dword [ecx + 0x74], 0xe
jbe 0x401cfe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x406fe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x24], 0x312
mov dword [ebp - 0x28], 0x238
mov dword [ebp - 0x2c], 0x2be
mov dword [ebp - 0x1c], 0x1eb
mov dword [ebp - 0x30], 0x93
mov dword [ebp - 0x14], 0xd9
mov dword [ebp - 0x34], 0x3e0
mov dword [ebp - 0x38], 0x114
mov dword [ebp - 0x3c], 0x93
mov dword [ebp - 0x40], 0x1c9
mov dword [ebp - 0x18], 0x395
mov dword [ebp - 8], 0x28c
mov dword [ebp - 0x44], 0x278
mov dword [ebp - 0x48], 0x25b
mov dword [ebp - 0x4c], 0x3ac
mov dword [ebp - 0x50], 0x1f5
mov dword [ebp - 0x54], 0x3d5
mov dword [ebp - 0x58], 0x3e8
mov dword [ebp - 0x5c], 0x11b
mov dword [ebp - 0x20], 0x318
mov dword [ebp - 0x60], 0x10c
mov dword [ebp - 0x64], 0x84
mov eax, dword [ebp + 0x24]
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x407094
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x4070a6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x18a35
cmp dword [ebp - 4], eax
jge 0x4070fc
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x20]
jge 0x4070c4
mov dword [ebp - 0xc], 1
jmp 0x4070cb
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0x1c]
cmp edx, dword [ebp + 0x10]
jge 0x4070dc
mov dword [ebp - 0x10], 1
jmp 0x4070e3
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
je 0x4070fa
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp + 0x14]
sub ecx, 1
mov dword [ebp + 0x14], ecx
jmp 0x40709d
mov esp, ebp
pop ebp
ret
Function at 0x408170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x40], 0x3d0
mov dword [ebp - 0x44], 0x3d7
mov dword [ebp - 8], 0x273
mov dword [ebp - 0x48], 0x154
mov dword [ebp - 0x4c], 0x394
mov dword [ebp - 0x14], 0x173
mov dword [ebp - 4], 0x8e
mov dword [ebp - 0x20], 0x66
mov dword [ebp - 0x24], 0x2ab
mov dword [ebp - 0x50], 0xbe
mov dword [ebp - 0x3c], 0x325
mov dword [ebp - 0x54], 0xf5
mov dword [ebp - 0x58], 0x276
mov dword [ebp - 0x34], 0xe2
mov dword [ebp - 0x5c], 0x333
mov dword [ebp - 0x60], 0x16e
mov dword [ebp - 0x64], 0x29
mov dword [ebp - 0x38], 0x28a
mov dword [ebp - 0x10], 0x166
mov dword [ebp - 0x68], 0x112
mov dword [ebp - 0x6c], 0x7b
mov dword [ebp - 0x70], 0x72
mov dword [ebp - 0x28], 0x1c3
mov eax, dword [ebp - 0x20]
add eax, 0x110
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, 0x6b
push ecx
mov edx, dword [ebp - 8]
sub edx, 0x37
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1a9
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, 0x6e
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x6b
push edx
mov eax, dword [ebp + 0x1c]
add eax, 0xf9
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x9e
push ecx
call fcn.00419a50
add esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x408272
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x18813
cmp dword [ebp - 0xc], eax
jge 0x408298
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 4]
jge 0x408296
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x408269
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jge 0x408301
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x38]
jge 0x408301
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x3c]
jge 0x4082ce
mov dword [ebp - 0x18], 1
jmp 0x4082d5
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jge 0x4082e6
mov dword [ebp - 0x1c], 1
jmp 0x4082ed
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp + 0x24]
and ecx, dword [ebp - 0x1c]
je 0x408301
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov esp, ebp
pop ebp
ret
Function at 0x40c3d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x28], 0x1b
mov dword [ebp - 0x58], 0x104
mov dword [ebp - 0x5c], 0xff
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x60], 0x342
mov dword [ebp - 0x34], 0x35a
mov dword [ebp - 0x64], 0x1f3
mov dword [ebp - 0x68], 0x11b
mov dword [ebp - 0x40], 0x2c7
mov dword [ebp - 0x6c], 0x152
mov dword [ebp - 0x44], 0x1b9
mov dword [ebp - 0x38], 0x2dc
mov dword [ebp - 0x70], 0x30d
mov dword [ebp - 0x50], 0x142
mov dword [ebp - 0x74], 0x369
mov dword [ebp - 0x78], 0x1e7
mov dword [ebp - 0x3c], 0x10e
mov dword [ebp - 0x7c], 0x3ba
mov dword [ebp - 0x80], 0x18a
mov dword [ebp - 0x24], 0x1b9
mov dword [ebp - 8], 0x383
mov dword [ebp - 4], 0x19f
mov dword [ebp - 0x10], 0x338
mov dword [ebp - 0x30], 0x160
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x30]
and ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x34]
jge 0x40c49e
mov dword [ebp - 0x14], 1
jmp 0x40c4a5
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x28]
jge 0x40c4b6
mov dword [ebp - 0x18], 1
jmp 0x40c4bd
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
je 0x40c531
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x40]
jge 0x40c4d6
mov dword [ebp - 0x20], 1
jmp 0x40c4dd
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x4c]
jge 0x40c503
mov dword [ebp - 0x1c], 1
jmp 0x40c50a
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x50]
and eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x54], 0
je 0x40c531
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], 0
jmp 0x40c54c
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x186bb
cmp dword [ebp - 0xc], edx
jge 0x40c56b
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x40c543
mov esp, ebp
pop ebp
ret
Function at 0x40f1c0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x60], 0xc1
mov dword [ebp - 0x64], 2
mov dword [ebp - 0x30], 0x1c5
mov dword [ebp - 0x34], 0x321
mov dword [ebp - 0x54], 0x306
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x68], 0x265
mov dword [ebp - 0x6c], 0x3c5
mov dword [ebp - 0x14], 0x22
mov dword [ebp - 0x70], 0x3d4
mov dword [ebp - 0x20], 0x2b
mov dword [ebp - 0x38], 0x16
mov dword [ebp - 0x74], 0x24e
mov dword [ebp - 0x48], 0x1f5
mov dword [ebp - 4], 0x273
mov dword [ebp - 0x78], 0x2b2
mov dword [ebp - 0xc], 0xbc
mov dword [ebp - 0x10], 0x3c
mov dword [ebp - 0x44], 0xbb
mov dword [ebp - 0x7c], 0x89
mov dword [ebp - 0x40], 0x366
mov dword [ebp - 0x28], 0x68
mov dword [ebp - 0x24], 0x7b
mov dword [ebp - 0x3c], 0x115
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jge 0x40f27f
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, 0x385
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x265
push ecx
mov edx, dword [ebp - 0x28]
add edx, 0x36e
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x39a
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x181
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x6f
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x363
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x139
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x295
push edx
mov eax, dword [ebp - 0x40]
sub eax, 0x127
push eax
call fcn.004133d0
add esp, 0x28
mov dword [ebp - 8], 0
jmp 0x40f2ff
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x1875b
cmp dword [ebp - 8], edx
jge 0x40f38b
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x14]
jge 0x40f31e
mov dword [ebp - 0x18], 1
jmp 0x40f325
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x50]
jge 0x40f34b
mov dword [ebp - 0x1c], 1
jmp 0x40f352
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x18]
and edx, dword [ebp - 0x1c]
je 0x40f386
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
jge 0x40f386
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x40f2f6
mov esp, ebp
pop ebp
ret